5jc_UdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlZddlZddlZddlZddlmZmZmZmZddlmZddlm Z m!Z!m"Z"m#Z#ddl$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,ddl-m.Z.ddl/m0Z0dd l1m2Z2ddl3Z3ddl4Z5dd l6m7Z8ddl9Z:dd l;mZ?dd l@mAZBddl$mCZCmDZDmEZEe jjdeHeeIjjj ddlLmMZN ddededededzdef dZO ddlLmQZQddlSZSddlTZUe%eVZWdeWjd<ddlYZZddl[m\Z]ddl=m^Z_ejjdddk7Zbecejjdd Zdejjd!eHeeIjjd"z d#z Zee_d$%ZfdZgebreZjd&ZgegjeZjd'eg_k eeejjd(d()e]eed*d+,ZmemjeZjd-egjemeWjd/ZveWjd0ZxeWjd1Zyejd2eWjd3<ejjd4d5jZ{e{re{eWjd6<ejd7Z|ejd8Z}ejd9Z~e~d:dd;dd?d@dAdBdCdDdEdFdFdFdGdCiZdHZdIe~ZdJdKgZdLZeejjdMdNZeejjdOdPZeejjdQdRZedSz ZedTz ZedUz ZedVz ZedWz ZedTz ZedUz ZedVz ZedXz ZedTz ZedUz ZedVz ZedYz ZedTz ZedUz ZedVz ZedZz Zed[z Zed\z Zed]z Zed^z Zed_z ZeeIjjd`z ZeeIjjdaz ZeeIjjdbz ZdcZhddZeZeZeejjdedfZeejjdgdhZeejjdidjZeejjdkdlZedmz ZeejjdndoZeejjdpdqZdrZejjdsdtZejjdudvZeeIjjdwz ZeeIjjdxz ZeeIjjdyz ZdzZd{Zd|Zd}Zd~ZdefdZdZdZ ddZeeIjjdz ZeeIjjdz ZdZdZdZdZdZdZdZeeezZdZdZdZdZd}Zd|Zd|ZdZdefdZdefdZdefdZdefdZdeHfdZdZdZdZdZdZא ddZdZeeIjjdz ZeeIjjdz ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZddddddidddedddd(dd d_ddedd_dd(dd dddedddd'dd dddedddd(dd gdǜdddddddSddedddd(dd dWddedddd(dd dXddedddd(dd dYddedddd(dd dddedddd(dd gdݜddddddddeddddddd'ddd dddeddddddd'ddd dddeddddddd'ddd dddeddddddd'ddd dddeddddddd'ddddddd eddd d d"dd'ddd d d deddddddd'ddd gddgddddgddggddddd'dddddd'ddddddZdZdZdZd Zd!Zd"Zd#Zd$Zd%Z dd&Zd'Zd(Zd)Zd*Zd+Zd,Zd-Zd.Zd/Z dd0Zd1Zd2Zd3Zd4Zd5Zd6Zd7Zd8Zd9Zd:Z d;Z eeIjjdz Z eeIjjd?z ZeeIjjd@z ZeeIjjdAz ZeeIjjdBz ZeeIjjdCz ZeeIjjdDz ZeeIjjdEz ZeeIjjdFz ZeeIjjdGz ZeeIjjdHz ZeeIjjdIz ZeeIjjdJz ZeejjdKeHeeIjjdz ZeeIjjdLz ZeeIjjdMz ZeeIjjdNz ZeeIjjdOz ZeeIjjdPz ZdQZ eeIjjdRz Z!eeIjjdSz Z"eeIjjdTz Z#eeIjjdUz Z$eeIjjdVz Z%eejjdWxs$eeIjjdXz Z&ejjdYxsdZjjOZ(ejjd[xs eHejRd\z d]z Z*ejjd^xsd_jZ+eejjd`xs$eeIjjdaz Z,e-ejjdbxs eHdcZ.e-ejjddxsdeZ/e-ejjdfxsdgZ0e-ejjdhxsdiZ1eejjdjxs$eeIjjdkz Z2ejjdlxsdmZ3ejjdndoZ4e-ejjdpdqZ5ejjdrdsZ6ejjdtdvxsdvjZ7ejjdudoZ8e-ejjdvdqZ9ejjdwdxZ:ejjdydzZ;ejjd{d|ZeeIjjdz Z?eeIjjdz Z@ejZBeeIjjdz ZCeeIjjdz ZDeeIjjdz ZEeeIjjdz ZFd}ZGeejjdxs$eeIjjdkz ZHejjdxsdZIeeIjjdz ZJejjdxsdZKeeIjjdz ZLeeIjjdz ZMeeIjjdz ZNeeIjjdz ZOeeIjjdz ZPeeIjjdz ZQeeIjjdz ZReeIjjdz ZSeeIjjdz ZTeeIjjdz ZUdxdddd+ddZVdZWdZXeeIjjdz ZYdddddddZZdZ[eXdzZ\eeIjjdz Z]ddddddZ^d*Z_dZ`d+ZadZbdZcdZddZedZfdZgdZhdZidZjdddddddddgZkdZlgdZmhdZngdZoddddZpgdZqeeIjjdz ZreeIjjdz ZseeIjjdz ZteeIjjdz ZueeIjjdz ZveeIjjdz ZweeIjjdz ZxeeIjjdz ZyeeIjjdz ZzdĐdggdƢgdǢgdȢdggdʢdgd̜Z{e{jDchc] }|D]}| c}}Z}eeIjjdz Z~gd΢ZgdϢZeegdТgdѢgdҢdӜZdԄZdՄZdքZdׄZddgiZeeIjjdz ZdgZdِdiZeeIjjdz ZeeIjjdz ZeeIjjdz ZeeIjjdz ZeeIjjdz ZeeIjjdz ZdZeeIjjdz ZeeIjjdz ZeeIjjdz ZdZdddddZdZgdZeeIjjdz ZeeIjjdz ZdgZeDchc]}|d c}ZeeIjjdz ZeeIjjdz ZeeIjjdz ZeeIjjdz ZdZdZdZ ddZdZdZdZdZdZdZdZdedefdZdeHdedefdZdeHdefdZdeHdefdZdeHdefdZdeHdeHdefdZdeHfdZdZdZeSjlfeSjneSjpfeSjrfeSjtfeSjvfeSjxfdZdedefd Zd edefd ZdeHdefd Zdefd ZdeddfdZdeHdefdZdefdZĐdeddfdZdefdZƐdedefdZǐdeHdefdZȐdedzdefdZɐdedzdefdZʐdedefdZːdeHdefdZdefdZ͐deddfdZΐdeHdefdZАdedefd Zdefd!ZҐd"ZӐdeddfd#ZԐdeHdefd$ZeeIjjd%z Zdefd&Zא d dd'Zdefd(Zِdeddfd)Zڐdedefd*Zېdedefd+Zܐd,Zݐd-edefd.Zߐd/edefd0Zd/edefd1Zd/ed-edefd2Zd3Zdefd4Zd5eddfd6Z dd7eHd8eHdzdefd9Z dd:Zd;eHdefd<Zdefd=Zd eddfd>Zd?Zd@ZdAZdBZdxZdCZdDZdEZdFZdGZdHZdIZdJZdKZdLZd'ddMgdNdOdvdPZdQZdRZdSZdTZ ddUZdVZdWZdXZdYZdZZd[Zd\Zd7eHdeHfd]Zd^eHdeHfd_Zdefd`Z daeddfdbZ deHd^eHdceHdeddf ddZ defdeZ deHdedzfdfZ deeHfdgZdeHdefdhZdefdiZdaeddfdjZdkeHdefdlZd^eHdkeHdceHddfdmZd^eHdceHddfdnZd^eHdceHddfdoZ ddpZhdqZd^eHdefdrZdsedeHdtededzfduZd^eHdedzfdvZ ddwZdxZdyZdzZe j>d{Z ed|z Z!d}edeHfd~Z" ddeHdedeeHeffdZ#eSjneSjreSjpdZ$deHdeHd-edefdZ%de-fdZ&de-fdZ'defdZ(d5efdZ) ddeHde-deHdzdeHdzfdZ*deHde-deHdefdZ+dZ,deHdeHfdZ-deHdeHfdZ. ddeHdeHdzdededzfdZ/hdZ0hdZ1 e-ejjddZ2dedefdZ4d-edzdeefdZ5dededzde-fdZ6dededdfdZ7 ddede-dedzfdZ8deHdedzdeHfdZ9 ddkeHde-deHfdZ:deHdeHdedzdeHfdZ;dedefdZ<deHdefdZ=dededzfdZ>dedefdZ?dedefdZ@dededdfdZAdedeeHdeeHdeeHdeef dZBdeddfdZCdZDdZEdZFejjejjejjeIdZJdZKdZLeLeD\ZDZKdZMdZNdZOdZPdZQd„ZRdÄZSdĄZTdńZUdƄZV ddDŽZWdȄZXeWjdɫeQdʄZZd˄Z[d̄Z\d̈́Z]d΄Z^dτZ_dЄZ`dфZa ddeHdzdedeefd҄Zb ddeHdeHdzdededzfdӄZcdeHfdԄZddeHdeHfdՄZeeWjd֫dׄZfeWjdثdلZgeWjdګdۄZheWjdܫeNd݄ZieWjdސdge[dZjeWjddge[dZkeWjddge[dZleWjddge[dZmdZndedededefdZoeWjddge[dZpeWjde[dZqeWjde[dZreWjde[dZseWjddge[dZtdZueĐdeuzZveWjddge[dZweWjde[dZxeWjde[dZyeWjde[dZzeWjde[dZ{eWjddge[dZ|eWjddge[dZ}eejjddZ~d Zd Zd Zd Ze~d z ZdefdZdefdZdeddfdZdeHdedefdZe~dz ZdddddddddZdefdZdeddfdZdeHfd Zd!edeHfd"Ze~d#z Zd$d%d&d'Zdefd(Zd)eddfd*Zdefd+Zd,eHdeHfd-ZdeHdedzfd.Zd/eHd0edae-dedzfd1ZdeHdzfd2ZdeHd0edae-dedzfd3ZdeHddfd4ZdeHdeHdedzfd5Zd6edefd7Zd6edefd8Zd6ededdfd9Zd6ededdfd:Zd;edeefd<Zd=edeefd>ZeWjd?dge\d@ZeWjdAdge\dBZeWjdCdge\dDZeWjdEe\dFZeWjdGe\dHZeWjdIe\dJZeWjdKeWdLhdMdNZeWjdOdPge\dQZeWjdOdgeQdRZeWjdSdPge\dTZeWjdUdge\dVZeWjdWdgeQdXZeWjdYdPge\dZZeWjd[dgeQd\ZeWjd]dgeQd^ZeWjd]d_geQd`Z ddedSedzdefdaZ ddedSedzdefdbZdedefdcZ ddedXedzdefddZdeHd-edefdeZeWjdfdgeNdgZeWjdhdgeNdiZeWjdjdgeNdkZeWjdldgeNdmZeWjdneNdoZeWjdpeNdqZeWjdreNdsZeWjdtdgePduZeWjdveNdwZeWjdxeNdyZeWjdzeNd{ZeWjd|eNd}ZeWjd~eNdZdedefdZdefdZeWjdeNdZeWjdeNdZeWjdeNdZeWjdeNdZeWjdeNdZeWjdeNdZeWjdeUdd_dZː ddeHdeHdzdefdZeWjdeUdd_dZeWjdeNdZeWjdeNdZeWjddgeUdd_dZeWjddgeUdd_dZeWjdeNdZeWjddgeNdZeWjddgeNd;eHfdZeWjdeNd;eHfdZeWjddgeNdZeWjddgeNdZeWjdePdZeWjdeOdZeWjddgeOdZdefdZېdeddfdZܐdeHd7eHddfdZd'd'dZdefdZߐdeddfdZdZdZdgd'dgddgdddZdefdZdefdZdeddfd„ZdedeHdefdÄZdedeHdefdĄZ ddńZ ddefdƄZdDŽZ ddȄZdɄZ ddʄZ dd˄Z ddeHdeHdzfd̄Z ddefd΄Z ddτZdЄZdeHdeHdefdӄZeWjdԫeadՄZeWjd֫eadׄZeWjdثeadلZeWjdڐdgeadۄZeWjdܐdgead݄ZeWjdސdgead߄ZeWjddgeadZeWjdeadZeWjdeadZeWjddgeadZeWjdeadZeWjddgeadZdZdedefdZeWjdeNdZeWjddgeNdZeWjdeadZeWjddgeOdZeWjdeNdZeWjddgeNdZeWjddgeNdZ eWjdeOdZ eWjddgeOdZ eWjddgeOdZ eWjddgeOdZ eWjddgeOdZeWjddgeOdZeWjddgeOdZeWjddgeOdZdeeHfd Zgd Zdededd d eddf d ZeWjddgeNdZdedeeHdefdZeWjddge[dZgdZeWjddge[dZdeHdeHdd fdZeWjddge[dZeWjde[dZeWjde[dZed gzZeWjd!dge[d"ZdeHdd fd#Z d6ededdfd$Z!d6edefd%Z" dd&Z#ddd'd6ed(ed)ed*eHddf d+Z$eWjd,dgeNd-Z%eWjd.eNd/Z&eWjd0eNd1Z'eWjd2eNd3Z(eWjd2dgeQd4Z)ddd'd6ed(ed)ed*eHddf d5Z*eWjd6dge[d7Z+eWjd8eNd9Z,eWjd:eNd;Z-eWjd<dge[d=Z.eWjd>dgeNd?Z/eWjd@eNdAZ0eWjdBeNdCZ1eWjdDeNdEZ2eWjdFeNdGZ3eWjdHdPgeNdIZ4eWjdJdgeNdKZ5dedeHdzdLedeHdzfdMZ6deHdNeedOedPeeHdQeHdeHdzf dRZ7d;edNeedSedTeeHdeef dUZ8dedVeHdWeHdXedd f dYZ9eWjdZdge[d[Z:ed\Z;d]Z<d^Z=dZ>eWjd_e[d`Z?eWjdadge[dbZ@eWjdcdge[ddZAeWjdee[dfZBdgZCeeIjjZDddhdiZEdjZFejZG ddkZHeWjdleQdmZIeWjdndgeQdoZJeDdpz ZKdqZLejZMdrZNdsZOdtZPeWjdueQdvZQeWjdudgeQdwZRdxZSdyZTeWjdzeQd{ZUeWjdzdgeQd|ZVeWjd}eQd~ZWeWjd}dgeQdZXeWjdeQdZYeWjddgeQdZZeWjdeQdZ[eWjddgeQdZ\ddddddddZ]e]jDcic]\}}|dk7s ||c}}Z_dZ`deHfdZadeHfdZbdeHfdZcdeHfdZdeWjdeNdZeeWjddgeNdZfdeHfdZgeWjdeNdZheWjdeQdZieWjddgeQdZjeWjdeQdZkeWjddgeQdZleWjdeQdZmeWjddgeQdZneWjdeQdZoeWjddgeQdZpeWjdeQdZqeWjddgeQdZreWjdeNdZseWjddgeNdZteWjdeNdZueWjddgeNdZveWjdd_geNdZweWjddgeNdZxeWjddPgeOdZyeWjddgeOdZzeWjddPgeOdZ{eWjddgeOdZ|eWjddPgeQdZ}eWjddgeQdZ~hdZdedeeHeHeffdZdeHd-edzdeeHfdZdeHdeeHdeHde-fdZdeHde-fdZded0edeސeeHeffd„ZdedeHddfdĄZdŐedeHdeHfdDŽZdeސe-eHffdȄZdŐedefdɄZdeefdʄZdefd˄ZdeHfd̄ZeWjd͐dgeQd΄ZeWjdϐdgeQdЄZeWjdѐdgeQd҄ZeWjdӐdPgeQdԄZeWjdՐdgeQdքZeWjdאdPgeQd؄ZeWjdِdPgeQdڄZeWjdېdPgeOd܄ZeWjdېdgeOd݄ZeWjdސdgeNd߄ZeWjddgeNdZeWjddgeNdZgdZdZeWjddPge[dZeWjddge[dZdZdZeWjddge[dZdZdZdZeWjddPge[dZdd~dZdZdZdZdZdZdZeWjddge[dZeWjddge[dZdZe j>dZdkeHdeHfdZdedeHddfdZdedefdZdefdZdeHfdZ ddefdZdefdZdeddfd ZeWjd dge[d ZeWjd dge[d ZeWjddPge[dZeWjddge[dZeWjddge[dZdZdZdedeHfdZdeHdefdZdedeHfdZeWjddge[dZeWjddge[dZeWjddPgeNdZedZeWjd eNd!ZeZŐdeHdedzfd"ZeWjd#e[d$Zǐdedefd%ZȐd&Zɐd'edefd(Zʐd)Zːd*eHdeHfd+ZdeHfd,Z͐dedefd-Zdefd.Zϐdeddfd/ZeWjd0e[d1ZeWjd0dge[d2ZeWjd3dge[d4ZeWjd5d6ge[d7ZeWjd5d_ge[d8ZeWjd9dge[d:ZeWjd;e[d<ZeWjd=dge[d>ZeWjd?dge[d@ZeWjdAe[dBZڐdCZeWjdDeNdEZeWjdDdgeQdFZeWjdGd6geQdHZeWjdGd_geQdIZߐdJZdKZdLZdMZdNZdOZeWjdPdPgeNdQZeWjdRdgeNdSZeWjdTdgeNdUZeWjdVeNdWZeWjdVdgeQdXZeWjdYeNdZZeWjdYdgeQd[ZeWjd\eNd]ZeWjd\dgeQd^ZeWjd_eQd`ZeWjdadgeQdbZeWjdcdgeQddZeWjdeeQdfZeWjdgdgeQdhZeWjdieQdjZeWjdkeQdlZdmZeWjdneQdoZeWjdndgeQdpZeWjdqeQdrZeWjdqdgeQdsZeWjdteQduZeWjdtdgeQdvZeWjdwdxZeWjdydzZeWjd{d|ZeWjd}d~ZeWjdeQdZdZdZdZddvdvdvdvdvdvdggdvdvdd'dddddgdddZdefdZdefdZdZdZ dZ dZ eWjdeQdZ eWjdeNdZ eWjddgeNdZeWjddgeQdZeWjdeQdZeWjddgeQdZeWjdeNdZeWjddgeNdZeWjdeNdZdZeWjdeQdZeWjdeQdZdZdZdZddlmZej<ZiZ ee!d<defdZ"defdZ#defdZ$defdZ%defdZ& ddededzfdZ'eWjdeQdZ(eWjddgeQdZ)defdZ*dZ+eWjdeQdZ,eWjddgeQdZ-eWjddgeQdZ.eWjdeQd„Z/eWjddgeQdÄZ0eWjdĐd6geQdńZ1eWjdĐd_geQdƄZ2eWjdǫeQdȄZ3eWjdǐdgeQdɄZ4eWjdʐdgeQd˄Z5eWjdʐd_geQd̄Z6eWjdͫeQd΄Z7eWjdϐdgeQdЄZ8eWjdѐdgeQd҄Z9deHfdӄZ:eWjdԫeQdՄZ;eWjd֫eQdׄZ<dؐZ=dِZ>dڄZ?dۄZ@d܄ZAd݄ZB dd߄ZCe j>dZDdefdZEddvdvdddZFdZGdZHdZIdZJdddddddddddd ZKdZLdZMdZNdZOdZPdZQeWjdeXdZRdZSeWjdeWdhdZTeWjdeWdhdZUejZVdhaWdZXdZYdZZdZ[dZ\e[e\fZ]dZ^ ddZ_eWjdeWd hd Z`d d d ddZadddАddZbd͐ddӐdd3ZcdZddZedZf ddZgdZheWjdeXdZieWjdeWdLhdMdZjeWjdeQdZkeWjdeWdhd ZleWjd!eWdhd"ZmeWjd#dPgeQd$ZneWjd#dgeQd%ZoeWjd&dPgeQd'ZpeWjd(dgeQd)Zqd*Zrd+Zsd,Ztd-Zud.Zvd/Zw dd0Zxd1ZyeWjd2dgeQd3ZzeWjd4dgd5Z{eWjd6dgd7Z|eWjd8dgd9Z}eWjd:eQd;Z~ dd<ZeWjd=dgeQd>ZeWjd?dgeQd@ZeWjdAdgeQdBZeWjdCd_geQdDZeWjdEeQdFZeWjdEdgeQdGZeWjdHeQdIZeWjdJdgeQdKZeejjdLxsee jdMz ZeeeedNZhdOZdPZdQZdRZdSZdTZdUZdVZdWZeWjdXeNdYZeWjdZdgeNd[ZeWjd\eNd]ZeWjd^d_ZeWjd`daZeWjdbdcZeWjddeQdeZeWjdddgeQdfZeWjdgeNdhZeWjdieNdjZeWjdgdgeNdkZeWjdleNdmZeWjdld6geNdnZeWjdodgeNdpZeWjdqdgeNdrZeWjdseWhdtduZeWjdvdPgeQdwZeWjdvdgeQdxZeWjdvd_geQdyZeWjdzdPgeQd{ZeWjd|dPgeQd}ZeWjdzdgeQd~ZeWjdzd_geQdZeWjddPgeQdZeWjddgeQdZeWjdd_geQdZ ddZeWjdeWdĐdhdZeWjdeWdĐdhdZdddddZeWjdeWdhdZeWjdeWd hdZeWjddgeNdZeWjddgeNdZdZdZhdZdZdZdZeWjdeNdZeWjdeNdZeWjdeNdZeWjddgeNdZeWjddgeNdZeWjddgeNdZeWjdeNdZdZeWjdeNdZeWjddgeNdZeWjde]dZeWjde]dZeWjddge]dZeWjddge]dZeWjde]dZeWjddge]dZeWjde]dZeWjddge]dZ͐dZeWjde^dZϐd„ZАdÄZѐdĄZeWjdūe^dƄZeWjdǫe^dȄZddɐlՐm֐Z֐mאZאmؐZؐmِZِmڐZڐmېZېmܐZܐmݐZݐmސZސmߐZߐmZddlZe jddlZddlZddlZe jddlZe j e je۫ ddʄZedːZeWjd̫eNd̈́ZeWjdΫeNdτZeWjdЫeNdфZeWjdҐdgeVdhdԄZeWjdիeVdhdׄZeWjdؐdgeVdhdلZeWjdڐdgeVdhdۄZd܄ZeWjdݫeNdބZeWjdݐdgeVdhdZeWjddgeVdhdZeWjdd_geVdhdZeWjdeNdZeWjdeNdZdZeWjddgeVdhdZeWjddgeVdhdZeWjdd_geVdhdZdZdZ ddZdZdvddZeWjdeVdhdZeWjdeVdhdZeWjdeVdhdZeWjddgeVdhdZeWjddgeVdhdZeWjddgeVdhdZ eWjdeVdhdZ eWjddgeVdhdZ eWjdd_geVdhdZ eWjddgeVdhdZ eWjddgeVdhdZeWjdd_geVdhdZdZd Zd Zd Zd Z dd ZeWjdeVdhdZeWjdeVdhdZeWjdeVdhdZdZdZeWjddgeNdZeWjdeNdZhdZeWjddgeVdhdZeWjddgeVdhdZddl Z e jBddl"Z"e" jFdZ$d Z%eZ&d!Z'eWjd"eVe&d#Z(eWjd$eVdhd%Z)eWjd$dgeVdhd&Z*eWjd'eVdhd(Z+eWjd'dgeVdhd)Z,eWjd'd_geVd*hd+Z-eWjd,eVdhd-Z.eWjd.eVdhd/Z/d0Z0eWjd1eVdhd2Z1eWjd3eVdhd4Z2eWjd5eVd*hd6Z3eWjd5dgeVd*hd7Z4eWjd8d_geVd*hd9Z5eWjd:eVd*hd;Z6eWjd:dgeVd*hd<Z7eWjd=eVd*hd>Z8eWjd=dgeVd*hd?Z9eWjd@eVd*hdAZ:eWjd@dgeVd*hdBZ;eWjdCeVd*hdDZeWjdHdgeVd*hdIZ?eWjdHd_geVd*hdJZ@eWjdKeVd*hdLZAeWjdKdgeVd*hdMZBeWjdNdgeVd*hdOZCeWjdPdgeVd*hdQZDeWjdPd_geVd*hdRZEeWjdSeVd*hdTZFeWjdSdgeVd*hdUZGeWjdVdgeVd*hdWZHeWjdXdgeVd*hdYZIeWjdZeVd[hd\ZJeWjdZdgeVd[hd]ZKeWjd^eVd[hd_ZLeWjd`eVdhdaZMeWjd`dgeVdhdbZNeWjdcdgeVdhddZOdeZPeWjdfdgeVdhdgZQeWjdheVd*hdiZReWjdhdgeVd*hdjZSeWjdkeVe&dlZTeWjdkdgeVe&dmZUeejjdneeIjjdoz ZVeejjdpeeIjjdqz ZWdrZXe j>dsZYdtZZduZ[dvZ\eejjdweeIjjdxz Z]dyZ^dzZ_d{Z`d|Zad}Zbd~Zc ddZddddddddddZedZfdZgegdfZhegfdZidZjdZk ddZl ddZmeWjdeVd*hdZneWjddgeVd*hdZoeWjdeVd*hdZpeWjddgeVd*hdZqeWjdeVdhdZreWjdeVdd*hdZseWjdeVdhdZteWjddgeVdhdZueWjddgeVdd*hdZveWjdeVdd*hdZweWjddgeVdhdZxeWjddgeVdd*hdZyeWjdeVdd*hdZzeWjddgeVdhdZ{dZ|dZ}dZ~dZdZeWjde^dZeWjde^dZeWjde^dZeWjde^dZeWjde^dZeWjde^dZdd}dZdZdZdZdZd„ZdÄZdĄZdńZdefdƄZdedefdDŽZdeHdefdȄZdedzdefdɄZdʄZ dd˄Zd̄Zd̈́Zd΄ZdτZdЄZdфZd҄ZdӄZdԄZdՄZdքZdׄZd؄ZdلZeWjdګeNdۄZeWjdܐdgeQd݄ZeWjdސdgeQd߄ZeWjddgeQdZeWjddgeQdZdZdefdZdeddfdZdedeHfdZ ddeHdeHdzdeHdzfdZdZdZdZdefdZeWjddPgeNdZeWjddgeNdZeWjddgeNdZeWjddgeNdZeWjdd_geNdZdefdZdeddfdZdedeHfdZdefdZ ddeHdeHdedefdZdZdZdZeWjddPgeQdZeWjddgeQd ZeWjd dgeQd ZeWjd d_geQd Zd ZdZÐdZĐdZeWjdeVeϐeddZeWjdeVeϐeddZeWjddgeVdhdZeWjddgeVdhdZeWjdd_geVdhdZeWjdeVeϐeddZeWjddgeVdhdZeWjddgeVdhdZeWjdd_geVdhd ZeWjd!eVeϐedd"ZeWjd!dgeVdhd#ZeWjd$dgeVdhd%ZeWjd$d_geVdhd&ZeWjd'eVeϐedd(ZeWjd'dgeVd)hd*ZeWjd+dgeVd)hd,ZeWjd+d_geVd)hd-Z֐d.Zאd/Zؐd0ZeWjd1eVeϐedd2ZeWjd3eVeϐedd4ZeWjd5eVeϐedd6Zܐd7ZeWjd1dgeVd8hd9ZeWjd3dgeVd8hd:ZeWjd;dgeVd8hd<ZeWjd3d_geVd8hd=ZeWjd>eVeϐedd?ZeWjd>dgeVd8hd@ZeWjdAdgeVd8hdBZeWjdAd_geVd8hdCZhdDZhdEZdefdFZdeHfdGZde-fdHZde-fdIZdJdKhZdLZdefdMZdeHfdNZdeHfdOZdefdPZdeddfdQZd7eHdReHdefdSZdTZdUZdVZdWedXeHdeHfdYZdZZhd[Zhd\Zdefd]Zdefd^Zd_eHdefd`ZdefdaZ ddededefdbZdcZdeHfddZdefdeZdfe-dge-defdhZdiZdjeHfdkZdjeHfdlZ ddmZdefdnZdoedefdpZ dvddqdrZ defdsZ dededefdtZ dededefduZ dZdvedeHfdwZdedefdxZdedefdyZdedzedefd{Zd|e-defd}Zd~ZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%hdZ&hdZ'd$Z(hdZ)ddhZ*hdZ+hdZ,hdZ-dZ.dZ/dZ0drZ1djZ2iZ3iZ4defdZ5deddfdZ6eeIjjdz Z7dZ8dZ9dZ:dZ; ddZdefdZ?deHdeHfdZ@deHfdZAdefdZBdZCdZDdZE ddZFdZGdZHdZIdZJ ddedefdZKdZLdZMdedefdZNdedefdZOdedefdZPdededzedefdZQdefdZRddddvdddSd͐ddWdАddXdӐddYddgdœZSdefdÄZTdefdĄZUdededefdńZVdededefdƄZWdDŽZXdededefdȄZYdeHfdʄZZdeHdeHdeHfd΄Z[dededefdτZ\dededefdЄZ]eWjdѐdPgeNd҄Z^dӐedefdԄZ_eWjdՐdPgeQdքZ`dׄZad؄ZbeWjdՐdgeQdلZceWjdڐdPgeQdۄZdeWjdܐdgeQd݄ZedӐedefdބZfeWjdߐdPgeNdZgeWjdߐdgeNdZheWjddgeNdZidZjeWjddgeNdZkeWjdd_geNdZleWjdѐdgeNdZmeWjddgeNdZneWjddgeNdZoeWjdd_geNdZpeWjddgeNdZqd$ZreWjddgeNdZseWjddPgeQdZteWjddgeQdZueWjddgeNdZveWjddPgeQdZweWjddgeQdZxeWjddgeNdZyeWjddgeNdZzeWjddgeN dZ{eWj ddgeN dZ|eWj dd_geN dZ}eWj ddgeN dZ~ deHf dZeWj ddgeN d ZeWj d dgeN d ZeWj d  d Zdef dZdedef dZdededef dZdededef dZ dZdededef dZeWj deN dZeWj deN dZeWj ddgeN dZeWj ddgeQ dZ dZ dZ dZ dZ dZ d Z d!Z d"Z d#Z d$Z d%Zeeeeeeeeee d& Z d'ZeWj d(eN d)Z d*ZeWj d+eN d,ZeWj d-eN d.Z d/Z d0Z d1Z d2ZeWj d3eN d4ZeWj d5eN d6Zdedzf d7ZdkeHdedzf d8Zdef d9Zdeddf d:ZdeHf d;Z d<e d=eHf d>Z d?Zd~Zdef d@Z dAedeHf dBZ dAedef dCZ dDZ dEZd$Zdef dFZdef dGZ dHZ dIZdPZd$Z dJZdZ dKZ dLZdZ dMZ dNZ dde-f dOZdef dPZ dQddddd dRZ dSe dTedef dUZdef dVZÐdeddf dWZdef dXZŐdeHdef dYZdv dZdeHdef d[Zǐ d\ZȐ d]Zɐ d^dO d_ d` da db dc ddZʐd7eHdef deZː dfZdef dgZ͐ dSe dTedef dhZdef diZϐdeddf djZАdeHdef dkZdef dlZҐ ddeHdef dmZӐ dnZԐ doZՐ dpZdZא dqZdef drZِ dseH dteHf duZڐ d dveHdef dwZh dxZܐ dAef dyZݐ dAef dzZސ dseHf d{Zߐ dde dseH d|eHdef d}Z dAededef d~Z deHdef dZdef dZdef dZ dAedef dZ d<e dseHdeHf dZ dAededef dZ dAef dZeWj ddgeQ dZ dZ dZ dZdeHf dZeWj d dZdeHf dZeWj d dZeWj d dZeWj d dZeWj ddg dZeWj ddg dZeWj deQ dZeWj ddgeQ dZeWj ddgeN dZeWj ddgeQ dZeWj dd_geQ dZeWj dg deN dZeWj d dZeWj ddPgeN dZeWj ddgeN dZeWj ddgeN dZeWj dd_geN dZeWj ddgeN dZeWj deN dZ dZeWj ddgeN dZeWj ddgeN dZ dZ dZ dZ dZeWj ddgeN dZ dZ dZ dZ dZ eWj d d„ZeWj dë dĄZ d dńZ dƐZeWj dǫ dȄZeWj dɫeN dʄZ d˄ZeWj d̫eN d̈́ZeWj dΫ dτZeWj dАdgeR dфZeWj dҐdgeR dӄZeWj dԐdgeR dՄZeWj d֐dgeR dׄZeWj dؐdgeR dلZeWj dڐdgeR dۄZeWj dܐdgeR d݄ZeWj dސdgeR d߄ZeWj ddgeR dZeWj ddPgeQ dZ eWj ddgeQ dZ!eWj de^ dZ"eWj ddge^ dZ#ejj ddvZ$dZ%eWj ddg dZ&ejj ddvZ' dZ(eeIjj dz Z) dZ* dd}iZ+ dZ, dZ- dZ. dZ/ dZ0eWj ddg dZ1eWj deQ dZ2eWj deQ dZ3eWj deQ dZ4eWj deQ dZ5eWj ddgeQ dZ6eWj ddgeQ dZ7ddl8Z8eeIjj dz Z9dvZ:dvZ; d d dZ< dZ=d~d( dZ> dZ?dZ@dZAd}ZBdZCdZD d ZE d ZF d ZG d ZH d ZI d dZJ dZK dZLejZMiZN d dZO d dZP d dZQde?f dZR dZS dZT dZUe j> dZVe j> de jZXe j> dZYe j> dZZejZ[iZ\ dZ] dZ^ dZ_ dZ` d d Za d!Zb d d"Zcde@f d#Zde@f d$ZeejZfiZg d%Zh d&Zi d'Zj d( d) d* d+ d,Zk d-Zle@f d.Zm d/Zn d0Zo d1Zp d d2ZqejZrd'ddv d3Zs d4Zt d5Zu d6Zv d7Zwe j> d8e jZye j> d9Zz d:Z{ d;Z| d<Z} d=Z~ d>Zdrd d? d?Z d@Z dAZ dBZd*Z dCZ dDZ dEZdZejZiZiZid dF dL dG dJ dHd+ dI dJ dK dL dM dN dO dP dQ dR dS dT dU dV dU dW dX dY dZ d[ d\ d] d^ d_ d^ d` da db dc dd de de df dg dh di dj dj dk Z dlZ d dmZ dnZ doZ dpZ dqZ drZ dsZ dtZ d duZ dvZeWj dweQ dxZeWj dwdgeQ dyZeWj dzdgeQ d{ZeWj d|dgeQ d}ZeWj d~eQ dZeWj deN dZeWj ddgeN dZeWj ddgeN dZeWj deN dZ dZ dZ dZ dZ dZ dZ dZ dZ dZ dZ dZ dZ dZeDchc]\}}| c}}Z dZ dZ dZ dZ dZ dZ dZ dZeWj deWeϐe{ d dZeWj deWeϐe{ d dZeWj deWeϐe{ d dZddlZg dZeDchc]\}}| c}}Z dZ dZ dZ dZh dZ dZ dZÐ dZĐ dZŐ dZeWj ddPgeN dZeWj ddPgeN dZeWj ddgeN dZeWj ddgeN dZeWj dd_geN dZː dZeWj ddgeN dZeWj ddgeN dZΐ dZϐ dZА dZѐ dZҐ d dZӐ dZԐ d dZՐ d dZeWj ddgeN dÄZeWj dĐdPgeN dńZeWj dƐdPgeN dDŽZeWj dȐdPgeN dɄZڐ dʄZې d˄Zܐ d̄Zݐ d̈́Zސ d΄Zߐ dτZddlZeeIjj dz Z dѐZ dҐZ dӐZ dԐZdd( dZ dCZdZd}Z dՄZ dքZ dׄZ d d؄Z dلZ dڄZejZiZ d dۄZ d d܄ZdPdef d݄ZejZiZ dބZ d߄Z dZ dZ d dZejZd'ddv d3Z dZ dZ dZ dZeWj deQ dZeWj ddgeQ dZeWj ddgeQ dZeWj ddgeQ dZeWj deQ dZeWj deN dZeWj deN dZ dZ dZ dZ ejZ iZ dZ dZ dZ dZ dZ dZ dZ dZ dZ dZ dZdPZ dZ dZ dZ dZddlZeeIjj dz Z dZ! dd( dZ" dZ#dZ$dZ%d}Z& dZ'd$Z( d Z) d Z* d d Z+ d Z, d Z- dZ. dZ/ dZ0 dZ1 dZ2 d dZ3ejZ4iZ5 d dZ6e'de$f dZ7 d dZ8 dZ9ejZ:iZ; dZ< dZ= dZ> d dZ?ejZ@d'ddv d3ZA dZB dZC dZD dZEeWj d eQ d!ZFeWj d dgeQ d"ZGeWj d#dgeQ d$ZHeWj d%dgeQ d&ZIeWj d'eQ d(ZJeWj d)eN d*ZKeWj d+eN d,ZLddlMZMeeIjj d-z ZN d.ZO d/ZPeP d0zZQ d1ZR d2ZS d3ZT d4d( dZUdZVdZWd}ZXd$ZYdZZ d5Z[ d6Z\ d d7Z] d8Z^ d9Z_ d:Z` d d;ZaejZbiZc d d<ZddeVf d=Ze d>ZfdeVeZf d?Zg d@Zh dAZiejZjiZk dBZl dCZm dDZn d dEZoejZpd'ddv d3Zq dFZr dGZs dHZt dIZu d dJZveWj dKeQ dLZweWj dKdgeQ dMZxeWj dNdgeQ dOZyeWj dPdgeQ dQZzeWj dReQ dSZ{eWj dTeQ dUZ|eWj dVdgeQ dWZ}eWj dXeN dYZ~eWj dZeN d[Z d\Z d]Z d^Z d d_ZeWj d`e^ daZeWj d`dge^ dbZeWj dcd6ge^ ddZeWj dcd_ge^ deZiZejZ dfZeWj dgdge^ dhZeWj die^ djZeWj dke^ dlZee dmZ dnZ doZeWj dpdPge^ dqZeWj dpdge^ drZeWj dsdPge^ dtZeWj dsdge^ duZeWj dve_ dwZeWj dxdge_ dyZeWj dzdge_ d{ZeeIjj d|z Z d}Z d~Z dZ dZ dZ dZ dZ d dZ dZ dZ dZ dZ dZdeHdzf dZ d=eH deH deHdzdeedzf dZeWj deN dZeWj deN dZiZeeHeeHecffe! d<dZ d=eH deHdeHdzf dZ d=eHdeH deHdeedzf dZeWj deN dZ dZdZ dZdސZdZd*ZeeIjj dz ZejZ dZd,Z dZd+Z dZ dZ dZ d dZ dZ d ddo dds d dZ dZ dZ d dZÐ d dZejZŐ dZƐ dZd' d dd}djgg d d d dd dZȐ dZɐ dZʐ dZː dZ̐ d dZ͐dhaΐdZϐ d dZe j> dZѐ dZҐ dZӐ dZԐ dZՐ dZG d d«ZG dÄ dĐe׫Zؐdddd dŐ dƜZG dDŽ dȫZG dɄ dʫZG d˄ d̐e׫Zܐ d̈́ZeݫZސ d d΄Zߐ d dτZ dЄZe-ejj dѫxsdZdhd dҜZejZd'a dӄZ dԄZ dՄZ dքZ dׄZ d؄ZeWj dِdgeQ dڄZeWj dېdg d܄ZeWj dݐdߐd6g dބZeWj dߐdg dZeh dZ dZe j> de jZdd dZ dZeWj ddgeQ dZ dZeWj ddg dZeh dZdZeWj ddg dZeWj deQ dZeWj deQ dZeWj de` dZeWj ddge` dZej Z d Z d Z d Zej Z d Z d Z d ZeWj ddPdgeQ d Zd} Z d~ Z d+ Z d Z dJ Z d Zd Z ded|e-deef d Zi ZeeHefe! d<ej Zd' ddeH dedef d ZeWj ddge` d ZeWj de` d ZeWj ddge` d ZeWj ddg d Z d ZeWj d e` d ZeWj d e` d ZeWj ddgeQ d ZeWj deQ d ZeWj ddgeQ d ZeWj deQ d ZeWj ddgeQ d ZeWj de` d Z eWj de` d Z!eWj de` d Z" d Z#eWj de` d Z$eWj d e` d! Z%eWj d"eQ d# Z&eWj d$dgeQ d% Z'eWj d&dgeQ d' Z(eWj d(dgeQ d) Z)eWj d*d_geQ d+ Z*eWj d,eQ d- Z+eWj d.dgeQ d/ Z, d0 Z-eWj d1 d2 Z.eWj d3 d4 Z/eWj d5 d6 Z0eWj d7 d8 Z1eWj deQ d9 Z2 d: Z3 d; Z4eWj d<e` d= Z5eWj d>dge` d? Z6eWj d@eW dAh dB Z7 dC Z8 dD Z9eWj dEeW dAh dF Z: d dG Z; dH Zdv a? dL Z@ejj dMddk( ZA eAreWjj dNneWjj dO eAr*ej e@d( P ZD eDj dQ ZF eArej eFd( P ZG eGj eUj dR ZI eIreWjj dS eIej ZLejeBd( PjejeCd( PjeUjd Ueje_ dVd(id( Wj dX ZN eAr*ej eNd( P ZO eOj dY ZP eAr*ej ePd( P ZQ eQj eAr&ejevd( Pj eAr&ejed( Pj eAr&ejeDd( Pj eAr&ejetd( Pj eAr&ejed( Pj dZ ZR eAr*ej eRd( P ZS eSj d[ ZT d\ ZU d] ZV eAr*ej eVd( P ZW eWj d^d' d_ d^d' d_ d^d' d_ d` ZXej ZY da ZZ db Z[eWj dcdPdgeQ dd Z\eWj dedPgeQ df Z] dg Z^ dh Z_ eAr~ej e_d( P Z` e`jejed( P Za eajejed( P Zb ebjd Zc die djef dk Zd dl Ze dm Zf d dn Zg do Zh dp Zi eAr*ej eid( P Zj ejj dqeH drededef ds ZkeWj dteW duh dveHf dw ZleWj dxeW duh dveH dyeHf dz ZmeWj d{eW duh dveH dyeHf d| ZneWj d}eW duh dveH dyeH d~eHf d ZoeWj ddPdgeQ dveHf d Zp d Zq d ZreeIjj dz dz Zse j> d Ztdef d Zu deddf d Zv deHdeHdzf d ZwdŐedef d Zx deHdeHdzf d Zy deHddf d ZzeWj deQ d Z{eWj ddgeQ d Z|eWj ddgeQ d Z} d d Z~ e~eV dk(r?e-ejj d d ZeWj d ed' yy#eP$rddlLmQZR ddededededzdef dZOYwxYw#eP$rdZQYwxYw#eq$r)ZrdZgeWjjd.erYdZr[rdZr[rwwxYwcc}}wcc}w#e3$rdZ2YCwxYwcc}}w#e$rYS"wxYwcc}}wcc}}w#e$r!eWjj dTYwxYw( u app.py — QR Carrier PDF generator: single-item and CSV-driven multi-item workflows. Serves the upload UI at /qr/add/ (Apache ProxyPass). Environment variables: QR_WATCH_DIR Root directory that contains job subfolders (default: /var/www/html/qr) QR_BASE_URL Public URL that maps to QR_WATCH_DIR (default: http://fileshare.icastinc.com/qr) PORT Port for the built-in dev server (default: 5001) N)datedatetime timedeltatimezone)Path)quoteunquoteurlparseurljoin)Flaskabortgjsonify make_responserender_template_stringrequest send_file)FPDF) load_workbook)secure_filename)Imagewraps) OrderedDict)contextmanager)redirectsessionurl_for) merge_item carrier_path shop_path output_foldersubmittal_pathreturnc 8ttt|t|t||r t|ndt}|j |j k7r/|j |j |j|S)N)carrier_sheet_pathshop_drawing_pathr"r#base_url)r_qr_merge_itemstr_get_qr_base_urlresolve write_bytes read_bytesunlink)r r!r"r# generateds /var/www/html/togen/app.py _merge_itemr2;s"<0!)nm,2@3~.d%'       ,"6"6"8 8  $ $Y%9%9%; <    )build_carrier_pdfc8t}|jddt|j}|dt|j}|r|dt|jnd}|j }t |||} |j | |S)N/)r+rstriprnamer._build_carrier_pdfr-) r r!r"r# _base_url folder_urlshop_url submittal_url carrier_bytes result_bytess r1r2r2Ns$& !((-.am6H6H0I/JK  \5#8"9:HV:,an.A.A(B'CD\^ $//1 )-Q   .r3i@MAX_CONTENT_LENGTH)RotatingFileHandler)dequeTOGEN_REQUEST_TELEMETRY10TOGEN_SLOW_REQUEST_MS1500TOGEN_SLOW_REQUEST_LOGlogszslow_requests.log)maxlenztogen.slow_requestFTparentsexist_okiP)maxBytes backupCountz%(asctime)s %(message)sz3Slow-request log unavailable (%s); using app.loggerc>tjt_yN)time perf_counterr _req_startr3r1_telemetry_mark_startrYs((* r3c Xttdd}|tj|z dz}|tk\r|ddt j dt jdt jxsdd|j }tjtjt|d t j t jt j|jd ttj||Stj j#d ||S) NrWg@@.0fzms  z -> ?z status=)tsmsmethodpathendpointstatuszSLOW-REQUEST %s)getattrrrUrV_SLOW_REQUEST_MSrrarbrc status_code_recent_slow_requestsappendround_slow_request_loggerinfoapploggerwarning)responsestart elapsed_mslines r1_telemetry_recordrts<.  ++-5?J--!#&c'..)97<<.I!**1c2(8;O;O:PR&,,99;eJ.B&~~w||!(!1!1X=Q=QS (3(--d3JJ&&'8$?r3c tjjdr|jdk(rd|jd<|S#t $rY|SwxYw)u DVI-945: content-hashed /static assets are immutable, so cache them for a year. Filenames embed the content hash, so a JS change yields a new URL — no stale-cache risk. Flask's static handler already supplies ETag + conditional 304; this just extends the freshness lifetime.z/static/rKz#public, max-age=31536000, immutable Cache-Control)rrb startswithrgheaders Exception)rps r1_static_immutable_cacherzsV  << " ": .83G3G33N0UH  _ - O   O s=A A AFLASK_SECRET_KEY SECRET_KEYTOGEN_SESSION_COOKIE_DOMAIN .icastinc.comSESSION_COOKIE_DOMAINAZURE_CLIENT_IDAZURE_CLIENT_SECRETAZURE_TENANT_IDiCastz$fed82ffb-eb77-41d4-9f50-59c80f1a942fz$f0e1aca6-fe4f-4f79-9a8b-3ae4bf644db7z$13a096d3-08d9-40e2-a6ba-affd2f181249z$75cb48a6-8d0d-48e5-a90e-75d5f65453b7z$5d5e2955-9b1b-4f16-8e8e-94426158c639z$8da8d55b-f4f7-4801-84e0-ea509eb5b381z$ea998389-b27d-45e4-b23e-966bb47cb772 wor_admin togen_admintakeoff_workflowprod_run togen_mts togen_scada togen_vision)r9 base_groupgroupsz$5040da8d-ce20-4443-a761-20600db23e5ezVoyage Technologyz$f5a4b007-b23a-4db0-9fc7-2e45a08d45b8)rrz/https://login.microsoftonline.com/organizationsz"https://login.microsoftonline.com/z User.ReadzGroupMember.Read.Allz(https://togen.icastinc.com/auth/callback QR_WATCH_DIRz/var/www/html/qr QR_SHARED_DIRz/var/www/html/sharedWOR_DIRz/var/www/html/wor maintenance in_progress completed cancelled mobilemachinesafety preventivezrecurring.json_testzwor_test_counter.json_deletedzwor_deletion_log.jsonlmanualszpm_manuals_index.jsonzpm_manuals_text_index.jsonpm_manuals_thumbsi>.doc.jpg.pdf.png.docx.jpeg SUPPORT_DIRz/var/www/html/support_requests FEATURE_DIRz/var/www/html/feature_requestsPROJECTBUILDER_DIRz/var/www/html/projectbuilderSTOCK_PRODUCTS_DIRz/var/www/html/stockproductsdrawingsMTS_LABELS_DIRz/var/www/html/mtslabelsOCR_DIRz/var/www/html/ocr QR_BASE_URLz http://fileshare.icastinc.com/qrAZURE_MAIL_FROMr7ztool_visibility.jsonztool_order.jsonztool_separators.json)leftcenterright)nonerrboth)autor^rP< cV|dk(xs#t|txr|jdS)z{True for a home-grid separator token (DVI-1337): the legacy 'separator' marker (DVI-524) or a unique 'sep_' token. separatorsep_ isinstancer*rwtids r1_is_separator_tokenrMs) +  R*S#"6"Q3>>&;QRr3ci}t|ts|S|xsgDchc]}t|s|}}|jD]\}}||vst|tst |j ddj dt}|j d}|tvrd}|j d} | tvrd} t|j dxr| dk7} |j d } t| } | tvrd } |s|dk(r | dk(r| d k(rd|i} |r|| d<| dk7r| | d<| rd | d<| d k7r| | d <| ||< |Scc}w#ttf$rYbwxYw) a_Sanitize a separator-properties map against the ids present in the owning order list (DVI-1337). - Drops props whose id is not a separator token present in `order_ids`. - Coerces `justify` and `collapse` to their enums (defaults 'center'/'none'), `collapsed` to bool, `columns` to auto|1..6 (default 'auto'), and caps `label` at 60 chars. - `collapse == 'none'` forces `collapsed` off (a non-collapsible bar can't be collapsed-by-default). - Drops entries with no meaningful properties so the store stays minimal (a bare separator simply renders unlabeled). labelr7Njustifyrcollapser collapsedcolumnsrT)rdictritemsr*getstrip_SEPARATOR_LABEL_MAX_SEPARATOR_JUSTIFY_SEPARATOR_COLLAPSEboolint TypeError ValueError_SEPARATOR_COLUMN_CHOICES) raw order_idsouttallowedsidpropsrrrrrentrys r1_sanitize_tool_separatorsrSs C c4  $?FQ/B1/EqFGFiik" U g Zt%< EIIgr*+1134I5IJ))I& , ,G99Z( . .H;/0GX5G ))I& 'lG 3 3G'X-(f2Dv% G$ "E'N v  (E*  !%E+  f &E) CE"F JIG$:&   sEE9 EE'&E'ci}tjr: tjtj }t |t r|}t|tS#tjtf$rY/wxYw)zReturn the admin-default separator-properties map (DVI-1337), sanitized against the admin tool order so orphaned entries never surface.) TOOL_SEPARATORS_FILEis_filejsonloads read_textrrJSONDecodeErrorOSErrorr_load_tool_orderrdatas r1_load_tool_separatorsrss C##% ::2<<>?D$% %S*:*< ==$$g.   9A%%BBcXtjtj|dyNrindent)r write_textrdumpsmappings r1_save_tool_separatorsr##DJJwq$ABr3ztool_items.json tool_icons)webdtiledashrefPi)newtabembed)linkglobechartdocwrenchfactorycamerabook),geartoolboxhammer screwdrivernut_bolt thermometerwaterfireboltbatteryplug lightbulbpackagetruckforklift clipboardcalendarclock stopwatchrocheckstopbellchart_up chart_downlaptopdesktopphoneemailfolderbuilding construction safety_vesthelmetmagnify test_tubeflask microscopemagnetpinkeylockrecycleruler )defaultwidetallr*cHt|txr|jdS)zETrue for a website item token (DVI-1344): a unique 'web_' token.web_rrs r1_is_web_item_tokenr4s c3  :CNN6$::r3cHt|txr|jdS)zBTrue for a dashboard-tile item token (DVI-1346 P2): 'dtile_'.dtile_rrs r1_is_dashboard_item_tokenr7s c3  '.dashref_rrs r1_is_dashref_item_tokenr:s c3  >CNN:$>>r3cLt|xst|xs t|S)uTrue for any home-grid item token (DVI-1344/1346/1347). Website tiles (web_), dashboard tiles (dtile_), and embedded dashboards (dashref_) — all ride behind the same token/props/render/sanitize seams.)r4r7r:rs r1_is_tool_item_tokenr<s+ s # +'?'D +%c*,r3c|t|xsdj}|rt|tkDry|j }t j d|ryd|vr#|jds|jdsyd|z} t|}|jdvs |jsy|S#t$rYywxYw)u4Return a safe http(s) URL for a website tile, or '' when invalid. A tile opens this in a new tab and the favicon fetch dereferences it server-side, so anything but http/https (javascript:, data:, file:, …) is rejected. A scheme-less value is assumed https so an admin can type a bare host.r7z3^(javascript|data|vbscript|file|about|blob|mailto):://http://https://)httphttps) r*rlen_WEB_ITEM_URL_MAXlowerrematchrwr rschemenetloc)rurllowparseds r1_sanitize_web_item_urlrMs ciR.   C #c(.. ))+C  xxFL |y)S^^J-G3#}}--V]] J s B// B;:B;c Lt|jddjdt}t |jd}|r|sy|jd}|t vrd}|jd}|dk(rZt jd dt|jddjdd }|tvr d |||d|d Sd |||d dSt jddt|jdddd}|dk(r |r d |||d|dSd |||d dS)aValidate one website tile's props (DVI-1344). Returns the normalized entry or None when it can't render (a web tile needs a name + a valid http(s) url). icon_mode is 'favicon' (default), 'custom', or 'glyph' (DVI-1355). A 'custom' entry keeps its icon id (a filename token in TOOL_ICONS_DIR); a 'glyph' entry keeps a curated glyph id from _WEB_ITEM_GLYPH_IDS (an arbitrary string is rejected). Either degrades to favicon when its id is missing/unknown so the tile always has an icon source.r9r7NrJmoder icon_modeglyph [^a-z0-9_](r)typer9rJrOrPrQfavicon)rTr9rJrOrP [^A-Za-z0-9_]icon@custom)rTr9rJrOrPrW) r*rr_WEB_ITEM_NAME_MAXrM_WEB_ITEM_MODESrFsubrE_WEB_ITEM_GLYPH_IDS)rr9rJ open_moderOrQrWs r1_sanitize_web_itemr_sB uyy$ % + + -.A/A BD 5!1 2C s &!I' 99[ !D w}b#eii.D*E*K*K*MNsPRS ' '!4Y!(5: :tC&( ( 66"BEIIfb,A(B CCR HD xDtC%t5 54Y" $$r3clt|jddj}|dk(s |tvryt ||jdxsi}|jd}|t vrd}d|||d }t|jd djdt }|r||d <|S) uValidate one dashboard-tile home item (DVI-1346 P2). It wraps a dashboards tile: {type:'dtile', tile_type, config, size, title?}. The tile_type must be a registered dashboard tile type (never 'group' — no nested panels on the home grid) and its config is validated through the shared _sanitize_tile_config. Returns None when the tile_type is unknown/unsupported. Home sizing is presets only (D4): default / wide / tall. tile_typer7groupNconfigsizer.r)rTrarcrdtitle)r*rr_dashboard_tile_types_sanitize_tile_config_DASHBOARD_ITEM_SIZES_DASHBOARD_ITEM_TITLE_MAX)rrarcrdrres r1_sanitize_dashboard_itemrj0sEIIk2./557IGy0E0GG "9eii.A.GR HF 99V D ((9PT UE  '2& ' - - /0J1J KE g Lr3c ,tjddt|jdddd}|sy|jd}|tvrd}|jd}|t vrd }t |jd xr|d k7}|jd }|tvrd }|jd }|tvrd }d||||d}t|jddjdt}|r||d<|d k7r||d<|rd|d <|S)uValidate one embedded-dashboard home item (DVI-1347 P3). It references a whole Dashboard by id and renders as a full-width collapsible section: {type:'dashref', dashboard_id, title?, justify, collapse?, collapsed?, columns, rows}. The bar follows the Separator model (justify/collapse chevrons/collapsed-by-default); columns/rows shape the embedded grid. Returns None when there's no dashboard_id (nothing to embed). The referenced dashboard's existence + view-gating is resolved at render time (a stale ref simply redacts its own section), not here — the props map only carries the reference + display options.[^A-Za-z0-9_-]r7 dashboard_idNrrrrrrrrrowsr)rTrmrrrnreT) rFr\r*rrrr_DASHREF_COLUMN_CHOICES_DASHREF_ROW_CHOICESr_DASHREF_TITLE_MAX) rdash_idrrrrrnrres r1_sanitize_dashref_itemrsEs.ff&C ."0M,NOPSQSTG ii "G((yy$H**UYY{+,CV1CIii "G-- 99V D ''GT CE  '2& ' - - /0C1C DE g6$j!k Lr3cRi}t|ts|S|xsgDchc]}t|s|}}|jD][\}}||vst|tst |r t |}n"t |r t|}n t|}|W|||<]|Scc}w)aSanitize an item-properties map against the ids present in the owning order list (DVI-1344/1346/1347), mirroring _sanitize_tool_separators. - Drops props whose id is not an item token present in `order_ids`. - Type is inferred from the token (web_ / dtile_ / dashref_) so an id can never masquerade as another item type; each type has its own validator. - An entry that can't render (validator returns None) is dropped. ) rrr<rr:rsr7rjr_)rrrrriidrrs r1_sanitize_tool_itemsrvls C c4  $?FQ/B1/EqFGFiik  U g Zt%<  !# &*51E %c *,U3E&u-E  CH  JGs B$B$ci}tjr: tjtj }t |t r|}t|tS#tjtf$rY/wxYw)zReturn the admin-default item-properties map (DVI-1344), sanitized against the admin tool order so orphaned entries never surface.) TOOL_ITEMS_FILErrrrrrrrrvrrs r1_load_tool_itemsrysr C  ::o779:D$% %5%7 88$$g.   rcXtjtj|dyr)rxrrrrs r1_save_tool_itemsr{stzz'!<=r3c|r t|ni}|jdxs t}tt }|jd}t |tr|j |t||S)a7Resolve the item-properties map that renders for `email` on the home grid (DVI-1344/1346): admin defaults overlaid by the user's own overrides (D3), sanitized against the user's effective tool order so orphans are dropped. Mirrors the client-side _webItemProps / _dtileItemProps override resolution. tool_order tool_items)_load_user_settingsrrrryrupdaterv)rsettingsordermerged user_itemss r1_effective_tool_itemsrsi .3"5)H LL & <*:*aaxaa%a@zzaRzazza(a equipment Equipmentequipment-manualsz em-tiles-gridactivatezemSwitchTab('settings')assetszAssets Inventoryz:Asset registry, models, sub-assemblies, parts & inventory.zemSwitchTab('assets')) idre descriptionrWrtab access_leaf open_default extra_accessManualsz6Browse and search equipment repair & operator manuals.zemSwitchTab('manuals')equipment.manualsrpmzRepair Parts Managerz'Parts requests, approvals and tracking.zemSwitchTab('rpm') equipment.rpm _rpmAccess oversight Oversightz*View equipment on the facility floor plan.zemSwitchTab('oversight')equipment.oversight)rrtool_id containerrcatalogwork_order_requestzWork Order Request work-orderzwor-tiles-list wor_types Maintenancez)Facility & equipment maintenance requestszworSelectType('maintenance')Mobile Machinez&Vehicle & mobile equipment work orderszworSelectType('mobilemachine')Safetyz Safety concerns & hazard reportszworSelectType('safety')Preventative MaintenancezScheduled PM tasks & partszworSelectType('preventive') ithelpdeskz IT Help Deskz'IT support tickets to Voyage TechnologyzitOpenHelpDesk())rrrrrvisibility_sourcerqualityQCz qs-tiles-gridbatchesz Batch Ticketsz=Capture daily concrete batch tickets against mixture recipes.qcBatch Productionzqc-tab-batcheszqcSwitchTab('batches')batch_production) rrerrW target_tool target_titlepane_idrrrrrrbdailyzDaily Productionz/Record the day's per-segment production totals.z qc-tab-dailyzqcSwitchTab('daily') _qc_dailyimportImportz+Import PLC/SCADA batch logs (Pipe Mix Log).z qc-tab-importzqcSwitchTab('import') qc.importreportsReportsz/Daily + date-range material consumption totals.zqc-tab-reportszqcSwitchTab('reports') qc.reports kiln_statusz Kiln Statusz-Live kiln temperature sensors and monitoring. scada-view Kiln Metricszscada-panel-statuszscadaSwitchTab('status')rd _km_scada kiln_metrics)rrerrWrrrrrrrr render_hookrbkiln_reportingzKiln Reportingz#View and generate kiln log reports.zscada-panel-logszscadaSwitchTab('logs')kiln_oversightzKiln Oversightz-View kiln sensors on the facility floor plan.zscada-panel-oversightzscadaSwitchTab('oversight'))rrrrrrtiles)rrr) sep_qcbprrrrsep_qckmrrrrrr)rrrrr)rr)r separators)rrrrrrrdefault_layout)rrrcR|jd xr|jddk7S)usWhether a surface's catalog visibility/access is managed by the sub-tool stores (tile_surface_subtools + Users->Access). False for an external-catalog surface (no catalog in the layout) and for a WO-type surface (DVI-1503: visibility lives in the WO-type stores — wor_type_visibility + per-user hide + the preventive role — NOT tile_surface_subtools).external_catalogrrr)surfaces r1_surface_uses_subtool_storers2  ./ / @ /0K?Ar3c,tj|SrT)_TILE_SURFACESr) surface_ids r1 _tile_surfacers   j ))r3cVt|}|sgS|dDcgc]}|d c}Scc}wNrrrrrcs r1_surface_catalog_idsrs1J'G  $Y/ 0AdG 00 0s &cXt|}|r|jdrgSt|S)u^Catalog ids that participate in a surface's editable LAYOUT order. Empty for an external-catalog surface (DVI-1503): its catalog (e.g. the WOR types) is ordered + hidden entirely in its own stores, so catalog tokens never enter tool_subpages — the surface layout holds only added items (D-WOR2-B without a second order/hide system).r)rrr)rrs r1_surface_layout_catalog_idsrs- J'G gkk"45  ++r3c2t|}|r'|jddk(rttS|rNt |jdt r/|djd}t |tr t|Stt |S)aCatalog-seeded default order (D8-A): a surface with no stored admin default seeds its order from its catalog, so Equipment works with zero admin setup. An external-catalog surface seeds an EMPTY order (added items only). A WO-type surface (DVI-1503 board follow-up) seeds from the WO-type order store so the deploy-day landing order matches the admin's current wor_type_order; the surface layout owns the order thereafter.rrrr)rrlist_load_wor_type_orderrrr)rrrs r1_surface_default_orderrsJ'G7;;23{B(*++:gkk*:;TB()--g6 eT ";  +J7 88r3c t|}|rpt|jdtrQ|djd}t|tr-|j Dcic]\}}|t|c}}SiScc}}w)zSeeded separator props for a surface's default_layout (D6). Empty for a surface with no default_layout (equipment / work_order_request), so their seeding is unchanged.rr)rrrrr)rrsepskvs r1_surface_default_separatorsrsqJ'G:gkk*:;TB'(,,\: dD !+/::<841aAtAwJ8 8 I9s$Bctt|}t|tsgStg}}dx}x}x}}|D]} | |vrt | r|t k\r|dz }nVt | r|tk\r8|dz }n;t| r|tk\rS|dz }n t| r|tk\rn|dz }n| |vry|j| |j| |S)uValidate a surface's order token list. Catalog tokens are validated against THIS surface's catalog (a top-level tool id / a foreign catalog token is dropped — cross-surface rejection, D9); sep_/web_/dtile_/dashref_ tokens ride the same caps as the home order.rr^)setrrrr_MAX_SEPARATORS_PER_LISTr4_MAX_WEB_ITEMS_PER_LISTr7_MAX_DASHBOARD_ITEMS_PER_LISTr:_MAX_DASHREF_ITEMS_PER_LISTaddri) rrcat_idsseenr sep_count web_count dtile_count dashref_countrs r1_sanitize_subpage_orderrs -j9:G c4  r#D:;;I; ;K- $;  s #44 NI  $33 NI %c *;; 1 K #C ( ;; Q M      3-. Jr3ct|tr|ni}t||jd}t |jdxsi|}t |jdxsi|}|||dS)zSanitize one surface's {order, separators, items}. The separator/item maps reuse the home validators, scoped to the sanitized order.rrrrrr)rrrrrrv)rrrrrs r1_sanitize_subpage_layoutr?sjC&#BC #J0@ AE $SWW\%:%@b% HD !1!7R ?E$ ??r3cji}tjr: tjtj }t |t r|}i}|jD].\}}|tvst |t s t||||<0|S#tjtf$rY`wxYw)zReturn the admin-default per-surface layout map (DVI-1496 P1), sanitized + self-healing (drop-unknown surface) on load like every sibling store.) TOOL_SUBPAGES_FILErrrrrrrrrrr)rrrrlayouts r1_load_tool_subpagesrIs C!!# ::0::<=D$% Cyy{= V . Z%=/Vz(JK-2"5)HH||O,H(D!jj1I4&PJ'g&J$Z6:J;E  ,'R+Fz+R SD(,,|,d3 H\*+ 7#)r *E(,,w'. Xg&' #J%t^c0d eer3ctj|xsi}|jdxs t|}t|||jdxs t ||jdxsidS)zThe surface's ADMIN-DEFAULT layout (DVI-1496 P4): the stored admin default, or the catalog seed (D8-A) when none is stored. Sanitized. This is what the Default-scope editor edits and what a user with no override inherits.rrrr)rrrrr)rrrs r1_admin_subpage_layoutrxst ! % %j 1 7RE IIg  D"8"DE #Jii -X1LZ1X7#)r1 r3cd|r t|ni}|jd}i}t|tr$t|j|tr||}|jd}t|tr|ng}t |||jdxsi|jdxsidS)zThe surface's RAW per-user override (DVI-1496 P4), sanitized. `order` is empty when the user has no custom order (so the client knows to inherit the admin default in the My-list scope, mirroring the home tool_order model).rrrrr)rrrrrr)rrrrrrs r1_user_subpage_layoutrs.3"5)H||O,HH(D!jj1I4&PJ' LL !Et,E"E #Jll<06Bg&,"1 r3ct|}|sgS|dDcgc]}|d|d|d|d|d|jdd|jd |jd |jd |jd |jd |jd|jd|jddc}Scc}w)zCatalog metadata handed to the SPA so it can render tiles without a second fetch. P1 exposes the display + navigation fields; the P2 access fields (access_leaf/open_default) ride along for the client's forward use.rrrerrWrrTrrrrrrrrb)rrerrWrrrrrrrrrrb)rrrs r1_surface_catalog_publicrsJ'G  Y' )T7QwZ-@PvYqxUU>48EE-0UU>2EE-0UU>2i(z*EE-0eeGn & )) )sB/C c "t|}|xsijd}t|tsgS|Dcgc]M}t|tr;|jdr)|d|dt|jdxsgdOc}Scc}w)uCatalog group metadata (DVI-1522 Amendment 1) — [{id, label, tiles:[ids]}]. Empty for a surface with no groups (equipment / work_order_request).rrrrr)rrrrr)rrrrs r1_surface_groups_publicrsJ'Gm  *F fd #  Dz!T2uquuT{T7QwZ$uquuW~?SQS:T U DD DsAB ctjDcic]Q\}}||d|d|d|d|jdxsijddt|t |dSc}}Scc}}w) zDThe whole surface registry as a JS mirror for the SPA (DVI-1496 P1).rrrrrrr7)rrrrsettings_activaterr)rrrrr)rss r1_tile_surfaces_publicr s)..0  2 Q $!G*9 ~()j(9(?R'D'DZQS'T4S9237 9 9 22 2sAA2cLt|}|sy|dD]}|d|k(s |cSyrr)r subtool_idrrs r1_surface_catalog_entryr s<J'G  Y  T7j H r3c tjDcic](\}}t|r||dDcic]}|dd c}*}}}}d|vrd|dvrt|dd<|Scc}wcc}}}w)uAdmin-default visibility for every surface's catalog (N3-A — Assets/Manuals/Oversight default enabled). DVI-1496 P3 (§3.6): the Equipment RPM sub-tool seeds its default from the retired ``repair-parts-manager`` Tools-Enabled value so the effective state is unchanged on deploy day (the standalone tile defaulted disabled). An explicit rpm entry in tile_surface_subtools.json (an admin toggling it post-deploy) overrides this.rrTrr)rrr_rpm_legacy_tile_enabled)rrrrs r1_subtool_default_visibilityrs(--/ S SsA3Nq3Q ) 514$5 5 SC Sces;'77":"<K J 6 SsA, A'A,'A,ct}tjr tjtj }t|trQ|jD]>\}}||vs t|ts||D]}||vst|||||<@|S#tj tf$ri}YwxYw)zAdmin-default {surface_id: {subtool_id: bool}}, self-healing / drop-unknown on load like wor_type_visibility (missing surface/subtool defaults enabled).) rTILE_SUBTOOLS_FILErrrrrrrrrr)rsavedrsubscids r1_load_subtool_visibilityrs & 'C!!# JJ1;;=>E eT ""[[] < T#:*T4"8"3x<$;,0cOCHSM< < J$$g. E s'B**CCcXtjtj|dyr)rrrrrs r1_save_subtool_visibilityrrr3cn|siSt|xsijd}t|tr|SiS)zFPer-user override {surface_id: {subtool_id: bool}} from user settings.subtool_visibility)rrrr)rrs r1_user_subtool_visibilityrs9  u % + 0 01E FCS$'3/R/r3cVtj|ij|dSNT)rr)rr s r1_subtool_admin_enabledrs% # % ) )*b 9 = =j$ OOr3c~t|j|}t|tr||vrt || SyNF)rrrrr)rr rsurfs r1_subtool_user_hiddenr!s> #E * . .z :D$*"4Z())) r3c|r|jdryt||}|sy|jddry|jd}|r|t|xsivry|jddk(rt|xsiry|jddk(rt |xsiry|jdd k(rt |xsiryy) a4Whether *user* is permitted the sub-tool by the access model (independent of the admin enable/user-hide toggles). Admin always; an open_default catalog entry is open to every logged-in user (N2-A); otherwise the entry's access leaf must be held (RPM's _rpmAccess role ORed in for forward-compat).rTFrrrrrr)rr _tool_effective_resources _rpm_role_ok _km_role_ok_qc_daily_access)rr usercatleafs r1_subtool_access_okr* s  ' Z 8C  ww~t$ 77= !D 1$*"== ww~,.< 3K ww~+-+djb2I ww~+-2B4:22N r3c6t|jdS)uKiln Metrics (SCADA View) access — the togen_scada role (Togen Admins pass at the top of _subtool_access_ok). Mirrors the standalone scada-view tile gate.rrrr's r1r%r%%s ' ((r3cZtt|xsittzS)uDaily Production access — any qc.production. grant (Togen Admins pass earlier). Matches the standalone Daily Production tab gate (DVI-1410).)rr#r_qc_production_leavesr-s r1r&r&+s. )$*"5+-./ 00r3c tjrItjtj }t |t rd|vrt|dSy#tjtf$rYywxYw)upRead the retired ``repair-parts-manager`` Tools-Enabled value straight from the store. DVI-1496 P3 removed it from ``_ALL_TOOL_IDS`` so ``_load_tool_visibility`` no longer returns it — this is used ONLY to seed the RPM sub-tool's admin-enabled default on deploy day (§3.6) so the effective state is unchanged. The standalone tile defaulted disabled.zrepair-parts-managerF) TOOL_VISIBILITY_FILErrrrrrrrr)rs r1rr2su   ' ' )JJ3==?@E%&+AU+JE"89::   ' *   sAA A<;A<ctddS)uWhether the RPM sub-tool is admin-enabled — the post-merge replacement for the retired ``repair-parts-manager`` Tools-Enabled flag (seeded from it on deploy day, then tracks the RPM Tools-Enabled sub-row in tile_surface_subtools.json).rr)rrXr3r1_rpm_tool_enabledr3Bs "+u 55r3cr|jdryt|jdxr tS)NrTr)rrr3r-s r1r$r$Js. xx  % & >+<+>>r3c|r|jdry|xsijdd}t||xrt||| xr t|||S)zDEffective visibility of a sub-tool's tile + tab + routes for *user*.rTrr7)rrr!r*)rr r'rs r1_subtool_visibler6Ps` ' ZR  Wb )E ":z : A(ZGG A":z4@Br3ctjDcic]6\}}t|r&||dDcic]}|dt||d|c}8c}}}Scc}wcc}}}w)zEffective {surface_id: {subtool_id: bool}} for the SPA (drives tile + tab hiding; server routes re-check independently, D9).rr)rrrr6)r'rrrs r1_subtool_visibility_for_userr8Zs )..0 T TQ4OPQ4R Y<)D'+C4$??) ) TT) TsAAAAztoolbar_visibility.jsonzpublic_version.txtzabout_content.mdzsite_text_settings.jsonztool_overrides.jsonzsync_service_state.jsonznews_posts.jsonznews_subscribers.jsonzshared_url_prefix.json user_settingszfb_watcher_state.jsonzscada_config.jsonzscada_report_schedules.jsonzscada_enforced_recipients.jsonzscada_external_recipients.jsonSCADA_REPORTS_DIRzvision_collectors.jsonzvision_settings.jsonzvision_agents.jsonzvision_agent_names.jsonz vision.dbzvision_policy.jsonzvision_interpret_log.jsonlzvision_watch_criteria.jsonzvision_monitor.jsonzvision_recovery.jsonVISION_FOOTAGE_DIRvision_footageVISION_FOOTAGE_BACKENDlocalVISION_FOOTAGE_SSH_KEYz.sshid_togen_rsync_pullVISION_FOOTAGE_REMOTE_BASEfootageVISION_FOOTAGE_CACHE_DIRvision_footage_cacheVISION_FOOTAGE_CACHE_MAX_BYTESi VISION_FOOTAGE_CACHE_TTL1800VISION_FOOTAGE_SSH_POOL_SIZE4VISION_FOOTAGE_LISTING_TTL10VISION_AGENT_DIST_DIR agent_distVISION_AGENT_ZIP_NAMEztogen-vision-agent.zipVISION_RSYNC_HOST165.188.108.55VISION_RSYNC_PORT4423VISION_RSYNC_USERaivVISION_RSYNC_MGMT_KEYBACKUP_RSYNC_HOSTBACKUP_RSYNC_PORTBACKUP_RSYNC_USERtogenBACKUP_RSYNC_KEYz/home/manager/.ssh/id_ed25519BACKUP_RSYNC_SRCz/var/www/html/BACKUP_RSYNC_DESTz togen-backup/zprint.dbz backup.dbzbackup_schedule.jsonz history.dbzhistory_settings.jsonhistory_archivezdiag_timeline.dbPRINT_AGENT_DIST_DIRPRINT_AGENT_ZIP_NAMEztogen-print-agent.zipdisplay_agent_winDISPLAY_AGENT_ZIP_NAMEztogen-display-agent.zipzbranding_settings.jsonzdisplay_defaults.jsonzregional_settings.jsonzprinting_settings.jsonzwinston_settings.jsonzwinston_schedules.jsonzwinston_run_records.jsonzcorporate_logo.svgzcorporate_bg_light.svgzcorporate_bg_dark.svg togen_defaultd) logo_modebg_modebg_opacity_lightbg_opacity_dark tile_columnstile_side_padding)rZ corporate)rcflatrkcustom_backgrounds image/png image/jpegz image/webpz image/gif image/svg+xml)pngjpgjpegwebpgifsvgi)rYdashboard_images)rqrrrsrtrv )gridrc|dk(ry t|}t|cxkr tkr|Syy#ttf$rYywxYw)zDReturn "unlimited" or an int in [3, 9] for a valid input, else None. unlimitedN)rrrTILE_COLUMNS_MINTILE_COLUMNS_MAXvaluens r1_coerce_tile_columnsr4sQ  J10 001  z "s +==rSct t|}t|cxkr tkr|Syy#ttf$rYywxYw)zAReturn an int in [0, 40] for a valid percentage input, else None.N)rrrTILE_SIDE_PADDING_MINTILE_SIDE_PADDING_MAXrs r1_coerce_tile_side_paddingrGsF J:%::;  z " %77ct t|}t|cxkr tkr|Syy#ttf$rYywxYw)z@Return an int in [40, 100] for a valid opacity input, else None.N)rrrBRANDING_OPACITY_MINBRANDING_OPACITY_MAXrs r1_coerce_bg_opacityrVsF Jq8$889  z "rzhttps://docs.icastinc.comz docs.icastinc.com/shared (HTTPS)rrzhttps://fileshare.icastinc.comz%fileshare.icastinc.com/shared (HTTPS)zhttp://fileshare.icastinc.comz$fileshare.icastinc.com/shared (HTTP))project-buildertakeoff-bridgezprod-run-merger wor-admin sync-admin file-browserz simple-qrsingle-carrier-sheet mts-labelrvisionrrocr-toolrauditorbotsrvisitor-registry dashboardsr logisticsr>rrrrrrrr)search assistantrSearch AssistantCalendar)rrrrrzwor_type_visibility.jsonzwor_type_order.jsonzwor_primary.jsonzwor_approvers.jsonzwor_testers.jsonzwor_policy.jsonzwor_equipment.jsonztogen_fqdns.jsonzauditor_access.jsonzassistant.historyzassistant.failures)history.prodrun history.printhistory.wor-adminz history.rpmzhistory.single-carrier-sheetzhistory.mts-labelzhistory.file-browserzhistory.ocr-toolzhistory.takeoff-bridgezhistory.project-builderzhistory.sync-adminzhistory.togen-adminzhistory.vision-agentsz history.botszhistory.scada-reportingzhistory.signage-agentszhistory.dashboardszhistory.assetszhistory.datasources)policies.wor-admin policies.rpmpolicies.vision)diagnosis.timelinediagnosis.botsdiagnosis.visiondashboards.inspector)reporting.idenciareporting.powerbireporting.assets reporting.qcreporting.datasourcesreporting.viewreporting.viewerreporting.builderr)rhistorypolicies diagnosisr reportingrztool_access.json)rr qc.mixturesr qc.settingsqc.filebrowser)zqc.production.wet_castzqc.production.pipezqc.production.block)rlogistics.loadslogistics.resourceslogistics.settings)r assets.editassets.catalogassets.inventory assets.admin)rrrrzequipment.settings)rrrrc tjdDcgc]}d|z c}Scc}w#t$rttcYSwxYw)z`qc.production.` leaves for every segment (incl. inactive, so a grant for a deactivated segment still validates for historical viewing). Generated from the segment registry (DVI-1452 P1 D3).Tinclude_inactiveqc.production.)qc_store segment_idsryr_QC_PRODUCTION_FALLBACKrs r1r/r/sV-!--tDF!1$F FF -+,,-s. )..A A c6tttzSrT)r_QC_BASE_LEAVESr/rXr3r1_qc_access_leavesrs  #8#: ::r3ctjDcic]\}}|t|}}}t|d<|Scc}}w)zThe tool->capability-leaf tree with the dynamic qc.production. leaves folded into the qc group. Use this (not the static _TOOL_ACCESS_TREE) wherever dynamic correctness matters (self-heal, admin grant validation, tile-lighting).r)_TOOL_ACCESS_TREErrr)rrtrees r1_tool_access_treersB$5#:#:#< =41aAtAwJ =D ="$DJ K >sAcltjDchc] }|D]}| c}}Scc}}w)zFEvery known capability leaf, including per-segment qc.production..)rvalues)leavesrs r1_tool_access_allr's.-/668 I&& IQA IA II Is0ztool_access_groups.jsonz email-botWinstonzbot_visibility.jsonzbot_order.jsonzrpm_known_parts.jsonzrpm_settings.jsonzrpm_approval.jsonzrpm_tracking.json)rrzoversight_config.jsonoversight_planszoversight_editors.jsoni)rqrrrsrvlocation)zSouth Structure F - TrainingzEast Structure E - ShippingzEast Structure D - Break Roomz Northeast Building G - WarehousezNortheast Building H - Coringz Northeast Building J - Warehousez2Northeast Annex - Reinforcement and Styrofoam AreazSouth Hall - Precastz)North Building B - Pipe Equipment StoragezNorth Building A - Besser KilnszCenter High Bay - Pipe PlantzCurtain Hood - Hawkeye CuringzNorth Building C - Maintenancez*West Bay - Box Culvert and Specialty Plantzvisitor_registry.jsonzpersonnel.json)driverDriverzdashboards.jsonzdashboard_sources.jsonzsignage_agents.json signage_agentxctDcic]}|ddd }}tjr tjtj }tD]^}|j |}t|ts%t|j ddt|j ddd||<` |S|Scc}w#tjtf$rY|SwxYw)zReturn {toolbar_id: {"admins": bool, "users": bool}} for top-bar functions. Defaults to both enabled so existing behavior (Search/Assistant/Calendar shown to everyone) is preserved until an admin changes it (DVI-616). Tadminsusersrr) _TOOLBAR_IDSTOOLBAR_VISIBILITY_FILErrrrrrrrrr)rdefaultsrrows r1_load_toolbar_visibilityrs AMMt44MHM&&( JJ6@@BCE# iinc4("&swwx'>"?!%cgggt& visible to everyone; otherwise visible only to Togen Admins when "admins" is enabled. Trrr)rrr) toolbar_idis_adminvisrs r1_toolbar_enabled_forrsO  +)+C ''*= >C www .SWWX. //r3cDtDcic] }||tv }}tjrL t j tj }tD]}||vst||||< |S|Scc}w#tjtf$rY|SwxYw)zReturn dict of {tool_id: bool} for all manageable tools. Tools in ``_TOOL_DEFAULT_DISABLED`` start hidden so they stay invisible to non-admins until an admin explicitly enables them (DVI-569: Auditor). ) _ALL_TOOL_IDS_TOOL_DEFAULT_DISABLEDr1rrrrrrrrrrs r1_load_tool_visibilityrs CPP3S 666PHP##% JJ3==?@E$ 5%<$(s$4HSM 5 O8OQ$$g.   O sA=4B%BBBctjr tjtj }t |t rntg}}|D])}||vs|j||j|+tD])}||vs|j||j|+|S t tSt tS#tjtf$rYt tSwxYw)z6Return deduplicated list of tool IDs in display order.) TOOL_ORDER_FILErrrrrrrrrirrrrrdedupedrs r1rrs  JJ88:;E%& #rg ,C$ s+,),C$ s+,'  4 $$g.     sA C#1C%CDDci}tjr tjtj }t |t r|jD]\}}|tvst |t si}t|jddj}t|jddj}|r||d<|r||d<|s|||<|S|S#tjtf$rY|SwxYw)aReturn {tool_id: {"name": str, "description": str}} admin overrides for a tool's display name/description (DVI-588). Only known tool IDs are kept and blank values are dropped, so the client can safely fall back to its built-in defaults for anything not present here. r9r7r)TOOL_OVERRIDES_FILErrrrrrrrr*rrrr)rrrovrr9descs r1_load_tool_overridesrs C""$ JJ2<<>?E%&${{} )GC-/z"d7K Ervvfb1288:DrvvmR89??AD(,f /3m,#(C ) J3J$$g.   J sC C.#C..D  D c8tDcic]}|d}}tjrL tjtj }tD]}||vst ||||< |S|Scc}w#tjtf$rY|SwxYw)z9Return dict of {wor_type: bool} for each Work Order type.T) _WOR_TYPE_IDSWOR_TYPE_VISIBILITY_FILErrrrrrrrs r1_load_wor_type_visibilityrs%23cT 3H3'') JJ7AACDE$ 5%<$(s$4HSM 5 O8O4$$g.   O  A74A<A<<BBc tjr tjtj }t |t rwtg}}|D]2}|tvs ||vs|j||j|4tD])}||vs|j||j|+|S t tSt tS#tjtf$rYt tSwxYw)zAReturn deduplicated list of Work Order type IDs in display order.) WOR_TYPE_ORDER_FILErrrrrrrrrrirrrs r1rr%s""$ JJ2<<>?E%& #rg ,Cm+4 s+,),C$ s+,'  4 $$g.     $AC#'C#,1C#%C##D  D c8tDcic]}|d}}tjrL tjtj }tD]}||vst ||||< |S|Scc}w#tjtf$rY|SwxYw)zIReturn dict of {bot_id: bool} for each bot (admin Tools-Enabled submenu).T) _BOT_IDSBOT_VISIBILITY_FILErrrrrrrrs r1_load_bot_visibilityr:s%-.cT .H.""$ JJ2<<>?E 5%<$(s$4HSM 5 O8O/$$g.   O rc tjr tjtj }t |t rwtg}}|D]2}|tvs ||vs|j||j|4tD])}||vs|j||j|+|S t tSt tS#tjtf$rYt tSwxYw)z5Return deduplicated list of bot IDs in display order.) BOT_ORDER_FILErrrrrrrrrrirrrs r1_load_bot_orderrHs JJ~779:E%& #rg ,Ch3d? s+,$,C$ s+,' >4>$$g.   > rr'ch|xsi}t|jdxs|jdS)a]Preventative Maintenance is role-restricted (DVI-462). Only Work Order Admins and Togen Admins may see the PM tile or submit a PM work order. The ``togen_admin`` role already maps to both the iCast and the Voyage Technology Togen-Admin Azure groups (see ``_AZ_TENANT_CONFIG``), so those groups are covered by this single check. rrr,r-s r1_user_can_access_pmr]s/ :2D %@-)@ AAr3wor_typecz|dk(r t|S|jdrytj|dS)zEWhether *wor_type* is usable by *user*. Togen Admins bypass the gate.rrT)rrr)rr's r1_wor_type_enabled_forr is<<"4(( xx  $ & * *8T ::r3rcdtjdd|j}t|dz S)z:Return the JSON settings file path for a given user email.[^a-zA-Z0-9@._-]_.json)rFr\rEUSER_SETTINGS_DIR)rsafes r1_user_settings_pathrts, 66%sEKKM :D $u~ --r3ct|}|jr$ tj|j SiS#tj t f$rYiSwxYw)zCReturn per-user settings dict (tool_visibility, tool_order, theme).)rrrrrrr)rfps r1rrzsZ U #B zz| ::blln- - I$$g.   I s"AAArctjddt|}|jt j |d|j tjtjzy)z"Persist per-user settings to disk.TrMrrN) rmkdirrrrrchmodstatS_IRUSRS_IWUSR)rrrs r1_save_user_settingsrsOD48 U #BMM$**Xa01HHT\\DLL ()r3extchtjdd|j}t|d|z S)zJReturn the on-disk path for a user's custom background with the given ext.r r .)rFr\rE CUSTOM_BG_DIR)rrrs r1_custom_bg_pathrs0 66%sEKKM :D dV1SE? **r3ctjdd|j}tD]$}t|d|z }|j s"|cSy)zEReturn the user's existing custom-background file (any ext), or None.r r rN)rFr\rECUSTOM_BG_EXT_MIMESrr)rrrrs r1_find_custom_bgr"sQ 66%sEKKM :D" vQse_ , ::<I r3rrrr)new status_changerdue_soonoverdue evh_waitingc |jdxsi}i}tD]H}|j|xsitDcic]}|tfdt|D c}||<J|Scc}w)zADerive the friendly 3x5 grid (all-off default) from stored prefs.wo_notificationsc3RK|]}tj| ywrTr,).0ev type_prefss r1 z3_notification_grid_from_settings..sS"T*..,-Ss$')r_NOTIFY_GRID_TYPES_NOTIFY_GRID_COLUMNSany_NOTIFY_COLUMN_EVENTS)rstoredrzwtcolr.s @r1 _notification_grid_from_settingsr7s} \\, - 3F D  ZZ^)r ,  S8Mc8RSS S R K  s#A,rzci}tD]Q}|j|xsi}i}tD]'}|j|st|D]}d||< )|sM|||<S|S)zTranslate the friendly grid into the core module's event-keyed shape. Only enabled events are stored; all-off types are omitted entirely so the absence of an entry reads as "off" in the core resolver. T)r0rr1r3)rzrr5col_valseventsr6r-s r1_notification_grid_to_storager;s| C 88B<%2' &C||C /4&B!%F2J& & CG Jr3cJtt|}t||d<|S)zDLoad per-user settings plus the derived friendly notifications grid. notifications)rrr7)rrs r1_user_settings_with_gridr>s&'./H @ JH_ Or3ci}tjr: tjtj }t |t r|}i}tD]I}|j|}t |tr!|Dcgc]}t |ts|c}ng||<K|S#tjtf$rYqwxYwcc}w)zEReturn Primary email lists keyed by WO type, normalised to all types.) WOR_PRIMARY_FILErrrrrrrrr0rrr*)rrrr5emailses r1_load_wor_primaryrCs D! **-779:C#t$ C `"?I&RV?Wf; 1c(:1;]_B` J $$g.    <9B'CC'CCrczi}tD]}tg}}|j|xsgD][}t|ts|j j }|s5||vs:|j||j|]|||<tjtj|dy)z@Persist Primary lists, de-duplicated and lowercased per WO type.rrN) r0rrrr*rrErrir@rrr)rcleanr5rorderedrBnorms r1_save_wor_primaryrIs E rg((2,$" %Aa%779??$DD(t$  %b   5 ;rDczi}tD]}tg}}|j|xsgD][}t|ts|j j }|s5||vs:|j||j|]|||<tjtj|dy)zDPersist approver lists, de-duplicated and lowercased per department.rrN) rOrrrr*rrErrirNrrr)rrFrPrrGrBrHs r1_save_wor_approversrS* s E rg((4.&B %Aa%779??$DD(t$  %d  !!$**U1"=>r3ctjr tjtj }t |t rL|Dcgc]@}t |tr.|jr|jjBc}S gSgScc}w#tjtf$rYgSwxYw)z9Return the list of authorized-tester emails (lowercased).) WOR_TESTERS_FILErrrrrrr*rrErrrrBs r1_load_wor_testersrW= s! **-779:C#t$36=a%a-!'') )==% I2I =$$g.   I $;B#ABB#B##C?CrAc:tg}}|xsgD][}t|ts|jj }|s5||vs:|j ||j |]tjtj|d|S)zNPersist the tester list, de-duplicated and lowercased. Returns the saved list.rr) rrr*rrErrirUrrrrArrGrBrHs r1_save_wor_testersr[J sE2'Dl!!S! wwy  D$ HHTN NN4 ! 71 => Nr3cX|sy|jjtvS)zHTrue if the email is on the Authorized Testers list (per-request check).F)rrErWrs r1_is_authorized_testerr^X s&  ;;=   $5$7 77r3ch|xsi}|jdryt|jddS)u'Whether a user may CREATE and VIEW test WOs (DVI-1082). Togen Admins always qualify; other users qualify only if their email is on the Authorized Testers list. This is the single gate for test-WO create and visibility — never trust a client-supplied ``test`` flag without it. rTrr7)rr^r-s r1 _wor_can_testr`_ s2 :2D xx  '2!6 77r3ctjjddvxs!tjjddv}t |xr t |S)zTrue when the current request asks for a test WO AND the user is authorized. Fails closed: an unauthorized user who forges ``test=1`` gets a normal production WO, never a test one. testrEtrueonyes)rformrargsrr`)r'flags r1_wor_test_requestedrjl sS <<  F #'A A B <<  F #'A A : ----r3required_deptscdt}|Dcgc]}|j|r|c}Scc}w)zIReturn departments in required_depts that have zero authorised approvers.)rQr)rk approversds r1_wor_approvers_missing_deptsrow s)#%I% >!Y]]1-=A >> >s-- user_emailc |sgSt}|j|jDcgc]\}}tfd|xsgDr|!c}}Scc}}w)zTReturn departments the user is authorized to approve (case-insensitive email match).c3DK|]}|jk(ywrTrE)r,rBemail_lcs r1r/z+_wor_user_approver_depts.. sAQ1779(A )rQrErr2)rprmrPrArts @r1_wor_user_approver_deptsrv} sa  #%I!H%.__%6 C\T6A6s9D/ D4=D4D10D1cji}|xsijD]\}}t|trt|ts'|j j }|sHt g}}|jdxsgD]2}|tvs ||vs|j||j|4|s||jdxs#tjjd|jdxsdd||<tjt!j"|dy ) zPersist the access map, lower-casing emails, de-duping + validating keys. Users whose grant list is empty are dropped (revoking every resource removes Auditor visibility entirely).rxry%Y-%m-%dT%H:%M:%SZrzr7r{rrN)rrr*rrrErrr}rri_datetime_typeutcnowstrftimer|rrr)rrFrr~rHrrrs r1_save_auditor_accessr s Ezr((* s%%ZT-B {{}""$ E2c''+&," A**q}  1    +e~/D/D/F/O/OPd/e +1r d  $""4::eA#>?r3c|s tStj|jj }|rt|jdgStS)z?Granted Auditor resource-key set for a user (case-insensitive).rx)rrrrrErr~s r1_auditor_access_forr sM u  $ $U[[]%8%8%: ;C,/3sww{B' (:SU:r3c|r |jdrttSt|xsijddS)uJFull granted set for a session user — admins implicitly hold everything.rrr7)rrr}rr-s r1_auditor_effective_resourcesr s8 ')**  //< ==r3ci}tjr: tjtj }t |t r|}i}t}|jD]\}}t |trt |t s'|jd}t |tr|Dcgc] }||vs| c}ng}t|}||jdxsd|jdxsdd||jj!<|S#tjtf$rYwxYwcc}w)uReturn {email(lower): {resources:[...], added_at, added_by}} for per-user tool grants (DVI-1373). Clone of _load_auditor_access — unknown resource keys are dropped so the store self-heals if the tree shrinks in a later release.rxryr7rzr{)TOOL_ACCESS_FILErrrrrrrrrrr*rr_tool_access_migrate_leavesrrE)rrr all_leavesrr~rrs r1_load_tool_accessr s# D! **-779:C#t$ C!#Jjjl  s%%ZT-B ggk"5?T5J#1Qjq1PR)#. +1r +1r& EKKM   !"   J$$g.   2s9D&9 EE&EEc t|tjD]e\}}|vr tj |gDcgc] }||k7s | }}t fd|DrI|D]}|vsj |gScc}w)uBehavior-preserving upgrade of a Phase-1 grant (DVI-1373 P2). A grant that holds a base leaf (e.g. `qc`) but none of its split sibling leaves is a legacy grant from before the capability split — fold in the implied leaves (e.g. `qc.reports`) so those users keep the access they had. Idempotent: once any sibling leaf is present the grant is considered intentional and left alone.c3&K|]}|v ywrTrX)r,rrs r1r/z._tool_access_migrate_leaves.. s*AqCx*)r_TOOL_ACCESS_MIGRATErrrr2ri)rbaseimpliedrsiblingsrs @r1rr s s)C-335 g s? 044T2>L!!t)ALL ** *  A| 1    J Ms  B B cvi}t}|xsijD]\}}t|trt|ts'|j j }|sHtg}}|jdxsgD].}||vs||vs |j||j|0|s||jdxs#tjjd|jdxsdd||<tjt!j"|dy ) zPersist the tool-access map, lower-casing emails, de-duping + validating keys. Users whose grant list is empty are dropped (revoking every capability removes the row entirely).rxryrrzr7r{rrN)rrrr*rrrErrrrirrrrrrr) rrFrrr~rHrrrs r1_save_tool_accessr s E!#Jzr((* s%%ZT-B {{}""$ E2c''+&," AJ1D=  1    +e~/D/D/F/O/OPd/e +1r d  $ 5 ;Granted tool-capability key set for a user (case-insensitive).rx)rrrrrErs r1_tool_access_forr sM u   ! !%++-"5"5"7 8C,/3sww{B' (:SU:r3zuser_directory.jsonc>i}tjr: tjtj }t |t r|}i}|jD]\}}t |trt |t s'|jdxsd|jdxsd|jdxsd|jdxsdd||jj<|S#tjtf$rYwxYw)zCReturn {email(lower): {name, given_name, family_name, last_login}}.r9r7 given_name family_name last_loginr9rrr)USER_DIRECTORY_FILErrrrrrrrrr*rrrE)rrrrr~s r1_load_user_directoryr- s D""$ **0::<=C#t$ Cjjl s%%ZT-B GGFO)r'',/5277=17R'',/52 & EKKM   !"  J$$g.   s9DDDc|xsdjj}|rd|vryt}|xsdj|xsdj|xsdjtjj dd||<t jtj|dy)zBest-effort upsert of one user's display-name snapshot (DVI-1432 D1-A). Callers wrap this in try/except so a write failure never blocks login.r7@Nrrrr) rrErrrrrrrr)rr9rr directorys r1_record_user_directoryrD s[b   ! ' ' )E Cu$$&I""$!'R..0#)r002$++-667KL Ie ""4::i#BCr3ci}tjr: tjtj }t |t r|}i}t}|jD]\}}t |trt |t s'|jd}t |tr|Dcgc] }||vs| c}ng}|jdxsd||jdxsd|jdxsdd||jj<|S#tjtf$rYwxYwcc}w)u Return {group_id(lower): {name, resources:[...], added_at, added_by}} for Azure AD group-backed tool grants (DVI-1373 P3). Same self-heal as _load_tool_access — unknown resource keys are dropped so the store heals if the tree shrinks in a later release.rxr9r7ryrzr9rxryrz)TOOL_ACCESS_GROUPS_FILErrrrrrrrrrr*rrrrE)rrrrgidr~rrs r1_load_tool_access_groupsrT s) D&&( **4>>@AC#t$ C!#JJJL  S#s#:c4+@ ggk"5?T5J#1Qjq1PRGGFO)r +1r +1r $ CIIK      J$$g.   2s9D/9 EE/E  E ci}t}|xsijD]\}}t|trt|ts(|j j }|sItg}}|jdxsgD].}||vs||vs |j||j|0|s|jdxsd||jdxs#tjjd|jdxsdd||<tjt!j"|d y ) zPersist the group->capability map, lower-casing group ids, de-duping + validating keys. Groups whose grant list is empty are dropped (revoking every capability removes the mapping entirely).rxr9r7ryrrzrrrN)rrrr*rrrErrrrirrrrrrr) rrFrrr~rHrrrs r1_save_tool_access_groupsrq s$ E!#JZR&&( S#s#:c4+@ yy{  " E2c''+&," AJ1D=  1   GGFO)r +e~/D/D/F/O/OPd/e +1r  d  &&&tzz%'BCr3c|xsijdxsg}|s tSt}|s tS|Dchc],}|st|j j .}}t}|j D]+\}}||vs |j|jdg-|Scc}w)a+Capability leaves granted to a user via their Azure AD group membership (DVI-1373 P3). Unions the leaves of every mapped group present in the user's login-snapshotted group set (session["user"]["az_groups"]). Returns an empty set when the user has no snapshot or no mapped group matches. az_groupsrx)rrrr*rrErr)r'rrrhaverrr~s r1_tool_access_group_resourcesr s jb  k * 0bF u &(G u ,2 8qaCFLLN " 8D 8 %CMMO1S $; JJsww{B/ 01 J 9s B=)B=c|r|jdr tSt|xsijddt|xsizS)uFull granted tool-capability set for a session user — admins implicitly hold every capability; otherwise the UNION of the email-allowlist grant and any Azure AD group-backed grants (DVI-1373 P3).rrr7)rrrrr-s r1r#r# sJ '!! djb--gr: ;*4:26 78r3) operationsrr sidecar_datac|xsi}t|jdd}|jdxstDcic]}|dc}}d}d}|jdxsdj}|rmt |}t } | j|} | rEt| jdd}|r(| jdxstDcic]}|dc}}|r+|r)dtDcgc]}|j|ds|c}fS|r)dtDcgc]}|j|ds|c}fSdgfScc}wcc}wcc}wcc}w)a.Return (rts_required: bool, required_depts: list) for a WO sidecar. Merges WO-level rts_required/rts_departments (from the request form, P3) with the equipment-level setting from wor_equipment.json. Equipment-level wins if it forces rts_required=True; WO-level can only opt in on top. rts_requiredFrts_departmentsTNrr7)rrrOr_normalize_equipment_load_wor_equipment) rsdwo_rtsrnwo_deptseq_rtseq_depts raw_equipr)registryrecords r1_wor_effective_rtsr s:  B "&&/ 0Fvv'(Ij,IQW,IH FH $*113I"9-&(c" &**^U;1HCTQU U  % AI~s  1BqAMBIB  q\F Xx%abM?qQh->?I? ! >3J ?Y8VC @sA D1D1* D74D7( D<3D<8D< E*E EEc|jdxsg}|jdxsi}|jDchc] \}}|xsijddk(s|"c}}t|xrtfd|DScc}}w)z8Return True when all required departments have approved.rkrrrc3&K|]}|v ywrTrX)r,rnrs r1r/z#_evh_is_complete.. s!BA!x-!Br)rrrall)rrrrnrrs @r1_evh_is_completer syww'(.BH $*I'oo/XdaAG==3Ji3WXH > Bc!B!BBBYs B  B cg}|xsi}|jdxsdj}|r|j||jd|jdfD]D}|xsijD]+}|xsijd}|s|j|-Ft }|jdxsgD]*} |j| gD]}|j|,|S)uJCollect every email involved in an EVH approval. Guarantees EVH finalized/rejected mail reaches the WO submitter, every approver who has signed off (including a cleared rejection set), and all currently-configured approvers for the required departments — independent of the notification grid/policy config. rr7r_rejected_sign_offsapprover_emailrk)rrrirrQ) rrrAr submitterrbsoaddrrmrPs r1_evh_participant_emailsr sF  B&B--/I i ''+&0E(FG$;B&&( $BH">>"23D d# $$ $%I)*0b MM$+ D MM$    Mr3rrrrc*tjS)uReturn equipment registry keyed by normalized asset_id. DVI-1472 P2: the registry merged into assets.db, so this is now a thin compatibility shim over assets_store.load_equipment_registry() — every legacy consumer (RtS/EVH, WO history, Manuals index, Oversight equipment + lorawan_mobile, Makdash counts, mm-eas-options) keeps its {norm_name: record} view unchanged. The old wor_equipment.json is frozen on disk as a rollback archive after the one-time migration (see _migrate_equipment_registry_once).) assets_storeload_equipment_registryrXr3r1rr, s  / / 11r3rc.tj|y)zDVI-1472 P2 shim: upsert the {norm_name: record} registry back into assets.db (auto-seeds an asset + alias for an unknown equipment name).N)rsave_equipment_registryrs r1_save_wor_equipmentr9 s((2r3r9 created_atc t||j|xs#tjj ddt Dcic]}|dc}dddddd Scc}w)z8Build a new equipment registry record with RtS defaults.%Y-%m-%dT%H:%M:%SFTr7) asset_idr9rrrinclude_in_oversightoversight_dev_euiasset_noout_of_serviceoffsite)rrrnowrrO)r9rrns r1_make_equipment_recordr? sg).  VN$6$6$8$A$ABU$V-78AtG8 %    9s A ct}d}tD]}|js|jdD]} t j |j }t|ts8|jdxsdj}|s^t|}|sl||vsqt|||<d}|r t|yy#tjtf$rYwxYw)a9Ensure every equipment name seen in WO sidecars exists in the registry. Scans all WO type directories for sidecars with a non-empty `equipment` field and inserts any unknown names (keyed by normalized asset_id) without overwriting existing records. Safe to call on every GET /equipment/registry. F*.jsonrr7TN)r_wor_type_dirsis_dirglobrrrrrrrrrrrr)rchangedrsidecarrrr)s r1_seed_equipment_registryrS s#$HG#% !  ~~h/ G zz'"3"3"56dD)88K(.B557C&s+Cs(* 6s ;  "H%(('2  s#CC,+C,rc g}gd}|D]}t|jD]\}}|js|jdD]} t j |j }t|ts9|jdxsdj}t||k7rk|jdj} d} |jd} | j!rz'_equipment_wo_history.. s qyr3Tr)reverse)_wor_dest_dirsrrrrrrrrrrrrr with_suffixr9rrutcfromtimestamprst_mtimer_wor_display_titlerrorisort)rmatchesrrrdrrrrpdf_name mtime_strpdf_pathrr actionables r1_equipment_wo_historyrq s?GHI)&"0!9!?!?!A& & FI##%$>>(3# &::g&7&7&9:D"$-xx ,299;',8"..v6;; "..v6##% . ? ? 00!h34!)/(DI ($% hhv&!6s!;J*-''(*;E,'4>E0125'':J2KE./25'':JB2OE./-0WW["-EE/*7ST^7_E34'*wwy'9E)$/2ww7R/SE+,u%G# && &)&T LL($L7 NE,,g6s#H""H? >H? ci}tjr: tjtj }t |t r|}td|iS#tjtf$rY(wxYw)zGReturn the friendly Policy grid (all-off default) from wor_policy.json.r*) WOR_POLICY_FILErrrrrrrrr7)r4rs r1_load_wor_policy_gridr sp F  **_6689C#t$ ,-?,H II$$g.   s9AA:9A:cjtjtjt |dy)zAPersist the friendly Policy grid in the core's event-keyed shape.rrN)rrrrr;rzs r1_save_wor_policy_gridr s% 06qACr3cptjr"tjjSy)z!Return the public version string.Unknown)PUBLIC_VERSION_FILErrrrXr3r1_load_public_versionr! s)""$",,.4466 r3uTogen is iCast's integrated tools platform for bridging material quantity estimation to production. From take-off data to QR-coded labels, work orders, SCADA monitoring, document sync and preview, and daily production runs — Togen pulls it forward. Why “togen”: Togen is the past participle of the Old English verb “tēon,” which means to draw or pull. The term ‘togen’ in Old English literature is often associated with the concept of ‘fate’ or ‘destiny’, reflecting the beliefs of the Anglo-Saxon culture regarding the inevitability of certain events. Or its short for TOol GENerator. Built as a platform to build and access tools, chain them into workflows, and impact operations.ctjr. tj}|jr|S t St S#t$rYt SwxYw)z0Return the editable About popup text (Markdown).)ABOUT_CONTENT_FILErrrrDEFAULT_ABOUT_MARKDOWNtexts r1_load_about_contentr' s\!!# %//1Dzz|  "! !!   !! s%A AAc.tj|yrT)r#rr%s r1_save_about_contentr) s!!$'r3zPull it Forwardctt}}tjr t j tj }t|trt|jdtr&|djr|dj}t|jdtr&|djr|dj}||dS#tjtf$rY wxYw)zCReturn the editable header title/tagline, falling back to defaults.retaglinerer+)DEFAULT_SITE_TITLEDEFAULT_SITE_TAGLINESITE_TEXT_SETTINGS_FILErrrrrrrr*rrr)rer+rs r1_load_site_textr0 s')=7E&&( JJ6@@BCE%&eii0#65>;O;O;Q!'N002Eeii 2C8U9=M=S=S=U#I.446Gw //$$g.   sCC((DDc^tjtj||ddy)Nr,rr)r/rrrr,s r1_save_site_textr2 s#&& Uw7Br3zrclone-bisync.servicec~ tjddtgddd}|jdk(S#t$rYnwxYwt j rj tjt j}t|trd|vrt|dSy#tjtf$rYywxYwy)zReturn the real run-state of the rclone bisync service. Queries systemctl first; falls back to the persisted desired-state file when systemctl is unavailable (dev environment, insufficient permissions, etc.). systemctlz is-activeTrcapture_outputr&timeoutrrunning) subprocessrun _BISYNC_UNIT returncoderySYNC_SERVICE_STATE_FILErrrrrrrrr)resultrs r1_load_sync_service_runningr? s   +| 4dA    A%%    &&( ::5??ABD$%)t*;DO,, $$g.     s.1 ==ABB;:B;cntjtjdt |idy)Nr8rr)r=rrrrr8s r1_save_sync_service_runningrB' s%&&tzz9d7m2LUV'WXr3ixctjttd}tj|_|j d|jd|S)z@Open backup.db, creating schema on first use. Caller must close.Fcheck_same_threadPRAGMA journal_mode=WALa CREATE TABLE IF NOT EXISTS runs ( id TEXT PRIMARY KEY, started_at REAL NOT NULL, finished_at REAL, status TEXT NOT NULL DEFAULT 'running', exit_code INTEGER, duration_s REAL, log_text TEXT ); CREATE INDEX IF NOT EXISTS idx_backup_runs_started ON runs (started_at DESC); )sqlite3connectr*BACKUP_DB_PATHRow row_factoryexecute executescriptconns r1 _backup_dbrP3 sJ ??3~.% HD{{DLL*+    Kr3c ddl}ddl}|jj}|j}t }|j d||f|j |j dtdtd}ddd d d |ttd td tg}tj|ddd}|j}|j xsd|j"xsdz} |j$dk(rdnd} t }|j d|| |j$||z | |f|j |jy#t&$rf} |j}t }|j d|||z t)| |f|j |jYd} ~ yd} ~ wwxYw)zAExecute rsync backup; updates backup.db. Runs in a daemon thread.rNzBINSERT INTO runs (id, started_at, status) VALUES (?, ?, 'running')zssh -p z -i z5 -o StrictHostKeyChecking=accept-new -o BatchMode=yesrsyncz-azz--deletez--statsz-er:T r5r7okfailedzYUPDATE runs SET finished_at=?, status=?, exit_code=?, duration_s=?, log_text=? WHERE id=?zaUPDATE runs SET finished_at=?, status='failed', exit_code=-1, duration_s=?, log_text=? WHERE id=?)uuidrUuuid4hexrPrLcommitclose_BACKUP_RSYNC_PORT_BACKUP_RSYNC_KEY_BACKUP_RSYNC_SRC_BACKUP_RSYNC_USER_BACKUP_RSYNC_HOST_BACKUP_RSYNC_DESTr9r:stdoutstderrr<ryr*) _uuid_timerun_idstartedrOssh_cmdcmdr>finishedlogrdexcs r1_backup_run_threadrmG s [[]  FjjlG  ? ORDER BY started_at DESC LIMIT 1z{SELECT id, started_at, finished_at, status, duration_s FROM runs WHERE status != 'running' ORDER BY started_at DESC LIMIT 1r8)statelast_run started_at finished_atrdidle) rUrPrL_BACKUP_STALE_SECONDSfetchoner[rrry)rerrOactive last_donelrs r1_backup_get_statusryy s **,C | 0 ( ( *  (*  LL 0  (*  &D9 9 iB"2l#34B|  #B}$5$: ; CtB} \r: :  ..    sA'C>>C CC02:00rr^rrPrrrAmerica/Chicagoenabled frequencyrUdaysrlast_fired_datectddlm} ||jdxsdS#t$r |dcYSwxYw)zGReturn a ZoneInfo for the schedule, defaulting to US Central (CST/CDT).rZoneInforr|)zoneinforrry)schedrs r1_backup_schedule_tzr s?!+ *-B1BCC +)**+s #77c<tt} tjrHt j tj }t|tr|j||S#t$r#tjjdY|SwxYw)z;Return the persisted backup schedule, merged over defaults.zFailed to read backup schedule) r_BACKUP_SCHEDULE_DEFAULTBACKUP_SCHEDULE_FILErrrrrrryrmrn exception)rrs r1_load_backup_scheduler s| ) *E?  ' ' )::2<<>?D$% T" L ? => L?sAA//(BBc tjtj|dy#t$r"t j jdYywxYw)NrrzFailed to write backup schedule)rrrrrrmrnrrs r1_save_backup_scheduler E@'' 5(CD @ >?@*-(AAc t|jddjddd\}}t|t|}}d|cxkrdkrny d|cxkrdkrny ||fSy #t$rYy wxYw) zAParse the schedule time into (hour, minute), defaulting to 02:00.rUrzrSNrrrr)rr)r*rsplitrry)rhhmms r1_backup_schedule_hmr s UYYvw/066s;BQ?BR#b'B . svr):r3Tr ) NEWS_FILErrrrrrrrrpostss r1_load_news_postsr s~ JJy2245E%& :D I ' I2I$$g.   I sA A((BBcXtjtj|dyr)rrrrrs r1_save_news_postsr s E!45r3ctjr= tjtj }t |t r|S gSgS#tjtf$rYgSwxYw)z*Return list of subscriber email addresses.) SUBSCRIBERS_FILErrrrrrrrrs r1_load_subscribersr sn! ::.88:;D$% & I2I$$g.   I 8AA10A1cXtjtj|dyr)rrrrrs r1_save_subscribersr s 4 :;r3c&tjrT tjtj }t |t r|jdr|dStStS#tjtf$rYtSwxYw)z/Return the configured shared URL prefix string.prefix) SHARED_URL_PREFIX_FILErrrrrrrrrDEFAULT_SHARED_URL_PREFIXrs r1_load_shared_url_prefixr" s}%%' ::4>>@AD$%$((8*<H~% %$ $$$$g.   $$ sA A//BBc\tjtjd|idy)Nrrr)rrrrrs r1_save_shared_url_prefixr. s %%djj(F1CA&NOr3cdj|xsdjjjS)zJCase/whitespace-insensitive key for matching Equipment/Asset/System names.r\r7)joinrrErr9s r1rr4 s0 88TZR&&(..0668 99r3stored_filenamec$t}|d|S)z-Document Viewer URL for a stored manual file.z /wor/manuals/r)rrs r1_manual_viewer_urlr9 s $ &FX]?"3 44r3ctjr= tjtj }t |t r|S iSiS#tjtf$rYiSwxYw)z@Return the {normalized-equipment: manual-entry} association map.) WOR_MANUALS_INDEX_FILErrrrrrrrrs r1_load_manuals_indexr? sn%%' ::4>>@AD$% & I2I$$g.   I rindexcXtjtj|dyr)rrrrrs r1_save_manuals_indexrK s%%djjq&ABr3 original_namec t|}|syt}|||xsdjt|t j j d|xsijddd||<t|y)zFAssociate a manual with an equipment name so future WORs can reuse it.Nr7rr9rrrrJ updated_at updated_by) rrrrrrrrr)rrrr'r)rs r1_manuals_index_setrO sy y )C   !E#&o2,,.!/2$((*334GHzr&&vr2 E#Jr3c g}tjD]}|jd}|rt|z j s.|j ||jd||jddt ||jdd|jddd|jdd |S) zReturn every manual in the association index whose file still exists. Covers both standalone uploads (Equipment Manuals tool) and manuals attached to Preventative Maintenance work orders, since both paths write the same index. rrrr7rrrc&|jddS)Nrr7rrs r1r z#_list_all_manuals..s sQUU<4r3Tr )rrrWOR_MANUALS_DIRrrirr)rrfns r1_list_all_manualsr` s E$&--/   YYz "/B.779  "YY;;3%b)))L"5))L"5     JJ4dJC Lr3ct|}|sytj|}|r|jdsyt|dz j syt |}t |d|d<|S)zMReturn the manual entry previously associated with an equipment name, if any.NrrJ)rrrrrrr)rr)rs r1_manuals_index_lookuprw sp y )C   ! % %c *E  *- eJ/ / 8 8 : KE%eJ&78E%L Lr3c.idtddffd }tdD]v}|js|jdD]O} t j |j }t|ts8||jddQxtjD]+}t|ts||jdd-tjd S#tjtf$rYwxYw) a}Distinct Equipment/Asset/System names known to the system (DVI-590). Gathers EAS values from every Preventative Maintenance work order sidecar (any status) plus the device-manual association index, so the WOR form can offer them as type-ahead suggestions. Deduplicated case-insensitively, preserving the first-seen display spelling, and sorted alphabetically. rr$Ncd|xsdj}|syt|}|r |vr||<yyyNr7)rr)rr9r)rs r1_addz%_collect_pm_eas_options.._add s> r  " "4( 3d?DI#3r3rrrr7c"|jSrTrsrs r1r z)_collect_pm_eas_options.. s qwwyr3r))r*rrrrrrrrrrrrrsorted)rrrrrrs @r1_collect_pm_eas_optionsr sD#$$L1 0 !  ~~h/ 0G zz'"3"3"56$%TXXk2./  0 0%&--/- eT " ;+ ,- $++-%8 99(('2  s#C88DDctjjd}|r#|jrtj j |jdj}|tvr%djtt}dd|fStjddt|jxsd|z}tjj!dd |}|j#t%t|z t'|||j|||jt)|d dfStj*jd d j-}|rud |vsd|vsd|vryt|z j/rQtj*jdd j-xs|}t'||||||t)|d dfSy)a}Resolve the manual for a PM submission from the request. Returns (manual_dict | None, error_message | None). A newly uploaded file (request.files['manual']) takes precedence and is saved + indexed; otherwise an existing manual referenced via the 'manual_existing' form field is reused (and re-associated with the current equipment). No manual -> (None, None). manualr^, N'Unsupported manual file type. Allowed: TrM %Y%m%d_%H%M%Sr )rrrJmanual_existingr7r6\..)NInvalid manual referencemanual_existing_nameNN)rfilesrrosrbsplitextrEALLOWED_MANUAL_EXTSrrrrrrrrsaver*rrrgrr) rr'frrrr4existingoriginals r1_pm_process_manualr s  (#AQZZggqzz*1-335 ) )ii': ;x#~"&&(11/BC1TFK s?V+,-9fajj$?"QZZ)&13489 9|| 126<<>H (?dh.$(2B3 h & / / 1||''(>CIIKWxH y(Hd C (8-h79:>? ? r3ctjr= tjtj }t |t r|S iSiS#tjtf$rYiSwxYw)z@Return the {stored-filename: {text, pages, ...}} OCR text index.) WOR_MANUALS_TEXT_INDEX_FILErrrrrrrrrs r1_load_manuals_text_indexr  sn"**, ::9CCEFD$% & I2I$$g.   I rcXtjtj|dyr)rrrrrs r1_save_manuals_text_indexr  s**4::eA+FGr3r&cg}d}t|jdD]2\}}|}|t|z}|j|dz||d|dz}4|S)zPer-page [start, end) character offsets from the OCRmyPDF sidecar text. OCRmyPDF separates pages with a form feed (\f); each page's slice lets the search route map a hit's character offset back to a 1-based page number. r r^)numberrqend) enumeraterrCri)r&pagesposipartrqrs r1_manuals_page_offsetsr sh E CTZZ-.4CIo AcBCAg  Lr3ct}|||t|tjj dd||<t |y)Nr)rrr&r indexed_at)r rrrrr )rr&rrs r1_manuals_text_index_setr sI $ &E#&&t,$((*334GH E/U#r3c6 t|z }|jr|jjdk7ry ddlm}m}m}|jd}|jd} ||||}tjt|t||jd t||j |y#t$rYywxYw#|$rYyt$r'|jd |jd YywxYw#t$rYywxYw) aBackground pass: replace a stored PDF manual with its searchable version and record the recognized text in the manuals text index. Only PDFs are processed (the only thing OCRmyPDF can turn into a searchable PDF in place without changing the stored filename the association index keys on). Non-PDF manuals are left untouched and unindexed. Engine-unavailable and OCR errors are swallowed so an upload never fails on a best-effort index pass. rNr)ocr_pdfOcrEngineUnavailable SKIP_TEXTz .ocrtmp.pdf.txtrOT missing_ok)rrsuffixrE ocr_enginerrr ImportErrorr ryr/rrr*rr&) rrsrcrrrtmp_outrr>s r1_run_manual_ocrr& s/{{} 0 0 2f <   K K//-0%%f- S' :F 3w<S*$'mL    $    NNdN + NNdN +   se6D C"D ' C2AD  C D CD D D ,D D D  D DDc\tjt||fdjy)zDStart a daemon thread to OCR + index a freshly uploaded manual (D3).TrrhrN)rrr&rq)rrs r1_enqueue_manual_ocrr)s' } - egr3c ttj}tj syi}t j D]+}|jd}|s|jd|||<-tjdD]/}|j}||vrt||j||1y#t$rYywxYw)zOne-time idempotent pass: OCR + index any existing PDF manual not yet in the text index. Runs in a daemon thread at startup so it never blocks boot.Nrr*.pdf) rr keysrrrrrrr9r&ry)indexednamesrrrbs r1_backfill_manuals_ocrr/(s.05578%%' (*113 ;E:&B!IIor:b  ;$((1 3DBW} B "b 1 2  3 s5C0C)AC CC>bmprurrrqrsrtct|dzz S)Nr)WOR_MANUALS_THUMBS_DIR)rs r1_manual_thumb_pathr3Js !_v%= >>r3r$thumbc tjdd|dk(rddl}ddl}|j t |} |j dkr |jy|jd}tt|jj|jjdz }|j|j||}t!j|j"|j%dj'd } |jn7|t(vr.t!jt |j'd } ny| j+ttf|j-d } | j/t | d d t1j2t | t ||S#|jwxYw#t4$rYywxYw)aRender a small JPEG thumbnail for one manual. Returns the path or None. Writes atomically (temp + replace) so a concurrent reader never sees a partial file. Best-effort: any renderer/IO error yields None so the grid falls back to client-side rendering. TrMpdfrNr^matrixrqRGBz.tmp.jpgJPEGRr)r2rfitzioopenr* page_countr[ load_pageMANUAL_THUMB_MAX_PXmaxrectwidthheight get_pixmapMatrix _pil_imageBytesIOtobytesconvert_MANUAL_THUMB_IMAGE_EXTS thumbnailr rrrry) r$rr4r=r>rpagezoompiximgtmps r1_generate_manual_thumbrTNs|$$TD$A %<  ))CH%C >>A%  }}Q'*S$))BRBRTU-VVooT[[t-DoE oojbjjU1C&DEMMeT , ,//#c(+33E:C *,?@A + S62. 3s8SZ(   s>?G%GG%#B2GAG%A2G%G""G%% G10G1cft|z }|jsyt|} |jr7|jj|jjk\r|S|j jjd}t|||S#t $rYAwxYw)zReturn a cached thumbnail path for a manual, regenerating on staleness. The cache is keyed by stored filename and invalidated by source mtime, so a manual replaced in place (e.g. by the OCR pass) re-renders on next request. Nr) rrr3rrrr!rElstriprT)rr$r4rs r1_ensure_manual_thumbrWqs O +C ;;=  /E ==?uzz|44 8K8KKL **    # #C (C !#sE 22    sAB$$ B0/B0c: tjsytjD]_}|js|jj j d}|dk(s |tvsKt|jay#t$rYywxYw)zPre-cache Grid-view thumbnails for every manual on disk (DVI-585). Runs in a daemon thread at startup so the first Grid-view load is served from cache instead of rendering each manual on demand. Best-effort.Nrr6) rriterdirrr!rErVrMrWr9ry)rbrs r1_backfill_manual_thumbsrZs %%' #++- 0D<<>++##%,,S1Ce|s&>>$TYY/  0 sBAB6B BBctt}tjr t j tj }t|tr|jdtvr|d|d<|jdtvr|d|d<t|jd}dD].}t|j|}|||vr||}|*|||<0t|jd}|||d<t|jd}|||d<|S|S#tjtf$rY|SwxYw)z9Return branding settings, falling back to Togen defaults.rerf bg_opacityrgrhrirj)rDEFAULT_BRANDING_SETTINGSBRANDING_SETTINGS_FILErrrrrrBRANDING_LOGO_MODESBRANDING_BG_MODESrrrrr)rrlegacyr)opacityrirjs r1_load_branding_settingsrdsW-.H%%' JJ5??ABE%&99[)-@@,1+,>H[)99Y'+<<*/ *:HY',EIIl,CDB0C03@G3e+;@R"(*(/ 0 4EIIn4MN +/;H^,$=eiiH[>\$]!$04EH01 O8O$$g.   O sB:D.!A D..E  E cXtjtj|dyr)r_rrrrs r1_save_branding_settingsrgs%%djj!&DEr3c t}|dS)zJReturn the base URL for QR-linked files: shared URL prefix + /shared path.z/sharedrrs r1r+r+s $ &FXW r3z$^[a-zA-Z0-9][a-zA-Z0-9 _\-\.]{0,79}$zwor_counter.json file_pathct|j}ttj|vryttj|vryttj|vryy)z,Detect wor_type from the resolved file path.rrrr)r*r,WOR_MOBILEMACHINE_DIRWOR_SAFETY_DIRWOR_PREVENTIVE_DIR)rirs r1_detect_wor_typernse I    A ( ( *+q0 > ! ! #$)  % % '(A- r3rbc|rt|z }||dz |dz |dz dS|dk(rttttdS|dk(rt t ttdS|dk(rttttdStttt dS)akReturn status->directory mapping for a WOR type. When ``test`` is set, the mapping points at the segregated ``_test`` subtree (DVI-1082) instead of the production tree. The layout mirrors production (new = the type root, plus in_progress/completed/cancelled subdirs) so the existing status-move plumbing works unchanged inside the test tree. rrrr$rrrrrr) WOR_TEST_ROOTrkWOR_MM_INPROGRESS_DIRWOR_MM_COMPLETED_DIRWOR_MM_CANCELLED_DIRrlWOR_SAFETY_INPROGRESS_DIRWOR_SAFETY_COMPLETED_DIRWOR_SAFETY_CANCELLED_DIRrmWOR_PREVENTIVE_INPROGRESS_DIRWOR_PREVENTIVE_COMPLETED_DIRWOR_PREVENTIVE_CANCELLED_DIRWOR_MAINTENANCE_DIRWOR_MAINT_INPROGRESS_DIRWOR_MAINT_COMPLETED_DIRWOR_MAINT_CANCELLED_DIR)rrbrs r1r r s x'-/ + +   ?"(0--   8!411   <%855   #/,,  r3)rrrrcX|xsi}||jd||jd|jd|jd|jd|jd|jd|jd|jd|jd d S) uUBuild the notify() context for a work-order event from its sidecar. Carries recipient-resolution inputs (per-WO opt-in ``_notify``, the submitter email, and ``wor_type``) plus the template fields the branded email renders. ``wor_id`` is the filename — stable across status moves so the idempotency log keys correctly. _wor_number_notifyrrequestor_namerrurgencydesired_completion_dater) wor_id wor_numberrnotifysubmitter_emailrrrrrrrr)rrrrs r1_wor_event_contextr s  Bff]+&&#66'?&&!12FF:&FF:&66)$#%66*C#Dvvm,  r3ctjddd}tjr8 t j tj jdd}t|ddz}tjt jd|i|S#tjtf$rd}YXwxYw)z;Atomically increment and return the next work order number.TrMr next_numberr^) rrWOR_COUNTER_PATHexistsrrrrrrrCrrcounters r1_next_work_order_numberr$s MM$M.G  jj!1!;!;!=>BB=RSTG'1o!G M7+C DE N $$g. G 7B!!B?>B?ctjddd}tjr8 t j tj jdd}t|ddz}tjt jd|i|S#tjtf$rd}YXwxYw)zAtomically increment and return the next TEST work order number (DVI-1082). Uses a counter separate from the production one so test WOs never burn or gap production WO numbers. Test WO numbers are surfaced with a ``T`` prefix. TrMrrr^) rqrWOR_TEST_COUNTER_PATHrrrrrrrrCrrrs r1_next_test_work_order_numberr2s t4G##% jj!6!@!@!BCGG WXYG'1o!G$$TZZ0H%IJ N $$g. G rctjr( tjtj SiS#tj t f$rYiSwxYw)z'Load the recurring work order registry.)WOR_RECURRING_PATHrrrrrrrXr3r1_load_recurring_registryrDsW  " ::0::<= = I$$g.   I s&?AActjddtjt j |dy)z'Save the recurring work order registry.TrMrrN)rrrrrrrs r1_save_recurring_registryrNs+ MM$M.!!$**Xa"@Ar3 start_datefrequency_days after_datecjddlm} tj|dj }|s"tjj n#tj|dj }||}|}||kr ||z }||kr |jdS#t t f$rYywxYw)zPCalculate the next run date from start_date + frequency, on or after after_date.rrrNr) rrrstrptimerrrrr)rrrrrqrefdeltanxts r1_calc_next_runrTs"'' J?DDF.8.    # # %^=T=TU_ak=l=q=q=sC > *E C * u  * << ##  "s$B B21B2end_datecddlm}g} tj|dj }|r|dkr|Sd}|r% tj|dj }||} ||kr*||z j|z} || | zz}||kr || z }||kr ||kr&|r||kDr |S|j||| z }||kr&|S#t t f$r|cYSwxYw#t t f$rd}YwxYw)a:Enumerate recurring run dates (date objects) falling within [win_start, win_end]. ``start_date``/``end_date`` are ``YYYY-MM-DD`` strings (end optional); ``win_start``/``win_end`` are ``date`` objects. Used by the Calendar tool to plot a marker on every due date of a recurring schedule (DVI-630). rrrNr) rrrrrrrrri) rrr win_startwin_endrrunscurrrskips r1_recurring_runs_in_windowrcs)#D%%j*=BBD ^q0 C  ))(J?DDFC > *E YC%%7EDL Io 5LCIo . 39  K C u  . K-  " I& C s"$C$CCCC0/C0zworkorderadmins@icastinc.comsubject body_textcZts tjjdy t j t tt}|jdg}d|vr tjjdy|d|d d d tiigd d d}tjdtdd|ddd|d}|jdvr.tjjd|jddyy#t $r"tjj#dYywxYw)zQSend a notification email to WOR admins via Microsoft Graph API. Fire-and-forget.z4Cannot send WOR admin email: AZURE_MAIL_FROM not setN authorityclient_credential$https://graph.microsoft.com/.defaultscopes access_tokenz(WOR admin email: failed to acquire tokenText contentTypecontent emailAddressaddressrbody toRecipientsfalsemessagesaveToSentItems'https://graph.microsoft.com/v1.0/users/ /sendMailBearer application/json Authorization Content-Typerxrr7rKzWOR admin email failed: %s,zWOR admin email error)rrmrnromsalConfidentialClientApplication _AZ_CLIENT_ID_AZ_AUTHORITY_HOME _AZ_SECRETacquire_token_for_clienterrorWOR_ADMIN_EMAIL_http_requestspostrgr&ryr)rr app_client token_result graph_bodyresps r1_send_wor_admin_emailrs7  QR677 %7:W !:::;;=  - JJ  G H #(.9E#i%AB! '  ""5o5Fi P#*<+G*H!I 2    : - JJ  9499Tc? K . 6 456sAC?A:C??(D*)D*c`tjt||fd}|jy)zCSend admin email in a background thread to avoid blocking requests.Tr(N)rrrrq)rrrs r1_send_wor_admin_email_bgrs& 5Wirr.heicr.webp> attachment rts_approval rts_rejectionWOR_PHOTO_MAX_MB15wor_pathc:|j|jdzz S)z@Return the sibling '.photos/' directory for a WO PDF path.z.photos)parentstem)rs r1_wor_photos_dirrs ??hmmi7 88r3cT|xsijd}t|tr|SgS)zDReturn the sidecar 'photos' list, tolerating missing/malformed data.photosrrr)rrs r1_wor_photo_listrs+ b % %h /F-6525r3rc |xsgDcgc]}|s|js|}}|sy|xsi}tdzdz}t|}|jddt j j d}g}|D]}|jjdtj|jj} |jjd| |kDritjj|jdj} t|jxs d| xsdz} t j j d d | } |j!t#|| z |j%| |sy|j'd } i}| j)r$ t+j,| j/}t5|}|D])} |j%| |j7d d|d dd+||d<| j9t+j:|dt=|Scc}w#t*j0t2f$ri}YwxYw)aSave photos/files staged on a Work Order Request form (DVI-1065). Mirrors the WO Admin ``/wor-photo-upload`` storage: files land in the sibling ``.photos/`` directory and are appended to the sidecar ``photos`` list with context ``attachment``. Any file type is accepted; oversize files (> ``WOR_PHOTO_MAX_MB``) are skipped. Returns the count actually saved so callers can no-op cleanly when nothing was attached. rTrMrr^photor7%Y%m%d_%H%M%S_%fr rr9rfile uploaded_by uploaded_atcontextcaptionrrr)rrrrrrrstreamseekrSEEK_ENDtellrbrrErrr*rir rrrrrrrrrrrC)rrr'ruploads max_bytes photos_dirr_rrdrrr4rrrs r1_save_wor_request_photosrs4!;B.photos/' directory when the WO PDF changes dirs. Keeps attachments co-located with the work order across status moves, mirroring how the PDF, JSON sidecar, and '.evh.pdf' snapshot are relocated. TrMN)rrr,rrshutilmover*)r r src_dirdest_dirs r1_move_wor_photos_dirrso g&Gx(H~~GOO-1A1A1CCdT: CL#h-0Dr3img_pathmax_pxc|jdz }||jdzz } |jr7|jj|jjk\r|S|j ddt j|5}|jd}|j||f|jt|ddd d d |S#1swY|SxYw#t$rYy wxYw) aReturn a cached JPEG thumbnail for a WO photo, generating it on demand. Thumbnails are cached in a '.thumbs/' subfolder of the photos directory. Returns None if the source image cannot be decoded (e.g. HEIC without a codec); callers fall back to serving the original. z.thumbsrTrMr9r:r;r<N) rrrrrrrIr?rLrNrr*ry)rr thumb_dir thumb_pathims r1_ensure_wor_photo_thumbr!s)+Ihmmf45J     OO%..(--/2J2JJ t4 __X & 9"E"B LL&&) * GGC OVRG 8 9  9 s7AC+*(C+AC C+C(#C+(C++ C76C7c|xsijd}t|trd|dStjd|xsd}|rdt|j ddSy)zKReturn a "WO #00042" label from sidecar data, falling back to the filename.rWO #05d _(\d{4,6})_r7r^WO)rrrrFrrb)rrnumms r1_wor_number_labelr8se :2  = )C#sc#Y .(.b1Ac!''!*oc*++ r3limitcdj|xsdj}t||kr|S|d|jdzS)zECollapse whitespace and truncate request text, appending an ellipsis.r\r7N...)rrrCr8)r&r s r1 _wor_abbrevr#CsH 88TZR&&( )D 4yE <   5 ((r3c|s|St||}|dk(ra|jdxsijdxsd}djd|jd|jdfD}nY|jdxs(|jdxsijdxsd}t|jd xsd}|g|r|gngz|r|gngz}d j|S) aBuild a human-friendly WOR list title from sidecar data (DVI-393, DVI-394). Format: "WO #NNNNN - - " where description is the machine + asset number for mobile-machine WORs, or the abbreviated request text otherwise. The WOR type is rendered separately as a list tag, so it is intentionally not repeated in the title. Falls back to the filename when no sidecar data is available. rrrr7r\c3&K|] }|s| ywrTrXr,rs r1r/z%_wor_display_title..YsXaVWXmachine asset_numberr - )rrrr#)rrrwo requestorrsegmentss r1rrKs  8T *B?"XXi(.B334DEK xxXDHHY$7.9Q#RXXXX./P),2778HIPMO 488M28b9tv2.9+PRSH ::h r3c  ddlm}|t|}|jr|jdj nd}|j d}i}t |D]\}}|j}|jdr|dzt|ks:||dzj} tjd| } | r5| jd|d<| d | jj} tjd | } | rG| jdj|d <| d | jj|d <| |d <|jd r|dzt|ks'||dzj} tjd| } | r:| jd|d<| | jd j|d<| |d<|jdr.|dzt|ks||dzj|d<|dk(r{g} t!|dzt|D]:}||jjdrn| j#||<dj%| j|d<U|jdr0g}gd}t!|dzt'|dzt|D]}||}|jjds|jjdrnU|D]N}d|vs||vs |j)d}|j)|}||ks5||z dks>|j#|P|s_dj%||dz|dz}|D]@}tjdtj*|z|s0|j#|B||d<|dk(r.|dzt|ks||dzj|d<|jd r.|dzt|ks||dzj|d!< |jdst!|dzt'|d"zt|D]Q}d||vsd#||jd dk(s$||j-ddj}|d$vr||d%<|S)&zNBest-effort extraction of form data from a WOR PDF (fallback when no sidecar).r) PdfReaderr7 Requestor namer^z[\w.\-+]+@[\w.\-]+\.\w+rNz(\d[\d\-\(\)\s\.]{6,}\d)rrDate of requestz(\d{4}-\d{2}-\d{2})date_of_requestrBuildingrRequest descriptionz Type of issuer) AutomotiveGroundsPlumbing CustodialCranesConcrete FormsTelehandler/ForkliftMachine Electrical Tool RepairrOtherrz Best timesUrgencyu✔ru [✔4]\s* issue_typeBest times for service best_timesDesired completion daterrrJLowMediumHighr)pypdfr/r*r extract_textrrrrwrCrFrrbrqrGrrrirminfindescaper)rr/readerr&linesrrrsrval email_match phone_match date_matchrjtypes all_typesclr idx_checkidx_typeblockurgs r1_extract_wor_data_from_pdfr]bs s8} %F-3\\6<<? ' ' )rD JJt EDU#N4 JJL <<( )1us5z!AEl((* ii(BCH $/$5$5a$8DM2{002399;C ii(CSI $/$5$5a$8$>$>$@DM-01E+2C2C2E-F-L-L-ND)*-0D)* \\+ ,1us5z!AEl((*XX&.>q.AD*+'*:>>+;+<'='C'C'ED$.1D*+ \\* %1us5z!#(Q<#5#5#7Z ' 'D1q5#e*- &8>>#..? E!H% &#'))D/"7"7"9D  \\/ *EI 1q5#a!eSZ"89 ,1X88:((6"((*:O:OPY:Z",A{qBw$&GGEN #%771:$x/X 5IR4O!LLO , , %Aq1u"56"(Ayy ! !?r3r item_refs item_cols_ac V|jdDcgc]}|}}g}t|D]\}}|t|kr||nd} |t|kr||nd} |} | | | fD cgc]1} | js| jj 3} } | jr| jj gng}i}|D]}|j j t |j|}tfd| DsLjdr|jd|pjdr|jd|jds|jd|d|vryd|vru|rs|D]n}|j j jds/tfd|DsD|jdt |j|n|j||Scc}wcc} w) uScan *folder* recursively for PDFs and match them to items by identifier presence + suffix. Identifiers: col A (item_cols_a[i]), col H (item_refs[i]), col C (items[i]). All non-empty identifiers must appear in the filename stem (case-insensitive). Suffix determines file type: stem ends with 'shop' → shop drawing stem ends with 'submittal' → submittal document stem ends with 'carrierqr' → QR carrier sheet Submittal fallback: if no submittal matches all identifiers (common when the submittal is a shared document not named per item), retry with only col A as the required identifier. Paths stored are relative to *folder* so they work regardless of subdirectory depth. Returns a list[dict] parallel to *items*; each dict maps 'shop'/'submittal'/'carrier' to the relative path string from *folder* (key absent if no match found). r+r7c3&K|]}|v ywrTrXr,ident stem_lowers r1r/z(_match_files_to_items..sDuu *Drshop submittal carrierqrcarrierc3&K|]}|v ywrTrXrrs r1r/z(_match_files_to_items..s;hTYEZr= blank_bytesr@ output_paths r1_run_merge_singlersO !%%G%i$ J&&( ) yy{ahhnn.&8 vv||~ $    G D Y%6I t^ D   d//K!HOOC()5+=*>?J!l!E)..$9#:;MQuTYY/01H$$&K$[-JL+.FGGKL)r3uA Togen — Pull it Forward

{{ site_title|e }}

{{ site_tagline|e }}
z//__TOGEN_JS_EXTRACT_START__z//__TOGEN_JS_EXTRACT_END__staticcdddl} |jt}|jt|}|jd|t dz}||t tz|jd}d|vsd|vr,t jtjd|dfS|jd }|j|jdd }d |z}d |z} tjt d tj"j%t |} tj"j'| set)j*t d\} } tj,| d5} | j/|dddtj0| |  tj6| dd| z}|d||z||dz| fS#t $r/t jtjd|dfcYSwxYw#1swYxYw#t2$r6tj"j'| rtj4| wxYw#t8$rYwxYw#t8$r7}t jtjd||dfcYd}~Sd}~wwxYw)uReturn (html_with_external_script, js_url_or_None). Slices the JS between the extract markers, writes it to static/togen..js (idempotent, atomic), and replaces the inline block with an external z9DVI-945: JS extract markers not found; serving JS inline.r0z{{z{%zCDVI-945: extracted JS still contains Jinja markers; serving inline.utf-8r-z togen.%s.jsz /static/%sTrOz.tmp)dirr!wbiz8DVI-945: could not write static JS (%s); serving inline.z$ )hashlibr_TOGEN_JS_EXTRACT_START_TOGEN_JS_EXTRACT_ENDrCr_logging getLogger__name__rorencodesha256 hexdigestrmakedirs _STATIC_DIRrbrrtempfilemkstempfdopenwriter BaseExceptionremoverr)htmlrsiei script_closejs_bodyjs_bytesdigestrrJrfdrSfhrl new_blocks r1_extract_static_jsr,sm TZZ/ 0 TZZ-r 2!tzz+r2S5EE 2344R8>>tDG w$'/8$,, Q Tz~~g&H ^^H % / / 1#2 6Fv%H  !C K$/k84ww~~f%&&;vFGB YYr4('BHHX&' 3'  HHVU #8#=I 9y 4 #6 6 ;;a 8$,, G Tz 6''! 77>>#&IIcN     8$,, F Tz syA G(A._wrapH-sT{{6"!%`acfff%kkGFOGG,- -$!&!!r3rrrs` r1login_requiredrF-s  1X"" Lr3c.tfd}|S)z+Require login + WOR Admin group membership.ctjdsCtrtddfStj td<t tdStdjdstdd fS|i|S) Nr'rrrrrr:Access denied: Work Order Admin group membership required.rrs r1rz!wor_admin_required.._wrapU-sx{{6"!%`acfff%kkGFOGG,- -v"";/!]^`cc c$!&!!r3rrs` r1wor_admin_requiredrS-  1X"" Lr3c.tfd}|S)zRequire login + WOR Admin / Togen Admin group, OR presence in any Authorized Approvers department list (wor_approvers.json). Approver status is evaluated per request so Settings changes apply immediately without re-login (DVI-1024).c^tjd}|sCtrtddfStj td<t tdS|jds:|jds)t|jd d std d fS|i|S) Nr'rrrrrrrrr7zGAccess denied: Work Order Admin or Authorized Approver access required.r) rrrrrrJrrrv)rhrr'rs r1rz$wor_approver_required.._wrapg-s{{6"!%`acfff%kkGFOGG,- -%-)@+DHHWb,AB!jkmpp p$!&!!r3rrs` r1wor_approver_requiredrb-s"  1X " " Lr3c.tfd}|S)z-Require login + Togen Admin group membership.ctjdsCtrtddfStj td<t tdStdjdstdd fS|i|S) Nr'rrrrrrz5Access denied: Togen Admin group membership required.rrrs r1rz#togen_admin_required.._wrapx-sx{{6"!%`acfff%kkGFOGG,- -v""=1!XY[^^ ^$!&!!r3rrs` r1togen_admin_requiredrv-rr3c.tfd}|S)zRequire login + Oversight-editor authority (Togen Admin OR granted editor, DVI-1103). Re-checked per request so a client can't reach the editor routes without a live grant.ctjdsCtrtddfStj td<t tdSttdstddfS|i|S) Nr'rrrrrzGAccess denied: Oversight editor access is not enabled for your account.r) rrrrrrJrr_oversight_can_editrs r1rz(oversight_editor_required.._wrap-sr{{6"!%`acfff%kkGFOGG,- -"76?3!jkmpp p$!&!!r3rrs` r1oversight_editor_requiredr-s" 1X"" Lr3ctddfS)NzOAccess denied: Auditor access to this resource is not enabled for your account.rrrrXr3r1_auditor_deniedr-s j kmp ppr3ctddfS)Nz\Access denied: this tool is not enabled for your account. Ask a Togen Admin to grant access.rrrrXr3r1_tool_access_deniedr-s w xz} }}r3cfd}|S)zGate a route behind a tile-surface sub-tool's effective visibility (DVI-1496 P2, D9). 403s when the sub-tool is admin-disabled, user-hidden, or the caller lacks access; Togen Admins always pass. Login is required first.c4tfd}|S)Nctjd}|sCtrtddfStj td<t tdSt|r|i|StddfS) Nr'rrrrrz:Access denied: this sub-tool is disabled for your account.r) rrrrrrJrrr6)rhrr'rr rs r1rz9subtool_route_required.._decorator.._wrap-sw;;v&D#%")degjjj")++ 011 J=$)&))!]^`cc cr3r)rrr rs` r1 _decoratorz*subtool_route_required.._decorator-s" q d  d r3rX)rr rs`` r1subtool_route_requiredr-s  r3cFtrdn tfd}|S)u]Gate a route behind per-user tool access (DVI-1373). Passes for Togen Admin, or for a user whose per-user tool grant intersects ``resource_keys``. Grants are evaluated per request so Access changes apply without re-login. Clone of ``auditor_or_role`` without the role-flag branch. ``resource_keys`` may be a set/iterable OR a zero-arg callable returning one (DVI-1452 P1): the QC "any qc leaf" gate passes ``_qc_access_leaves`` so the dynamic per-segment qc.production. leaves are re-resolved per request — a grant for a segment added after boot works without a restart.Nc4tfd}|S)NcRtjd}|sCtrtddfStj td<t tdS|jdr|i|Stn}t||zr|i|StS)Nr'rrrrrr) rrrrrrJrrrr#r)rhrr'r, _static_keysr resource_keyss r1rz7tool_access_required.._decorator.._wrap-s;;v&D#%")degjjj")++ 011xx &$)&))+7+?3}'\D(.5$)&))&( (r3r)rrrrs` r1rz(tool_access_required.._decorator-s q )  ) r3)callabler)rrrs` @r1tool_access_requiredr-s%$M24M8JL" r3c,tfd}|S)afGate an Auditor data route (DVI-1052). Passes for Togen Admin, for a user holding any session flag in ``role_flags`` (used on endpoints shared with the owning tool, e.g. Production Run history), or for a user whose per-user Auditor grant intersects ``resource_keys``. Grants are evaluated per request so Access changes apply without re-login.c4tfd}|S)NctjdsCtrtddfStj td<t tdSjdr|i|SrtfdDr|i|Stjd d zr|i|StS) Nr'rrrrrrc3@K|]}j|ywrTr)r,flr's r1r/zEauditor_or_role.._decorator.._wrap..-s!D2$((2,!Drr7) rrrrrrJrrr2rr)rhrr'rr role_flagss @r1rz2auditor_or_role.._decorator.._wrap-s;;v&D#%")degjjj")++ 011xx &$)&))c!D!DD$)&))"488GR#89MI$)&))"$ $r3r)rrrrs` r1rz#auditor_or_role.._decorator-s q %  % r3)r)rrrs`` r1auditor_or_roler-s  &M" r3c.tfd}|S)zGate the generic /history/ routes: the required Auditor resource is derived from the tool slug (history.). Admin passes unconditionally.ctjd}|sCtrtddfStj td<t tdS|jdr|i|Sdt|jd d jz}|t|jd d vr|i|StS) Nr'rrrrrrzhistory.toolr7r) rrrrrrJrrr*rrr)rhrr'r)rs r1rz'auditor_history_required.._wrap-s{{6"!%`acfff%kkGFOGG,- - 88M "d%f% %3vzz&"56<<>> %dhhw&;< <d%f% %  r3rrs` r1auditor_history_requiredr-s" 1X ! ! Lr3z/diag/slow-requestsctt}|jttt t t||S)zDVI-939: recent slow requests (in-memory ring) for latency triage. Full history lives in the rotating slow_requests.log for Phase 3 analysis.)r~ threshold_mslog_pathcountrequests)rrhr r_REQUEST_TELEMETRY_ENABLEDrf_SLOW_REQUEST_LOGrCrs r1diag_slow_requestsr.s8 & 'E MMO *%"%j  r3c.tfd}|S)zHRequire login + Togen Take-off Workflow or Togen Admin group membership.c6tjdsCtrtddfStj td<t tdStd}|jds|jdstd d fS|i|S) Nr'rrrrrrrzAAccess denied: Togen Take-off Workflow group membership required.rrrhrurs r1rz(takeoff_workflow_required.._wrap.s{{6"!%`acfff%kkGFOGG,- - FO()QUU=-A!degjj j$!&!!r3rrs` r1takeoff_workflow_requiredr.  1X " " Lr3c.tfd}|S)zERequire login + Togen Production Run or Togen Admin group membership.c6tjdsCtrtddfStj td<t tdStd}|jds|jdstd d fS|i|S) Nr'rrrrrrrz>Access denied: Togen Production Run group membership required.rrrs r1rz prod_run_required.._wrap".s{{6"!%`acfff%kkGFOGG,- - FOj!QUU=%9!abdgg g$!&!!r3rrs` r1prod_run_requiredr .rr3c.tfd}|S)z:Require login + Togen MTS or Togen Admin group membership.c6tjdsCtrtddfStj td<t tdStd}|jds|jdstd d fS|i|S) Nr'rrrrrrrz3Access denied: Togen MTS group membership required.rrrs r1rz!mts_label_required.._wrap2.s{{6"!%`acfff%kkGFOGG,- - FOk"aeeM&:!VWY\\ \$!&!!r3rrs` r1mts_label_requiredr0.rr3c.tfd}|S)z._wrapB.s{{6"!%`acfff%kkGFOGG,- - FOm$m(<!XY[^^ ^$!&!!r3rrs` r1scada_requiredr@.rr3c.tfd}|S)a:Require login + authority to action a SCADA report approval: a Togen SCADA / Togen Admin member, OR an email listed in the configured ``report_approvers`` (scada_config.json). Evaluated per request so approver changes apply immediately without re-login (mirrors wor_approver_required, DVI-1102 F4).crtjd}|sCtrtddfStj td<t tdS|jdsD|jds3tj|jd d std d fS|i|S) Nr'rrrrrrrrr7z5Access denied: SCADA report approver access required.r) rrrrrrJrrscada_report_approvals is_approverrs r1rz-scada_report_approver_required.._wrapV.s KK !%`acfff%kkGFOGG,- -m$m(<)55aeeGR6HI!XY[^^ ^$!&!!r3rrs` r1scada_report_approver_requiredr P.s"  1X " " Lr3c.tfd}|S)zRequire login + Vision access: togen_admin always, OR togen_vision only while the Vision tool is enabled in Tools Enabled (admin-disabled => 403).cztjdsCtrtddfStj td<t tdStd}|jdr|i|S|jdr"tjd d r|i|Std d fS) Nr'rrrrrrrrFz&Access denied: Vision access required.r) rrrrrrJrrrrs r1rz%vision_access_required.._wraph.s{{6"!%`acfff%kkGFOGG,- - FO 55 d%f% % 55 %:%<%@%@5%Qd%f% %EFKKr3rrs` r1vision_access_requiredre.s$ 1X L L Lr3c.tfd}|S)uRequire Repair Parts Manager access. DVI-1496 P3 (D6-B): RPM is now the Equipment ``rpm`` sub-tool. togen_admin always passes; otherwise the RPM sub-tool must be admin-enabled (D9 — a disabled sub-tool 403s) AND the caller must have access: the ``equipment.rpm`` access leaf OR the legacy wor_admin role (``_rpm_role_ok``, both ORed in per the plan). User-hiding is a personal convenience and never 403s a route.cVtjdsCtrtddfStj td<t tdStd}|jdr|i|Stdd rtdd |r|i|Std d fS) Nr'rrrrrrrrz4Access denied: Repair Parts Manager access required.r) rrrrrrJrrrr*rs r1rzrpm_required.._wrap.s{{6"!%`acfff%kkGFOGG,- - FO 55 d%f% % !+u 5:L[Z_ab:cd%f% %STVYYYr3rrs` r1 rpm_requiredrx.s$ 1X Z Z Lr3c|dk(rttttg}n|dk(rtt t tg}n|dk(rttttg}nn|dk(rttttg}nRtttttttttt t tttttg}|r6|dn|fD],}|j!t#|dj%.|S)aLReturn the ordered list of directories to search for a given WOR type. ``include_test`` (DVI-1082) appends the segregated ``_test`` subtree dirs. It defaults to False so every production caller stays isolated from test WOs by construction; only surfaces that have authorized the viewer for test mode pass True. rrrrr#Trb)rkrrrsrtrlrurvrwrmrxryrzr{r|r}r~extendr r)rrdirsrs r1rr.s?"%'<>R$& X  9;S(* \ !"$A,.JL ] "#%=?V') !9;R # !#8:N 57O $  = (*F  %K,4; ?A KKqt4;;= > ? Kr3c|rd|vsd|vryt||D]\}||z j}t|jt|jsy|j sZ|cSy)zFind a WOR file across new / in_progress / completed directories. ``include_test`` (DVI-1082) also searches the segregated ``_test`` subtree; default False keeps production reads isolated from test WOs. rr6Nr)rr,r*rwr)rrrrnrs r1_resolve_wor_filer.sv tx'3(? H< @\**, 9~((QYY[)9:       r3cxtjd}|r|Stjj ddzS)aBest post-login redirect target, preserving the originating FQDN. login_required stores the full pre-login URL (scheme + host + path) in session["next"], so a login started on a custom FQDN can land the user back on that same host after the canonical /auth/callback completes (DVI-1181, Option B). Falls back to the current request's origin so a direct hit on /login still returns to the right host. rr6)rrrhost_urlr8)rs r1_post_login_targetr.s6 ++f C     " "3 '# --r3cx|syddlm} ||}|js*|j dr|j ds|}|Sd}|S|j xsdj }tDchc]6}|jdr#|jdxsdj 8}}||vs|jds|dk(r5|jxsd}|jr|d |jzz }d ||S|jj dr |jSdS#t$rYywxYwcc}w) aValidate the OAuth `state` before using it as a redirect target. `state` round-trips through Microsoft and is used verbatim as the post-login redirect, so it must be constrained to prevent an open redirect. Absolute URLs are only honored when the host is an allowed Togen FQDN (registered in togen_fqdns.json or any *.icastinc.com host, matching the SESSION_COOKIE_DOMAIN scope); otherwise the path is kept and the host is dropped. Relative targets must start with "/". r6rr z//r7fqdnr~ icastinc.comr]r@) urllib.parser ryrIrwhostnamerE _load_fqdnsrr|rbquery)ror rLrbhostrB allowed_hoststails r1_safe_post_login_redirectr'.s> %% ==((-e6F6Ft6Lu SV OO !r ( ( *D 55= v "##%M  } o >$.BX{{!c << C&,,& &D$v&& ++0056;;>3>) sD(3;D7( D43D4z/loginctjttt}|j t tt}t|S)z5Initiate Microsoft OAuth 2.0 Authorization Code flow.r) redirect_uriro) rrr _AZ_AUTHORITYrget_authorization_request_url _AZ_SCOPES _AZ_REDIRECTrr)rXauth_urls r1rr.sJ  + +* NB//! "0H H r3z/auth/callbackc 0tjjddjdk(r(tjjdd}d|ddfStjjd }|sy t j t tt }|j|tt }d |vrd|jd|d dfS|d}|d}|jdd}|jdd}tj|}|std|d|ddy|d} |d} |jdi} td| d|d |d| Wtjd"| d#d$|id%&} | jdk7r(td'|d(| d)| jdd*| d+d,fSi} d-D]}| j|}|sd.| |< tjd"|d#d$|id%&}|jdk(| |<td/|j!d0|d1|jd2| |dg} tj$d4d$|d5d6d7d.id%8}|jdk(rB|j'jd9xsgDcgc]}t)|t*s|}}ntd:|d1|jd|jd|| | d=| d>| d?| d@| dA| dB| dC|dD t,dE< t/||jd|jdF|jdGt1tjjdIdJ}t3|S#t"$r1}d.| |<td/|j!d3|dYd!}~d!}~wwxYwcc}w#t"$r}td;|d<|dYd!}~ d!}~wwxYw#t"$r}tdH|d<|dYd!}~d!}~wwxYw)Kz@Handle the redirect from Microsoft after login or admin consent. admin_consentr7rdtenantunknownz.Admin consent granted successfully for tenant z. You may close this window.rKcode)z(Authentication failed: no code returned.rr)rr)rz Login error: error_descriptionrid_token_claimsrrpreferred_usernamez*[AUTH] Rejected login from unknown tenant z (user=)Tflush)zqAccess denied: your organization is not authorized to use Togen. Contact your IT administrator to request access.rr9rrz[AUTH] Login from tenant  (z), user=Nz-https://graph.microsoft.com/v1.0/me/memberOf/rrrrxr7z#[AUTH] Base group check failed for z: group=z , status=zKAccess denied: your account is not a member of the required Togen group in z2. Contact your IT administrator to request access.rrF[z] Group check for z : status=z , granted=z] Group check failed: z3https://graph.microsoft.com/v1.0/me/getMemberGroupsrrsecurityEnabledOnlyrrz"[AUTH] getMemberGroups failed for z![AUTH] getMemberGroups error for : rrrrrrr) r9rr1rrrrrrrrr'rrz'[AUTH] user_directory write failed for ror6)rrhrrErrrr*r#acquire_token_by_authorization_coder,r-_AZ_TENANT_CONFIGprintrrgupperryrrrr*rrr'r)r1r3rXr>claimstoken user_tenantusername tenant_cfg tenant_namer tenant_groups graph_resprrole_keygroup_idrrlrgmrnext_urls r1 auth_callbackrO /s||,224>!!(I6 + +* NB  3 3 Zl4 "E**UB'Kzz. :H#&&{3J  8 FJa !  V$KL)JNN8R0M #K=;-@z #'';J< H$w&78  ! !S ( 5hZ@# Ij.D.D-EG  ""-/CC  J|Q $$X.#(Jx  Q!%%?zJ(GE7*;<D $(#3#3s#:Jx HNN$%%7zB**+:j6J5KM Q4IQ  A(/w&7%79'/   >>S %'WWY]]7%;%ArYqjQRTWFXYIY 6xjANN+-48 : F# ,!-0&'9:z* ,!-0">2 GFOWxF);%zz,7M9R T))9)9'3)GHH H _ Q#(Jx Ahnn&''=cUC4 P P Q&Z Q 1(2cUC4PPQ* W 7zC5IQUVVWsb A&N AO O6O: O;O/ N= &N88N=O O,O''O,/ P8PPz/logoutcVtjd}ttd|S)z0Clear local session and sign out from Microsoft.https://togen.icastinc.comz-/oauth2/v2.0/logout?post_logout_redirect_uri=)rclearrr*) post_logouts r1logoutrT/s3 MMO.K  /%%0M 3 r3r6c ddlm}tjdi}|jdd}|||jddt |}|jdd}t }t tfid|d |d td ||d td ||dtd||d|jddd|d|jddd|jdddtt|d|jdddt|dtt|dt|jdd xr t|dtt|dt|jdd xrt|t!t#zdtd t|vd!t|jdd xr2t|t!t#zxs|jd"d#t|jdd xrt|t!t$d$zd%|jd&dd'|jd(dd)|jd*dd+|jd"dd,|jd-dd.t'd/t)d0t+d1t-d2t/d3t1|d4t3d5t5d6t7d7t9d8t;d9t=d:t?d;tAtCdtEd?d@tGdAtI|dBtK|dCtM|dDtOdEtPjSdFtU|S)GNris_assistant_connectedr'rr7rFassistant_availabletoolbar_visibilityshow_toolbar_searchrshow_toolbar_assistantrshow_toolbar_calendarr user_namer9UserrprEr1 is_wor_adminris_evh_approveris_togen_admin wor_can_testauditor_resourcesis_auditor_scopedtool_access_resources is_qc_scopedis_qc_filebrowserris_quality_scopedris_logistics_scopedris_takeoff_workflowr is_prod_runr is_togen_mtsris_togen_scadais_togen_visionrtool_visibilityr}tool_separatorsr~ tile_surfacesrsubtool_visibility_admintool_overrideswor_type_visibilitywor_type_orderbot_visibility bot_orderpublic_version about_html site_titlere site_tagliner+shared_url_prefixr9regionalwor_primary_enforcedbranding_settingsbranding_has_logo print_can_use)+rrWrrrrr_HTMLrrrvr`rrrr#rrrrrrryr r8rrrrrrr!_render_news_markdownr'r0rr>_resolve_regionalrLrdCORPORATE_LOGO_FILEr_user_can_print)rWr'rp_assistant_available _is_admin _toolbar_viss r1rr/s_1 ;;vr "D'2&J1DHH]E24G 4S.I+-L ! 8 08 (8 19lS 8  4KLY 8  3:y,W 8 ((66*8 8 HHXr*8 XXk518 5jAB8 xx u58 #4(8 !!=d!CD8 488M5#AAeFYZdFef8  %%>t%DE!8 "dhh}e<<[8>EVEXAYY\#8 &/3LT3RRS'8 ,488M5#AA @%>t%DsK\K^G_%_%?'+xx '>A-8 2!TXXmU%C!C"M&?&E(+,=k,J(K'LN38 8!HH%7?98 :HHZ/;8 <XXk51=8 >xx u5?8 @7A8 B./C8 D$%E8 F./G8 H$%I8 J,-K8 L8=M8 N":!;O8 P,-Q8 R67S8 T,-U8 V,-W8 X"#Y8 Z,-[8 \))<)>?]8 ^#$W-_8 `%&y1a8 b23c8 d/z:e8 f#:.g8 h7zBi8 j23k8 l.557m8 n&d+o8 8r3z /upload-csvPOST)methodsc dtjvrtddidfStjd}|jr)|jj j dstddidfSt |j}t|j}t|z }|jdd||z }|jt|g}g}t|d d 5}tj|}t!|d|D]y} t#| d k\s| d j%s&|j'| d j%|j't#| dk\r| dj%nd { ddd|stddidfS||||t)t#|D cic]} t| ic} id} t+|| t|||dS#1swYhxYwcc} w)NcsvrzNo CSV file providedr`.csvzFile must be a .csvTrMr7 utf-8-signewlineencodingrPrrru>No items found — expected data in column C from row 2 onward) csv_filenamerrrnrresults)rrrn)rrrrrEr|rrrrbrrr*r?rrOrrCrrirrm) r safe_namerrcsv_pathrrnrrOrrros r1 upload_csvr/s GMM!!7893>> eA ::QZZ--/88@!678#== +I  ?  D  F LLL- !HFF3x=EI h[ 9JRB VT JC3x1}Q SV\\^,  3s8q=QbI JJ !abcehhh"&+CJ&78#a&"*8 E dUK LL)JJ 9s05G8&G8:AG8H 8Hz /upload-zipcdtjvrtddidfStjd}|jr)|jj j dstddidfSt |j}t|j}t|z }|jddtj|j5}|jD]c}||z j}t!|j#t!|jrHtdd |idfccdddS|j%t!|dddt'|j)d xst'|j)d }|stdd idfS|d }g} g} g} t+|dd5} t-j.| } t1| d| D]}t3|dk\s|dj5s&| j7|dj5| j7t3|dk\r|dj5nd| j7|r|d j5nd ddd| stddidfSt9|| | | }i}t;|D]\}}t=||t!|<t!|j?||| | | |id}tA||t|| | |dS#1swYxYw#1swYxYw)NziprzNo zip file providedr`.zipzFile must be a .zipTrMzUnsafe path in zip entry: *.csv**/*.csvzNo CSV file found in ziprr7rrrPrrrzECSV in zip has no items (expected data in column C from row 2 onward)rrrrnrorr)rrrnr)!rrrrrEr|rrrrbrzipfileZipFilernamelistr,r*rw extractallrrr?rrOrrCrrirrrr{rm)rrrrzfmemberdest csv_filesrrrnrorrOrr files_staterrros r1 upload_zipr0s GMM!!7893>> eA ::QZZ--/88@!678#== +I  ?  D  F LLL-  "#bkkm VFVO,,.Dt9''FNN,<(=>+EfX)NOPRUUU ## V c&k" #v{{7+,Ov{{:7N0OI !;<=sBB|HEIK h[ 9BRB VT BC3x1}Q SV\\^,  3s8q=QbI""S3q6<<>bA  BB !hijlooo'vuiMJK +, 7"7m CF,H0089"E dUZde ff_##"BBs2AL/7L/L/5L< L<!A?@#EE,,""8R0K,,""<4J,,"";3I88!456;;   k *dk.A!123S88  $F ==?!MNOQTTT +IFF3v ! "#  EJSEWb!,,Z.col0s##&s8c>s3x~~9r9r3r^rrrr) structure_id product_codeweightstructure_sizepart_refr7)rr*_CARRIER_META_KEYSrr)rrrr6fieldsr)s` r1_build_carrier_fieldsr0s :::a&a&a&a&a& F"R(,,sHLLb,ABHbIOOQs R Mr3/submitc  tjdxsi}|jdd}tj |rd|vrt ddidfSt |z }t|}|jd g}|st dd idfS|jd }t|tr6|jDcic]\}}t|t|c}}ni}t|jd tr|jd nd} | ft|jrM|d z } | jr8 t!j"| j%d} t| tr| } | xsi} | jd} t| tsi} d} d}t|jr ddlm} ||dz }t1|dd5}t3t5j6|}dddi}d}t9D]8\}}|dk(r t;|dk\s|dj=s/|||<|dz }:g}t9|D]\}}|jdijt|i}|jd}|jd}|jd}|s|j?ddi{d}|s"|jt|s|j?dd |d!i|r|j?d|i||vr|||ng}tA|| | jt|i}|d"r|d#s|j?dd$|d%i | ||&}||jBjEd'd(z } | |k7r|jE| | jB}d}|jIdijIt|i}"||"d<d|"d+<||z }#||z }$|r||z nd}% tK|$|#||%}&tM}'|'jOd,d,tQ|d-}(|(d,tQ|d,-})|(d,tQ|d,-}*|r|(d,tQ|d,-nd}+||vrE|||}t;|d.kr |j?dt;|d.kr |)|d/<|+|d0<|*|d1<d2|i|jId3it|<dd4tQ|d-d5tQ|d,-d6tQ|d-d5tQ|d,-d7},|r d|,d+<||,d<|j?|,t1|d8dd5}t5jR|jU|ddd|r||d <tW||t d3|iScc}}w#t j&t(f$rYOwxYw#t.$rd}YwxYw#1swYxYw#tF$r$}!|j?dd)|d*|!iYd}!~!d}!~!wwxYw#tF$r'}!|j?dt|!iYd}!~!d}!~!wwxYw#1swYxYw)9NTrrr7rrrr`ru,No items in session — please re-upload CSV create_flagsrproject_metadata.jsonrritem_overridesrcreate_carrier_sheetz^Carrier sheet generation is unavailable on this host (qr_merge.create_carrier_sheet not found)rrrrPrr^rrurxrvskippedFzShop Drawing uploaded for "z"" but QR Carrier Sheet is requiredrrzXProject metadata (customer and project name) is required to create a carrier sheet for ""rr"zCarrierQR blankzCarrierQR generatedz%Carrier sheet generation failed for "z": rr6rr-ryr outputrzdownload-file?folder=&file=zpreview-file?folder=)rU download_url preview_urlw),rrrrarGrrbrkrrrr*rr2rrrrrrrqr_mergerr#r?rrrOrrCrrirr9rryr}r2r+r8rwriter writerowsrm)-rrrror raw_flagsrrrr meta_pathloadedr_create_carrier_sheet_create_import_errorrrrn item_row_map item_countrow_idxrrrrr shop_name carrier_namesubmittal_name created_nowrgen_path final_pathrlrr!r r#rrr<r= carrier_urlr>r>s- r1submitr0s   4 ( .BD((8R(K   k *dk.A!123S88  $F  E YYw #E !OPQSVVV(I i &&/__%67TQQa7,. (2$((:2F'Mtxx #SWHC 3 3 5644     I$7$7$7$IJfd+%H~2H\\"23N nd +  <   !  Nn--H h[ 9$RCJJrN#$$&LJ!$  a<  s8q=SV\\^'.L $ !OJ G!%(N0 9 '2&**3q6266* 9- ;/ NNIt, -  ##CF++FykQs)tuv#)=>?+, +<$|A'"C*3.:L:LSQRVUW:XYF/*&2H,DENDOOP*Q RS 0fU$hmm&;&;1$ 0%lIv~VK -.H's34AeKb6Q5RSJ)l!E)#,F+GHH)l!E,S,I+JKKQ_zl!E.s,K+LMegML <?+#hmJJrN#hm"A'B%B7?6NE  Y +CF 3"7kPR8S7TTZ[`amtw[xZy z"6u[r7R6SSYZ_`lsvZwYx yF $(y!$0y! NN6 "YN0b hR' :'b 2  &' ,n Iw' ((M 8(('2   < ! $$` +PQZP[[^_b^c)def V 0 NNGSX. / / 0''s{V,7V2W"W$A W1B,X!B X!%Y2WW W! W!$W.1 X:XX! Y*Y  YYz/download-filectjjdd}tjjdd}|r|sytj |rd|vryt |z j }||z j }t|jt|tjzs||k7ry|jsytt|d S) Nrr7rMissing parametersr`rrr` Invalid pathr`File not foundT as_attachment rrhrrarGrbr,r*rwrseprrrrrris r1 download_filerP1s,,""8R0K,,""62.H h(   k *dk.A$[(113F("++-I y> $ $S[266%9 :yF?R"    $ S^4 88r3z /download-csvctjjdd}tj |rd|vryt |z }t |}||jddz }|jsytt|dS) Nrr7rrr)z CSV not foundrTr) rrhrrarGrbrkrrr*)rrrors r1 download_csvrc1sy,,""8R0K   k *dk.A$  $F  E ."55H ?? # S]$ 77r3z/list-shared-foldersctjs tdgiStdtj Dd}td|iS)z7Return sorted list of subdirectory names in SHARED_DIR.foldersc3K|]=}|js|jjdr0|j?ywrN)rr9rwr,rs r1r/z&list_shared_folders..x1s.[AAFFDUDUVYDZ[sAAATr ) SHARED_DIRrrrrY)rs r1list_shared_foldersr q1sO     2''[++-[G Iw' ((r3z/select-shared-folderc @tjdxsi}|jdd}tj |rd|vrt ddidfSt |z j}t|jtt jr|jst dd id fSt|z }|js(tjt|t|t|j!d xst|j!d }|st dd idfS|d}g}g}g}t#|dd5} t%j&| } t)| d| D]} t+| dk\s| dj-s&|j/| dj-|j/t+| dk\r| dj-nd|j/| r| dj-nd ddd|st ddidfSt1||||} t3| D cic]\} }t| t5|}} } t7|jdi}t;|t4rt=t+|D]} |jt| i}t;|t4s/|jdsA|jdsS||dz j?sj|d|t| d<d|t| d<|d| | d<t|jA||||||id}tC|||dz }|j?}d}|r& tEjF|jId}t |||| ||dS#1swYxYwcc}} w#t8$ri}Y`wxYw#tDjJtLf$rd}YTwxYw) zOLoad a shared folder: copy to WATCH_DIR if needed, parse CSV, auto-match files.Trrr7rrInvalid folder namer`z$Folder not found in shared directoryrrrzNo CSV file found in folderrrrNrPrrrz>CSV has no items (expected data in column C from row 2 onward)rrrxrrrrF)rrrnr has_metadatar)'rrrrarGrr r,r*rwrrbrr copytreerrr?rrOrrCrrirrrrkryrrrr{rmrrrrr)rrr$dstrrrrnrorrOrrrrr prev_filespfrorrrs r1select_shared_folderr~1s   4 ( .BD((8R(K   k *dk.A!678#==  # , , .C s8  s:#5#5#78 9!GHI3NN k !C ::<C#c(+sxx()IVCHHZ4H-II !>?@#EE|HEIK h[ 9BRB VT BC3x1}Q SV\\^,  3s8q=QbI""S3q6<<>bA  BB !abcehhh&sE9kJJ/8/DEtq!3q647?EKE  %))'26 *d#s5z" 9AA+B2t$ ):rvvi?Pr)},55713I CF#I.15 CF#I.+-i= 1 i(  9H0056"EU--I$$&LH !zz)"5"5w"5"GHH  $  gBBF  8$$g. ! L !sC!5OO+A'? @ HZHZH\!345s::55IH zz)"5"5w"5"GHH(D)# OOTXXo6<"=CCEDHH^4:;AAC"488,A#B#HbIOOQ"  #= $; 34:: $ $S[266%9 :yF?R"    $ S^.? @@r3z/takeoff/project-filesc ~tjjdd}tj |rd|vrt ddfSt |z j}|jst ddfSd h}g}t|jd d D]}|jr)|jjd s|j|vr>|j|}t|j j#t$j&d}|j)|jt|j#t$j&d|d k(rdn||j*j-j/d |j1j2dt ||S)zList the files in a Take-off working folder for the Project Information popup's file browser/preview panels (DVI-641). Returns a flat, recursive listing so every project document is reachable in one list.rr7rrrr`rrrhr1c4t|jSrTr*rErs r1r z'takeoff_project_files..:2sSV\\^r3rrr6)r9rrrrd)rr)rrhrrarGrrbr,rrrzrr9rwr{r*rrrrrir!rErVrst_size)rr skip_namesrrrrs r1takeoff_project_filesr(,2s_ ,,""8R0K   k *dk.A-.33+% . . 0F ==?/0#55J E FLL%+C D  yy{aff//4*8L mmF#SZZ((5 FFs8##BFFC032F88>>#**3/FFH$$     +U 33r3z/takeoff/file-previewctjjdd}tjjdd}|r|sytj |rd|vsd|vryt |z j }||z j }t|jt|tjzsy|jsytt||jS) zServe a Take-off working-folder file inline for the Project Information popup preview pane (DVI-641). Unlike /preview-file (PDF-only), the mimetype is auto-detected so images and text files render inline too.rr7rrrrr download_name)rrhrrarGrbr,r*rwrrrrr9rrrris r1takeoff_file_previewr-I2s ,,""8R0K ,,  62 &C c(   k *dk.ATS["+% . . 0F#&&(I y> $ $S[266%9 :"    $ S^9>> BBr3z/download-job-zipcltjjdd}tj |rd|vryt |z j }|jsytj}tj|dtj5}t|jdD]D}|js|j dk7s$|j#||j%|F d d d |j'd t)|d |d d S#1swY,xYw)zMZip the entire job folder (excluding state.json) and stream it as a download.rr7rr)rrrr1rhNrTrapplication/ziprr+r!)rrhrrarGrbr,rr>rJrr ZIP_DEFLATEDrrzrr9rr{rr)rrbufrrs r1download_job_zipr3^2s,,""8R0K   k *dk.A$+% . . 0F ==?& **,C c7#7#7 83B S)* 3Ayy{qvv5AMM&12 33HHQK  $ T*"   33s.D* D*#D**D3z/publishc"tjdxsi}|jdd}t|jdd}tj |rd|vrt dd id fSt|z j}|jst dd id fStjdd t|z j}t|jttjst dd id fS|jr4|st d|ddddfStj t|tj"t|t|t ddiS)zDCopy job folder to SHARED_DIR. Errors if destination already exists.Trrr7 overwriteFrrrr`Source folder not foundrMInvalid destination pathA folder named "z(" already exists in the shared directory)rrrU)rrrrrarGrrbr,rr rr*rwrr rmtreer)rrr5r$rs r1publishr;v2sd   4 ( .BD((8R(KTXXk512I   k *dk.A!123S88 { " + + -C ::<!:;>@AE%&eii 2D9%*9%5C Neii 2D9>CI>N%aRUVWRXR^R^R`c!flln%aC Neii8$?DI/DZ+mq^abc^d^j^j^lCFLLN+mC( J &b+m  ' *  J s<BE%E E ,E E*EE EE43E4rJctjddtjt j |dyNTrMrr)rBrrIrrrrJs r1_save_prodrun_approvedrO2s.dT2$$TZZA%>?r3rJcL ddlm} ||}|jxsdj sy|j dgDcgc]I}t |js|j jdjK}}tfd|Dsy|j dgDcgc]}t |js| }}|r%|jxsd t fd |Dsyy #t$rYywxYwcc}wcc}w) zuTrue when *url*'s host is in the allowlist and (if any prefixes are set) its path starts with an approved prefix.rrFr7rEz*.c3TK|]}|k(xsjd|z!ywr)r|)r,rnr$s r1r/z(_prodrun_url_approved..2s*Dqtqy2DMM#'22Ds%(rFc3@K|]}j|ywrT)rw)r,rrbs r1r/z(_prodrun_url_approved..2s8!4??1%8rT) r r ryr!rErr*rrVr2rb) rJrJr rrnrErprefixesr$rbs @@r1_prodrun_url_approvedrT2s& SM JJ " # # %D 7:wwy"7M`!QTUVQWQ]Q]Q_qwwy%++-`G` DGD D77?B7Ja3q6<<>JHJvv|8x88   aKs)D D&/DD!D! DDzresolutions.jsonrzOutside approved domains/paths Not a PDFz HTTP errorzSharePoint access deniedz Network errorz Merge errorz Unknown error)file_not_foundoutside_approved_domainnot_pdf http_errorsharepoint_auth network_error merge_errorr2c tjr9tjtj }t |t r|SiS#tjtf$rYiSwxYw)zDAll persisted resolutions, keyed by job_id -> {failure_key: record}.) PRODRUN_RESOLUTIONS_FILErrrrrrrrrs r1_load_prodrun_resolutionsr_3se # + + -::6@@BCD$%  I  ' *  I sA AA.-A.ctjddtjt j |dyrM)rBrr^rrrrs r1_save_prodrun_resolutionsra3s.dT2'' 4(BCr3c&|d|xsdd|xsdS)ztStable identity for a failed item within a run (survives merge_error's item_idx of -1 by folding in type + url).rSr7rX)item_idxtype_rJs r1_prodrun_failure_keyre3s#Zq" Qsybk 22r3rc X|jdxsd}tj||}|jddk(rdnd}ddd |d |d d |jd xsdd |d d|jdxsdd|jdxsdddg}dj|S)zSeed prompt fed to the existing Assistant so it can suggest a fix for one failure and a general rule to auto-resolve that error type in the future.categoryr2rTdrawingDrawingLabelzA Production Run PDF merge failed to fetch a source document. Help me resolve it, and suggest how Togen could auto-resolve this error type in the future.r7z- Failure category: r:r7z - Document: doc_numz (unknown)z- Source URL/path: rJ(none)z- Error detail: reasonz(none captured)zPlease provide: (1) the likely cause, (2) concrete steps to fix this specific failure, and (3) a rule Togen could apply automatically to prevent or auto-correct this category of error.r0)r_PRODRUN_CATEGORY_LABELSr)rr(rrdrPs r1_prodrun_resolution_promptro3s %%  (yC $ ( (c 2Ev)3IE  ugRuA. quuY'6;7r%B aeeEl6h78 155??.?@A  : E 99U r3zautotune_rules.jsonzDomain rewritez Path remapzSource substitution)domain_rewrite path_remapsource_substitutioncn tjrztjtj }t |t rCt |jdtr$|dDcgc]}t |t s|c}SgScc}w#tjtf$rYgSwxYw)z1All saved auto-tuning rules (list of rule dicts).rules) PRODRUN_AUTOTUNE_FILErrrrrrrrrrrrs r1_load_prodrun_rulesrwE3s ( ( *::3==?@D$%*TXXg5F*M#'=HaJq$4GHH II  ' *  I s*A1B3B B BBB43B4rtctjddtjt j d|idy)NTrMrtrr)rBrrurrr)rts r1_save_prodrun_rulesryQ3s3dT2$$TZZ%0@%KLr3c |jdxsdj}|tvry|jdxsdj}|jdxsdj}|r|sy|jdxsdj}|r |tvrd}|||||jdxsdjt |jd d d fS) zValidate/normalize the editable fields of a rule payload. Returns (fields, None) on success or (None, error_message) on failure. id, author, timestamps and provenance are managed by the route, not here.rTr7)NzUnknown rule typerG replacement)Nz'Both match and replacement are requiredrgnotesr~)rTrGr{rgr|r~N)rr_PRODRUN_RULE_TYPESrnr)rrtyperGreplr(s r1_prodrun_rule_cleanrV3sXXf  # * * ,E ''( XXg  $" + + -E HH] # )r 0 0 2D > 88J  %2 , , .C s22((7#)r002+,     r3 viewer_urlcddlm}m}d|vr4||}||j}|j ddgd}|r|S|S)aExtract direct PDF URL from Google Docs viewer wrapper URLs. Input: https://docs.google.com/viewer?url=http://fileshare.icastinc.com/shared/... Output: http://fileshare.icastinc.com/shared/... (with double-encoding resolved) Non-viewer URLs are returned unchanged. r)r parse_qszdocs.google.com/viewerrJr7)r r rr#r)rr rrLqsinners r1_extract_pdf_urlrn3sL0:-*% fll #urd#A& L r3c>ddlm}m}m}||}|jt k7ry||j }|jddgd}|rI|jtr4|ttd}|r t}|d||d} d || |d Sd |d S) ugRecognise SharePoint URLs from icastinc.sharepoint.com. Returns a typed dict: - AllItems.aspx?id= URLs → {type:"path", relative_path, fileshare_url, sp_server_path} - Sharing links (/:b:/s/…) → {type:"sharing_link", url} - Other SP URLs → {type:"sharing_link", url} (best-effort) - Non-SharePoint URLs → None r)r rrNrr7/shared/r6rrb)rT relative_path fileshare_urlsp_server_path sharing_link)rTrJ) r r rrr! _SP_HOSTNAMEr#rrw_SP_SYNC_PREFIXrCr) rJr rrrLrid_paramr _url_prefixrs r1_resolve_sharepoint_urlr3s76 c]F ,& &,, BvvdRD!!$HH''8 _!5!67 13K*m8E-c4R3STM!.!."*  #3 //r3rrc ddlm}tjtt t }|jdtdg}d|vr!td|jd d d y ||d}dttd|d}tj|d|ddddd }|jt|j} | r| j!j#dsd|dd} t%| } || z } d} | j'r-| j(} || d| dz } | dz } | j'r-t+| d5} |j-dD]}| j/| d d d td| jd | S#1swY%xYw#t0$r}td|d Yd }~y d }~wwxYw) zDDownload a file directly from SharePoint using app-only credentials.rrrr@z /.defaultrrz1[PRODRUN-SP] Failed to acquire SharePoint token: r4r2Tr8Nr6rz&/_api/web/GetFileByServerRelativeUrl('z ')/$valuerapplication/octet-streamrrrrxr7rrfile_04dr^r r z-[PRODRUN-SP] Downloaded from SharePoint API: z-[PRODRUN-SP] SharePoint API download failed: )r rrrrrrrrrAr _SP_SITE_PATHrraise_for_statusrr9rEr|rrrr? iter_contentrry)rrr_qrr encoded_pathapi_urlrfnamerrrrchunkrls r1_download_from_sharepointr3s-,77 %7:W !::|nI67;9  - C##$7CDF  .s3 |n]O4++7.  C !! #*<+G*H!I4  ^$))EKKM226:E#;d+E&%kkm99Day55D qLGkkm$  **40    =dii[IQUV     =cUC4Ps=A)F,,CF, F,(F <#F, F)%F,, G5G  Gcddl}ddlm}m} |jgddd}d}|j D][}|j}|jd s%tj|jd d d j}n|r|jd sy|jdd}|r d|vr|jddzn|}|j|} | |j|j krddl} t dd | j#gddd| jgddd} | j D][} | j} | jd s%tj| jd d d j}n|jd S#t$r}t d|d Yd}~yd}~wwxYw#t$r}t d|d Yd}~Ud}~wwxYw)uGet a Graph-compatible access token from rclone's OneDrive/SharePoint config. The rclone remote iCast_StackIT has delegated tokens with Files.Read.All and Sites.Read.All — sufficient for resolving sharing links. rN)rr)rclonercshow iCast_StackITTr)r&r7z([PRODRUN-SP] rclone config read failed: r8ztoken ==r^rexpiryr7+Z+00:00u0[PRODRUN-SP] rclone token expired, refreshing…)rlsfziCast_StackIT:z --max-depthrFr)r7r6z*[PRODRUN-SP] rclone token refresh failed: )r9rr check_outputryrA splitlinesrrwrrrrr8 fromisoformatrutcr:) r9rrrrl token_datarsrexp_strexp_dt_spout2l2s r1_get_rclone_sp_tokenr3s +((( 9r# J!!#zz| ??9 %DJJsA$6q$9$?$?$ABJ   Z^^N; ^^Hb )F  R7:&7HfmmC(83fG++G4Fhll33(HPTUO "49''Ar(+//+BB}}Y/%)ZZa0@0C0I0I0K%L   >>. ))?  8>dK: R >seDD Q Q Rs6G>B:G)99G) G& G!!G&) H 2HH ch dtj|jjdj z}dt dzfd}|}|rdd|ini}d}|rs r1_try_graph_tokenz2_resolve_sp_sharing_link.._try_graph_token4sE77 %7:W 44:;5=zz.))r3rrz(https://graph.microsoft.com/v1.0/shares/z /driveItem$selectzname,parentReference,sizerrxparamsr7rrzM[PRODRUN-SP] App credentials lack Graph file permissions, trying rclone tokenTr8z-[PRODRUN-SP] No rclone token available eitherr7rKr9parentReferencerbz)[PRODRUN-SP] Sharing link resolved: name=z parent=r6ru*[PRODRUN-SP] Sharing link → local file: z[PRODRUN-SP] Local not found: rrrz#[PRODRUN-SP] Trying fileshare URL: rr7rrrrr^r rrz'[PRODRUN-SP] Downloaded via fileshare: z=[PRODRUN-SP] Fileshare download failed, trying Graph downloadz no responsez%[PRODRUN-SP] Graph driveItem lookup: r\z/driveItem/contentrContent-Dispositionz filename=z" z/[PRODRUN-SP] Downloaded via Graph sharing API: z-[PRODRUN-SP] Sharing link resolution failed: )"base64urlsafe_b64encoderr8decoder*rrrgrArr_SP_DRIVE_SYNC_ROOTrMrCr rr rrrrrr?rrr9ryr&rxrrrEr|)rJrr sharing_tokenrrrx meta_resp rclone_tokenrmeta parent_pathmarkerr rel_parent local_pathrrrfs_respdl_fnamerrrrrdrdl_respcdrls r1_resolve_sp_sharing_linkr3s633CJJLAHHNUUWWM*cDj*$%L=I', 89rGI"&&6}oZ P:;   J . aim nII11Z?+- 'L&',(@AG&**:=/T!#>? I A NH ..#5>>#DHHVR(E((#4b9==fbIK =eYh{o^fj k+,A.F""6*CaxE(s6{):);< '*4u< $$&FzlS[_`%%6zlC4P.57 #.-xj3>NQV>V]`8a7b c ;M?KSWXg,00TXYG,,.9>u5eERU;VZD[H#h.DG++-'TYYKq *FF1 ++-dD)+Q%,%9%9$%?+EGGEN++CDII;OW[\K/8Y**]F+49>>$3'"D 9&4&IQU V!$$6}oEW X     "$$%:B?Bb -b177=EKKM226:E#;d+E&%kkm 1WIT::D qLGkkm$   --d3    ? {KSWX K++ !gYaeffg8    =cUC4Ps7C RAR A=Q% Q%(Q>#Q%"DR? R (R4#RQ"Q%%Q?;R>Q??RR R R1R,,R1c456ddlm}ddlm6t|z }t |}|st |dddy|jjd}||z }|d z }|d z }||fD]}|jd d t |d dd|jdg} |jdi} |jdi} t5g} g} d}t| D]\}}| jt|i}|jdd|dz}|jd}d}|r|jddk(rn|r&|jddk(r|dt|d}na|r:|jddk(r&|jdrt|d|dd}n%|jdrt|d|dd}|rZ||d<||d<|jd |dz|d <t| jt|d!|d"<| j!||jd#}d}|r|jddk(rn|r&|jddk(r|dt|d}na|r:|jddk(r&|jdrt|d|dd}n%|jd$rt|d$|d$d}|rZ||d<||d<|jd |dz|d <t| jt|d!|d"<| j!||jdrk|jd$r~t|| vs|d!z }t |d d%t#| d&t#| d'ddtd(t$d)td*t&t$dzt(dzff6fd+ 4d,t(d(t$d)td*t&t$dzt(dzff45fd- }g}g}t| D]\}}||||\}}|r$|j!||jd"d!f9|j!|d|d|jd d|jd.|jd|jdd/|xsijd0d1|xsijd2d3d4g}t| D]\}}||||\}}|r$|j!||jd"d!f9|j!|d|d|jd d#|jd.|jd|jdd/|xsijd0d1|xsijd2d3d4t |d d5t#|d&t#|d'ddd6lm}g}| j/D]\} }d7D]}!|j|!}"|"r|"jds(|j!t| j1r t| n| |!|"jd|"jdd/|"jd8d/|"jd9d/d:d;|t#|||t#|d<}#|r |}$|D]/\}%}&t3|&D]}'|$j!t|%1|d=}(||(z })t5|)d>5}*|$j7|*ddd|(|t#|$j8d?t;|d/@dAt;|(d/@dBt;|d/@dAt;|(d/@dC|#dD<|r |}$|D]/\}%}&t3|&D]}'|$j!t|%1|dF}(||(z })t5|)d>5}*|$j7|*ddd|(|t#|$j8d?t;|d/@dAt;|(d/@dBt;|d/@dAt;|(d/@dC|#dG<dID]3\},}-|#j|,s|j!dJd/d|-d/dK|#|,d45t#||#dL<||#dM<t ||# t?dNr+d/x}.}/| D]9}0|.s|0jdOr|0dO}.|/s|0jdPr|0dP}/|.s6|/s9ntA|D1chc]}1|1jd0d1c}1}2g}3|.r|3j!|.|/r|3j!dQ|/|3j!t#|dR|r|3j!t#|dStCdNdT|jdUd/dVjE|3||#jdWt#|t#||2|.|/dXYyy#1swYxYw#t<$r}+t|+|#dE<Yd}+~+~d}+~+wwxYw#1swY"xYw#t<$r}+t|+|#dH<Yd}+~+d}+~+wwxYwcc}1w#t<$r"tFjHjKdZYywxYw)[zEBackground worker: download PDFs from saved state and merge each set.rrrrzNo state foundrdrNrrlabelsTrM processinguPreparing downloads…rdrr overrides quantitiesrkzRow rrhrTremovedrr)rjob_dirrJ)rJ original_url drawing_urlrcrow_numr^qtyr label_urlz Downloading z drawings and u labels…rrr$c tj|dd} |j|}|j rt |j jnd }|r|jjd sd |dd }t|}||z }d} |jr-|j} || d| d z }| dz } |jr-t|d5} |jdD]} | j|  ddd|dfS#t$r"t |dd}|dvrdnd}d|d |d fcYSwxYw#1swY;xYw#t$r} ddt!| ddd fcYd} ~ Sd} ~ wwxYw)zDownload a PDF. Returns (path, None) on success or (None, error) where error is {category, reason} for DVI-959 failure diagnostics.rTrrgNrrZrYzHTTP rgrmr7rrrr^r rrr[rK)rrrryrerbrr9rEr|rrrr?rrr*)rJrrrr3r(rLrrrrrrrlr s r1 _download_pdfz,_prodrun_merge_worker.._download_pdf4s Q!%%c3tDD I%%' c]F.4kkD%**rE 6 6v >c{$/#E*Ee#DG++-yyTF!G9D"991 ++-dD! #Q!..t4#EGGEN# #: % It]D9+/:+='<#5HHH I # # QoS$3PP P Qs^EDB+E E$(E E(EEEEE E E9E4.E94E9r$cd|vrst|d|dz }|jsddd|jdddfS|jj dk7rddd |j dfS|dfS|d } jd rt | s dd d |dddfSt|}|r|ddk(rt|d ||}|r|dfSddddfSt|dz }|jr1|jj dk(rtd|d|dfStdd |d||\}} |r|dfStddt|d||} | r| dfS| xsijdd} | dk(rd| xsijddvrd} d| | xsijdddfS |||S) NrrrVzFile does not exist: r7rrrXzProvided file is not a PDF: rJr~rWz*Source host/path not in approved domains: rTrrZz-SharePoint sharing link could not be resolvedrz&[PRODRUN-SP] Using local synced file: Tr8z2[PRODRUN-SP] Local not found, trying fileshare URLrz4[PRODRUN-SP] Fileshare failed, trying SharePoint APIrrgrY403rmzSharePoint download failed) rrrr!rEr9rTrrr rAr)r$rrrrJsp_inforrr>errresult2r(r approved_cfgs r1_resolve_sourcez._prodrun_merge_worker.._resolve_source4s] S=S^$s6{2A88:*:*?PR@S?T(UWWWxx~~6))*Fqvvh(OQQQd7N%j   I &/DS,/W&?&PQTUYVYQZP[$\^^ ^)#. v.0,WU^XuMd7N*;(WYYY$go&>>J  "z'8'8'>'>'@F'J>zlKSWX!4'' Ft T'(@(ERKFCt|# HQU V/8H0I8UZ[G}$9"//*.?@Cl"u"0M'M'c%(YBOOH>Z$[]] ]S(E22r3rr7rgr2rmDownload failed)rcrkrrTrJrgrmzMerging  PdfWriterrhr applied_by applied_at)rcrTcorrection_typerrrdone)rd skipped_rowsfailed_downloads failed_items correctionscorrected_countz Drawing Merge.pdfrzprodrun-preview?job_id=rrzprodrun-download?job_id=)rr^r@rr drawing_mergedrawing_merge_errorz Label Merge.pdf label_mergelabel_merge_error))rrh)r rrr\rrprodruncustomerso_numzSO z failedz correctedr:run_by · rd)rdrr categoriesr r actorsummaryrdetailzprodrun history record error)&rrr r rB_prodrun_load_state_prodrun_write_statustodayrrrrKrr*rrrirCrtuplerrJrrisdigitrr?rrrry_is_history_capture_enabledrrecord_historyrrmrnr)7r^rrrodate_strdate_dir drawings_dir labels_dirrnrrrdrawing_sources label_sourcesrritemrrkdraw_ovdraw_srclbl_ovlbl_srcr drawing_filesrr$rr label_filesrridx_strkindor>rrrr  merged_name merged_pathrrl_mk_mlabel_cust_so_itfi_cats _summary_bitsrrr s7 @@@r1_prodrun_merge_workerr- w4s %F"G  (E g'DT'UVzz|$$Z0H!Hj(LH$JJ '- t,-'lG_#`a IIgr "E +r*I<,J)+L#%O "MGU#)4 ]]3q62 &((9QUGn5&&# $ w{{6*i7  V,6 ' 0S\JH V,5'++g:N/0@ASZ[bScdH XXm $/]0CDVZ[hVijH #$HZ ")HY "&((9a!e"RUVcRdQeeop$rsQ3Q$QsQuTD[RVY]R]E]?^Q:,3T,3T,3#,3%t UY\`U`H`Ba,3\-/M!LO, 3 lA63  !SWWUA%6!7 8    Oy>779-!ww~swwucggfb>Q/RS YBOOJ B9"//(4EF!  +-KM* 3 j!43   3775!#45 6    Oy>779-ww~swwucggfb>Q/RS YBOOJ B9"//(4EF!  'l!)#m*<)=^CP[L\K]]gh$jk !K (  ( Dt AAEE&M   ,/L,@,@,BCL#$55=w+eeL"5eeL"5      -$"{+ F 5[F!. 1 #s1AMM#h-01 1&J&89K"[0Kk4( A Q ( !&,,/!8vB9O8PPVW\]hoqWrVst":5b;Q:RRXY^_jqsYtXu v 'F? # 3[F!, 1 #s1AMM#h-01 1&J&67K"[0Kk4( A Q ( !&,,/!8vB9O8PPVW\]hoqWrVst":5b;Q:RRXY^_jqsYtXu v %F= !] W ::c?   2$)VC[! "%\!2F )F>'6*"= &y 1 EC !4 OEswwx0h-CS  LQbBFF:y9QREM$$U+$$s3%[1  C $5#6g!> ?$$K(8'9%DE 5ii"- M2$jj2(+L(9'*;'7"' %!  % 2_   5,/HF( ) 5   3*-c(F& ' 36R. = ;<=s+Ag <gAg /Ag?g2Ag?Ah)h) h)h$8Ch)g g g/g**g/2g<7g?? h!hh!$h))(iic>t|z j}t|jttjsy|j sy|j D],}|j s||z }|j s*|cSy)aLocate a merged PDF for a job, regardless of which date subdir it sits in. Merged files are written under PRODRUN_DIR///. Live runs use today's date, but History opens older runs, so we search all date subdirs instead of assuming date.today(). N)rBr,r*rwrrYr)r^rrr\rs r1_prodrun_find_filer/ 5s & ) ) +D t9  K$7$7$9 : ; ;;=||~ ::<>D{{}  r3rc |dz S)Nzprodrun_state.jsonrX)rs r1_prodrun_state_pathr1 5s ) ))r3ct|}|jr#tj|j SiSrT)r1 rrrrrrs r1r r 5s.G$A() 4::akkm $::r3cbt|jtj|dyr)r1 rrr)rros r1_prodrun_save_stater5 5s  ++DJJuQ,GHr3cV|dz jtj|dyN status.jsonrrrrrrrds r1r r 5  }((F1)EFr3rc \g}t|dd5}tj|}t|dt |dD]\}}t |dkDr|dj nd}t |dkDr|dj nd}t |dkDr|dj nd}t |d kDr|d j nd} t |d kDr|d j nd} |s| s| s|j||||| | d  ddd|S#1swY|SxYw) Nr7rrrrqr^rrrrrkr r rr)r?rrOrrrCrri) rrrrOrrrkr r col_ocol_ps r1_parse_csv_prodrunrB 5sE h[ 9RB VT%fA6 LGS(+C1 c!flln"G),SAs1v||~2H'*3x!|SV\\^F'*3x"}CGMMO"E'*3x"}CGMMO"E5 LL""$ $"   & L'& Ls DD!!D+ xlsx_pathc 2t|dd}t|jdkDr|jdn|jd}g}t|j dddD]\}}|rt|dkr|dt |dj nd}t|d kDr!|d t |d j nd}t|d kDr!|d t |d j nd}t|d kDr!|d t |d j nd} t|d kDr!|d t |d j nd} |s| s| s|j||||| | d !|j|S)NT) read_only data_onlyr^rr)min_row values_onlyr= r7rrr> rr? ) rrC worksheetsr iter_rowsr*rrir[) rC rwsrrrrkr r r@ rA s r1_parse_xlsx_prodrunrL 5s yDD AB /!3q q9IBE!",,qd,"KSTU c#hl ),Q);#c!f+##%*-c(Q,3q6;M3s1v;$$&SU(+C1 Q9KSV""$QS(+C2 #b':MCG ""$SU(+C2 #b':MCG ""$SUuU        $HHJ Lr3z/prodrun-uploadctjjd}|r |jst ddidfS|jj }|j ds |j dst ddidfSttjdd }t|z }|jd d |t|jz }|j|g}|j dr t|}n t|}|s/t!j"t|d t dd idfSt%|t|j|idt ||dS)zTAccept a CSV or XLSX, parse items with Document Numbers and URLs, return for review.rrrr`r.xlsxzFile must be a .csv or .xlsxNrTrM ignore_errorszNo items found in file)rrr)rr)rrrrrrEr|r*rWrXrBrrrrL rB r r:r5 )csv_file fname_lowerr^r saved_pathrs r1prodrun_uploadrT 6sY}}  'H 8,,!345s::##))+K    ' 0D0DW0M!?@A3FF  r "FF"G MM$M.?8+<+<==J MM*EG$#J/":.  c'l$7!9:;S@@'(9(9:" fu5 66r3z/prodrun-upload-filec tjjd}tjjdd}tjjdd}tjjdd}|r|jr|r|st ddidfSd |vrt dd idfS|jj jd st dd idfSt|z j}t|jttjst dd idfS|jd d t|j}|j||z t d|iS)z9Accept a per-item file override for production run merge.rrr7rrrrr`rrrFile must be a PDFTrMr)rrrrgrrrEr|rBr,r*rwrrr)rrrrrrs r1prodrun_upload_filerW )6sR  &!A \\  h +F!!,3J   b1I AJJfI!567<< v~!123S88 ::    & &v .!567<<V#,,.G w< " "3{':':'<#= >!123S88 MM$M. AJJ 'EFF7U? J& ''r3/prodrun-submitc8tjdxsi}|jdd}|jdi}|jdi}|rd|vrtdd id fSt|z j }t |jt tj stdd id fSt|}|stdd id fStjd xsi}|jd xs|jdxsd}tjjd}|jD]r} t| tsdD]Z} | j| } t| ts%| jds7| j!d|| j!d|\t||d<||d<||d<t#||t%j&t(|fd} | j+td|iS)z9Accept reviewed items with overrides and start the merge.Trrr7rrrrrr`u*No upload state found — upload CSV firstr'r9rr2secondstimespecrrTrrr r(r^)rrrrrBr,r*rwr rrrrrrrr}r5 rrr- rq) rrrrrro_u_who_when_ov_kind_ors r1prodrun_submitrc C6s   4 ( .BD XXh #Fb)I,+J TV^!123S88V#,,.G w< " "3{':':'<#= >!123S88  (E !MNOQTTT V  "B 66&> 9RVVG_ 9 D    * *I * >E!3#t$ ) 3EB"d#v lD1 lE2  33#E+$E,E(O' 5VIdSAGGI Hf% &&r3z/prodrun-statuscTtjjdd}|rd|vrtddidfSt|z dz }|j stdd d S tt j|jS#t$rtdd d cYSwxYw) z%Poll for production run merge status.r^r7rrInvalid job_idr`r8 ruInitializing…ruReading status…) rrhrrrBrrrrry)r^ status_paths r1prodrun_statusrg o6s\\  h +F TV^!123S88&6K    )8IJKKNtzz+"7"7"9:;; N)8KLMMNs!+B B'&B'z/prodrun-previewctjjdd}tjjdd}|r |rd|vsd|vryt||}|syt t |dS) z5Serve a merged production run PDF inline for preview.r^r7rrzInvalid parametersr`rrr rrhrr/ rr*r^rris r1prodrun_previewrl 6si\\  h +F||+H TV^tx7G("684I $ S^.? @@r3z/prodrun-downloadctjjdd}tjjdd}|r |rd|vsd|vryt||}|syt t |d|S) z%Download a merged production run PDF.r^r7rrri rTrr+rj rk s r1prodrun_downloadro 6sj\\  h +F||+H TV^tx7G("684I $ S^4x PPr3z/prodrun-historyr)rctjjddv}tjjdxsdj}g}tj rtj D]}|js|dz }|j s+ tj|j}|jd}|dvret|}|jdg}d} d} |D]9} | s| jd r| d } | s| jd r| d } | s6| s9n|jd xsi} |jd xsi} t|jd xsgDchc]}|jddc}}|r|dk7r|jdsD|r||vrL |jj}|j#|j$t'|dz|jddt)|| | | jd| jd|jdd||jdd|jdd|d |j+ddt-d|iS#t$rY3wxYwcc}w#t $rd}YwxYw)aList completed production runs, latest first (DVI-528). Each entry summarizes a finished merge job; the client reuses /prodrun-status?job_id= to load full detail (merged-file preview / download URLs) when an entry is opened. DVI-959 P2: optional filters ``failures_only=1`` and ``category=`` let the Auditor Production Run sub-tab focus on problem runs. failures_onlyrErdrfrgr7r8 rd)rrrr r rr rr2rrrrr@r) r^ timestamp_msrrr r drawing_pages label_pagesrrdrrr c |dS)Nrt rXrs r1r z!prodrun_history..6s An-r3Tr r)rrhrrrBrrYrrrrryr rrrrrir9rrCrr)f_failures_only f_categoryrrrf rdstrorr r itdmlmr* catsmtimes r1prodrun_historyr 6sll&&7;OOO,,"":.4";;=JD"**,5 G>>#!M1K%%' K$9$9$;< H%B**'0EIIgr*EHF BFF:$6!*~H"&&"2\F  O,2BM*0bB&,jj&@&FBI!66*i8IJD2=DV9Wj4 #((*33 KK!,, #EDL 1 % ." =!%j$ !# !5!vvl3$*JJ/A1$EGR0#)::.?#C" O5 l II-tI< FD> ""_  (I  s**#J%J5 J:% J21J2: KKz/prodrun-approved-sourcesGETc(ttS)z?DVI-959 P2: return the approved domains/paths allowlist config.)rrKrXr3r1prodrun_approved_sources_getr 6 )+ ,,r3cdtjdxsi}t}t|j dd|d<t |j dt rG|dDcgc]5}t|jst|j7c}|d<t |j dt rG|dDcgc]5}t|jst|j7c}|d<t|td|dScc}wcc}w)zCDVI-959 P2: save the approved domains/paths allowlist (admin only).Trr~FrErF)rUrc) rrrGrrrrr*rrOr)rrJrnrs r1prodrun_approved_sources_saver 6s   4 ( .BD # %C$((9e45C N$((9%t,26y/TQSV\\^#a&,,.TI$((?+T28<_8M`1QTUVQWQ]Q]Q_A `O3 $#. // U`s)D(D(D-.D-z/prodrun-resolutionsctjjdd}|rd|vrtddidfStdt j|iiS)zGDVI-959 P3: resolutions recorded for one run (job_id) -> {key: record}.r^r7rrre r` resolutions)rrhrrr_r^s r1prodrun_resolutions_getr 6sZ\\  h +F TV^!123S88 M#<#>#B#B62#NO PPr3z/prodrun-resolve-promptcbtjdxsi}tdt|iS)uDVI-959 P3: build the Assistant seed prompt for a failure. No LLM call happens here — the frontend feeds this into the existing Assistant surface.Trprompt)rrrrors r1prodrun_resolve_promptr 7s/   4 ( .BD H8>? @@r3z/prodrun-resolve-failurec tjdxsi}|jdxsdj}|rd|vrt ddidfSt |z j st dd id fS|jd xsdj}|st dd idfStjd xsi}|jdxs|jdxsd}t|jd|jd|jd}||jd|jd|jd|jd|jd|jd||jddk(rdnd|tjjdd }t}||j|i|<t| tdrY|jdxsd}t!dd|t"j||d|d d!|||jd|d|d"#t d|d$S#t$$rYwxYw)%zDVI-959 P3: record a human resolution for one failed item (mark resolved, how it was fixed, who/when). Persisted per job as the tuning foundation for the future Option 3 rules engine, and mirrored into shared history.db.Trr^r7rrre r` Run not foundr resolutionzA resolution note is requiredr'r9rr2rcrTrJrkrgrmsourcerrrZ r[ ) r)rcrTrkrgrJrmr r resolved_by resolved_atr r,r>Nr)rgrJr r r rUr)rrrrrrBrrrerrrr_r}rar r rnry) rr^r r] whor)rstore_cats r1prodrun_resolve_failurer 7sV   4 ( .BDhhx &B - - /F TV^!123S88 & ( ( *12C77((<(.B557J !@ABCGG V  "B &&. 8BFF7O 8yC txx 3TXXf5EtxxPU WCHHZ( 88I&HHZ(xx((8$ !%(!3{!B+%))+55y5I F & 'E(.EVR %e$ &y 1::j)6YD 9377dCDBzRUSUFWX $!::e,$X.",   $&1 22    s3A$I%% I10I1z/prodrun-autotune-rulesc6tttdS)zDVI-963 O3.P1: list saved auto-tuning rules. Read-only for prod-run users; editing is admin-gated below. Rules are inert in P1 (no merge consumes them).)rtrV)rrwr}rXr3r1prodrun_autotune_rules_getr G7s 02=PQ RRr3z/prodrun-autotune-rulectjdxsi}t|\}}|rtd|idfSt j dxsi}|j dxs|j dxsd}t jjd }d d tjjd dzi||j dxsdjxsd |j dxsdjxsd |||d}t}|j|t|td|dS)zDVI-963 O3.P1: create an auto-tuning rule. Optionally seeded from a saved resolution (source_job_id/source_key). Created disabled by default; enabling is inert until P2 (dry-run) / P3 (live) wire application.Trrr`r'r9rr2rZ r[ ratr_Nr- source_job_idr7 source_key)r r created_byrrrUrule)rrrrrrrrrrWrXrYrrwriry)rrrr] r rr rts r1prodrun_autotune_rule_creater O7s4   4 ( .BD%d+KFC ~&++ V  "B &&. 8BFF7O 8yC     ( () ( cdvsdvrtddidfStjdxsi}t|\}}|rtd|idfSt }t fdt |Dd }|d krtdd id fS||}|j|tjjd |d<t|td|dS)zHDVI-963 O3.P1: edit an existing rule's fields / toggle its enabled flag.rr6rzInvalid rule idr`Trc3RK|]\}}|jdk(s| ywrNr)r,rrrule_ids r1r/z/prodrun_autotune_rule_update..v7s$Ida!%%+2HI''rrRule not foundrrZ r[ rr ) rrrrrwrrrrrrry)r rrrrtrrs` r1prodrun_autotune_rule_updater k7s w#.!234c99   4 ( .BD%d+KFC ~&++  !E Ii.I2 NC Qw!123S88SzH OOF+//1;;Y;OH\ $1 22r3DELETEct}|Dcgc]}|jd|k7s|}}t|t|k(rtddidfSt |tddiScc}w)zDVI-963 O3.P1: delete a rule.rrr rrUT)rwrrCrry)r rtr new_ruless r1prodrun_autotune_rule_deleter 7sp !E!g} t%| tr| g} |jd?d} gd@} $d#z } t'dt)| d#D]~}| ||d#z}|D]^}|| v}#j dAdd2#j d5d5|rdBnddC#j d ddD#j | d5z d5dE|z`#jdFdG| v}#j dAdd2#j d5d5|rdBnddC#j d ddD|r| rdH| zndI}#j | d5z d5dE|z#jd3#j}$d:z }#j*}#j d dd#j |d5dJd#j d dd2#j |d3|jdKddd4#jd:#j d dd#j |d5dLd#j d dd2#j |d3|jdMddd4#j}|jdNd}||z}#j||#j d dd#j |d5dOd#j-|dPD]r}||k(}#j dAdd2#j d5dF|rdBnddC#j d ddD#j |d5z dFdE|zd#j-|t#j}#j#t/||dz|jdQd}#j dAdd2#j d5d5|rdBnddC#j d ddD#j $d5z d5dRd|r|jdSxst0Dcic]}|dTc}}|j3Dcgc]\}}|s |j5}}}#j d dUd#j d5dd#j $d5z ddV|rdWj7|ndXzd#jd##j|#j &#j d dd2#j $ddYdTdZ#j "|xsi} | jd[dxs|jd\r|d\d]nd}!|d^| jd_dfd`| jdadfdb|!fgdcd#j9Scc}wcc}}w)fuGenerate a Work Order Request PDF matching the ICAST template layout. *maintenance* — optional dict with keys ``accepted_by``, ``date``, ``work_order_number`` to fill the "For use by maintenance department" block. Prletter orientationunitformatFrrxrrrrr r rrr HelveticaB2r-ICASTrlnzMaintenance Work Orderr^rcjjjdddjdd|zddjy Nr r rr Tr^fillr set_fill_colorset_text_colorset_fontcellreblackr6pwtealwhites r1section_headerz)_generate_wor_pdf..section_header7]D!E" [#r* Qu 4A6E"r3rc Dt|z }jddd|D]\}}j|d|jdjddd|D]'\}}j||t |xsdd)j|yNr r rrr7ryborderrCr r r r*pairsrow_hcol_wrr rQr6r s r1label_value_rowz*_generate_wor_pdf..label_value_row7SZ [#q) &HE1 HHUAu % & q  ["a( ?FAs HHUE3syb>#H > ? u r3Requestor informationr1rr7Phone #rEmailrrPRequest detailsr2r3Locationrr4rMan Holeman_holeEquipment/asset/system affectedrrr!Attached repair / operator manualryrr r rr5rr;rSr@)$Type of issue (check all that apply)rBissue_type_other r6r7r8r9r:r;r<r=r>r?r ZapfDingbatsrJr rr @r@Other: Other:rCrDrErrUrgency (check one)rFrz@ Return-to-Service (RtS) approval required upon work completionrTIzApproving departments: r—# For use by maintenance departmentr work_order_numberrr Accepted by accepted_byDaterAssigned work order #rr r)rset_auto_page_breakadd_pagerr r r r rr*r set_draw_colorget_xget_yrDset_xy multi_cellset_yrrrCl_marginset_xrCrOr capitalizerr)'rr dark_graylight_bgr r _manualrx0y0 issue_types other_textrWr row_start row_itemsr checked other_checked other_display y_sectionhalfr~ left_end_yrurg_xlevel right_end_yrrn rts_deptsrrwo_numr r6r r r s' @@@@@r1_generate_wor_pdfr" 7sJ 3T( ;C'LLN B DI EH ELLc2&CHHRWH#HHQ,H3FF1I## *+ 488$4b9: DHHWb)* $((7B'( FF1I$% DHH%6;< TXXj"-. TXXj"-. TXXj"-. *DHH[",EF hhx &BG{{?# [#q) Q;< q  ["a( QGKK<=caPFF1IC!LLc1%HHR)aH0LLb!$ 88M2 &DsC% YY[#))+BHHRRJJrAvrAvNN263%IIb2gLLc1%HHR:qHA((<,K+s#"m ,b1JI FE1c)na0 i A 6  0Dk)G LLQ / HHQ'3r!H < LLb! , HHUQY4$; /  0 s {*MLLQ'HHQ-3RH:LLb!$.; I *PXMHHUQY4-/0FF1I I 6D BLLc1%HHT1.1H5LLb!$HHT1dhh|R0HCFF1ILLc1%HHT1/AH6LLb!$HHT1dhh8"=caHPJhhy"%G IEJJui LLc1%HHT1+H2IIe*U" ^R+ CR: ["a( 3u 3 % ))+KIIc*k*Q./88NE2LLLQ'HHQ,3BqH9LLb!$HHR!VQZ_`HaHH./PZ3PAtG3P .7oo.?Eda11<<>EE [#q) Ar a5w79K\abghiFF1IC "CLLc1%HHR9HKCrA UU& + pPTPXPXYfPg4 3Fs2KmoF mR01 vr"# &)  ::<)4QEs* b b!b!c !"#$%tddd""jd"j"jdz #d$d }d %d }d !"j d dd"j !"j dddd"j d dd"j dddd"jd!"#$%fd}dp"#fd }|d|d|jddfd |jd!dfd"|jd#dfg"jd$|d%|d&|jd'dfd(|jd)dfg|d*|jd+dfd,|jd-dfd.|jd/dfg|jd0xsi}|jd1ry"j d dd"j #dd2"jd"j d dd3"j #d4t|jd1ddd5"jd$"j|"j d dd"j #d6d7d"j d dd3|jd8d}"jd9d9d9"j"j} }"j|| #d:"j|d;z| dz"j!#dz d<|"j#| d=z"j d dd"j #d6d>d|jd?g} t%| tr| g} |jd@d} gdA} #d$z } t'dt)| d$D]~}| ||d$z}|D]^}|| v}"j dBdd3"j d6d6|rdCnddD"j d ddE"j | d6z d6dF|z`"jdGdH| v}"j dBdd3"j d6d6|rdCnddD"j d ddE|r| rdI| zndJ}"j | d6z d6dF|z"jd4"j}#d;z }"j*}"j d dd"j |d6dKd"j d dd3"j |d4|jdLddd5"jd;"j d dd"j |d6dMd"j d dd3"j |d4|jdNddd5"j}|jdOd}||z}"j||"j d dd"j |d6dPd"j-|dQD]r}||k(}"j dBdd3"j d6dG|rdCnddD"j d ddE"j |d6z dGdF|zd"j-|t"j}"j#t/||dz|dR"j d dd"j #dSzd6dT"j #dUzd6dV"j #dSzd6dW"j #dSzd6dX"jd6|jdYg}"j d ddE|dZdED]}"j #dSzd4t|jd[ddD"j #dUzd4t|jd\ddD"j #dSzd4t|jd]ddD"j #dSzd4t|jd^ddD"jd4|st'd$D]s}"j #dSzd4ddD"j #dUzd4ddD"j #dSzd4ddD"j #dSzd4ddD"jd4u"jd"j d ddE"j #d6d_t|jd`dzdab"jd"j|"j %"j d dd3"j #ddcddde"j !|xsi}|jdfdxs|jdgr|dgdhnd} |di|jdjdfdk|jdldfdm| fgdno"j1S)qu(Generate a Preventative Maintenance Work Order PDF. Mirrors the standard maintenance template plus a Parts table (matching the Mobile Machine layout). The "Completed / In progress" status selections are intentionally omitted — status is tracked by Work Order Admin processing. r rr r Fr rxr r r r r r r r r r-r rr z#Preventative Maintenance Work Orderr^rcjjjdddjdd|zddjyr r r s r1r z4_generate_preventive_wor_pdf..section_header_8r r3rc Dt|z }jddd|D]\}}j|d|jdjddd|D]'\}}j||t |xsdd)j|yr r r s r1r z5_generate_preventive_wor_pdf..label_value_rowf8r r3r r1rr7r rr rrPr r2r3r rr4rr r r rrrr ryrr rr5rr;rr r rBr r r rJr rr r r@r r rCrDrErrr rFParts皙? Part Number皙? Part NameQuantityAmountpartsNrr9ramount Parts Total: parts_totalRalignr Tr r rrr r r rr rr r rr r rr r r r rr*r r r r rDr r r rrrCr r rCr)&rrr r r r r rr r r r rWr r r r r r r r r r~ r rr r r r0 rr rr! r r6r r r s& @@@@@r1_generate_preventive_wor_pdfr8 E8sp  3T( ;C'LLN B DI EH ELLc2&CHHRWH#LLc2&HHQ9aH@FF1I## *+ 488$4b9: DHHWb)* $((7B'( FF1I$% DHH%6;< TXXj"-. TXXj"-. TXXj"-. *DHH[",EF hhx &BG{{?# [#q) Q;< q  ["a( QGKK<=caPFF1IC!LLc1%HHR)aH0LLb!$ 88M2 &DsC% YY[#))+BHHRRJJrAvrAvNN263%IIb2gLLc1%HHR:qHA((<,K+s#"m ,b1JI FE1c)na0 i A 6  0Dk)G LLQ / HHQ'3r!H < LLb! , HHUQY4$; /  0 s {*MLLQ'HHQ-3RH:LLb!$.; I *PXMHHUQY4-/0FF1I I 6D BLLc1%HHT1.1H5LLb!$HHT1dhh|R0HCFF1ILLc1%HHT1/AH6LLb!$HHT1dhh8"=caHPJhhy"%G IEJJui LLc1%HHT1+H2IIe*U" ^R+ CR: ["a( 3u 3 % ))+KIIc*k*Q./7LLc1%HHR#Xq-(HHR#Xq+&HHR#Xq*%HHR#Xq(#FF1I HHWb !ELLb!$bq  c1c$((8R"89#F c1c$((62"67D c1c$((5""56sC c1c$((8R"89#F q  q A HHR#Xq"SH 1 HHR#Xq"SH 1 HHR#Xq"SH 1 HHR#Xq"SH 1 FF1I   FF1ILLb!$HHROc$((="*E&FFcHRFF1IC "CLLc1%HHR9HKCrA UU& + pPTPXPXYfPg4 3Fs2KmoF mR01 vr"# &)  ::<r3c tdddjdjjdz dd }d d d }j d ddj j ddddj ddddjdfd}dnfd }|d|d|jddfd|jd dxs|jd!r|d!d"ndfg|d#|jd$dfd%|jd&dfg|d'|jd(dfd)|jd*dfd+|jd,dfgjd-|d.|d/|jd0dfd1|jd2dfg|d3|jd4dfd5|jd6dfg|d7|jd8dfgjd-j d ddj d9d:d|jd;g}t|tr|g}gd<}d=z }tdt|d=D]~}|||d=z} | D]^} | |v} j d>dd?j d9d9| rd@nddAj d ddj |d9z d9dB| z`jdCjd-j|j d ddj} j dDz d9dEdj dDd9dFdj d dd?|jdGd} jj}}j!dHdHdHj#||dIj%|d-z|dzj'dz dJ| j)|dKzj d ddj d-z d9ddj dz d9dLt|jdMdzdj dz d9dNt|jdOdzdjd-|dPj d ddj dQzd9dRj dSzd9dTj dQzd9dUj dQzd9dVjd9|jdWg}j d ddX|dYdXD]}j dQzdZt|jd[ddAj dSzdZt|jd\ddAj dQzdZt|jd]ddAj dQzdZt|jd^ddAjdZ|std=D]s}j dQzdZddAj dSzdZddAj dQzdZddAj dQzdZddAjdZujdj d ddXj d9d_t|jd`dzdabjdj|j j d dd?j ddcdddej |df|jdgdfdh|jdidfg|dj|jdkdfdl|jdmdfgj+S)ozEGenerate a Mobile Machine Work Order PDF matching the ICAST template.r rr r Fr rxr r r r r r r r r r-r rr zMobile Machine WORK ORDERr^rcjjjdddjdd|zddjyr r r s r1r z,_generate_mm_wor_pdf..section_header9r r3rc Dt|z }jddd|D]\}}j|d|jdjddd|D]'\}}j||t |xsdd)j|yr r r s r1r z-_generate_mm_wor_pdf..label_value_row#9r r3zMachine Informationr=r(r7z Order Number _order_numberrrzAsset #r)zOrder Received Byorder_received_byzOrder Date & Timeorder_date_time Date Promised date_promisedzDate Delivereddate_deliveredrzVehicle InformationVINvinzMake and Model make_modelzOdometer ReadingodometerzMotor # motor_numberzLicense # and State license_staterz Service Type service_type) LubricatezWiper ReplacementzAir Filter Replacementz Change Oilz Boom RepairzSpark Plug ReplacementzTransmission Servicez Fuel SystemzExhaust System CheckzBattery Replacement / CheckzTire Replacement ElectronicszDifferential ServicezBrake Inspection / ReplacementzSuspension and Steering CheckzFlat Tire RepairzCoolant System FlushzHydraulic repair / fillrPr ryrJr r r rzLabor DescriptionTimelabor_descriptionr;r zTime: labor_timez Labor Total: labor_totalr) r* r+ r, r- r. r/ r0 rNrrr9rr1 r2 r3 r4 r5 z AuthorizationTr zWork Order Compiled By compiled_byr compiled_datezWork Authorized By authorized_byzAuthorization Dateauthorization_dater )rr r rr r r r rrr*rrCr r r r rDr r r r)rr r r r service_types all_servicesr r r r r labor_header_yrr r r0 rr r r6r r r s @@@@@r1_generate_mm_wor_pdfrX 9s 3T( ;C'LLN B DI E EHLLc2&CHHRWH#HHQ/AH6FF1I## () DHHY+, /26{[_[c[cdq[rd=>QRU=Vxz| DHH^R01 dhh':B?@ dhh'8"=> $((?B78 488$4b9: FF1I()eTXXeR014Ddhh|]_F`3abc TXXj"56 DHH^R01+TXXor-JKLMFF1ILLc1%HHRNqH)HH^R0M-%& L FE1c,/3  9q=9  0Dm+G LLQ / HHQ'3r!H < LLb! , HHUQY4$; /  0 s FF1IC!LLc1%YY[NHHR"Wa,H3HHRFqH!LLb!$ 88' ,D YY[#))+BsC%HHRRJJrAvrAvNN263%IIb2gLLc1%HHR!VQqH!HHR!VQ3txx b'A#BBqHIHHR!VQ#dhh}b.I*JJqHQFF1I7LLc1%HHR#Xq-(HHR#Xq+&HHR#Xq*%HHR#Xq(#FF1I HHWb !ELLb!$bq  c1c$((8R"89#F c1c$((62"67D c1c$((5""56sC c1c$((8R"89#F q  q A HHR#Xq"SH 1 HHR#Xq"SH 1 HHR#Xq"SH 1 HHR#Xq"SH 1 FF1I  FF1ILLb!$HHROc$((="*E&FFcHRFF1IC "CLLc1%HHR%DQH7C !488M2#>? /2./ txx<= txx(g} t%| tr| g} |jd?d} gd@} d#z } t'dt)| d#D]~}| ||d#z}|D]^}|| v}j dAdd2j d5d5|rdBnddCj d ddDj | d5z d5dE|z`jdFdG| v}j dAdd2j d5d5|rdBnddCj d ddD|r| rdH| zndI}j | d5z d5dE|zjd3j} d:z }j*}j d ddj |d5dJdj d dd2j |d3|jdKddd4jd:j d ddj |d5dLdj d dd2j |d3|jdMddd4j}|jdNd}||z}j||j d ddj |d5dOdj-|dPD]r}||k(}j dAdd2j d5dF|rdBnddCj d ddDj |d5z dFdE|zdj-|tj}j#t/||dzj|j "j d dd2j ddQdRdSj |xsi}|jdTdxs|jdUr|dUdVnd}|dW|jdXdfdY|jdZdfd[|fgd\]j1S)_uGenerate a Safety Concerns Work Order PDF matching the ICAST template layout. *safety* — optional dict with keys ``accepted_by``, ``date``, ``work_order_number`` to fill the "For use by Safety department" block. Status checkboxes from the paper template (Completed, In progress/parts ordered) are intentionally omitted — those states are tracked by the Work Order Admin workflow. r rr r Fr rxr r r r r r r r r r-r rr zSafety Concernsr^rcjjjdddjdd|zddjyr r r s r1r z0_generate_safety_wor_pdf..section_header9r r3rc Dt|z }jddd|D]\}}j|d|jdjddd|D]'\}}j||t |xsdd)j|yr r r s r1r z1_generate_safety_wor_pdf..label_value_row9r r3r r1rr7r rr rrPr r2r3r rr4rr r r rrrr ryrr rr5rr;rSrr r z+Type of Safety issue (check all that apply)rBr ) zSlip/Trip/FallzIsleway or EgresszGeneral SafetyLightingz Near Missr;zMobile equipmentr=r>z Tool/Cordsr4r rJr rr r r@r r rCrDrErrr rFz For use by Safety departmentTr r rrr r r rr rr r r7 )#rrr r r r r rr r r r rWr r r r r r r r r r~ r rr r r rr! r r6r r r s# @@@@@r1_generate_safety_wor_pdfr] 9s8 3T( ;C'LLN B DI EH ELLc2&CHHRWH#HHQ%!H,FF1I## *+ 488$4b9: DHHWb)* $((7B'( FF1I$% DHH%6;< TXXj"-. TXXj"-. TXXj"-. *DHH[",EF hhx &BG{{?# [#q) Q;< q  ["a( QGKK<=caPFF1IC!LLc1%HHR)aH0LLb!$ 88M2 &DsC% YY[#))+BHHRRJJrAvrAvNN263%IIb2gLLc1%HHRAaHH((<,K+s#"m ,b1JI FE1c)na0 i A 6  0Dk)G LLQ / HHQ'3r!H < LLb! , HHUQY4$; /  0 s {*MLLQ'HHQ-3RH:LLb!$.; I *PXMHHUQY4-/0FF1I I 6D BLLc1%HHT1.1H5LLb!$HHT1dhh|R0HCFF1ILLc1%HHT1/AH6LLb!$HHT1dhh8"=caHPJhhy"%G IEJJui LLc1%HHT1+H2IIe*U" ^R+ CR: ["a( 3u 3 % ))+KIIc*k*Q./C "CLLc1%HHR44AHFC "A UU& + pPTPXPXYfPg4 3Fs2KmoF mR01 vr"# &)  ::<r3c !"#$%|jdxsi}tddd""jdd"j"jd z #d $d %d !d }!"#$%fd}"j ddd "j !"jdddd"jdddd"jd|d|jdd}t|trd|dn t|}"j ddd#dz }"j|dd "j|dd!"jd"j ddd""j|d||d#"j|d||jd$xsdd#"jd""j ddd"j#dd%"jd"j ddd""j#d||jd&xsdd#"jd"d'D]\}} "j ddd"j#d|"jd"j ddd"|j| xsdjxsd(} "j#d)|| d#"jd|d*d+d,d-d.d/} |jd0xsi} |jd1xsg} tD]q}|| vr | j|xsi}"j ddd""j#d2| j||jd"j ddd3|jd4xsd5j!}|jd6xs|jd7xsd}|jd8xsd}"j#d9z d2|d:|"j#dzd9z d2|d;|d<|d=d|jd>xsdj}|r"j#d2|d?|d"jdt|d@|jdAxsd(}"j ddd"j#ddB"jd"j ddd""j#d||d#"jdt#|Dcgc]}|xsijdCdDvr|}}|rYddEl}|dFt'|d="jdt)|}|r t+|ndE}|D]}|jdCdGk(rdHndI}|dJ|jdKddL|jdMdd=}|jdNxsdjr|dJ|dNjz }"j ddd3"j#d2|||r||jdOdz ndE}|r4|j-r# t/j0|5}|j3dP}|j5dQ|j7}|j9|dRdST|j;dt=dU#}||j>ztA|jBdz } "jE| z"jFdz kDr"j"jI|dV"jE|W"jK"jE| zd9zdEdEdE"jd"jOScc}w#1swY2xYw#tL$r"jdYQwxYw)Xa Generate an Equipment Validation Handoff Form PDF snapshot. Captures the full EVH sign-off audit trail at the moment all required departments have approved. Saved alongside the WO PDF as a permanent attachment (evh_pdf field in sidecar _evh block). rr rr r Trrmarginrxr r r ct|xsd}dD]\}}|j||}|jddjdSNr7))r -)u–rc )u‘')u’rd )u“r)u”r)…r")•r1latin-1rr*rrrrbadgoods r1_l1z_generate_evh_pdf.._l1a:sV RL8 %IC #t$A %xx 9-44Y??r3cjjjdddjdd|zddjyr r r s r1r z)_generate_evh_pdf..section_headerm:r r3r r rSr-r rr z!Equipment Validation Handoff Formr^rzEquipment Informationrr7rrrr Work OrderzEquipment / Asset IDryr rzRepair Completed Date / Timerepair_completed_at))Description of Work Performedwork_description)zOutstanding Follow-up Itemsoutstanding_followuprc rzDepartment Sign-offsr OperationsrQualityrrrkrrrr approver_namer timestamprPzStatus: zBy: z (r7rmReason: zRelease to Productionrz"Released to Production Date / Timer)rrNzReturn-to-Service Photos (rApproval Rejectionr*rr:rrrr9)Xrz r:rr<T@r)ryr)(rrr r rr r r r rrr*rr rOrBr rr>rCrrrrIr?rLrNrJrrrLrFrCrEr himager ryr)&rrrrl r r! wo_labelr field_label field_keyr dept_labelsrrkrPrrapproverr_rm released_atr _rts_photos_io _wor_path_pdir_ctx_metarRr_buf_disp_w_disp_hr r6r r r s& @@@@@r1_generate_evh_pdfr Q:sK   6 " (bC 3T( ;Cb1LLN B D E E @##LLc2&CHHRWH#HHQ7AH>FF1I*+   mR 0F&0&=fS\"3v;HLLc1% 6DHHT1l#HHT1,-FF1ILLb!$HHT1c(mCH0HHT1c#''+.4"5cHBFF1ILLc1%HHR23FF1ILLb!$HHRC 56<"=cHJFF1I#  Y [#q) Q $ q  ["a(779%+224; r1c'l37 q  )*$" K  $*IWW-.4"N ~ %  MM$  %2 [#q) Q d399;B ["a(%%/.Y::<55)JQUU3C-DJ UU;  %2 aC(6( 345 a!Qd8*Ct1$= >1E%%/'R..0  HHRC(6( 34H ; q "*+''56=#KLLc1%HHR89FF1ILLb!$HHRC $SH1FF1I.l;UwBmmI.2SSUKU3C 4D3EQGH q %h/ .7 *T A"#%% "2n"DJ$ fCmR 89AEE-QSd?| d@tCdArHtEdAdBtj dxsij d#dC|d/dD|ddE|d/d| dFGt| |HScc}w)Iz8Accept work order form data, generate PDF, and store it.rr'.This work order type is not currently enabled.rrrr7rrr3rrr rrrBr rDrrrr rts_dept_Requestor name is requiredr`Request description is required _wor_typeTrrrr$rMnotify_enabledr9Fr~rrequestor_emailrdisabled_by_adminr%Y-%m-%d_%H%M%S [^\w\s\-]NrSr\r TWORWORrrrrr wor_photoszNew Maintenance Work Order # — z=A new Maintenance Work Order has been submitted. Requestor:  Date: Location:  Description: rK Urgency:  Desired Completion: Not set Filename: > This notification was sent from the ICAST Togen application.rrzMaintenance WO # created — WO#rrr ris_test)#r rrrrgrrgetlistrOrjrrr rr" rrrrFr\rr-r rrrrrr=rEVENT_WO_CREATEDrrr r ) rPrr wor_numrr' notify_email pdf_bytesrv rrout_path json_paths r1 wor_submitr :s ! @MNPSSS ',,**+;R@FFH !!'2.446  !!'2.446  7<<++,=rBHHJ   GLL$$Z4::<   GLL$$Z4::<   GLL$$Z4::<  W\\%%k26<<>  w||'' r:@@B  gll**<8  GLL,,-?DJJL  gll&&|R8>>@  "7<<#3#34Mr#R#X#X#Z  7<<##Ir288:  ',,6  "  Ytf%5 5 ! D,  !9:C??  >?DD%D"'++f"56GW 07*,=T=VG!Dm':5AH NN4$N/ ;;v  $"D88GR(L#w||3((6*Dd3C.D'" DO"$'I""$--.?@I|R.>)?@"EKKMUUVY[^_I#&/q Qyk9+UYZH("H #$$W-I D34'--'' 5w{{67J7Pb   * * x = !*73-uTBR=S?B/01##'88,Ey#Q"RS! #K L  '{ 3 Y{{6*0b55f=*73-}TJZE[D\]'#'$1xH   Hg 66i sW+z/safety-wor-submitc tdtdstddfStjj ddj tjj ddj tjj d dj tjj d dj tjj d dj tjj d dj tjj d dj tjj ddj tjj ddj tjjdtjj ddj tjj ddj tjj ddj tjj ddj d}|dstddfS|dstddfSd|d<ttj d}|rd|d<|r tn t}||d<td|d}|jddtj dxsi}|j d d}d tjv|j d!xs|d||d"d#|d$<t|}tjj!d%}t#j$d&d|dd'd(j j'd)d*}|rd+nd,d*|d-d*|d*|d.} || z } | j)|| j+d/} | j-t/j0|d01t3| tj4jd2tj dxsi|st7d3|d-d4|dd5|dd6|j d dd7|j d dd8|j ddd'd9d:|j ddd;|j dd<d=| d>t9d?rHt;d?d@tj dxsij d!dA|d-dB|ddC|d-d| dDEt| |FS)GzHAccept Safety Concerns work order form data, generate PDF, and store it.rr'r rrrr7rrr3rrr rrrBr rDrrrrrr3rrr rrrBr rDrrr r`r r Trrrr$rMr r9Fr rr r NrSr\r TSWOSWOrrrrrr zNew Safety Work Order #r zAA new Safety Concerns Work Order has been submitted. Requestor: r r r rKr r r r r rrz Safety WO #r r r r r )r rrrrgrrr rjrrr rr] rrrrFr\rr-r rrrrrrr r ) rr r rr'r r rv rrr r s r1safety_wor_submitr R;s !76? ;MNPSSS!,,**+;R@FFH!!'2.446!!'2.446"<<++,=rBHHJLL$$Z4::<LL$$Z4::<LL$$Z4::<\\%%k26<<>||'' r:@@Bll**<8#LL,,-?DJJLll&&|R8>>@#*<<#3#34Mr#R#X#X#Z<<##Ir288: D"  !9:C??  >?DD D!'++f"56GW 07*,=T=VG!DhW5e)?@"EKKMUUVY[^_I#&/q Qyk9+UYZH("H #$$W-I D34'--'' 5w{{67J7Pb  %gc]%=M8N7O P/012XX/456*b123 HH]B7=>?B/01##'88,Ey#Q"RS! #K L  '{ 3 Y{{6*0b55f=%gc]-EU@V?WX'#'$,(C   Hg 66r3z/mm-wor-submitctdtdstddfSttjd}t j jd}t j jd}t j jd}t j jd }g}tt|D]}|t|kr||jnd }|t|kr||jnd }|t|kr||jnd } |t|kr||jnd } |s|s| s| s|j||| | d |s t|dtjd}id t j j d d jd t j j d d jdt j j dd jdt j j dd jdt j j dd jdt j j dd jdt j j dd jdt j j dd jdt j j dd jdt j j dd jdt j j dd jdt j jddt j j dd jdt j j dd jdt j j dd jd|ddt j vdt j vt j j dd jt j j dd jt j j d d jt j j d!d jt j j d"d jdd#} | d std$d%fSt| d tjdxsi\} } | rt| d%fS| r| | d&<|rd'| d(<|r tn t}|| d)<|sWt!d*|z|| j d | j d tjdxsij d+,t#d|-d.}|j%d'd'/tjdxsi}|j d+d }d0t j v|j d1xs| d ||d2d3| d4<t'| }t)j*j-d5}t/j0d6d | d d7d8jj3d9d:}|rd;nd<d:|d=d:|d:|d>}||z }|j5||j7d?}|j9t;j<| d@At?|t j@jdBtjdxsi|stCdC|d=dD| d dE| d dF| j d d dG| j dd dH| j ddIdJ| j dd dK|dL tEdMrHtGdMdNtjdxsij d1dO|d=dP| d dQ|d=d|dRSt||TS)UzGAccept Mobile Machine work order form data, generate PDF, and store it.rr'r rr part_number[] part_name[] part_qty[] part_amount[]r7rr9rr1 r(r)r> r@ rA r= rD rC rE rG rF rH rL rO rP r0 awaiting_approval parts_orderedr3 rQ rR rS rT r r3 rQ rR rS rT r Machine name is requiredr`rTrrWO#%srequipment_namer)r rr$rMr r9Fr rr r NrSr\r TMMWOMMWOrrrrrr zNew Mobile Machine Work Order #r z>A new Mobile Machine Work Order has been submitted. Machine: z Asset #: z Order Date: z Date Promised: r z Make/Model: r r rrzMobile Machine WO #r r r r r )$r rrrjrrrgr rrCrri_rpm_register_submitted_partsrrr_rpm_record_parts_usager rrX rrrrFr\rr-r rrrrrrr r )r part_numbers part_names part_qtys part_amountsr0 rpnnmqtamr manual_info manual_errr rr'r r rv safe_machinerr r s r1 mm_wor_submitr ;s !'&/ BMNPSSS"'++f"56G<<''8L%%m4J $$\2I<<''8L E 3|$ %N()C ,=(=\!_ " " $2&'#j/&9Z] "r%&Y%7Yq\   !R()C ,=(=\!_ " " $2 rR LLB2L M N -e_gkkRXFYZ 7<<##Ir288:  ((<BBD  7<<++,=rBHHJ  ))/2>DDF   ',,**+;R@FFH   W\\--.A2FLLN   gll&&|R8>>@  w||r*002  GLL$$Z4::<  ))/2>DDF   ((<BBD   ,,^<  W\\--.A2FLLN  gll&&|R8>>@  w||'' r:@@B  ! " 0GLL@# $)GLL8||'' r:@@B||'' r:@@B ))/2>DDF ))/2>DDF%ll../CRHNNP$1 D6  ?78#==1i'++fBUB[Y[\KZ(#--$XW 07*,=T=VG!D  g uTXXi5H.1;;v&,"11': <oG|d8d?| d d@| d dA| j dd dB| j dd dC| j dd d2dDdE| j dd dF| j ddGdH|dItMdJrHtOdJdKtjdxsij d,dL|d8dM| d dN|d8d|dOPt|| j d!|QS)RzQAccept Preventative Maintenance work order form data, generate PDF, and store it.rr'r rrr r r r r7r rrrr3rrr rrrBr rDrrr0 r r r3 r r`r rr Trrr )r r rr$rMr r9Fr rr r NrSr\r TPMWOPMWOrrrrrr z)New Preventative Maintenance Work Order #r zJA new Preventative Maintenance Work Order has been submitted. Requestor: r r r rKr r r r r rrzPreventive Maint. WO #r r r r )rrr )(r rrrjrrrgr rrCrrir rrrr r rr8 rrrrFr\rr-r rrrrrr=rr rrr r )r r r r r r0 rr r r r rr r r rr'r r rv rrr r s r1preventive_wor_submitr 2<s !wv ?MNPSSS"'++f"56G<<''8L%%m4J $$\2I<<''8L E 3|$ %N()C ,=(=\!_ " " $2&'#j/&9Z] "r%&Y%7Yq\   !R()C ,=(=\!_ " " $2 rR LLB2L M N -e\7;;vCVW ',,**+;R@FFH !!'2.446  !!'2.446  7<<++,=rBHHJ   GLL$$Z4::<   GLL$$Z4::<   GLL$$Z4::<  W\\%%k26<<>  w||'' r:@@B  gll**<8  GLL,,-?DJJL  gll&&|R8>>@  "7<<#3#34Mr#R#X#X#Z  7<<##Ir288:    0GLL@! " GLL8# $ w||'' r:@@B% D*  !9:C??  >?DD0k1BGKKPVDWD][]^KZ(#--$X$DW 07*,=T=VG!D  g uTXXk5J;;v&,"11': <l9%@H NN4$N/ ;;v  $"D88GR(L#w||3((6*Dd3C.D'" DO-T2I""$--.?@I|R.>)?@"EKKMUUVY[^_I$'&173-q 1YKW[\H("H #$$W-I D34'--'' 5w{{67J7Pb   * * xt < !7}E$O_J`Ia b/012XX/456*b123 HH]B7=>?B/01##'88,Ey#Q"RS! #K L  '{ 3 Y{{6*0b55f=0 ]4P`KaJbc'#'$0hG   HTXXh-? QQr3z /wor-historyc tjjdd}t|}g}|ddf|ddffD]\}}|j s|j dD]}t j|jj}t|j|}d}|r$ tj|j}|j#|jt%|j|||j'd|d|j)d d t+| S#tt f$rd}Y{wxYw) zFList new and in-progress Work Order Request PDFs (excludes completed).rTrr$rr+Nr)r9rerrdc |dSrrXrs r1r zwor_history..<s QvYr3Tr r)rrhrr rrrrrrrr9rrrrrrirrrr) rrrrrdrr rrs r1 wor_historyr <s?|| 6H ( #D E#E{E2T-5H-4XY 6! ( A"33AFFH4E4EFE*1668.photos/`` directory and recorded in the sidecar ``photos`` list. Gated by ``wor_approver_required`` so both admins (general attach) and department approvers (RtS approve/reject) can attach. rr7rrrr'rWork order not foundrrrzAt least one photo is requiredr`rTrMrr^rrd z' exceeds the z MB limitrrr r9rrrrr photo_addedz photo(s) added to )rrr )rUadded photo_count),rrgrrWOR_PHOTO_CONTEXTSrr`rr _wor_locaterr rrrrrrrrrbrrErrrrrrr*rirrrrrrrrrr r r rC)rrrrr  _wor_is_testrrrrr'r_rrrdrr4rrrs r1wor_photo_uploadr <s   (.B557H|| *:lAACG|| *0b779G(( }W[[-@ACH 34c99$X.Aq,!--//9NQQ1::qNGN =>CC 4'$.I *JTD1 ;;v  $"D     & &': ;B E ggqzz*1-335  a%xx}}  a ) 1QZZL$4#5Y"@ABEF Fqzz*=w}"&&(112DEFavN s:&'( V"#}W[[-@ACG B G--/0BR F  88FB/    BxL4::b34 W%00Bq1IJ 7 D ((6"5zl"5hZ@&U<   d#e*#f+ FF}OD$$g. B s$P, P,P,#P11QQz /wor-photosctjjdd}tt jd}t ||st ddfSt||}i}|r$ tj|j}t|}t |t|S#tjtf$ri}Y>wxYw) zCReturn the photo metadata list + count for a work order (DVI-1063).rr7r'rr rr)rr)rrhrr`rrrrrrrrrrrC)rrrrrs r1r r B=s||+H!V!45L XL A34c99"8,GG B G--/0BR F &F 44$$g. B s,#B00C Cz /wor-photoctjjdd}tjjdd}t|t t jd}|sy|r d|vsd|vsd |vryt |}||z j}t|jt|jr|jsytjjd r4t|}|r'tt|d }d |jd<|Stt|S)zMServe one WO photo inline; ``?thumb=1`` returns a downscaled JPEG (DVI-1063).rr7r9r'rrr6rrr4ror private, max-age=86400rv)rrhrrr`rrr,r*rwrrrrx)rr9rrrr4rs r1 wor_photor X=s ||+H <<  FB 'D }W[[-@ACH $ 3$;$$,$$,$ *JT!**,H M $ $S););)=%> ?##%$|| '1 SZ,?D,DDLL )K S] ##r3z /wor-evh-pdfctjjdd}t|}|sy|jdz}|j |z }|j st|}i}|r$ tj|j}|jdxsijddk(rL |jt||||dd<|r&|jtj |d |j sy t+t-|d |S#tjtf$ri}YwxYw#t"$r#t$j&j)d |YtwxYw)zServe the generated EVH form PDF for a completed/approved work order. Takes the WO PDF filename; the EVH snapshot lives alongside it as ``.evh.pdf`` (written by :func:`_generate_evh_pdf` on finalization). rr7r.evh.pdfrrdrrrrz%EVH PDF lazy generation failed for %s)zEVH form not foundrFrn )rrhrrrrrrrrrrrr-r rrryrmrnrrr*)rrevh_nameevh_pathrrs r1 wor_evh_pdfr s=sV||+H *H $}}z)H)H    &x0   ZZ 1 1 34 FF6N b % %h /: = X$$%6x%DE(06 9%&&tzz"Q'?@    ( S]%x PP(('2   X $$%LhW Xs%-#D+8A E +E E  )E87E8z/wor-viewer-urlc:tjjdd}t|}|st ddidfS |j t j}t}|d|}t d|iS#t$rt ddidfcYSwxYw)z4Return the Document Viewer URL for a work order PDF.rr7r not foundrz/wor/rJ) rrhrrrr{rr,rr)rrirrrJs r1wor_viewer_urlr =s||+H!(+I -.334##GOO$56% &F HE# C E3<  4-.334s#A??BBz/pm-manual-lookupc ttjjdd}|s t ddiSt d|d|jd|d|jdt |d|jddd S) zLReturn any manual previously associated with an Equipment/Asset/System name.rr7foundFTrrrJ)r rrrJr)rrrhrrr)rs r1pm_manual_lookupr =s "',,"2"2;"C DE '(( *%?E*4EFyy 253D EFYY{B/  r3r~cNt|txr|jddk(S)zBTrue if a registry record is classified Mobile (DVI-1136 Phase 6).rmobilerrrr~s r1_equipment_is_mobiler =s# c4 PSWW-C%D%PPr3c tjDchc]9}t|r,|jdrt |jdd;c}Scc}w)z9Normalized names of registry equipment classified Mobile.r9r7)rrr rrrx s r1_mobile_equipment_namesr =sR)*113 :#A&155= !vr!2 3 :: :s>Az/mm-eas-optionsc,g}tjD]X}t|s|jds!|j |d|jdxsdj dZ|j dtd|iS)zMobile equipment for the Mobile-Machine WO picker (DVI-1136 Phase 6). Returns objects {name, asset_no} so selecting one fills both the Machine and Asset # fields. Only registry records classified Mobile appear.r9rr7)r9rc(|djSNr9rs)r" s r1r z mm_eas_options..=sAfIOO-r3roptions)rrr rrirrr)optsr~s r1mm_eas_optionsr =s D"$++-`  $ KKV377:;N;TRT:[:[:]^ _` II-I. It$ %%r3z/pm-eas-optionsct}tjjdxsdj dk(r't }|Dcgc]}t ||vs|}}td|iScc}w)aEquipment/Asset/System names for the PM work order type-ahead (DVI-590). `mobility=stationary` (DVI-1136 Phase 6) drops names registered as Mobile machines so they route through the Mobile-Machine WO instead; free-text entry is unaffected (this only curates suggestions).mobilityr7 stationaryr )rrrhrrr rr)r r r" s r1pm_eas_optionsr =so&'G $*113|C(*%O)=a)@)N1OO Iw' ((Ps A3 A3z/wor-eas-optionsct}tjjdxsdj fdt fd|j Dd}td|iS)a/Equipment names from the registry for the maintenance WOR type-ahead (DVI-1014). `mobility=stationary` (DVI-1136 Phase 6) returns non-mobile equipment (stationary + unclassified); `mobility=mobile` returns only mobile. No param preserves the legacy full list. Free-text entry is unaffected.r r7cHdk(r t|Sdk(r t| Sy)Nr r T)r )r~r s r1_keepzwor_eas_options.._keep=s/ x ', , | #+C00 0r3c3xK|]1}|jds|s|jdd3yw)r9r7Nr)r,rr s r1r/z"wor_eas_options..=s-Tqv5QR8vr Ts :::c"|jSrTrsrs r1r z!wor_eas_options..=s aggir3rr )rrrhrrrrr)rr r r s @@r1wor_eas_optionsr =sd#$H   ,299;HTHOO$5T G Iw' ((r3z/wor-equipment-rtsc ttjjdxsdj}|s t dSt |}t }|j|}|s t dSt d|jdd|jdtDcic]}|dc}Scc}w) zReturn RtS settings for a given equipment name (DVI-1014). Used by the WOR form to apply forced/default RtS state when equipment is matched to a registry record. rr7Fr Trr)r rr)rrhrrrrrrO)r9r)rrrns r1wor_equipment_rtsr =s LL  [ ) /R 6 6 8D U## t $C"$H \\# F U## ZZ6 #4 6S1q$w6ST 7Ts B5z/pm-manual-urlctjjddxsdj}|r d|vsd|vsd|vrt ddidfSt |z j st ddidfSt d t|iS) z8Return the Document Viewer URL for a stored manual file.rr7r6rrrr rrJ)rrhrrrrrrrs r1 pm_manual_urlr >s   ,299;H sh$(*:dh>N-.33 h & / / 1-.33 E-h78 99r3z/wor-manual-infocttjjdd}|s t ddiS t j |j}|jdxsi}|jd}|rt|z js t ddiSt d||jd|t|d S#t jtf$rt ddicYSwxYw) zIReturn the manual attached to a given work order (from its JSON sidecar).rr7r FrrTr)r rrrJ) rrrhrrrrrrrrrr)rrrr4s r1wor_manual_infor >s#7<<#3#3FB#?@G '(()zz'++-.XXh  %2F ZZ #F /F2;;='(( OV<!&)    ' *)'(()s#C&C;:C;z/equipment-manuals/listc,tdtiS)zNReturn all uploaded/attached equipment manuals for the Equipment Manuals tool.r)rrrXr3r1equipment_manuals_listr 7>s I023 44r3q only_filenamec |xsdjj}t|dkrgSi}tj D]}|j d}|s|||<g}t jD]\}}|r||k7rt|z js'|j ddxsd}|j}|j|} | dkrd|j|} d} |j dgD]D} | j dd| cxkr| j d dks/n2| j d d} ntd| d z } tt|| t|zd z}|| |jd d j}| dkDrd|z}|t|kr|dz}|j |i}|j||j dxs|j d||j ddt!|| | |d|j#dd|S)a[Full-text OCR search across stored manuals (DVI-491). Returns each matching manual with a context snippet, the 1-based page number of the first hit, total hit count, and a link to open it. When ``only_filename`` is given, the search is restricted to that single manual (DVI-626: WO-scoped "start with the attached manual" search).r7rrr&rr^rrqrrrr r\re rr)rrrrJrO match_countsnippetc |dS)Nr rXrx s r1r z$_em_search_manuals..t>s q/r3Tr )rrErCrrrr rrrrMrrCrLrrirr)r r qlassocrrrr&tlfirstrrOrrqrr! rs r1_em_search_manualsr' >>s5 'r  "B 2w{  E$&--/ YYz " E"I G-/557! E R=0 "$--/ yy$* ZZ\  19  7B' AuuWa E;AEE%O;uuXq) Aurz"#d)USW_r12uS/))$4::< 19goG T?oGyyR "YY7X488OUW;X+r2%b)   3! F LL/L> Nr3z/equipment-manuals/searchctjjdxsdj}t |dkr t g|St t ||S)zCross-manual full-text search over OCR'd manuals (DVI-491, D2). Within-document search is served separately by the searchable-PDF text layer (Ctrl-F).r r7r)rr#)rrhrrrCrr' r s r1equipment_manuals_searchr* x>sQ   #  $"++-A 1vzr++ -a0 ::r3z)/equipment-manuals/file/cd|vsd|vsd|vr tdt|z }|js tdtt |S)a~Serve a manual's raw bytes same-origin (DVI-464). The public ``url`` points at the external Document Viewer (docs.icastinc.com), which is cross-origin and therefore unusable as a PDF.js / source for the Grid-view thumbnails. This route streams the same file from the local manuals store so the browser can render a first-page preview without CORS issues. r6rrr)r rrrr*)rrbs r1equipment_manuals_filer, >sJ o!8DO c SY r3z*/equipment-manuals/thumb/cd|vsd|vsd|vr tdt|}|s tdtt|d}d|jd<|S) aqServe a small cached Grid-view thumbnail for a manual (DVI-585). Returns a pre-rendered JPEG (page 1 for PDFs, downscaled for images) so the grid loads quickly instead of downloading + rendering each full manual. A 404 here is expected for unsupported types or when the renderer is missing; the client falls back to its own pdf.js/image rendering. r6rrrror r rv)r rWrr*rx)rr4rs r1equipment_manuals_thumbr. >sX o!8DOs!!+r28b??AI JKSPP (#A AJJ893>> ''  1:: &q ) / / 1C %%))F#678FwiPQSVVV$6 1:: & :8c>D""$--o>?q GFFF3' ()y&!**gkk&6I6ORP + !&)  r3z/equipment-manuals/renamec tjdxsi}|jdxsdj}|jdxsdj}|r d|vsd|vsd|vrt d d fS|st d d fSt |z j st d dfSt|}|st d d fSt}d\}}|jD]\}}|jd|k(s||}}n|r t|n||d} tjdxsi} | j||t|tjj!d| jddd|||k7r|j#|d| ||<t%|t d||| dS)zEdit the Equipment/Asset/System name a manual is associated with (DVI-462). The index is keyed by normalized equipment name, so renaming re-keys the entry (moving it off the old key) while keeping the same stored file. Trrr7rr6rrrrr`r0 zManual file not foundrrrrr'rr9)rrrJrrNrJ)rUrrrJ)rrrrrrrrrrrrrrrrrrr) rrnew_eqnew_keyrold_keyrrrrr's r1equipment_manuals_renamer8 >s   4 ( .BD$*113Hhh{#)r 0 0 2F sh$(*:dh>N78#== JKSPP h & / / 145s::"6*G JKSPP  !ENGU 1 55  (UG  4;(X%VD ;;v  $"DKK!(+$((*334GHhhvr* w'1 '4 E'N dXT%[ QQr3z/equipment/registrycztt}t|jd}t |S)zKReturn all equipment registry records, auto-seeding from WO sidecars first.cB|jddjSNr9r7rrErx s r1r z)equipment_registry_list..?saeeFB6G6M6M6Or3r)r)rrrrr)rrecordss r1equipment_registry_listr> >s1"$HX__&,OPG W %%r3c tjdxsi}|jdxsdj}|st ddfSt |}|st ddfSt }||vrt d| d fSt|}|||<t|td r   d6 **r3z/equipment/registry/PATCHc6t}||vrtddfStjdxsi}t ||}d|vrt |d|d<d|vrgt |dtrT|jdxstDcic]}|dc}}tD]}||dvs t |d|||< ||d<d|vr|d}|d vr||d<nt ||d<d |vr#t|d xsd j|d <d |vr#t|d xsd j|d <d |vrt |d |d <d|vrt |d|d<|jddk(r1|jd xsd jstddfS|||<t|tdrtddtjdxsijdd|jd|||jd|jd|jd|jd|jd |jd |jd |jddtd|Scc}w)z@Update RtS Approval settings for an equipment record (DVI-1012).zEquipment not foundrrTrrrr)r r rr7rrrr z,An Asset # is required for mobile equipment.r`requipment_updatedr'r9z Equipment RtS settings updated: )r9rrrrrrrr r )rrrrrrrrrOr*rrr r r)rrrrrndeptsrPrQs r1equipment_registry_updaterF $?s#$Hx23S88   4 ( .BD (8$ %F!%d>&:!;~D Z5F0G%N ,-N:1Na!T'1N BDt-.."4(9#:4#@Ad  B%* !%)* * *-0F) *-1#YF) *d"&)$/B*C*Ir&J&P&P&R"#T j!1!7R8>>@z4#'-=(>#? D i1yzz()X5vzz*?U?[Y[>b>b>dKLcQQHX!";/ ,;;v&,"11&96vzz&(7S6TU 6* & > :#)::.?#@(. 3I(J%+ZZ0C%D"JJz2"(**-=">!::i0   d6 **W2Os Jz)/equipment/registry//wo-historyc0t|}t|S)zAReturn WO history rows for a given equipment asset_id (DVI-1012).)r)rr)rrs r1equipment_registry_wo_historyrH ^?s$H-G 7 ##r3z/wor-attach-manualctjjdxsdj}t |}|st ddfStjjdxsdj}t |tjdxsi\}}|rt |dfS|st d dfS tj|j}||d <|jtj|d t d|d|jd|jdS#tjtf$rt d d fcYSwxYw)uAttach a manual to an existing work order's JSON sidecar (DVI-462). Accepts a multipart form: ``file`` is the target WO's PDF filename. The manual itself is resolved via the same logic as PM submission — a freshly uploaded ``manual`` file (with an ``equipment`` name to index it under) takes precedence, otherwise an existing manual referenced by ``manual_existing``. The 'Open Manual' controls in WOA/WOR read this sidecar ``manual`` key. rr7r rrrr'r`zNo manual providedz!Work order data could not be readrrrrTrrrJ)rUrrrJ)rrgrrrrrrrrrrrrr)rrrr rrs r1wor_attach_manualrJ f?sJ   (.B557H"8,G 34c99!!+.4";;=I))W[[5H5NBOK S!3&& 12C77Gzz'++-.!DN tzz$q12 d[%S)?z7Email a Work Order Request PDF via Microsoft Graph API.Trrr7rInvalid filenamerr`zEmail address is requiredrr4Email sender is not configured. Set AZURE_MAIL_FROM.rrrrrr4rr2Failed to acquire mail token: rzICAST Mobile Machine Work OrderrzICAST Safety Work Orderrz)ICAST Preventative Maintenance Work OrderzICAST Maintenance Work Orderr rz_Please find the attached Work Order PDF. This email was sent from the ICAST Togen application.rrr#microsoft.graph.fileAttachmentrz @odata.typer9r contentBytesrrr attachmentsrrrrrrrrrrrNrKGraph API error: remailedr'r9WO z emailed to )torr rU)rrrrrrrrrrrrrr.rnr b64encoderrrrgrr&r r r) rrto_emailrirrrr rsubject_prefixrrr s r1 wor_emailr] ?s   4 ( .BDxx B'Hxx$**,H /0#55 893>>!(+I -.33 STVYYY33!3zSJ666779L\)2L4D4DWi4XY=cUCDcII$$&I *H?": X 2 \ !D7))xj9%L )X!67 $E$#4$*$4$4Y$?$F$F$H  *#-J2    1/1B)L&|N'C&DE.  D z)"-11)TYYt_M09:C??";/ ;;v&,"11&9(<z:"9   d r3z/wor-admin-listc V t}tjdxsi}|jdd}t|t |jdxs|jd}t j jddvxr t|}g}dD]l}t|| }|jD]H\}} | js| jd D]} | jjd r tj| j!j"} | j| j%d ||| j!j"|d } |j| j} | rI| jd| jdd| jdd| jddd| d<t'| j||}d}|r t)j*|j-}|xsijdxsi}|jdrd|jddd| d<|xsijdd| d<|xsijdd| d<|xsijd}|r4t3|}|jd| d<|| d <|jd!| d"<|jd#d| d$<|jd%g| d&<|jd'i| d(<t5|| d)<|Dcgc] }|vs| c}| d*<t |jd+| d,<|jd-}|sN|jdd.k(r:| j7| j8d z}|j;r |j}|| d-<|jd/| d0<|t<vr/t?|xsijd1\}}tA|| d2<tC|xsid3| d4<tAtE|xsi| d5<|xsijd6xsi}|jd7s|jd8rJ|jd7d|jd8d|jd9d|jd:dd;| d<<tG| j||| d=<|xsijd>| d?<|jI| Ko|sL|sJ|Dcgc]?}|jdd@k(r)tKfdA|jd&xsgDr|A}}|jMdBdC|D]} | dD=tO|ES#t.t0f$rd}YwxYwcc}wcc}w)FaList all WORs across new / in_progress / completed with status and type. Admins (wor_admin/togen_admin) get the full list. Approver-only callers (DVI-1024) get a server-side filtered list: only WOs awaiting RtS approval where one of their departments is required. r'rr7rrrbrcr#rr+r r)r9rrdrr r rnext_runrr~T)rr_ rr~ recurringrNrr)r~rrrsubmitter_namerrdrrrrr evh_equipmentrkrrrrevh_user_actionablerevh_allow_parallelrrrrr0 parts_countrrr _completionrq rr completed_by completed_atrq rr rg rh completionrerrr c3&K|]}|v ywrTrX)r,rn _viewer_deptss r1r/z!wor_admin_list..Z@sYm+Yrc |dSNr rXrs r1r z wor_admin_list..[@s QwZr3r r r )(rrrrvrrrhr`r rrrr9r|rrrrrrrrrrrrro with_namerrRPM_PART_WOR_TYPES_rpm_normalize_partsrCrrrrir2rr)r_viewer _viewer_email_viewer_is_admin _show_testrrr status_keyrrr rr~rrrrrrn evh_pdf_namer parts_normr _comprBrl s @r1wor_admin_listrz ?s()Hkk&!'RGKK,M,];MGKK 4R M8RS,,""6*.HH-#G, ELZ$hZ8%)ZZ\X $ !J ##%^^G,U $66??:.&778I8IJFF!NN+?@( (VVX..) ll166**-''2B*C$'GGJ$;$'GGJ$;#&779d#; *E+& /qvvxjY# ,'+zz'2C2C2E'F +0b55i@FBFzz),'+.4jj9I2.N+h1=0B/G/GQS/TE+,/;/Ar.F.FGWY[.\E*+'-2226:C%:3%? .1ggh.?l+8B4569gg>N6O2314b1Io.69gg>NPR6S2314b1Io.;WXb;c78CM7daQRVcQc7d346:377CS;T6U23 (+wwy'9 +0AZ0O#$;;qvv /B#CD#||~/3yy +7i(3677;V3W/011$8,:L"9Q9QRY9Z$[MJ+.z?E-();<;M2(Nq(Qn%'*?<;M2+N'Om$%+00?E299/0EII>T4U,1II6H",M05 :PRT0U(- ."(E(- ."(E +E,' "4AFFHl!Sg'3'9r&>&>}&Ml# U#kU $X $Z$| J![qEE,'+>>Yaee.@s !L/r3r)submissions_by_day status_countsrecurring_due_soon)rrrrrrrr rrrrr rrrrrrr fromtimestamprrrrrrrrirr)rr window_startr day_countsr rrv rrdayrrrnrr~ r rr~r_ nrr| s r1wor_admin_activityr a@s#    % % 'E9"--Lr   q) )33J?BJ aaaPML)%3H%=%C%C%E ) !J ##%^^G, ),9,=,=j!,Lq,P j)--0??$!!ZZ(9(9(;<B!vvf~P8I1JPbWWY(66))++38J+?*$sOq(O# ) ))0-3:3C3C3E,F$(AqQ 1399; #wwy$' 77:&," ((:>CCEB5j&& ?  % % $(GGJ > '   9: -#- o,'0! !I&   s1#J#5AJ(K!$K(J= <J= KKz/wor-admin-toggle-notifyctjdxsi}|jdd}|rd|vsd|vrtdd fSt |}|std d fS t j |jxsi}|jdxsi}d|d<d|d<||d<|jt j|dtdS#ttf$rtd d fcYSwxYw)z_Admin disables per-WO notifications: sets _notify.enabled false and flags it as admin-disabled.Trrr7rr6rL rr`rrCould not read work order datarrFr~r rrrY ) rrrrrrrrrrrr)rrrrrs r1wor_admin_toggle_notifyr @s    4 ( .BDxx B'H tx'3(?/0#55"8,G -.33Dzz'++-.4"XXi &BFF9"&F DO tzz$q12 d   D=>CCDs!'CC>=C>ctjr= tjtj }t |t r|S iSiS#ttf$rYiSwxYw)z5Return the {part_number: part_name} autofill catalog.) RPM_KNOWN_PARTS_FILErrrrrrrrrns r1_rpm_load_known_partsr @sh##%  /99; Part Name mapping (latest edit wins).r7N)rr rr )rr9rs r1_rpm_upsert_known_partr @s]l ! ! #F JB   D #%G{{6d"g&#r3)assume_stocked_on_completemark_stocked_on_deliveredc.tt}tjr[ t j tj }t|tr!tD]}||vst||||<|S|S#ttf$rY|SwxYwrT) r_RPM_SETTINGS_DEFAULTSRPM_SETTINGS_FILErrrrrrrr)rrnrs r1_rpm_load_settingsr @s*+H  "  ,6689A!T"/1AAv&*1Q4j 1 O8OG$   O sAB*BBBcXtjtj|dyr)r rrrrfs r1_rpm_save_settingsr As  HQ!?@r3) all_adminsrKspecific)rmr r r rmrOrr~rr) approve_mode approve_users auto_approvalcgt}}|xsgD]W}t|xsdjj}|s1||vs6|j ||j |Y|S)zCLower-cased, de-duplicated, order-stable email list from raw input.r7)rr*rrErri)rrrrrBs r1_rpm_norm_emailsr "AseCECl RL   & & ( $ HHQK JJqM  Jr3cdgddgddgddtDcic]}|gc}d}tjrv tjtj }t|tr=|jdtvr|d|d<t|jd|d<|jd }t|trt|jd |d d <tD]k}|j|}t|ts%|jd }|tvr ||d |d <t|jd |d |d <m|jd }t|tr+tD]"}t|j||d |<$|Scc}w#t tf$ri}YiwxYw)zAReturn the RPM approval/auto-approval policy, defaults filled in.r Frmr r r r r policy_notifyr r r r~rOrr )rp RPM_APPROVAL_FILErrrrrrrrr_RPM_APPROVE_MODESr r_RPM_AUTO_MODES)r5polrnrblkrOr s r1_rpm_load_approvalr -As%&1B?#.< ,>>R"b&> C  "  ,6689A a uu^$(::&'&7N##3AEE/4J#KC 55)D$%26txx 7J2KO$Y/,_B((2,C!#t,"wwv?2?CC04V<< 0D XXg  $" + + - 3 3 5E y#%GKK",EFqFFF z444 % && GsC#ct|tsyt}|jdxsi}|jdsy|j|xsi}|jdd}|jdxsdj j }|dk(r-t |jd xs|jd S|d k(r|t|jd vSt||S) zWhether a part added/submitted by ``user`` for ``wor_type`` should be auto approved under the current Auto Approval policy.Fr r~rOrmrr7r rrr r) rrr rrrErr r )r'rr rrJrOrs r1_rpm_auto_approve_forr mAs dD !  C 77? # )rD 88I  ((8  "C 776; 'D XXg  $" + + - 3 3 5E |DHH[)DTXXm-DEE z()9::: x 00r3c  tj||t||t||||xsij dxsd|xsij dxsddy#t $rYywxYw)zFire a Repair Parts Manager part-lifecycle email (DVI-614) to users who opted into (wor_type x event) in their RPM notifications grid. No-ops when no one is subscribed; runs on a background thread.r9r7r)rr wo_title part_name part_numberN)r= notify_rpmrrrry)eventrrrrs r1_rpm_notify_partr Asw     )(D9*8XtD*"))&17R JB++H5; )      sAA"" A.-A.ct|jdry|r|dk(ry|r0t|jdxsdjdk(ryy)zA part counts as stocked when explicitly flagged, or (per the "assume stocked on complete" policy) when its WO is marked completed, or (per the "mark stocked on delivered" policy, DVI-609) when its carrier tracking status is delivered.stockedTrtracking_statusr7 deliveredF)rrr*rE)rrv assume_on_completemark_on_delivereds r1_rpm_effective_stockedr AsR  DHHY  jK7S*;! Part Name in the known-parts catalog so they surface in RPM and the WO Admin Parts dialog. Returns the normalized list to store on the WO sidecar. DVI-614: when ``wor_type`` + ``user`` are supplied and the WO creator matches the Auto Approval policy for that type, every submitted part is approved up front. The created WO file does not exist yet here, so part-lifecycle emails are not fired from this helper — the submit handler owns notification.Trrr9)rq rr r )r0 rr'r r rrs r1r r Asc)/MJ KTK&;D(&K LD 7  AjMq{AfI67 r3ch|xsddk(r|jdxsdS|jdxsdS)uThe free-text equipment/machine name a WO's parts were used on — Mobile Machine WOs carry it as ``machine``, Preventive as ``equipment``.r7rr(rr)rrs r1_rpm_usage_equipmentr As8 B?*xx "(b( 88K &B&r3ct|xsd}|rtj|}|r|S|xsdj}|rtj|r|Sy)uBest-effort resolve a WO's equipment reference to an asset_tag for the parts ledger (via the DVI-1472 P2 equipment-alias shim, else a direct asset-tag match on the MM asset #). Blank when nothing matches — usage is still recorded (against the WO), never blocked.r7)rrasset_tag_for_equipmentr get_asset)r r)rHtagrs r1_rpm_resolve_usage_assetr AsY  4" 5D 2248 J  B % % 'D &&t, r3c|sy t||}|D]}t|ts|jdxsdj }|s;t |jdxsdj }t j||jdxsd|||jdxsd||} | jds| jdxsi} | jd rd n| jd rd nd} td d|d| jdz|d||rd|zndd| jdd| | jd||||| jd| jd | jd dt| d|zy#t$r#tjjd|YywxYw)uRecord MM/PM WO part usage into the inventory ledger (D8-A): each part with a part number decrements catalog on_hand exactly once (idempotent per the part's stable RPM id, so a WO re-read/re-save never double-counts). Below-min/negative only FLAG. WO sidecars are never rewritten by this — the ledger is the audit trail. Best-effort: a store failure never breaks the WO flow.Nrr7rr9rrecordedr below_minu — below minnegativeu — NEGATIVE togen-admin part_wo_usagepart:%sz used part u ×%s (on hand on_handr7)part_idpart_nowo_ref asset_tagrr r r r rr r z WO %s usage triggered_byz&RPM part usage recording failed for %s)r rrrrr*rrecord_wo_part_usager _parts_low_stock_alertryrmrnr) r r0 r r)r r rrrrrris r1r r As O,^\J  NAa&eeHo+224FaeeEl(b)//1C33f +S&!%%+:K5"C77:&776?(bD(+ (<$-0WWZ-@/b  e.FsWs]$BHHY'/$(88D>f"(y#'88I#6%(WW[%9$'GGJ$7 9 : #4mf6L M5 N6 O EvNOsF#F)))GGct||}|sy tj|jxsi}||fS#tt f$rYywxYw)zEResolve a WO sidecar and load its data; returns (sidecar_path, data).r)rrrrrr)rrrrs r1 _rpm_load_wor BsZ"8X6G zz'++-.4" D=  s'<A Apersistct|jd\}}|r2|r0|.||d< |jtj|d|S|S#t $rY|SwxYw)zGReturn normalized parts for a WO, persisting backfilled ids/flags once.r0 rr)rq rrrrr)rrr r0 rs r1 _rpm_wo_partsr )Bsn)$((7*; parts. Filters: type (all|mobilemachine|preventive), approved and ordered (all|yes|no), completed (yes|no — default no hides completed WOs). Cancelled WOs are never listed. Only WOs with >=1 matching part are returned.rTrrrGrr rfr r r'rr+rr F) r9rrdrer part_countr0 can_approver c |dSrn rX)rs r1r zrpm_parts..Bs ajr3Tr r )r)!rrhrrr rp rr r rrrr rrrrrrr r rr r rir9rrrCrrrr) type_filterr r include_completedrassumemark_deliveredrVr'r5can_approve_by_typerrrv rrrrr0 shownrpprs r1 rpm_partsr TBs<<##F+4u;;=K,,"":.7%>>@J!!),5<<>I ))+6>$EEG5P!#H 2 3F9:N)-??[NEWE ;;v  $"DI[\224T2>>\\ F'%3H%=%C%C%E&  !J [([(1B##%^^G, --0(::g&7&7&9:@bD>4%A,Q IF aB$:1j&R`$aByM%b)LL$ % FF ((/$G 1!&&$ ?"%e*"#6#:#:8U#KVVX..  + & 'P KK($K7  gJ & !![] #G,sK#'K""K5 4K5 z /rpm/wo-partsc tjjdxsdj}tjjdxsdjxsd}t ||\}}|st ddfSt ||}|jdxs|xsd}|D] }t|t ||t|||t|||ttjd xsi| S) zHParts associated with a single Work Order (used by the WO Admin dialog).rr7rTNr rrr r')r9rrer r0 r ) rrhrrr rr r rrr r)rrrrr0 resolved_type_ps r1 rpm_wo_partsr Bs   ,299;H   (.B557?4H 84MGT 34c99 '4 (EHH[);X;M"   =$?"8T2)'++f*=*C]S  r3z/rpm/manual-searchctjjdxsdj}tjjdxsdj}tjjdxsdjxsd}tjjdxsdj}d}|rht ||\}}|rW|jdxsi}|jd}|r/t |z j r||jd xs|d }|dk(r|r|dnd} t|d k\r t|| ng} t| ||| S)aSearch Equipment Manuals for a part from the RPM / WO Admin parts lists (DVI-626). With ``scope=wo`` (default) the search is restricted to the manual attached to the Work Order, if one is provided; ``scope=all`` searches every manual. ``wo_manual`` echoes the attached manual so the client can offer the "Search All Manuals" fallback only when a WO-scoped manual exists.r r7rrTNscoper+rrr4 r)r )rr#r wo_manual) rrhrrr rrrCr' r) r rrr r _sidecarrrronlyrs r1rpm_manual_searchr Bs7   #  $"++-A   ,299;H   (.B557?4H \\  g & .$ 5 5 7EI%h9$ "(bAz"B+446)+aeeO>T>ZXZ[ %*d]y9Z tD;>q6Q; $7BG 7!5I NNr3z/rpm/wo-parts/addc tjdxsi}|jdxsdj}|jdxsdjxsd}|jdxsdj}|jdxsdj}|jd xsdj}|jd xsdj}t |jd }|s|s|s|st d dfSt ||\}} |st d dfSt|| } | jdxs|xsd} ttjdxsi| } dtjjdd||||| d|ddddd } | j| t|| | t||| t vrft#d| jdxs|z| gt%| | | jdtjdxsijdt'| rt(j*nt(j,| || | t/dr\| rdnd}| rdnd }t1d|tjdxsijdd!|d"|xs|xsd#d$||| d%||| d&'t d| (S))zDAssociate a new part with a Work Order and remember its Part Number.Trrr7rTNrr9rr1 r zEnter at least one part detailrr`r rr r'r r-Fr r rr)rr r part_approvedpart_requestedz auto-approved requestedPart r>r2 for WO r)r rr9rr rUr)rrrrrrr r r rrWrXrYrir r rp r r r r=EVENT_RPM_PART_APPROVEDEVENT_RPM_PART_AWAITINGr r )rrrrr9rr1 r rrr0 r auto_approvednew_part_action_labels r1rpm_wo_parts_addr Bs   4 ( .BD$*113H &B--/74Hhhx &B - - /F HHV  " ) ) +D 88E? b ' ' )Chhx &B - - /F488I&'G dcV=>CC 84MGT 34c99 '4 (EHH[);X;M)'++f*=*C]SMTZZ\%%cr*+,$sf!e"UW H  LLwe,64(** txx .:( ;hZ/mD.1;;v&,"11':  < 1> --  2 2xx1 #5)%2/8H$1{ 7;;v&,"11&9F82f&A&A %B(8*U'~[hi   d **r3z/rpm/part/updatecztjdxsi}|jdxsdj}|jdxsdjxsd}|jdxsdjt ||\}}|st d d fSt ||}tfd |Dd}|st d d fSd D]3}|j|t||j||<5t|||t|d|dt d|S)zEEdit a part's details in place; re-remembers the Part Number -> Name.Trrr7rTNrr rrc34K|]}|dk(s |ywr rXr,rr s r1r/z"rpm_part_update..C6qw#~16 Part not found)rr9rr1 r rxrr9r ) rrrrr rr rr*r r ) rrrrrr0 rr)r s @r1rpm_part_updater Cs-   4 ( .BD$*113H &B--/74H 88D> R & & (C 84MGT 34c99 '4 (E 6e6 =F -.33P1 88C= $d3i...0F3K1we,6(+VF^< d ((r3z/rpm/part/removectjdxsi}|jdxsdj}|jdxsdjxsd}|jdxsdj}t ||\}}|st d d fSt ||}|Dcgc] }|d|k7s |}}t|t|k(rt d d fSt|||t d Scc}w) z Remove a part from a Work Order.Trrr7rTNrr rrr rY ) rrrrr rr rCr ) rrrr rrr0 r new_partss r1rpm_part_remover! Cs   4 ( .BD$*113H &B--/74H 88D> R & & (C 84MGT 34c99 '4 (E!4qQtW^4I4 9~U#-.33wi0 d  5s 7 D D z/rpm/part/flagc r tjdxsi}|jdxsdj}|jdxsdjxsd}|jdxsdj t ||\}}|st d d fSt ||}t fd |Dd}|st d d fS|jd xs|xsd}t|jd}t|jd} t|jd} d|vrAt|dr3|s1ttjdxsi|st d dfSd|vrt|d|d<d|vrt|d|d<d|vrt|d|d<d|vr#t|dxsdj|d<d|vr#t|dxsdj|d<t||||jdr|sttj|||||jdr| sttj |||||jdr| sttj"||||t%drq|jdxs%|jdxs|jdd} |jdrR|sPt'ddtjdxsijdd| d|| |jd|d|jdrb| s`t'ddtjdxsijdd| d|| |jd|jd|d |jdrR| sPt'dd!tjdxsijdd"| d|| |jd|dt d|#S)$zAMark a part approved/ordered/stocked (booleans sent in the body).Trrr7rTNrr rrc34K|]}|dk(s |ywr rXr s r1r/z rpm_part_flag..9Cr r r r rrGr r'z,You do not have permission to approve parts.rr rxrrr9r zPart approved: r )r rrr part_orderedzPart ordered: )r rtrackingr part_stockedzPart stocked: r )rrrrr rr rrr rr*r r r=r EVENT_RPM_PART_ORDEREDEVENT_RPM_PART_STOCKEDr r ) rrrrrr0 rr was_approved was_ordered was_stocked _part_labelr s @r1 rpm_part_flagr- -Cs   4 ( .BD$*113H &B--/74H 88D> R & & (C 84MGT 34c99 '4 (E 6e6 =F -.33HH[);X;M :./Lvzz),-Kvzz),-KTd4 #34\$W[[%8%>B N!OPRUU UT!$z"23zD i1yD i1yD $'->(?(E2$F$L$L$N !DY 526<<>ywe, zz*l>> xY]_ef zz)[==}hX\^de zz)[==}hX\^de"5)jj*Xfjj.@XFJJtUWDX ::j !, {{6*0b55f=)+hxjI#&&**X2FTab   ::i  ~{{6*0b55f=( XhZH#&&**X2F$*JJ/@$A}^   ::i  ~{{6*0b55f=( XhZH#&&**X2FTab   d ((r3z/rpm/known-partctjjdxsdj}|s t dSt t j|dS)zCAutofill lookup: return the remembered Part Name for a Part Number.rr7r)rrhrrrr )rs r1rpm_known_partr/ xCsPllx(.B 5 5 7F B -/33FB? @@r3z /rpm/settingsc*ttS)z=Return the RPM policy settings (Settings tab -> Policy pane).rf)rr rXr3r1rpm_settings_getr1 Cs .0 11r3ctjdxsi}t}tD]}||vst ||||<t |t d|S)z:Persist RPM policy settings. Only known keys are accepted.TrrUr)rrr r rr r)rrr)s r1rpm_settings_postr4 Cs_   4 ( .BD!#H%, $; cOHSM,x dX ..r3z/rpm/approval-policyc*ttS)z@Return the Approval permission + Auto Approval policy (DVI-614).policy)rr rXr3r1rpm_approval_policy_getr8 C ,. //r3ctjdxsi}|jd}t|tst ddfS|jdt vr|jdndt|jd d d gd d gd d tDcic]}|gc}d}|jd}t|trt|jd|dd<tD]l}|j|}t|ts%|jdtvr|d|d|d<t|jd|d|d<n|jd}t|tr+tD]"}t|j||d|<$ t|t dtScc}w#t$r}t d|dfcYd}~Sd}~wwxYw)zAPersist the Approval permission + Auto Approval policy (DVI-614).Trr7 zInvalid policy.rr`r r r Frmr r r r r~rOrr Failed to save: rNrUr7 )rrrrrrr r rp rr r rr )rr r5rFrr r rls r1rpm_approval_policy_postr= Cs   4 ( .BD ((8 C c4 ./444777>3JN`3`/fr)#''/*BC%*4?"+M1>R"b&>  E 77? #D$,0)1D,Eoy)$ YB((2,C#t$776?o59 Notifications.r'rr7)r=)rrrrB rr]s r1rpm_notifications_getrD Cs< [[ &B + +GR 8E !?@STY@Z![ \\r3c tjdxsi}|jd}t|tst ddfSt jdxsijdd }t|}i}tD]d}t|j|tr|j|ni}tDcic]}|t|j|c}||<f||tj<|r||d< t||t d| Scc}w#t$r}t d |d fcYd }~Sd }~wwxYw)z.Ds 7 r3Tr r )r ordered_not_stocked)r rp r rrrr rrrrrrr r r9rrrrrrirr)rr r r rK rrv rrrrr0 rr lstr| s r1rpm_processingrM Cs"#H 2 3F9:N-/*&9%3H%=%C%C%E 9 !J [( 0@0@0B^^G, 9--0(::g&7&7&9:@bD>49A-aV^T !$,",!3AFFHd!K$5affd$C !!"!2!2D55,)006uuY'+22489 9 99>"#67 +T: B7   %6L_ ``3#G,s'F44G G z/wor-admin-statuscLtjdxsi}|jdd}|jdd}|rd|vsd|vrtd d fS|d vrtd d fSt |}|std dfSt |}|jdxsdj }|jdxsdj }|dk(rSt|}i}|r$ tj|j}t|\} } | r|std d fS|dk(r1|dk(r+t|} | r% tj| j} ni} tjdi} | jdi}|jds| jdd|d<|jds&tj j#d|d<|jdst%t'|d<|| d<t)| |}|j+|| r&| j-tj.| d|dk(r1|dk(r+t|} | r% tj| j} ni} tjdi} | jdi}|jds| jdd|d<|jds&tj j#d|d<|jdst%t'|d<|| d<t1| |}|j+|| r&| j-tj.| d|dk(r1|d k(r+t|} | r% tj| j} ni} tjdi} | jd!i}|jds| jdd|d<|jds&tj j#d|d<|jdst%t'|d<|| d!<t3| |"}|j+|| r&| j-tj.| d|dk(r|d#k(rt|} | r% tj| j} ni} | jd$st%t'| d$<t5| }|j+|| r&| j-tj.| dt|}t7||}|j9dd%||z }|j;|j;k7r(t=j>t%|t%|d&}|rZ|jAd'}|j;|j;k7r(t=j>t%|t%|tC|||dk(r|r|jErr tj|j}t|\}}|r=|r:tj j#d(|jd)xsdj tG|jd)xsdj |d*id+d&d&||tj j#d(d, |d-<|j-tj.|d|d-}tI|}tK}tM|||}|D]I}|j|xsg}|stOjPtNjRtU||.K|dk(r|r|jEr|s|r tj|j}||tjdxsijddtj j#d(d/|d0<|j-tj.|dtVj|}|rYi} |r4|jEr$ tj|j} tOjP|tM||| tYd1rld2d3dd4d j||}!||d5}"|dk(r|s|r ||"d<||"d<t[d1d6tjdxsijdd7|d8|!||"9td|:S#tjtf$ri}YwxYw#tjtf$ri} YiwxYw#tjtf$ri} YTwxYw#tjtf$ri} Y?wxYw#tjtf$ri} Y,wxYw#tjtf$ri}YwxYw#tjtf$ri}YVwxYw#tjtf$ri} YwxYw);z7Change a WOR's status by moving it between directories.Trrr7rdrr6rL rr`rpzInvalid statusrrrq rr rz^Description of Work Performed is required for work orders with Return-to-Service requirements.rrr' _maintenancer r9rrr rrrrr_safetyrrr< rMNrrrFr ) rrrrkrrrdrrrq rr ro revh_dept_emailsri rf rreopenedacceptedr)r new_statusstatus_changedrW r\r )rUrd).rrrrrrnrrrrrrrrrrrrr*rr" r-rrr8 r] rX r rr,r r r rrrrrQrr=rEVENT_WO_EVH_AWAITINGr_WOR_STATUS_EVENTSr r )#rrrW src_pathr completion_wd completion_fu _pre_sidecar_pre_sd_pre_rtsr  sidecar_path form_datar'rr r cur_sidecarr dest_path dest_sidecar_sd_rts_req _req_depts _init_evh_init_actionable_init_approvers _init_ctx_d _d_emails_csdr r _status_label _hist_details# r1wor_admin_statusrr %Ds    4 ( .BDxx B'H(B'J tx'3(?/0#55II-.33 *H -.33)H XX017R>>@MXX45;BBDM[ +H5   **\%;%;%=>)1 ! M"OPQTU U]"x='@+H5   JJ|'='='?@ I{{62&mmNB7 }-)-&")=K &v&"0"4"4"6"?"? "KK 23/23J3L/MK+ ,$/ .!%i[I Y'   # #DJJy$C D]"x<'?+H5   JJ|'='='?@ I{{62&mmNB7 }-)-&")=K &v&"0"4"4"6"?"? "KK 23/23J3L/MK+ ,$/ .!0 T Y'   # #DJJy$C D]"x8';+H5   JJ|'='='?@ I{{62&y"-zz-($(HHVR$8F= !zz&!+//1:::FF6Nzz-.*-.E.G*HF& '% ),YvF Y'   # #DJJy$C D]"x?'B+H5   JJ|'='='?@ I}}_-),-D-F)GIo &(3 Y'   # #DJJy$C D'x0Kh' 3H NN4$N/8#IY..00 CM3y>2L ,,W5    L$8$8$: : KKK(#l*; <9-[ \l6J6J6L **\3356C 2#6*  "0"4"4"6"?"?@S"T!ggk28b??A0#''+2F2L"1S1S1UV","'--1%2(5'5'9'9';'D'DEX'YCK  # #DJJs1$= >F I4Y? 13O*8XsCI& +//39r !((%;;Y B  k!l|7K7K7M- ::l4467D!.$1$[[06B;;FBG*..099:MN  ]  4 :;  " ": .E  L002 "#zz,*@*@*BC  U$6x<$XY";/j$;  #j* % %-JG   $-=/#g5#g<*#h:#i#i"#jf54f58ggg98g9<hhh=<h=ii"jjj#"j#z/wor-evh-statuscvtjjddj}|rd|vsd|vrt ddfSt |}|st dgg S t j|j}|jd }|st dgg Stjd xsijd d}t|}t|}|Dcgc] }||vs| }}t |||| S#t jtf$rt dgg cYSwxYwcc}w)uGReturn EVH state for a WO and which departments the current user can action. Response fields: evh — the full _evh block from the sidecar (or null if none) actionable — list of dept slugs the current user can sign right now user_depts — all depts the current user is authorized to approve rr7rr6rL rr`N)rr user_deptsrr'r)rrrt all_actionable)rrhrrrrrrrrrrrvr) rrrrrprt currently_actionablernuser_actionables r1wor_evh_statusrx $Es2||+113H tx'3(?/0#55"8,G 4B2>>?zz'++-. ((6 C 4B2>>++f%+00"=J)*5J05"6JQ!z/qJOJ s:"6 88  ' *?4B2>>?Ks##D * D64D6 'D32D3z/wor-evh-actionc tjdxsi}|jdxsdj}|jdxsdj}|jdxsdj}|jdxsdj}|rd|vsd |vrt d d fS|t vrt d d fS|dvrt d d fS|dk(r|st d d fSt jdxsi}|jdd}|jdd}t|}||vrt d dfSt|} | st d dfS tj| j} | jd} | st d d fS| jddk7r!t d| jdd  d fSt| } || vrt |d! d fStj j#d"} ||||xsd#| d$}|d%k(r|| j%d&i|<t'| rd'| d<| | d(< t)|| }t+|}|r=t-|j.d)z}|j0|z }|j3||| d*<n,|| d&|<d,| d<| jd&i| d-<i| d&<d.| d/<| | d<| j=tj>| d01t+|}|r tA|nd2}tC||| }|d%k(r| jdd'k(r:tEjFtDjHtK|tM| | 3nt| }|Dcgc] }|| vs| }}tO}|D]I}|j|xsg}|stEjFtDjPtK||4Kn9tEjFtDjRtK|tM| | 3|dk(rd#}t+|}|r tA|}|r|rtU|jd5}|r|jWdd6||z }|jY|jYk7r(t[j\t_|t_||jad7}| jY|jYk7r(t[j\t_| t_|tc||| jd8d} te| tfrd9| d:n t_| }!d;dd?j||}"tid@|!dA|"d dB|!dC|"dD|dE|dF|"dG|dH| dItkdJrtmdJdK||!dL|"dM|d#dN|||dOPntkdJrz| jd8d} te| tfrd9| d:n t_| }!d;dd?j||}"tmdJdQ||!dR|"|||xsd#| jdd'k(dSPt d| TS#tjtf$rt d dfcYSwxYw#t4$r$t6j8j;d+|YwxYwcc}w)UuRecord an approve or reject sign-off on an EVH department. Body: {filename, dept, action: "approve"|"reject", reason?} On approve: records sign-off; if all required depts approved, finalizes EVH (sets released_to_production_at, generates EVH PDF snapshot, status→"approved"). On reject: records rejection, reopens WO to in_progress, clears ALL prior approvals so the next completion starts clean (board decision D2). Trrr7rPrrmrr6rL rr`zInvalid department)rrejectz$action must be 'approve' or 'reject'rz z Reason is required for rejectionr'rr9z)Not authorized to approve this departmentrzWork order sidecar not foundrCould not read sidecarrrz No EVH record on this work orderrdr z&EVH is not awaiting approval (status: r7z is not currently actionablerN)rru rrmrv rrrrr rz EVH PDF generation failed for %srejectedrFrrrr)evh_recipientsrS rrMrrrrrrs rrt ruRtS Approval Rejected — r:zReturn-to-Service approval for z was rejected by z. Rejected by: z Department: z Reason: z Timestamp: z The work order has been reopened to In Progress. All prior sign-offs have been cleared. A new completion will restart the RtS approval cycle.r evh_rejectedz RtS rejected by r r)rPrmr evh_approvedz RtS approved by )rPr| evh_completerUr)7rrrrrrOrrvrrrrrrrrrrr}rr rrrrr-ryrmrnrrrrnrr=rEVENT_WO_EVH_FINALIZEDrrrQrY EVENT_WO_EVH_REJECTEDr rr,r r r*r rrrrr r )#rrrPrrmr'rpr]rt rrrrv r_sign_off_recordr rrw evh_pdf_path _evh_wor_path _evh_wor_type_evh_ctx_newly_actionablern _unlocked _approver_maprm rn rrrd dest_scr! r dept_labels# r1wor_evh_actionr DEs   4 ( .BD$*113H HHV  " ) ) +Dhhx &B - - /Fhhx &B - - /F tx'3(?/0#55 :12C77 **CDcII &?@#EE ;;v  $"D'2&J$I**5J :HI3NN"8,G ;#6#6#CL#+??\#AL ,,Y7%1C N "1K"H %(WW["%= !"K % DL tzz$q12&h/M7D$]3-M!(M4@H  778  *  44X.Ec4.PQ  !6c : $5WqBV9VWIW/1M )--b17R !((%;;XyA    / / *A#t*L M $X. '1H %h/33MBHtd;$x/ ##%):):)<<KKH s9~>#//8??$(99KKG c'l;$Xy9-,*4VS*AT&&s6{%2, (Y@@CD$  ( "ZL B-hZ7H U%;b 5%,'hW  X  '{ 3 ^#*$5j\vcr{mT $7   '{ 3XXmR0F.8.EfS\*3v;H)6l$,DDGCdO  ^#*$5j\B $v~(+(9Z(GI   d $$O  ' *<56;;.!FsHQ!x-qH Nz&Gating department has not yet approvedz> wwx//;  w||'' r:@@B  gll**<8  GLL,,-?DJJL  gll&&|R8>>@  "7<<#3#34Mr#R#X#X#Z  7<<##Ir288:  ',,6  "  Ytf%5 5 ! D,  !9:C??  >?DD( 6LK zz,"8"8":;H",,~r:K&D&D!$K4G4HI #$$W-I D34";/ ;;v&,"11&90:JM1Z0[\ .   M **Q $$$g.   sQ5QQ54Q5z/safety-wor-editc@tjjddj}|rd|vsd|vrt ddfSt |d }|st d d fStjjd djtjjd djtjjddjtjjddjtjjddjtjjddjtjjddjtjjddjtjjddjtjj dtjjddjtjjddjtjjddjtjjddjd}|d st ddfS|dst ddfSt|d }i}|r6 tj|j}|jdi}d|d<||d<t||xsd }|j||jd!}|j!tj"|d"#t%d$rLt'd$d%t)jd&xsijd'd(|jd ||d)di*t |+S#tjtf$rYwxYw),zSAdmin-only: update an existing Safety WOR with edited form data and regenerate PDF.r r7rr6rL rr`rrr rrrrr3rrr rrrBr rDrrr r r rQ r NrR rrrrr r'r9uSafety WO edited — rr r )rrgrrrrr rrrrrrr] r-r rrr r r)r rrra rr r r s r1safety_wor_editr FsQLL$$_b9??AM DM1SM5I/0#55 BH <=sBB",,**+;R@FFH!!'2.446!!'2.446"<<++,=rBHHJLL$$Z4::<LL$$Z4::<LL$$Z4::<\\%%k26<<>||'' r:@@Bll**<8#LL,,-?DJJLll&&|R8>>@#*<<#3#34Mr#R#X#X#Z<<##Ir288: D"  !9:C??  >?DD( IL F zz,"8"8":;H\\)R0F!DDO(fnEI #$$W-I D34";/ ;;v&,"11&9+DHH5E},U+VW)   M **-$$g.   s5PPPz /mm-wor-editc  tjjddj}|rd|vsd|vrt ddfSt |d }|st d d fStjj d }tjj d }tjj d}tjj d}g}tt|D]}|t|kr||jnd}|t|kr||jnd} |t|kr||jnd} |t|kr||jnd} |s| s| s| s|j|| | | didtjjddjdtjjddjdtjjddjdtjjddjdtjjddjdtjjddjdtjjddjdtjjddjdtjjddjdtjjddjdtjjddjdtjj ddtjjddjdtjjddjdtjjddjd |d!d!tjvd"tjvtjjd#djtjjd$djtjjd%djtjjd&djtjjd'djdd(} | dst d)dfSt|d } | rV tj| j}|jd*r|d*| d*<|jd+r|d+| d+<t!| dt#jd,xsi\}}|rt |dfS|r|| d+<t%| }|j'||j)d-}|j+tj,| d./t/d0rLt1d0d1t#jd,xsijd2d3| jd||d4di5t |6S#tjtf$rYwxYw)7zEAdmin-only: update an existing Mobile Machine WOR and regenerate PDF.r r7rr6rL rr`rr r rr r r r r r(r)r> r@ rA r= rD rC rE rG rF rH rL rO rP r0 r r r3 rQ rR rS rT r r r< rr'rrrrr r9uMobile Machine WO edited — rr r )rrgrrrrr rrCrirrrrrrrrrX r-r rrr r )r rr r r r r0 rr r r r rra r r r r r s r1 mm_wor_editr FsLL$$_b9??AM DM1SM5I/0#55 IH <=sBB<<''8L%%m4J $$\2I<<''8L E 3|$ %N()C ,=(=\!_ " " $2&'#j/&9Z] "r%&Y%7Yq\   !R()C ,=(=\!_ " " $2 rR LLB2L M N 7<<##Ir288:  ((<BBD  7<<++,=rBHHJ  ))/2>DDF   ',,**+;R@FFH   W\\--.A2FLLN   gll&&|R8>>@  w||r*002  GLL$$Z4::<  ))/2>DDF   ((<BBD   ,,^<  W\\--.A2FLLN  gll&&|R8>>@  w||'' r:@@B  ! " 0GLL@# $)GLL8||'' r:@@B||'' r:@@B ))/2>DDF ))/2>DDF%ll../CRHNNP$1 D6  ?78#==' PL zz,"8"8":;H||O,(0(A_%||H%!)(!3X1i'++fBUB[Y[\KZ(#--$X$T*I #$$W-I D34";/ ;;v&,"11&93DHHY 4V3WX0   M **1$$g.   s A[[10[1z/preventive-wor-editc  tjjddj}|rd|vsd|vrt ddfSt |d }|st d d fStjj d }tjj d }tjj d}tjj d}g}tt|D]}|t|kr||jnd}|t|kr||jnd} |t|kr||jnd} |t|kr||jnd} |s| s| s| s|j|| | | didtjjddjdtjjddjdtjjddjdtjjddjdtjjddjdtjjddjdtjjddjdtjjddjdtjjddjdtjj ddtjjddjdtjjddjdtjjddjdtjjddjd|d d tjvd!d!tjvd"tjjd"dji} | dst d#dfS| dst d$dfSt|d } i}| rO tj| j}|jd%i}|jd&r|d&| d&<t!| dt#jd'xsi\}}|rt |dfS|r|| d&<d| d(<|| d%<t%| |xsd)*}|j'||j)d+}|j+tj,| d,-t/d.rLt1d.d/t#jd'xsijd0d1| jd||d2di3t || jd&4S#tjtf$rY2wxYw)5zOAdmin-only: update an existing Preventative Maintenance WOR and regenerate PDF.r r7rr6rL rr`rr r rr r r r r rrrr3rrr rrrBr rDrrr0 r r r3 r r rO rr'r NrP rrrrr r9u Preventive Maint. WO edited — rr )rr)rrgrrrrr rrCrirrrrrrrrr8 r-r rrr r )r rr r r r r0 rr r r r rra rr r r r r s r1preventive_wor_editr *GsLL$$_b9??AM DM1SM5I/0#55 FH <=sBB<<''8L%%m4J $$\2I<<''8L E 3|$ %N()C ,=(=\!_ " " $2&'#j/&9Z] "r%&Y%7Yq\   !R()C ,=(=\!_ " " $2 rR LLB2L M N ',,**+;R@FFH !!'2.446  !!'2.446  7<<++,=rBHHJ   GLL$$Z4::<   GLL$$Z4::<   GLL$$Z4::<  W\\%%k26<<>  w||'' r:@@B  gll**<8  GLL,,-?DJJL  gll&&|R8>>@  "7<<#3#34Mr#R#X#X#Z  7<<##Ir288:    0GLL@! " GLL8# $ w||'' r:@@B% D*  !9:C??  >?DD' MLK zz,"8"8":;H",,~r:K||H%!)(!3X1k1BGKKPVDWD][]^KZ(#--$X$D&D,T{?RdSI #$$W-I D34";/ ;;v&,"11&96txx@PR_7`6ab -   M$((82D EE7$$g.   s  *H 34c99)H"8,G @A3FFDJJw0023 j.9H) #kk&"-11&"=$((*334GH /IlM4::i:;()H)HXCCD( M@FGLLM +d Z +QDSEJKSPPQsl;G>9#H!?&I I5I5% I;>HH!'I  I  I2I-'I2-I2;J*J%J*%J*z/wor-remove-recurringcPtjdxsi}|jdd}|rd|vsd|vrtdd fSt |}|r\ t j |j}|jd d |jt j|d t}|j|d  t|tdS#t jtf$rYOwxYw#t$r}td|dfcYd }~Sd }~wwxYw)z*Remove recurring status from a work order.Trrr7rr6rL rr`r Nrrr rrY )rrrrrrrrrrrrrrr)rrrrb rrls r1wor_remove_recurringr Gs   4 ( .BDxx B'H tx'3(?/0#55"8,G  7#4#4#67I MM, -   tzz)A> ?()H LL4 Q * d $$g.    QDSEJKSPPQs1AC" D"C>=C> D% D D% D%z/wor-recurring-runc0t}td|S)z9Manually trigger processing of due recurring work orders.T)rUr)_process_recurring_work_ordersr)rs r1wor_recurring_runr Gs-.G dG ,,r3c \ ddlm}t}tjj d}g}d}t |jD]D\}}|jdds|jdd}|r ||krd|d<d};|jd d}|r||kDrU|jd i} | sj|jd | jd d } | jD cic]\} } | jdr| | } } } t}| d k(r|| d<d | d <|| d<tjddt| }tjdd| jddddj!j#dd}tjj d}d|dd|d|d}t|z }|j%||| d<|j'dj)t+j,| dn&| d k(r|| d<d | d <|| d<t.jddt1| }tjdd| jddddj!j#dd}tjj d}d!|dd|d|d}t.|z }|j%||| d<|j'dj)t+j,| dn"| d"k(r|| d<d"| d <|| d<t2jddt5| }tjdd| jddddj!j#dd}tjj d}d#|dd|d|d}t2|z }|j%||| d<|j'dj)t+j,| dntjj d$| d%<d&| d <|| d<t6jddt9| }tjdd| jd'dddj!j#dd}tjj d}d(|dd|d|d}t6|z }|j%||| d<|j'dj)t+j,| d|j;||jd)d*}t=|jd+|||,|d <||d-<||d.<d}G|r t?||Scc} } w)/zaCheck registry for due recurring WOs and create new instances. Returns list of created filenames.rrrFr~Trr7r_ r rr rr r3rrMr r RecurringNrSr\r WOR_rr_recurring_sourcerrrrSWO_rPMWO_z%Y-%m-%dT%H:%Mr> rr(MMWO_rZr)r last_createdrp) rrrrrrrrrrwrr{rr" rFr\rrr-r rrrrlr] rmr8 rkrX rirr)rrr rrr rrr_ templaterrrtemplate_cleanr r rrv new_filenamer r rs r1r r Gs"')H    ) )* 5EGG"&x~~'7"8PyyD) 99Z, 5($E) G 99Z,8e+ 99_b1 99Zk=)QR+3>>+;U41a1<0B0B0D0M0MN^0_N, -*9N; ',3N= ) ! ' 't ' D,^rr@rs r1_run_create_carrierr ZHs1(vZPL//K$&--c231U;5G4HIJQuY^^456H8F:,an11234D))+K$[-JL*//!22JKKKL)4(/  k !-- @   sCC0/C0z/create-carrierctjjd}tjjd}|r |jst ddfS|jj j dst ddfSdD]D}tjj|d jr2t d |d dfcStDcic]1}|tjj|d j3}}tjjd d j}|r(tjd d|ddjnttjdd}t|}t!|r t |S|j#dd|t%|jz }|j'|d} |r^|jrR|jj j dr)|t%|jz } |j'| t)j*t,||| |fd} | j/t1drt3ddt5jdxsijdd|jdd d|jdd d|jdd d ||jd|jd|jd!|jdd"#t |Scc}w)$zSAccept shop/submittal PDFs + carrier field data, create carrier sheet from scratch.rurvzShop Drawing PDF is requiredrr`rz'shop' must be a PDF file)rrrrr7rd z ' is requiredjob_name [^\w\s\-\.]r Nrrr TrMr(rr0r'r9uCarrier sheet generated — rz / rr:rr7r)r project vendor_coderr )rrrrrrEr|rgr_CARRIER_FIELDSrFr\r*rWrXrcrfrrrrrr rqr r r) rurv req_fieldrrr r^rdr!r#rs r1create_carrierr yHs !!&)D !!+.I T]];>TD || 2.4461YK}!=>C CD;J JQa!!!R(..00 JF J|| B/557H  ~sH-cr288:TZZ\*2A. "&)Jz"f%%TD1_T]];;IIIi$(NY''I,>,>,D,D,F,O,OPV,W#oi6H6H&II~&")^V < A GGI"#9: "K;;v&,"11&9.vzz/2/N.Os::nb12"VZZPR5S4TTUW"JJ7!::n5%zz*?@ & > :  & !!YKs#6M rc ddlm}||}|j Dcic]\}}||vs |s||c}}S#t$r-}tjj d||icYd}~Sd}~wwxYwcc}}w)u+Best-effort title-block extraction, filtered to `allowed` Create fields. Returns {} on any failure — OCR prefill is a convenience and must never block the Create flow. Honors the never-add-CSV-columns rule by only ever suggesting values for fields that already exist on the form. r)extract_title_block_fieldsz(title-block extraction failed for %s: %sN)r"r ryrmrnror)rrr suggestionsrlrrs r1_suggest_fields_from_pdfr Hst90: )..0 GTQALQAqD GG  ExQTU  Hs*< A5A5A5 A2"A-'A2-A2z/create-carrier/extractc(tjjdxstjjd}|r |jst ddfS|jj j dst ddfStj5}t|t|jz }|jt|t|t}dddt  S#1swYxYw) uOCR a just-selected drawing's title block (DVI-498) and return suggested, user-editable Create-Carrier field values. The upload is read in a temp dir and discarded — nothing is persisted and the take-off CSV is untouched.rruA PDF file is requiredrr`rrV Nr)rrrrrrEr|rTemporaryDirectoryrrrr*r r )rtdrSrs r1create_carrier_extractr Hs  &!>W]]%6%6v%>A !**56;; ::    & &v .12C77  $ $ &@"2h44 s3x)#?@ & !! @@s (A DD)rrrrrrz/takeoff/extract-metadatactjdxsi}|jdd}tj |rd|vrt ddfSt |z }|jst d dfSt|}|jd ixsi}d }d D]}|jD]}|xsij|}|s||z j} t| jt|js`| jsq| jjd k(s| }n|sn| t iSt t!|t"S)zOCR a representative drawing in a published folder (DVI-498) to suggest project-info values for the Take-off Bridge metadata popup. Prefers a carrier sheet (metadata sits below the QR zone), else a shop/submittal drawing.Trrr7rrrr`rrN)rxrurvrr )rrrrarGrrbrrkrr,r*rwrr!rEr _META_FIELDS) rrrrorrftyper r9rs r1takeoff_extract_metadatar HsV   4 ( .BD((8R(K   k *dk.A-.33  $F ==?/0#55  E IIgr " (bE#I1 LLN DJB##E*D$'')A1v  V^^%5!67AIIK(F2     b!! 29lK LLr3rrc"tj|rd|vsd|vryt|z j}||z j}t |j t |t jzsy|jsy|S)zResolve folder/rel under WATCH_DIR, rejecting traversal. Returns the file Path or None (shared by the DVI-641 project-file preview endpoints).rN) rarGrbr,r*rwrrrr,s r1_takeoff_resolve_filer Is~   k *dk.ATS[+% . . 0F#&&(I y> $ $S[266%9 :     r3z/takeoff/extract-metadata-filec8tjdxsi}t|jdd|jdd}|t ddfS|j j d k7rt d dfSt t|t S) uOCR the ONE document the user has open in the preview (DVI-641) and suggest project-info values. Unlike /takeoff/extract-metadata (which auto-picks a representative drawing), this reads the exact selected file. PDF-only — image/text documents have no title block to read.Trrr7rrrr`r OCR can only read PDF documents.r ) rrr rrr!rEr r )rris r1takeoff_extract_metadata_filer Is   4 ( .BD%dhhx&RSI^,c116)?@#EE 29lK LLr3z/takeoff/pdf-pagescttjjddtjjdd}|t ddfS|j j dk7rt d dfS d dl}|jt|} |j}|j t | S#|jwxYw#t$r}t d |d fcYd}~Sd}~wwxYw)uReturn a project PDF's page count so the preview can render each page as a fit-to-width image (DVI-641 — native PDF viewers zoom too far in on mobile and offer no controls).rr7rNrrr`rrUrzCould not read PDF: r)r) r rrhrrr!rEr=r?r*r@r[ry)rir=rrrls r1takeoff_pdf_pagesr #Is &gll&6&6x&D&-ll&6&6vr&BDI^,c116)[)3..@iiI' NNE IIK   IIK @3C59:C??@s6C"$ C 0C" CC"" D+D;DDz/takeoff/pdf-pagecttjjddtjjdd}||jj dk7ry t tjjdd}d dl} d dl }|jt|} |d ks||jk\r |jy |j|}td t!|j"j$d z d}|d krd}|j'|j)||}|j+d}|j t/|j0|dd|d zdS#t$rYy wxYw#|jwxYw#t,$r} d| dfcYd} ~ Sd} ~ wwxYw)zWRender one page of a project PDF as a PNG sized for fit-to-width preview (DVI-641).rr7rNrrrOrF Invalid pager`rzPage out of ranger@@r^@?r7rqCould not render page: rrnzpage-rr!r+)r rrhrr!rErrr>r=r?r*r@r[rArLrCrDrErGrHrKryrrJ) ripage_nor>r=rrOrPrQrqrls r1takeoff_pdf_pager ;Is &gll&6&6x&D&-ll&6&6vr&BDII,,224>"#gll&&vs344iiI' {g7/ IIK==)DvDIIOOQ 77=Dqy//T4)@/AC++e$C IIK ZRZZ_{%*7Q;-t#< >>' #"# IIK 4(.334sU*)F F/7F F/A8FF/ FFF,,F// G 8G>G G rz/takeoff/extract-regionc tjdxsi}t|jdd|jdd}|t dd fS|j j d k7rt d d fS t|jd d }|jdxsi} t|jdt|jd}}t|jdt|jd}}ttdtd|tdtd|f\}} ttdtd|tdtd|f\} } | |z dks| | z dkrt dd fS|jdxsdj} d dlm}  | |||| | | ft#| }t-drut/ddt1jdxsijd d!|jddd"||jdd|jdd|| xsdd#$| r'| t2vrt d%d fSt | |xsd&S|xsij5Dcic]\}}|t2vr|r||}}}t |'S#ttf$rt dd fcYSwxYw#ttf$rt dd fcYSwxYw#t$$r2}t&j(j+d||| rdni}Yd}~bd}~wwxYwcc}}w)(u~OCR a user-drawn rectangle on one page of the previewed PDF (DVI-645). Body: {folder, file, page, rect:{x0,y0,x1,y1 as 0..1 fractions}, field?}. Without `field`, returns {fields:{…}} parsed from "LABEL: value" lines (the "OCR this region → best guess" flow). With `field`, returns {field, text} where text is the raw recognized text for that one targeted input.Trrr7rNrrr`rr rOrr rDr r x1y1Invalid regionr {Gzt?*Selection too small — draw a larger box.fieldextract_regionrzregion OCR failed for %s: %srz region-ocrr'r9z Region OCR: z p)rrOr r z Unknown field)r r&r )rrr rrr!rErrrfloatrrCrLrr"r rryrmrnror r r_META_REGION_FIELDSr)rrirOrDr r r r fx0fx1fy0fy1r r r>rlrrrs r1takeoff_extract_regionr cIs-   4 ( .BD%dhhx&RSI^,c116)?@#EE2488FA&' 88F  !rD4txx~&dhhtn(=Btxx~&dhhtn(=B s3C -s3C /EFGHCs3C -s3C /EFGHC c UsSyE1IJCOO XXg  $" + + -E)% 4#sC1E%)%[2 ##34 l;;v&,"11&9"488FB#7"84&A$"hhx4d"]d,   + +136 6U266 & "3351tq!))ad1F1 & !!O z "2^,c112 z "4-.334 % 99cJ"%"1sCK4A(K6L-MK32K36LL M"'MMc|rd|vsd|vryt|z j}t|jttjsy|S)z8Resolve a job folder under OCR_DIR, rejecting traversal.r6rN)rr,r*rw)r^rs r1 _ocr_job_dirr IsM SF]dfn((*G w< " "3w'8#9 : Nr3cV|dz jtj|dyr7 r9 r: s r1_ocr_write_statusr Ir; r3c|dz }|jsddiS tj|jS#tjt f$rddicYSwxYw)Nr8 rdr)rrrrrrr3 s r1_ocr_read_statusr Is_-A 88:)$$%zz!++-((  ' *%)$$%s">AAcVtjsytjtdzz }tj D]P} |jr=|j j |kr tjt|dRy#t$rY_wxYw)z3Remove OCR job folders older than OCR_JOB_TTL_DAYS.NQTrO ) rrrUOCR_JOB_TTL_DAYSrYrrr r:r*r)cutoffchilds r1_prune_ocr_jobsr Is >>  YY[+e3 3F" ||~%**,"7"7&"@ c%j=   s A B B('B(r orig_namein_pathr rOc  ddlm}m} ||||}t |j} t|d|j | dtd r.td d |d |xs |j d | d |xsd| |dyy#|$r-} t|dt | |j dYd} ~ yd} ~ wwxYw#t$r-} t|dt | |j dYd} ~ yd} ~ wwxYw)z>Background thread: OCR the uploaded PDF into a searchable PDF.r)rrrrrdrrNrrdrrrzocr-runzOCR: r:p)r7rrOr ) r"rrr r*r9rCrr r ry) rr r rOr r rrr>rlrs r1 _run_ocr_jobr Is@< WhT:F FLL!' $  'z 2 I :X]];2eWBGO!&5   3$  g'CH4 MM  e $ !9:C? ?zz!**62!56; ;|| 4 = =D I MM$M 6TZZ\"2A&F" dT 2"&&(112CD qzz*1#78#==>s[AH6H>&H%G/ct|}|r|jstdddfSt|}t|j dd|j dd|j dd S) Nr Job not foundrrrdrrr7)rdrr)r rrr r)r^rrds r1 ocr_statusr Jsl6"G '..*g_=sBB g &F &**Xy9"JJz26GR0 22r3z/ocr/download/ct|}|r|js tdt|}|j ddk7r td||j ddz j }t |jt |j r|js tdtt |dd|jS) Nrrdrrr7rTr!rr+ r rr r rr,r*rwrrr9r^rrdr s r1 ocr_downloadr "Js6"G '..* c g &F zz(v% c &**Z44==?H x= # #C(9$: ;8??CT c S]->#'x}} FFr3z /ocr/backendc@ddlm}m}t||S)z@Return the selected OCR backend and the registered backend list.r list_backends load_backend)backendbackends)r"r# r$ rr" s r1ocr_backend_getr' 2Js7 <>MO DDr3cddlm}m}tjdxsi}|j dxsdj }||vrtdd fS||td| S) z Set the OCR backend. Admin only.r) OCR_BACKENDS save_backendTrr% r7Invalid OCR backend selected.rr`)rUr% )r"r) r* rrrrr)r) r* rr% s r1ocr_backend_postr, :Jsf6   4 ( .BDxx "(b//1Gl"<=sBB dG ,,r3c  ddlm}m} ||||}|jd} | js" | j|jxsdd t|j} t |d |j | d td r.td d|d|xs |j d| d|xsd| |dyy#|tf$r-} t |dt | |j dYd} ~ yd} ~ wwxYw#t$rYwxYw#t $r-} t |dt | |j dYd} ~ yd} ~ wwxYw)zBackground thread: OCR an existing project file into a searchable PDF and ensure a text sidecar exists for in-document search.r)ocr_filerrrr Nrr7rrrr rz ocr-projectzOCR (project): r:r r r )r"r. rrr r*r9r rrr&rrCrr r ry) rr r rOr r r. rr>rlrrs r1_run_ocr_project_jobr/ QJsR@= gxd;F&&v.~~ ""6;;#4"w"GFLL!'f(---2$4 5 &z 2 M))*Dx}})ERwbQO!&5   3%j1  g'CH4-t,2xx%2,,.$'mC T ;ckkm!LMsR Rchh'!JKSP Pxx , = =D I MM$M 6TZZ\"2A&F" dT 2!#((+9zG# SXs7|,388n))*/:X%'iX#NO";;v.4"99&A 4&4@*9 Q $ &',egcjj,,X-=-=-?@A c>Gf)-chh)<)<(=^&L")#&88- -1 I#1#78#==>s[A;J>JJ7I FJ J)I?9J:J?JJ J+J& J+&J+z/ocr/view/ct|}|r|js tdt|}|j ddk7r td||j ddz j }t |jt |j r|js tdtt |dd|jS) zFServe a finished job's searchable PDF inline (for the preview iframe).rrdrrr7rFr r r s r1ocr_viewr< Js6"G '..* c g &F zz(v% c &**Z44==?H x= # #C(9$: ;8??CT c S]->#(  GGr3z/ocr/search/ct|}|r|jstddfStjj dxsdj }|stdgdSt|}|j dd}|r||z jd nd }|r|jstdgdS |jd d }|j}g}d} t|jdD]\} } | j} | j|} | s*| | z } | j!|}t#d|dz }| ||t%|zdzj'ddj }|j)| dz| |dt| ||r |ddSdS#t$rtdgdcYSwxYw)zSearch a finished job's OCR text. Returns match count + per-page hits so the UI can jump the inline viewer to the first matching page.r rrr r7r)rr first_pagerrNrr)rerrorsr rSr0r\r^)rOrr! rO)r rrrrhrrr r rrrrErrrrMrCrCrri)r^rr rdr rr&r# rtotalrptextrKrrrqr! s r1 ocr_searchrB Js 6"G '..*_-s22   #  $"++-A Qq99 g &Fzz*b)H:Bw!..v6G '..*Qq99:  ') D BG Edjj./L5kkm IIbM QJE((2,C38$EE#A,"34<t,2((8$*113HHUO)r002HHZ(.B557+./ v&gnn.!56; ;!'* ::h 6 )!;gnnFV!ABCG G3(?dh.>(kBY!45s: :~~((0  H*2 !H:&S! <!<=sB B ;;(**, ,T[[5G5G5I!HI3N N ;;=A3F F S\3t9-$S)9)9(:J:J:L)M%N (* * >1#78#==>sLCJ ,J7A1J)JA JAJ J9AJ J="J82J=8J=z/uploadctjjd}tjjd}tjjd}tjjd}tjjddj }|r(|j r|r|j r|r |j st dd fSd|fd|fd|ffD]B\}}|j jjd r0t d |d d fcS|rC|j r7|j jjd st dd fS|r(tjdd|ddj nttjdd}t|}t|r t |S|j!dd|j#|t%|j z |j#|t%|j z |j#|t%|j z |r3|j r'|j#|t%|j z t'j(t*|fd} | j-t |S)Nrurvrxrr r7z.shop, submittal, and carrier PDFs are requiredrr`rrd z' must be a PDF filerzcsv must be a .csv filer r rrr TrMr()rrrrgrrrrEr|rFr\r*rWrXrcrfrrrrrrrq) rurvrxrQ r rrr^rdrs r1uploadrH KsP !!&)D !!+.I !!),G !!%(H   R0668H T]]yY5G5GG,,MNPSSSd^k9%= 7?STGqzz!**621UG+?!@A3F FGH%%h.?.?.E.E.G.P.PQW.X67<.>??@H%% j?83D3D#EEF 1 dSAGGI & !!r3z/status/ct|}|js tdt|}|rt d|j St dS)Nrrr r)rd)rcrr rfrr9r^rdr0s r1rdrd7KsJ"&)J     c  +Ify~~>> ) $$r3z/preview/cbt|}t|}|s tdt|dS)Nrrr )rcrfr rrJ s r1previewrL CKs0"&)J +I  c Y): ;;r3z/download/cxt|}t|}|s tdt|d|jS)NrTrn )rcrfr rr9rJ s r1 download_pdfrN MKs5"&)J +I  c Yd).. QQr3z/single-carrier-viewer-urlcttjjdd}|stddidfSt |}t |}|stddidfSt }|dt|jd t|j}t||jd |jd S) z=Return the Document Viewer URL for a generated carrier sheet.r^r7rzmissing job_idr`r rrr6)rJr) rrhrrrcrfrrr9)r^rdr0rrJs r1single_carrier_viewer_urlrP WKs\\  h +F !123S88!&)J +I -.33 $ &F HHU:??34AeINN6K5L MC 3*//):!INN;K'LM NNr3z/reprint-list-projectscFg}tjrp ttjddD]J}|js|jj dr0|j |jL td|iS#t$rYwxYw)zFReturn project folder names under SHARED_DIR, sorted newest-to-oldest.c6|jjSrTrrrBs r1r z'reprint_list_projects..vKsaffh//r3Tr rr) r rrrYr9rwrirrrrs r1reprint_list_projectsrV mKsG ""$/ / <<>%***?*?*DNN5::.  / Iw' ((   s4B B)B B B z/reprint-list-carriersc tjdxsi}|jddj}|rtj |rd|vrt ddidfSt|z j}t|jttjr|jst dd id fS|}|jd }t|d k\r|d j}n!t|dk(r|d j}|dz }|jr< tj |j#d}|jdr|d}t)|j+d}g}t-} d} |j/D]4} | j0j3dk(s!| js2| } n| r t5| ||| }|s?|dz } | jr) tj | j#d} t;| jdgD]\}}| jdijt|i}|jd}|sE||z }|js[t|j=t}|| vr~| j?||jd}|jd}|jA||tC||ttC||td |stE|dD]}|jFj3}t|j=t}|| vr@|jIds d|vsVd |vs[| j?||jA|jF|dddt |||d!S#tj$t&f$rYwxYw#t&t6j8f$rY+wxYw#tj$t&f$rY wxYw)"zAList carrier sheet PDFs in a project folder, ordered by CSV/JSON.Trrr7rrr r`rrr*rPr^rrrrrr+Nrrhrrrxrurvr9r r!r#c6|jjSrT)r9rErs r1r z'reprint_list_carriers..Ks!&&,,.r3rrwr0)r rcarriers)%rrrrrarGrr r,r*rwrrrCrrrrrrrrzrrYr!rE_reprint_carriers_from_csvrErrorrr{rri _reprint_relrrr|)rrrr r0 rrall_pdfsr[ rrr state_pathrorrfmrcprrsub_namer6rts r1reprint_list_carriersrd Ks   4 ( .BD((="-335K l00=AT!678#== +446K {  & &s:+=+=+?'@ AI[I[I]!345s::H   e $E 5zQ8>># Uq8>>#55I ::i1171CDDxx'/K%%g./HHUDH  " 88>> v %!))+H   1(HkSWXH  </      :#7#7#7#IJ$-eii.D$ELAy7B/33CFB?B#%66)#4L' $|3B::< bnnZ89Cd{ HHSM "vI!vvk2HOO )(+%1+y*%U*6{Hj*Y %0 ((@A C)Jcooj12Cd{"";/Z'K:,E HH$'!%&* !  " G$$g.   "#   :(('2  s7<;O&)PD'P&&PPP#"P#&QQsharedcj|sy||z }|jrt|j|SdSrT)rr*r{)rrre rs r1r^ r^ Ks3 A)*3q}}V$ %>$>r3r_ shared_dirrr!c|r_t|jdjddd}|D]-j|k(st j |cS|Dcgc]1}|j s|j j3}}|ra|D]\tfd|Dsjjj|sBt j |cSycc}w)zHLocate a PDF by URL-extracted filename or by identifier+suffix matching.r6r^rc3VK|] }|jjv"ywrT)rrE)r,rr6s r1r/z$_reprint_find_pdf..Ks!9Q1((9s&)N) r r8rsplitr9r*r{rrErrr|) rJr_ rg rr!rridentsr6s @r1_reprint_find_pdfrl Ks 3::c?11#q9"=> 8Cxx8#3??:677 8*5 BA aggioo BF B  8C9&99chhnn>N>W>WX^>_3??:677 8  Cs 'D= DrrcBg}t|dd5}tj|}t|g}|Dcgc] }|j j "} }it | D]\} }d|vrjd| d|vrjd| 4|dvrjd | Kd |vrjd | bd |vrjd | yd|vrjd| d|vsd|vsjd| d vr t|dkDrjd dd vr t|dkDrjd ddvr t|dkDrjdddvr t|dkDrjdddttdtdtffd } |D]} | | d } | | d}| | d}| | d }| s|s,| xs |xs|xs|}||| g}t| | d |t|d}|r||vr`|j||j||t| | d|t|dt| | d|t|dd ddd|Scc}w#1swY|SxYw)z._cell)Ls4''#,C'*3S>3s8>># Qr Qr3rwrurX N)r?rrOrrrErr}rCrr*rl r rri)rr_ rrr[ rrOheaderr} header_lowerrrx rr rp rrr displayids carrier_filer6s @r1r\ r\ LsH h[ 99RBfb!39:a ): :l+ *DAq1}ua(!x+//vq)!Q&vq)qvq)1$vq)!fkvq) *"  Vq NN61 %  Vr!1 NN62 &  Vq NN61 %  Vr!1 NN62 & RtCy Rs Rs R Cf%D3)FU#Cf%D3f33Gd#C,U3-?:WZ\ghL<4#7 HH\ " OO ,.uS&/A8ZY\^de"3E#v4FR\^acn"o  ! I9v Oq;9v Os*&J%JB#JJE>JJJ sent_namekeywordexcludec>|r$|t|z }|jr||vr|St|jD][}|jr!|jj dk7s||vr5|j j }d|vrT||vsY|cSy)z]Resolve a shop/submittal PDF in the job folder: client-sent filename first, keyword fallback.rr0N)rrrrYr!rEr9)rdr~ r r rrr9s r1_scs_find_job_pdfr LLsOI66 <<>d'1K J&&( )yy{ahhnn.&8AL vv||~ $   d?H r3/scs-save-to-projectc tjdxsi}|jdxsdj}|rtj |rd|vrt ddidfSt|z j}t|jttjtjzst ddidfS|jst dd id fS|jd xsdj}|st dd idfSt|jd d}tj!d}|dt#|d}d}d}|jdxsdj} | rd| vrt ddidfSt| z j} t| jttjtjzr| j%st ddid fS| j&|k(rgn| g} |jdxsdj} |jdxsdj} | rd| vr|dt#| d}| rd| vr|dt#| d}n|jdxsdj}|st ddidfSt)|}t+|} | st ddid fSt-||jdxsdd| h}t-||jdxsdd| h|r|hn t/z}| g||fDcgc]}|s| c}z} |r|dt#|j0d}|r|dt#|j0d}|dt#| j0d}g}| D]R}t3j4t|t||j0z |j7|j0Td}d}|dz }|j%rQ t9j:|j=d }|jd!}|r||z j%r||z }|GtCd"|jED}tG|d#k(r|d$}ntG|d#kDrd%}nd&}|rt d||d'StI|dd()5}tKtMjN|}ddd|jQ}tSD cgc]>\}} |d$kDr4tG| d*k\r&| d+jjQ|k(r|@}!}} d}"|!rN|!D]H}||} tG| d,kr | j7dtG| d,kr ||| d-<||| d.<|| d/<Jn|st d||j0dd0Sdgd,z}#|jd1xsdj|#d#<||#d+<|jd2xsdj|#d3<|jd4xsdj|#d5<|jd6xsdj|#d7<|||#d-<|||#d.<||#d/<|j7|#d}"tI|d8dd)5}tMjT|jW|dddt d||j0d|"tG|!|d9Scc}w#t8j>t@f$rYwxYw#1swY,xYwcc} }w#1swYgxYw):zXCopy an SCS carrier sheet (+ drawings) into a project folder and update its CSV records.Trrr7rrr r`Project folder not foundrrzProduct Code is required append_rowFr6rNr zInvalid carrier pathzCarrier sheet not foundr!r#r^zMissing job_idz No generated carrier sheet found shop_filenamerusubmittal_filenamervrhrrrc3~K|]5}|js|jjdk(s2|7ywrNrr!rErs r1r/z&scs_save_to_project..Ls+hAQYY[QXX^^M]agMgah ===r^r8Multiple CSV files found — project records not updatedu,No CSV found — project records not updated)rU saved_files csv_warningrrrPrr-ryrr)rUr csv_name csv_matchrrrrrrrr)rUr r r appended updated_rowsr),rrrrrarGrr r,r*rwrrrrr+r8rrrrcrfr rr9r r7 rirrrrrrrYrCr?rrrOrErrr)$rrproject_folderrr rr<r=r> carrier_rel carrier_src copy_sourcesshop_rel submittal_relr^rdshop_src submittal_srcrrr r$rr r` ror9csvsrrn code_lowerrrrr new_rows$ r1scs_save_to_projectr ]Lsb   4 ( .BD88M*0b779K l00=AT!678#== ;.779N ~  ) )#j.@.@.B*Cbff*L M!678#==  "!;<=sBBHH^,299;L !;<=sBBdhh|U34J!((-H:Qu[r:;?@#E E(//>Ar } HH[)/R668"239r@@B H,"1U8#%>$?@H T6'j% C*H)IJM((8$*113G%567< <%f- %j1 G%GHI3N N$Z/1J1PbRX[fZgh) !56<"k M8hZ ? $}Hm3L'RaPQ'RR $QuX]]'D&EFH )l!E-2D2D2,N+OPML% (8(8r"B!CDKK% SXs>CHH#<=>388$% HK,.J JJz33W3EFE99^,D$.779)D0h!7!7!9hh t9>AwH Y]TKHKd;{[\\ h[ 9$RCJJrN#$##%J%dOS 7s3x1}Q)=)=)?:)M G H "Cs)Cc(R- 2c(R-#!A('B!CG "&     $)hh~.4";;= ! hhx(.B557 hh/06B==? hhz*0b779  !GAJ  $'GBK!  G hR' :'b 2  &' "MMG $ k(S0$$g.   $$N''s>+\#3\#A\(?]A]%](]]]]$z/home/manager/rclone.logz/home/manager/rclone_resync.shz$/home/manager/rclone_force_resync.shz/sync-admin/logc `tjstdttzdfS tj j dtt}tdt|d}ttd5}|jd d |j}t|d }|jtd ||z |j}dddjd d }|j!}|| d}d}d} d} |rD|d} d| vrd| vrd}|D]0} d| vrd} t#j$d| t"j&s/d} 2t||| | t)|S#1swYxYw#t*$r!} tt| dfcYd} ~ Sd} ~ wwxYw)NzLog file not found at rrrPrTr^rrbrrrrr? FrzBisync abortedzMust run --resync to recoverTz(failed to bisync: prior lock file found:z\b(?:error|failed|aborted)\b)rP needs_resyncneeds_lock_fix has_errors total_lines)RCLONE_LOG_PATHrrr*rrhrSYNC_ADMIN_DEFAULT_LINESrrCrLr?rrreadrrrFr IGNORECASErCry)lines_requestedrrd chunk_sizerr& all_linesr&r r r last_linersrls r1sync_admin_logr Ls  " " $5O8LLMsRR&,!,,**74LSV*Wa_c!:; /4 ( A FF1aL668DT5)J FF3q$+, -&&(C zz')z4OO% /)*+  RI9,1OS\1\#  &=E%)N99AFAE7!A8FF7F<F F- F("F-(F-z/sync-admin/resyncctjjtst dtzdfS t j dtgt jt jdtddtjd xsijd d t dd S#t$r!}t t|dfcYd}~Sd}~wwxYw)NzResync script not found at rr /bin/bashTrbrcstart_new_sessionrresyncr'r9zResync initiatedr r zResync script launched.rUrr) rrbisfileRCLONE_RESYNC_SCRIPTrr9PopenDEVNULLr rrryr*rls r1sync_admin_resyncr .Ms 77>>. /:=QQRTWWW, . /%%%%"   (;;v&,"11&9& $(ABB ,SX&++,A>4 5@C]]^`ccc, 4 5%%%%"   .;;v&,"11&9; $)HI I ,SX&++,r z/sync-admin/log-tailc*tjstdddfS ttd5}|j dd|j }t |d}|j td||z |j}d d d jd d }|jd d }tdj|S#1swYJxYw#t$r"}tt|ddfcYd }~Sd }~wwxYw)zNReturn the last 50 lines of the rclone log for support request pre-population.zLog file not found.r7)rr&rr rrr Nrrr r0r%r)r rrr?rrrLrCr rrrryr*)rrdr rr&rPrls r1sync_admin_log_tailr ]Ms  " " $2>.1 ,3H:*>J ' $$+L> G    # %t|#/0C0C/DEE E,,.EN3B'H%h/7x(399$?B  *(3 f %&) d # *D  ;554 * * ; 4< 4SE:::;s[,D9$A!EEAEE- E9EE E E6E1E6%E1+E61E6z/togen-admin/versionctdz } |jstddfStj|j }|ddd|d|j d d d }t\}}|rt|d fS|d|dk7}t|||S#t$r}td |dfcYd}~Sd}~wwxYw)zDReturn deployed commit info and latest GitHub commit for comparison.VERSIONz*VERSION file not found. Redeploy required.rrr Nr-rrr7r zLocal version check failed: rU )r?remoteupdate_available) _TOGEN_APP_DIRrrrrrrryr ) version_filever local_inforlr gh_errr s r1togen_admin_versionr Ms"I-L H##%!MNPSS Sjj//12K$Kwwy"- /0K V$c))!&)[-@@ )  H;C5ABCGGHs#B!AB!! C*C:CCz/togen-admin/updatectd}|jstddfS tjdt |gtj tj dtdd tjd xsijd d tddS#t$r!}tt |dfcYd}~Sd}~wwxYw)zLTrigger a git pull and service restart (wired by Linux Automation Engineer)./opt/togen/update.shzDUpdate script not yet configured. Contact your system administrator.rir Tr r zupdate-appliedr'r9z5Immediate update applied (git pull + service restart)r z9Update started. The application will restart momentarily.r rN) rrrr9r r*r r rrry) update_scriptrls r1togen_admin_updater Ms/0M  "cdfiii, #m, -%%%%"   +;;v&,"11&9K $(cdd ,SX&++,sBB-- C6C CCzupdate_schedule.jsonzhelp@voyagetech.comc tjr'tjtj S dddddS#t $r"t jjdY1wxYw)zDReturn the persisted scheduled-update record, or a disabled default.zFailed to read update scheduleFr7rsr~version scheduled_forrd) UPDATE_SCHEDULE_FILErrrrryrmrnrrXr3r1_load_update_scheduler Msf?  ' ' )::2<<>? ? *bF SS ? =>?s:A(A0/A0c tjtj|dy#t$r"t j jdYywxYw)NrrzFailed to write update schedule)r rrrrrmrnrrs r1_save_update_scheduler Mrrc ddlm}|d}tj|}|j dddd}||kr|t dz }|j tjj d S#t$rRtjj dddd}|tjkr|t dz }|cYSwxYw) zFReturn the next 02:00 America/Chicago instant as a naive UTC datetime.rrr|rrr^rNtzinfo) rrrrrrr _dt_timezonerryr)rcentralnow_crs r1_next_2am_central_utcr Ns %,-""7+AaqI U? o1- -F  !1!12::$:GG &&(00a!YZ0[ ^**, , o1- -F sA:A==ACCz/togen-admin/scheduled-updatec*ttS)z4Return the current scheduled-update state (DVI-768).schedule)rr rXr3r1 togen_admin_scheduled_update_getr Ns 13 44r3c tjdxsi}t|jd}|s%t dddddt dt St|jd dj}|st d d fStjd }tjdi}d||d|jdxs|jdxsdtjjd d}t |tddtjdxsijdd|d|t d|S)a3Enable or cancel a scheduled update for 2:00 AM next morning (DVI-768). Body: {enabled: bool, version: str}. When enabled, ``version`` is the public version string to display to users once the update completes; the update is applied by the background scheduler at the next 2:00 AM Central. Trr~Fr7rsr rUr r z.Version is required when scheduling an update.rr`rr'rrr9)r~r r rdr rr zupdate-scheduledzUpdate vz scheduled for r )rrrrr rr r*rr rrrrr )rr~r r r'rs r1!togen_admin_scheduled_update_postr NsG   4 ( .BD488I&'G %BQS_efg$)>)@AA$((9b)*002G MNPSSS)+445IJM ;;vr "D&xx(BDHHV,<B$++-667KL  E% ){{6"(b--f57)?=/B dU ++r3c |jdd}|jdd}|jdd}|jdd}|r=d|jddd|jd dd |jd dd }n d |xsdd }d|d|d|d|d|d } tjtd|y#t$r"t j jdYywxYw)zHEmail help@voyagetech.com that a scheduled update was applied (DVI-768).r r7r rr z#
  • Commit: r z,
  • Committed: rz#
  • Message: r
    • z'
  • GitHub commit details unavailable: z unknown errorz

    Togen Scheduled Update Applied

    A scheduled application update has been applied per schedule.

    • Scheduled for: z,
    • Applied at (UTC): z(
    • Scheduled by: z2
    • Version shown to users: z0

    GitHub update information

      
    zTogen scheduled update appliedz%Failed to send scheduled-update emailN)rr=send_html_email_SCHEDULED_UPDATE_NOTIFY_EMAILryrmrnr) rr r r r rr gh_blockrs r1_send_scheduled_update_emailrANs0ii 2&GIIor2M<,J<,J 1&**VR2H1IJ//5zz&"/E.FG--3ZZ 2-F,Gu N  =V=V22<>..8\:88?yAj  F%% * ,  F DEFs%C(C,+C,c.t5t}|jdr|jddk7r dddy|jd}|s dddytjj d}||kr dddyt d}|js)tjjd dddy|jd d j}td \}}|r tj|d zd|d<d|d<||d<t#|t%||| t'j(dt+|gt&j,t&j,d tjj/d|dddy#t$r"tjj!dYwxYw#t0$r"tjj!dYawxYw#1swYyxYw)zBIf a scheduled update is due, set the public version and apply it.r~rdrNr rr z;Scheduled update due but update.sh missing; leaving pendingr r7Tr r0z0Scheduled update: failed to write public versionappliedFrr r z&Scheduled update launched (version=%s)z,Scheduled update: failed to launch update.sh)_UPDATE_SCHEDULE_LOCKr rrrrrrrmrnrorr r rrrr rr9r r*r rlry)rr now_strr r r r s r1_maybe_run_scheduled_updater eNs ,Q%'yy#uyy':i'G ,Q,Q /2   ,Q,Q!'')223GH ] " ,Q,Q34 $$& JJ  \ ] ,Q,Q ))Ir*002-D9  Y#..w~>$h i%le$$UFF; Q   c-01!))!))"&   JJOODg NU,Q,Q, Y $$%WX Y* Q JJ !O P QW,Q,Qsf1H H )H ;H 1H F/'H A G/(GH GH (HH HH  Hz/togen-admin/tool-visibilityc*ttS)zCReturn the current enabled/disabled state for each manageable tool.)tools)rrrXr3r1togen_admin_tool_visibility_getrNs .0 11r3cntjdxsi}|jdi}t}tD]}||vst ||||< t jtj|dtd| S#t$r}td|dfcYd }~Sd }~wwxYw) zCSave tool visibility settings. Body: {tools: {tool_id: bool, ...}}.Trr rrFailed to save settings: rrN)rUr ) rrrrrrr1rrrrrrincoming visibilityrrls r1 togen_admin_tool_visibility_postrNs   4 ( .BDxx$H&(J2 (?"8C=1JsO2E'' :a(HI d* -- E8>?DDE*B B4B/)B4/B4z/togen-admin/toolbar-visibilityc*ttS)zEReturn Admins/Users enable state for each top-bar function (DVI-616).)toolbars)rrrXr3r1"togen_admin_toolbar_visibility_getrN 46 77r3c tjdxsi}|jdi}t}tD]j}|j|}t |t s%t|jd||dt|jd||dd||<l tjtj|dtd| S#t$r}td | d fcYd }~Sd }~wwxYw)zMSave toolbar visibility. Body: {toolbars: {id: {admins: bool, users: bool}}}.TrrrrrrrrrrN)rUr)rrrrrrrrrrrrrr)rrrrrrls r1#togen_admin_toolbar_visibility_postrNs   4 ( .BDxx B'H)+Jll3 c4 swwxC1JKLcgggz#w/GHIJsOE**4::j+KL dZ 00 E8>?DDEs+*C"" D+D;DDz/togen-admin/tool-orderc*ttS)z&Return the current tool display order.r)rrrXr3r1togen_admin_tool_order_getrN )+ ,,r3ctjdxsi}|jdg}t|tst ddfSt gddddf\}}}}}}|D]}||vrt|r|tk\r|dz }nZt|r|tk\r8|dz }n?t|r|tk\rS|dz }n$t|r|tk\rn|dz }n |tvr}|j!||j#|tD])}||vs|j!||j#|+d |vr|d n t%} t'| |} d |vr|d n t)} t+| |} t,j/t1j2|d t5| t7| t;| t d|| | S#t8$r} t d | dfcYd} ~ Sd} ~ wwxYw)uSave tool display order. Body: {order: [tool_id | sep_id, ...], separators?: {sep_id: {label, justify, collapsed}}}. Beyond the admin-managed tools, the order may carry home-grid separator tokens (DVI-1337) — the legacy 'separator' marker or unique 'sep_' tokens — capped at 10 per list. An optional `separators` map carries their admin-default properties (edited in P2); it is sanitized against the saved order so orphaned entries are dropped. Trrorder must be a listrr`rr^rrrrFailed to save order: rN)rUrrr)rrrrrrrrrr4rr7rr:rrrrirrryrvrrrrrr{r_apply_dashref_org_share)rrrvalidrrrrr sep_sourcer item_sourcerrls r1togen_admin_tool_order_postr'Ns   4 ( .BDxx$H h %34c99DGE2qRSUVXYDYAD%I{M $;  s #44 NI  $33 NI %c *;; 1 K #C ( ;; Q M  %    S-. d? HHSM LL (4t';l#AVAXJ*:u=J#*d?$w-8H8JK e 4EB""4::eA#>?j) U# d%Je LL B5cU;>@"EA!!&1*t"34 ::<I r3 content_typec|xsdjddjj}tj D]\}}||k(s |cSy)z?Map a response Content-Type to a known icon extension, or None.r7;rN)rrrE_TOOL_ICON_EXT_MIMESr)r5ctrmimes r1_tool_icon_content_extr;[Os[  " # #C ( + 1 1 3 9 9 ;B)//1 T 2:J r3c Lt|}|jsy|jd|j}ddi}g} tj|d|}|j r|j rtjd|j dd tjD]}|jd }tjd |tjs:tjd |tj}|sb|jt|d z|jd|j|dzt} |D]} | | vr | j!|  tj| d|} | j r(| j"rt%| j"t&kDrht)| j*j dd} | ?| j-dddj/dd j1} | t2vr| } | | dk7r<| j"ddj5j1j7dr| j"| fcSy#tj$rYZwxYw#tj$rYTwxYw)zBest-effort server-side favicon fetch. Returns (bytes, ext) or (None, None). Tries the page's declared then /favicon.ico.rr>z User-Agentz#Mozilla/5.0 (Togen favicon fetcher)r)r7rxz ]+>N@ rzrel=["\'][^"\']*iconzhref=["\']([^"\']+)["\']r6r^z /favicon.icorr7rrr]rvrs RD SWtU ;;r3z/tool-icon/uploadc`tjjd}| |jst ddfSd|jvr-|jj dddj nd }|tvrt d dfS|jtdz}t|tkDrt d dfStjd d dtjjddz}t|d|z j!|t d |d|zS)zStore one uploaded custom web-tile icon and return its id/url. The caller stages the id into the item props; the item is saved via the tool-order / user-settings routes (config carries the id only; bytes live on disk).rWNNo file uploadedrr`rr^rr7z8Unsupported image type. Use PNG, JPEG, GIF, WebP or SVG.zIcon is too large (512 KB max).TrMicon_r$ z /tool-icon/)rUrrJ)rrrrrrj rE_TOOL_ICON_UPLOAD_EXT_MIMESr r@rCr3rrWrXrYr-)rrrGicon_ids r1tool_icon_uploadrTOs ==  V $D |4==/0#5569T]]6J$--  sA &r * 0 0 2PRC --WXZ]]] 99)A- .D 4y''>?DD5 (("--G 3%((55d; dwMG,C DDr3rSctjdd|xsd}|r|jdsytj |dzD]}|j s|cSy)z|The on-disk file for a custom icon id, or None. The id is scrubbed to a safe token so it can never escape the store dir.rVr7rQNr1)rFr\rwr3rr)rSrrs r1_tool_icon_pathrVOs] 66"B 2 6D tw/!!$+. ::<I r3z/tool-icon/ct|}|ytj|jj dj d}t t||dS)z.Serve a custom web-tile icon by id (DVI-1344).rJrrr rL)rVr8rr!rVrErr*)rSrr:s r1tool_icon_serverXOsW  !B z  # #BII$4$4S$9$?$?$A$> @D SWtU ;;r3z /togen-admin/wor-type-visibilityc*ttS)z;Return the enabled/disabled state for each Work Order type.)rV)rrrXr3r1#togen_admin_wor_type_visibility_getrZOs 24 55r3cntjdxsi}|jdi}t}tD]}||vst ||||< t jtj|dtd| S#t$r}td|dfcYd }~Sd }~wwxYw) zFSave Work Order type visibility. Body: {types: {wor_type: bool, ...}}.TrrVrrrrrN)rUrV) rrrrrrrrrrrrrs r1$togen_admin_wor_type_visibility_postr\Os   4 ( .BDxx$H*,J2 (?"8C=1JsO2E ++DJJz!,LM d* -- E8>?DDErz/togen-admin/wor-type-orderc*ttS)z1Return the current Work Order type display order.r)rrrXr3r1togen_admin_wor_type_order_getr^Ps -/ 00r3c>tjdxsi}|jdg}t|tst ddfSt g}}|D]2}|tvs ||vs|j||j|4tD])}||vs|j||j|+ tjtj|dt d| S#t$r}t d |d fcYd }~Sd }~wwxYw) zCSave Work Order type display order. Body: {order: [wor_type, ...]}.Trrr!rr`rrr"rNrUr)rrrrrrrrrrirrrrrrrrr$rrls r1togen_admin_wor_type_order_postrb Ps    4 ( .BDxx$H h %34c99%%D - CtO HHSM LL  d? HHSM LL B&&tzz%'BC d% (( B5cU;\}}||vs t |t s||D]}||vst|||||<@ t|td|S#t$r}td|dfcYd}~Sd}~wwxYw) zJSave sub-tool visibility. Body: {surfaces: {surface_id: {subtool: bool}}}.TrrerrrN)rUre) rrrrrrrrrrr)rrrrrrrls r1#togen_admin_subtool_visibility_postrh.Ps   4 ( .BDxx B'H)+J(D!!) ?ICj Zd%;%c??Cd{/3DI 3,? ? E , dZ 00 E8>?DDEs B11 C:C CCz/togen-admin/bot-visibilityc*ttS)z/Return the enabled/disabled state for each bot.)r)rrrXr3r1togen_admin_bot_visibility_getrjGPs ,. //r3cntjdxsi}|jdi}t}tD]}||vst ||||< t jtj|dtd| S#t$r}td|dfcYd }~Sd }~wwxYw) z7Save bot visibility. Body: {bots: {bot_id: bool, ...}}.TrrrrrrrN)rUr) rrrrrrrrrrrrrs r1togen_admin_bot_visibility_postrlNPs   4 ( .BDxx#H%'J2 (?"8C=1JsO2E&&tzz*Q'GH d ,, E8>?DDErz/togen-admin/bot-orderc*ttS)z%Return the current bot display order.r)rrrXr3r1togen_admin_bot_order_getrn_Ps * ++r3c>tjdxsi}|jdg}t|tst ddfSt g}}|D]2}|tvs ||vs|j||j|4tD])}||vs|j||j|+ tjtj|dt d| S#t$r}t d |d fcYd }~Sd }~wwxYw) z5Save bot display order. Body: {order: [bot_id, ...]}.Trrr!rr`rrr"rNr`)rrrrrrrrrrirrrrrras r1togen_admin_bot_order_postrpfPs    4 ( .BDxx$H h %34c99%%D (?s$ HHSM LL  d? HHSM LL B!!$**U1"=> d% (( B5cU;.password, DVI-1226) are write-only: they are managed via their own routes (e.g. /idencia/user-connection) and redacted here so no JSON surface ever echoes a stored secret.r'rr7servicespasswordT has_passwordrf)rrr>rrrr)rrrrredactedrsvcrrs r1user_settings_getrwPs FO   ,E'.H||J'H(D! ( HC#t$)<(+ G1qJq!tGG&*N#HSM  ( H %% Hs  C Cc tdjdd}tjdxsi}t |}d|vrb|d}t |t rM|r9ttdgz}|Dcic]}||vs|t||c}|d<n|jddd |vr|d }t |tr|rttdhz}tgd d d d f\}} } } } } |D]}||vrt|r| tk\r| d z } nVt|r| tk\r8| d z } n;t!|r| t"k\rS| d z } n t%|r| t&k\rn| d z } n||vry|j)|| j+|tD])}||vs|j)|| j+|+| |d <|jd }t |t r&t-|| }|r||d <n|jd d|jd }t |t r]t/|| }|r||d <nI|jd dn6|jd d|jd d|jd dd |vrX|d }t |t rC|jd xs t1}t-||}|r||d <n|jd dd |vrX|d }t |t rC|jd xs t1}t/||}|r||d <n|jd dd|vrS|d}t |t r>|r*t2Dcic]}||vs|t||c}|d<n|jddd|vrr|d}t |tr]|rItg} }|D]2}|t2vs ||vs|j)|| j+|4| |d<n|jddd|vrS|d}t |t r>|r*t4Dcic]}||vs|t||c}|d<n|jddd|vrr|d}t |tr]|rItg} }|D]2}|t4vs ||vs|j)|| j+|4| |d<n|jddd|vr|d}t |t ri}|j7D]w\}}|t8vst |t s t;t8|s3t8|dDchc]}|d }}|Dcic]}||vs|t||}}|ss|||<y|r||d<n|jddd|vr*|ddvr#|ddk(r|jddn|d|d<d|vr:|d}t |t r%t=|} | r| |d<n|jddd|vrM|d}!t |!t r8t|!jdt|!jdd|d<d|vr8|d}"|"dvr|jddn|"t>vr|"|d<ntAd !d"fSd#D]E}#|#|vs||#}"|"dvr|j|#d$tC|"}$|$tAd$!d"fcS|$||#<Gd%|vr<|d%}"|"d&vr|jd%dn tE|"}%|%tAd'!d"fS|%|d%<d(|vr!|d(}"|"tFvr|"|d(<ntAd)!d"fSd*|vr<|d*}"|"d&vr|jd*dn tI|"}&|&tAd+!d"fS|&|d*< tK||t |}(tO||(d<tAd|(.Scc}wcc}wcc}wcc}wcc}w#tL$r}'tAd,|'!d-fcYd}'~'Sd}'~'wwxYw)/z*Save the current user's personal settings.r'rr7Trror Nr}rr^rpr~rtrurvrwrrrtheme)darklightsystemr|r=r*scada_notifications stale_data out_of_range)r~rbg_mode_overriderInvalid background mode.rr`r].Opacity must be an integer between 40 and 100.ri)Nr7r.(Tile columns must be 3-9 or "unlimited". tile_viewzInvalid tile view.rj1Side padding must be an integer between 0 and 40.rrr3 )(rrrrrrrrrrrrrrr4rr7rr:rrrirrvrrrrrrr; USER_BG_MODESrrrTILE_VIEW_MODESrrrr7))rrrtv allowed_visrr base_allowedrr$rrrr existing_sepsprunedexisting_items pruned_itemsr_rrFtiwtvbvsvrrrknownrkeptrzr+snrQr)rcrirjrlrs) r1user_settings_postrPs FO   ,E   4 ( .BD"5)HD # $ b$ #=1]OC 2=/+.Cbg&/*+ .5t % h % #=1]OC PSPUWY[\^_abdePeMeY ; #&Cd{ *3/$(@@$!Q +C0$(??$!Q 1#6&*GG$#q( /4(,GG$%* L0 HHSMLL%-&.)*C$  S)**/& ( -> ? mT26}eLF6<!23 %6=!)l!;nd3#7#NL#1=. \48 \40 .5 \40 D # $ b$  \2H6F6HI-b))jt.D7s8KL/=S.A).LMQtWMEM<@QSC5LCd3i0QDQ%)c  *16-. 148$ =7 7G}( Wd+$(M!$O$ dD !.t4B/1+, /6$ ' ( b$ "266,#78 $RVVN%; </H* +T!%& *  LL+T 2 M !+.H' (!;" ' ' LL ./4L#%OPRUUU'3H^ $d; / !$'H[ !!56; ;d"&' ' ' LL,d 3 9# >  (%XY[^^^,=H( )EE8, >DNQx E8>?DDEsT1 ^4;^4# ^9-^90 ^>:^> _ _"_ _ _1_,&_1,_1z/user-settings/custom-bgctdjdd}t|}|s tdtj|j j djd}t||S)zIServe the current user's uploaded custom background image; 404 if absent.r'rr7rrrr ) rrr"r r!r!rVrEr)rrr:s r1user_settings_custom_bg_getrQsf FO   ,E  B  c  " "299#3#3C#8#>#>#@B\ ]D R$ ''r3cBtdjdd}tjjd}| |jst ddfSd |jvr-|jj d d d jnd}|tvrt d dfS|jjd tj|jj}|jjd |tkDrt ddfStj!ddt#|}|r=|j$j'd j|k7r |j)|j-t/t1||t3|}||d<d|d< t5||t7|}t9||d<t d|S#t*$rYwwxYw#t*$r}t d|dfcYd}~Sd}~wwxYw)aAccept a per-user custom background image upload (DVI-518). Validates type and size, replaces any previously uploaded image, records the extension in user settings, and switches the user's background override to "custom" so the new image takes effect immediately. r'rr7 backgroundNzNo file provided.rr`rr^rz8Unsupported image type. Use PNG, JPG, WEBP, GIF, or SVG.rzImage too large (max 8 MB).TrM custom_bg_extrYrrrr=r3 )rrrrrrrj rEr!rrrrrCUSTOM_BG_MAX_BYTESrrr"r!rVr/rrr*rrrrr7)rrrrdoldrrlrs r1user_settings_custom_bg_postrQs FO   ,E ,'Ay 0136636!**3D!**  C #B ' - - /"C %%WXZ]]]HHMM!R[[! 88==?DHHMM! !!:;S@@t4 % C szz  %++-4  JJLFF3uc* +,"5)H #H_#+H  EE8, >D?DDEs0/G+9 G:+ G76G7: HHHHctdjdd}t|}|r |jt |}|j dd|jddk(r|j dd t||t|}t||d <td | S#t$rYwxYw#t$r}td| d fcYd}~Sd}~wwxYw)zLRemove the current user's custom background and clear the "custom" override.r'rr7rNrrYrrrr=Tr3 ) rrr"r/rrrrrrr7)rrrrlrs r1user_settings_custom_bg_deleterQs FO   ,E  B   IIK#5)H LL$'||&'83 '.EE8, >D?DDEs/B.< B=. B:9B:= C!CC!C!z/notifications-settingsctdjdstddfStdjdd}tjd xsi}|jd }t |t std d fSt|}t|}|r ||d <|r||d<n|jd d t||tdt|S#t$r}td|dfcYd}~Sd}~wwxYw)zPersist the current user's notification grid (DVI-335). Stores the friendly 3x5 grid as the core module's event-keyed ``wo_notifications`` block inside the per-user settings JSON. r'rrrrrr7Trr=zMissing 'notifications' gridr`r*NrrrF ) rrrrrrrrr;rrrr7)rrrzrr+rls r1notifications_settings_postrQs  6?  { +YZ\___ FO   ,E   4 ( .BD 88O $D dD !;?DDEs C## D,D<DDz /wor-primaryc*ttS)z>Return the Primary recipient lists keyed by WO type (DVI-405).)rK)rrCrXr3r1wor_primary_getrR ,. //r3c ntjdxsi}|jdd}|jdd}|jdxsdj}|tvrt dd fS|d vrt d d fS|j }|d k(r(d |vsd|jd dvrt dd fSt}|j|g}|d k(r||vr'|j|n|Dcgc] }||k7s | }}|||< t|tdrGtdd|tjdxsijdd|d|d|||||dt dtScc}w#t$r}t d|dfcYd}~Sd}~wwxYw)z@Add or remove a Primary recipient email for a WO type (DVI-405).Trrr7rrzInvalid work order type.rr`rrInvalid action.rrrr"A valid email address is required.r; rNrprimary_r'r9zPrimary recipient r\ed for )rrrr )rUrK)rrrrr0rrErrCrirIrr r r) rrrrrHrKrArBrls r1wor_primary_postr%Rs   4 ( .BDxx B'H XXh #F XXg  $" + + -E))78#== &&./44 ;;=D CtOs$**S/":M/MABCGG!G [[2 &F  v  MM$ #1qDy!11GH<'"#;/ 8F8,;;v&,"11&9(axwxjI (46J   d$5$7 882 </u56;;<* F  F  F F4F/)F4/F4z/wor-approversc*ttS)zHReturn the Authorized Approver lists keyed by RtS department (DVI-1013).rm)rrQrXr3r1wor_approvers_getrORs 02 33r3c ntjdxsi}|jdd}|jdd}|jdxsdj}|tvrt dd fS|d vrt d d fS|j }|d k(r(d |vsd|jd dvrt dd fSt}|j|g}|d k(r||vr'|j|n|Dcgc] }||k7s | }}|||< t|tdrGtdd|tjdxsijdd|d|d|||||dt dtScc}w#t$r}t d|dfcYd}~Sd}~wwxYw)zAAdd or remove an approver email for an RtS department (DVI-1013).TrrPr7rrzInvalid department.rr`rrrrrrrr; rNr approver_r'r9z RtS approver r\r)rPrrr rUrm)rrrrrOrrErrQrirSrr r r) rrPrrrHrmrArBrls r1wor_approvers_postrVRs   4 ( .BD 88FB D XXh #F XXg  $" + + -E :23S88 &&./44 ;;=D CtOs$**S/":M/MABCGG#%I ]]4 $F  v  MM$ #1qDy!11IdO<I&#;/ 9VH-;;v&,"11&9#D66('$@ 46B   d&9&; <<2 </u56;; Testing).)testers)rrWrXr3r1wor_testers_getrRrr3c tjdxsi}|jdd}|jdxsdj}|dvrt dd fS|j }|d k(r(d |vsd |j d d vrt dd fSt}|d k(r||vr'|j|n|Dcgc] }||k7s | }} t|}tdd|tjdxsijdd|d|d|||dt d|Scc}w#t$r}t d|dfcYd}~Sd}~wwxYw)aAdd or remove an Authorized Tester email (DVI-1082). Authorized Testers may create and view test WOs without being Togen Admins. Managing this list is Togen-admin-only. Convert-to-test and delete remain Togen-admin-only and are NOT delegated to testers (Phase 2). Trrr7rrrrr`rrrrrr; rNr tester_r'r9zAuthorized Tester r\edrrr )rUr) rrrrrrErrWrir[rr r)rrrrHrrBrls r1wor_testers_postrRst   4 ( .BD XXh #F XXg  $" + + -E &&./44 ;;=D CtOs$**S/":M/MABCGG!G  w  NN4 %3d133<#G,){{6"(b--f5$TF!F826 0  dG ,,4 </u56;;<* D6D6 D;; EEEE>rrrrbc |j}|j}d|v}|r3|jd}|dzt|kr||dznd}|dvrd}n t |}|j j }|tvrd}|||fS)zReturn (wor_type, status, is_test) for a resolved WO PDF path. ``status`` is the lifecycle subdir name (or "new" for the type root), and ``is_test`` is True when the path lives under the segregated ``_test`` tree. rr^rr#r$)r,r0 rrCrnrr9_WOR_STATUS_SUBDIRS)rbresolvedr0 r rrrds r1r r Rs ||~H NNEG KK #$q53u:#55Q<= S S$H#D) __ ! !F (( VW $$r3c |g}|xsijd}t|ts6tjd|xsd}|rt|j d}t|tr|j d|d|S)zReturn the tool_history ref shapes for a WO (filename + "WO#NNNNN"). Mirrors _collect_wor_audit: ``created`` events key on ``WO#NNNNN`` while status/EVH/edit events key on the filename, so both must be quarantined. rrr7r^r r)rrrrFrrbri)rrrefsr! rs r1_wor_history_refsrRsv :D b % %m 4F fc " IInhn" 5 _F&# c&&' Kr3quarantine_keyrrmc|syt} djdt|z}|jd|zdz|j }t j jd}|D]7}|jd|d|d |d |d |d |d |d|d|||f 9|r|jd|zdz||jt||jS#|jwxYw)aMove a WO's ``wor-admin`` history rows out of the live table (DVI-1084). Copies matching rows into ``tool_history_quarantine`` (tagged with ``quarantine_key`` = the WO filename, so restore can target them) then DELETEs them from ``tool_history``. Live audit surfaces (WO Admin, Auditor History, Search, exports) read only ``tool_history``, so the WO disappears from them by construction. Returns the number of rows quarantined. r,r]zvSELECT id, tool, action, actor, summary, ref, detail, created_at FROM tool_history WHERE tool='wor-admin' AND ref IN (r7rzINSERT INTO tool_history_quarantine (orig_id, tool, action, actor, summary, ref, detail, created_at, quarantined_at, quarantine_reason, quarantine_key) VALUES (?,?,?,?,?,?,?,?,?,?,?)rrrr r rr rz.*`` companions follow. Returns (moved_basenames, dest_pdf_path). TrMrr r6)rr9r,r r r*rir rrrrrr) r rmovedr  src_sidecarre src_evhdest_evh src_photoss r1_move_wor_bundler%Ss  NN4$N/ E',,&HH,,.. CL#h-0 LL%%g.K++G4    L$8$8$: : KKK(#l*; < [%%&nn z 9:Ggll* ??  0 0 2 2 KKG c(m 4 W\\" )JWh/ Z__s*+ (?r3r)cT|jd}i}|jr$ tj|j }||j|dn|||<|jtj|dy#tj t f$ri}Y^wxYw)z@Set (or, when value is None, drop) a key on a WO's JSON sidecar.rNrr) r rrrrrrrrr)rr)rrrs r1_wor_set_sidecar_flagrGSs""7+G B G--/0B } sD3 tzz"Q/0 $$g. B s#B B'&B'r prev_hashcddl}|Dcic]}|dk7s |||}}tj|dd}|j||zj dj Scc}w)zLsha256 over the canonical JSON of an entry (minus its own hash) + prev_hash.rN entry_hashT)rrS) sort_keysrr)rrrrrr)rrrrr canonicals r1_wor_deletion_entry_hashrWSsf!& >9y088A B L L NN =s A'A'ctjsyd\}} tjdd5}|D]}|j}|s|dz }|} ddd|s|dfS |t j |jddfS#1swY7xYw#t$rYywxYw#t j$r|dfcYSwxYw) z;Return (entry_count, last_entry_hash) for the deletion log.)rr7rrrr^Nr7r) WOR_DELETION_LOG_FILErr?rrrrrr)rlastrrss r1_wor_deletion_log_scanr_Ss ( ( *KE4 " ' 'g ' > " zz|QJED    bydjj&**<<<<     bys@BB  B B%&B' BB B$#B$'CCctjddt\}}t|}|dz|d<||d<t |||d<t j dd 5}|jtj|d zd d d  tjt d |S#1swY&xYw#t$rY|SwxYw) uyAppend one hash-chained record to the tamper-evident deletion log (DVI-1084). ``entry_hash`` chains each record to its predecessor's hash, so editing or removing any past entry breaks every subsequent link — detectable via ``_wor_deletion_log_verify``. The file is written 0600 as defense-in-depth; we cannot *prevent* a root edit, only make it evident. TrMr^seqrrarrr0Ni) rrrrrrr?rrrrrr)rrrrs r1_wor_deletion_log_appendruSs MM$M.-/E9 KE19E%L"E+25)DE,  # #C' # :+b E"T)*+  &. L ++   L s#(B0B<0B9< C C cg}tjs|S tjdd5}|D]:}|j}|s |j t j |< ddd|S#t j$r|j d|iYpwxYw#1swY|SxYw#t$rY|SwxYw)z6Return all parsed deletion-log entries (oldest first).rrr _unparseableN) rrr?rrirrrr)rrrss r1_wor_deletion_log_entriesrSs C ( ( *   " ' 'g ' > 7" 7zz|7JJtzz$/0  7 7 J ++7JJ567 7 J   J sRB5B( $A</B(2B5<&B%"B($B%%B((B2-B52B55 CCctjsdddddSd}d}d} tjdd 5}|D]}|j}|s|d z } t j |}|jd d|k7r|jd |}nIt||}||jd dk7r|jd |}n|jd d}ddd|du}||||rddSd|ddS#tj $r|}Y5wxYw#1swY:xYw#t$r}d|dt|dcYd}~Sd}~wwxYw)zIRecompute the deletion-log hash chain; report OK or the first broken seq.TrNzNo deletion log yet.)rUentries broken_seqrr7rrrr^rrrFu'Chain intact — no tampering detected.zChain broken at entry #r) rrr?rrrrrrrr*) rrbrokenrrsr recomputedrlrUs r1_wor_deletion_log_verifyrSs ( ( *q13 3I E FX " ' 'g ' > 8" 8zz|  JJt,E99["-:"YYue4F5eYG <!<<"YYue4F!IIlB7 # 8 8* 4BfA GG$;F81"E GG++"F 8 8& XTcRUhWWXsYD%DC=.A2D D%=DDDDD"D%% E.E=EEctjdxsijdxs,tjdxsijdxsdS)Nr'r9rr7rrrXr3r1_wor_admin_actorrSsF KK  %2 * *6 2 dw{{67J7Pb6U6UV]6^ dbddr3z/wor-convert-testctjdxsi}|jdxsdj}t |d}|st dd fSt |\}}}|rt d d fS|jd }i}|jr$ tj|j}t||}t|d |} t!|| \} } t#| ddt%||d} t't)j*j-dt/d||jd|||jdxsdj| t1| | d } t3ddt/d|d|| dt d| | dS#tjtf$ri}Y wxYw)aConvert a production WO into a segregated test WO (DVI-1084, admin-only). Moves the full bundle into the ``_test`` tree, flags the sidecar ``_test``, and quarantines the WO's history rows so it leaves every prod audit surface. Reversible via ``/wor-convert-prod``. Trrr7Frz,Work order not found in the production tree.rrz%This work order is already a test WO.r`rrrrLrrrm r_r r wo_filename wo_numberwo_typeoriginal_statusrm files_movedquarantine_pathhistory_rows_quarantinedr wor_convert_testz Converted z to a test WO)r history_rowsr r r r)rUrr)rrrrrrr r rrrrrrrr rrrrrrrrr*r )rrr$rrdr rrrrrr n_histrs r1rrSs   4 ( .BD$*113H H5 9C KLcQQ +C 0HfgDEsJJoog&G B G--/0B Xr *DhT26:H&sH5OE8(GT2 $XtY ?F $##%../CD!#VVM*!88H%+224x=$* & E="4_/`` (outside every scanner) and the WO's history rows are quarantined, so it vanishes from every audit surface while the tamper- evident deletion log retains the compliance trail. A ``reason`` is mandatory. Trrr7rmzA deletion reason is required.rr`rr rrrr rdeleterr) rrrr rrrm deleted_by deleted_atrr _restore.jsonrrrrrr wor_deletedzSoft-deleted work order r)rrmrrrrdeleteduDeleted (soft) — _status_changermrr )rU quarantinerr)rrrrrrr r rrrrrrrrrrWOR_DELETED_ROOTrrrrrrrrr*r r9)rrrmr$rrdr rrrr_quarantine_dirrr rmanifestrs r1 wor_deleter&Ts   4 ( .BD$*113Hhhx &B - - /F =>CC H4 8C 45s:: +C 0Hfgoog&G B G--/0B Xr *D    ) )/ :B%2$aX0C0C/D(EEN^4HE1Q6xxPF!"VVM*&($++-667KL$* Ho%11$**Xa2PQ $|$,'VVM*!~.$* & E=-x 7M5hZ@'/6+1%,HI {IXl5K!4XJ?X1:f&+El4 5 d~':':,2e  FFe$$g. B s#II10I1z/wor-deleted-listcg}tjrttjdD]z}|js|dz }d|ji}|j r3 |j tj|j|j||t|S#tjtf$rY:wxYw)zEList quarantined (soft-deleted) WOs available for restore (DVI-1084).Tr rrr)r rrrYr9rrrrrrrrir)rrnmfrls r1wor_deleted_listrtTs E (002DA A88:_$B166?Dzz|KK 2<<> :; LL    ,,g6s.2B??CCz /wor-restorec$tjdxsi}|jdxsdj}|rd|vsd|vrt dd fSt |z j }t|jtt j r|jst d d fS|d z }|jst d d fS tj|j}|jdxsd}||z }|jst dd fS|jdxsd}|jdxsd}t!|jd} t#|| |} t%|| \} } | rdnt'|jdxs|} |j)d|j+t-t/j0j3dt5d||jd|||jdxsdj| t| | d }t7dd t5d!||| d"#| sDt7d$d%t5d&||d%|jdxsdj|d'd()t d| |d'*S#tjtf$rt dd fcYSwxYw#t$rY'wxYw)+zHRestore a soft-deleted WO from quarantine back to its origin (DVI-1084).Trrr7r6rzInvalid quarantine reference.rr`z!Quarantined work order not found.rrz7Restore manifest missing; cannot restore automatically.zRestore manifest is unreadable.rz&Quarantined work order PDF is missing.rrrr$r rrrrrrestorerrmrr wor_restoredz!Restored soft-deleted work order rrrrestoreduRestored from deletion — rr r r)rrrrrr r,r*rwrrrrrrrrr rrr/rmdirrrrrrr )rdir_namerrrrr rrdr rrr rrs r1 wor_restorerTs   4 ( .BD%2,,.H sh$(*:<=sBB&1::.F.F.H*I J!((*@A3FF / )B ::<VWY\\\E::blln-||J'-2Hx'G ?? EFKK||J'8=H \\+ , 5F8<< *+GhW5f=H2HE1Q3 %&2( 4F  T " %##%../CD!#\\+.!88H%+224x=$* & E=.8H8J>xjI'/&QS {J6F6H!?DDE"    s$$#K"L'K?>K? LLz/wor-deletion-logc`t}|jt|tS)zGServe the tamper-evident deletion log + chain-verify result (DVI-1084).)rverify)rr rrrs r1wor_deletion_log_getrTs'()G OO 7+C+E FFr3z/wor-deletion-log/verifyc(tditS)zFRecompute the deletion-log hash chain and report integrity (DVI-1084).rX)rrrXr3r1wor_deletion_log_verify_router Ts  0-/ 00r3z /wor-policyc*ttS)z8Return the Policy-enforced notifications grid (DVI-597).r6 )rrrXr3r1wor_policy_getr"Ts /1 22r3ctjdxsi}|jd}t|tst ddfS t |td r5td d tjd xsijd dt dtS#t$r}t d|dfcYd }~Sd }~wwxYw)z9Persist the Policy-enforced notifications grid (DVI-597).Trr7 zInvalid policy grid.rr`r; rNrpolicy_updatedr'r9z*Policy-enforced notifications grid updatedr r< ) rrrrrrrrr r rr)rrzrls r1wor_policy_postr%Ts   4 ( .BD 88H D dD !34c99<d##;/ );;v&,"11&9@ d#8#: ;; </u56;;|j:dd?}d@|}ndA}| |dB}|r||dC<t |S#t$r} t d|  dfcYd} ~ Sd} ~ wwxYw#t$r} t d|  dfcYd} ~ Sd} ~ wwxYw#t<$r} t?| }Yd} ~ ~d} ~ wwxYw)Dz9Accept a support request, store it as JSON, and email it.Trr9r7rrr active_tool app_statesend_to'icast.voyagetech.com@email.autotask.netIssue description is required.rr`r'rrMz)Cannot create support request directory: rNr r rSr\r SR_r)r9rrrr'app_state_jsonr) submitted_atrrz Failed to save support request: FrrrrzSupport Request from r:z ) Date/Time: z Active Tool:  Issue Description: z Application State: Reference: uTogen Support Request — r rrrrrrfromreplyTorrrrrrrrrrrrrrKrT Failed to acquire mail tokenr email_sent email_error) rrrrrrrrrrrrrFr\rrrrrrrrrrrrrrrgr&ryr*)rr9rr sr_datetimer'r(r)r'rlrv rrr rr6r7rr email_bodyrrr r>s r1support_request_submitr:Ts2   4 ( .BD 88FB  % % 'D HHWb ! ' ' )E((="-335K((:r*002K((="-335Kb)//1Ihhy"%++-Z1ZG =>CC ;;vr "D "% xx *U$6""$--.?@I|R.s399;CCCMIYKq 51HX%H"C>#5#5#7#A#A#C"#&**,668 FLDJJva89 JK3 #;;);z[J%>>>??AL-+D6E7;""-/$$/=1++6-8++4+6""* -&@vU;-#X+1'1! +Y,H!,i-?@$,i-AB)  (/# &&**=o=NiX+2<3O2P)Q(:$##z1!%J!YY[__Wb9==iSWTWYF$5fX">K< #* =F +} 6?g UHNOQTTTU( L?uEFKKLr #c(K #sUM""&N C8N0" N+N;NN N-N("N-(N-0 O9 O  Oz/feature-request-submitc tjdxsi}|jddj}|jddj}|jddj}|jddj}|jddjxsd }|st d d fSt jd i}|s|jdd}|s|jdd} t jddtjjd}tjdd|ddjjdd} d|d| d} t | z } |||||tjjd} | j!t#j$| dd} d}t&r t)j*t,t.t0}|j3d g!}d"|vrd#|d$|d%|d&|d'| }d(|d)|d*d+d,t&iid+d,|iigd+d,|iigd-d.d/}t5j6d0t&d1d2|d"d3d4|d56}|j8d7vrd} nE|j#jd8ijd9|j:dd:}d;|}nd<}| | d=}|r||d><t |S#t$r}t d| dfcYd}~Sd}~wwxYw#t$r}t d| dfcYd}~Sd}~wwxYw#t<$r}t?|}Yd}~~d}~wwxYw)?z9Accept a feature request, store it as JSON, and email it.Trr9r7rr beneficiariesr)r*z Feature description is required.rr`r'rrMz)Cannot create feature request directory: rNr r rSr\r FR_r)r9rrr<r)r.rrz Failed to save feature request: FrrrrzFeature Request from r:z) Feature Description: z, Who may use or benefit from this feature: r0uTogen Feature Request — rrrrr1rrrrrrrrrrrrrKrT r4r5r7) rrrrrrrrrrrrrFr\rrrrrrrrrrrrrrrgr&ryr*)rr9rrr<r)r'rlrv rrr rr6r7rrr9rrr r>s r1feature_request_submitr>gUs   4 ( .BD 88FB  % % 'D HHWb ! ' ' )E((="-335KHH_b1779Mhhy"%++-Z1ZG ?@#EE ;;vr "D "% xx *U$6""$--.?@I|R.s399;CCCMIYKq 51HX%H"&&**,668 FLDJJva89 JK1 #;;);z[J%>>>??AL-+D6E7;--8M:BBOQ""*-&@v#F+1'1! +Y,H!,i-?@$,i-AB)  (/# &&**=o=NiX+2<3O2P)Q(:$##z1!%J!YY[__Wb9==iSWTWYF$5fX">K< #* =F +} 6?_ UHNOQTTTU$ L?uEFKKLn #c(K #sUK3<&L-C/M3 L<L LL L>#L93L>9L> M MMz/it-help-desk-submitc ztdtdstddfStjdxsi}|j dd j }|j d d j }|j d d j }|j d g}t|tsg}|Dcgc]5}t|j st|j 7}}|std dfStj di}|s|j d d }|s|j dd}d} tjddtjjd} t!j"dd |ddj j%dd} d| d| d} t| z } |||||tjj'd} | j)t+j,| d|rd j/|nd!}d"}d }|xst0}t0r|r t3j4t6t8t:#}|j=d$g%}d&|vrd'|d(|d)|d*|d+| }d,|d-|d.d/d0|iid/d0|iigd1d2d3}t?j@d4|d5d6|d&d7d8|d9:}|jBd;vrd}nE|j+j d}d?|}nd@}| |dA}|r||dB<t|Scc}w#t$r}td|dfcYd}~Sd}~wwxYw#t$r}td|dfcYd}~Sd}~wwxYw#tF$r}t|}Yd}~d}~wwxYw)CzgAccept an IT Help Desk ticket, store it, and email icast.voyagetech.com@email.autotask.net as the user.rr'r rrTrr9r7rrrelatedr+r`rr*rMz!Cannot create request directory: rNr r rSr\r IT_r)r9rrr@r)r.rrzFailed to save request: rz(none selected)FrrrrzIT Help Desk ticket from r:z) Issue Related To: r/r0uIT Help Desk Request — rrrr)rrr2rrrrrrrrrrrrrrKrT r4r5r7)$r rrrrrrrrr*rrrrrrrFr\rrrrrrrrrrrrrrrrgr&ry)rr9rrr@rr'r)rlrv rrr r related_liner6r7send_asrrr9rrr r>s r1it_help_desk_submitrDUs !wv ?MNPSSS   4 ( .BD 88FB  % % 'D HHWb ! ' ' )E((="-335Khhy"%G gt $'.A!#a&,,.s1v||~AGA =>CC ;;vr "D "% xx *7GM$6""$--.?@I|R.s399;CCCMIYKq 51HX%H"&**,668 FDDJJva89*1499W%6GL JK&G7. #;;);z[J%>>>??AL-/vRw?))57++6-8""*-&?tf#E+1'1! +Y,@!,i-AB) (/ &**=gYiP+2<3O2P)Q(:$##z1!%J!YY[__Wb9==iSWTWYF$5fX">K< #* =F +} 6?AB M@FGLLM$ D7u=>CCDr #c(K #saM #M M?&M5C!N M2M-'M2-M25 N>NNN N:% N55N:) tranIditemLine_custom:Structure itemLine_itemitemLine_quantityitemLine_salesPriceitemLine_weight Item_SizePart ReferenceitemLine_descriptionz,itemLine_custom:Stack-It PART - DrawingImagez&itemLine_custom:Submittal Drawing linkzitemLine_custom:QR Labelctjjd}d|}d}ttfD]}|j s|j D]}|j s|j}|j|}|dk(r7||t|zd}d}|D]} | jr|| z }n|skt|t|}||dzdS) zFCompute the next project number for today: T + YYYYMMDD + 2-digit seq.%Y%m%dTrrNr7r^02d) rrrr rrrYr9rMrCr rCr) r rmax_seq search_dirrr9rr&digitschs r1_sp_next_project_numberrVUVs    ) )( 3E[FG!#564   " '') 4E<<>::D))F#Cbyc&k)*+DF ::<bLF   gs6{3 44&Xgk#& ''r3z/project-builder-next-numberc,tdtiS)Nr)rrVrXr3r1project_builder_next_numberrXpVs H578 99r3z/project-builder-checkc2tjdxsi}|jd|jddj}|rtj |rd|vrt ddid fSt|z j}t d |iS) NTrrrr7rrr r`r) rrrrrarGrr r)rr9rs r1project_builder_checkrZvVs   4 ( .BD 88M488NB#? @ F F HD |))$/44<!678#==4 ' ' )F Hf% &&r3c|tjddt|jjdS)z=Sanitize a project number / tranId for use in a CSV filename.[^A-Za-z0-9._-]+rc z-._rFr\r*rrs r1_sp_filename_partr_Vs. 66%sCJ,<,<,> ? E Ee LLr3cd}|D]P}t|ts|st|djs4t|dj}nt |}t |}|r |r|d|dS|dS)zECSV name convention: -.csv (DVI-323).r7rrc r)rrr*rr_)project_numberrnrtran_idrnum_part tran_parts r1_sp_csv_filenamereVsG c4 SSQ[->->-@#a&k'')G !0H!'*II1YKt,,]$ r3z/project-builder-submitc \ tjdxsi}|jddj}|jddj}|jddj}|jddj}|jddj}|jd g}|jd g}|jd dj}|jd dj} |rtj |rd |vrt ddidfS|r(tj |rd |vrt ddidfS| r(tj | rd | vrt ddidfS|st ddidfS|st ddidfS|xs t}|D cgc]1} t| tst| ttk(s0| 3} } | st ddidfSt|| |} |rt||| | ||||| S| rt| || | ||||| S tj!ddt|z } | j!dd| | z }|||||t%j&j)|d}| dz } t+|ddd5}t-j.|}|j1t|j3| dddt+|dd5}t5j6||ddddt9| t:|z }|j=rt?j@tC|t:j!ddt?jDtC| tC| t?j@tC| dtId!rJtKd!d"tMjd#xsijd$d%|d&|d'||t| d()t || d*Scc} w#t"$rt ddidfcYSwxYw#1swYaxYw#1swY?xYw#t"$r<}t dd|idfcYd}~t?j@tC| dSd}~wtF$r<}t dd |idfcYd}~t?j@tC| dSd}~wwxYw#t?j@tC| dwxYw)+NTrrr7rrrraproductsrnediting_folderimport_source_folderrrr r`zProject name is requiredzNo product rows providedrM5Server cannot write to temp directory. Contact admin.r)rrrrarrrgrrrrrrrPermission denied: rO File system error: rrr'r9zProject created: r:r7rarnr rr)'rrrrrarGrrVrrrC_SP_CSV_HEADERSre_sp_update_existing_project_sp_import_projectrrPermissionErrorrrrr?rrwriterowrrr_pb_move_temp_uploadsr rr r:r*rrr r r)rrrrrrargrnrhrir clean_rowsr tmp_folderrrrrrrrls r1project_builder_submitrwVs   4 ( .BD88NB/557LHH_b1779M((#8"=CCE((="-335KXX.399;Nxx B'H 88FB DXX.399;N88$:B?EEG l00=AT!678#==|11.AT^E[!678#==\%7%78L%MQUYmQm!678#== !;<=sBB !;<=sBB#@'>'@N!%d#C)>3s8sSbOcCc#dJd !;<=sBB#NJ LL* Kz <) )"ZZ^F OOO ,   Z ( ) )S7 3 .r IIh1 - . j)K' ;;= MM#d) $5JT3  c*oT:"#45 y;;v&,"11&9' ~R }AF&4c*oN   k,? @@Ke& `!XYZ\___`( ) )  . . D#6se!<=>CC  c*oT: D#6se!<=>CC c*oT:D  c*oT:sQ'QQQ:Q> Q14B Q>Q! Q!$Q.)Q>1Q;6Q>> TR>TT > T TTT TT "T+c  g |D]} t|dd5}tj|}t|d|D]l t dkr d d dg}t d |Ds3 j t fd d Dt fd d D|ddn ddd fd}g}|D]B t fdd D}|d|}|r|\ d< d< d<2|j D|D]1 t fdd D} |d| }|s#|\ d< d< d<3y#1swYxYw#ttjf$rY]wxYw)aFCarry forward cols J/K/L (DrawingImage / Submittal Drawing link / QR Label, indices 9-11) from existing CSV rows onto clean_rows so user edits in the builder don't wipe Bridge-written links. Matches first on (tranId, structure, item, part ref); falls back to (structure, item) for unmatched rows (DVI-323/DVI-387).r7rrNr-ryrrc3<K|]}|jywrTr)r,rs r1r/z+_sp_preserve_url_columns..Ws7Qqwwy7c3LK|]}|xsdjywr7Nrzr,rold_rows r1r/z+_sp_preserve_url_columns..Ws#$VAgaj&6B%=%=%?$V!$rr^rrc3LK|]}|xsdjywr}rzr~s r1r/z+_sp_preserve_url_columns.. Ws##O1WQZ%52$<$<$>#Or)r^rF)r)fburlsusedcHD]}|dr |||k(sd|d<|dcSy)NrTrrX)r rrrs r1_takez'_sp_preserve_url_columns.._takeWs< %E=U5\U%: $f V}$ %r3c3^K|]$}t|xsdj&ywr}r*rr,rrs r1r/z+_sp_preserve_url_columns..Ws'D!CA "%++-D*-r)c3^K|]$}t|xsdj&ywr}rrs r1r/z+_sp_preserve_url_columns.. Ws'=3s1v|$**,=rr) r?rrOrrCr2rir rr] ) source_csvsruold_csvrrOrr unmatchedr)rrrrs @@@r1_sp_preserve_url_columnsrVs G grK@ BBVT"% G7|b( #AJ WR[AD7$77 NN$$V$VV##O#OO $ % $  (I"D|DDUC  '+ $CFCGSW   S ! ", =f= =T2 '+ $CFCGSW ,C  #   s)E BD=.E =E E  E&%E&c t|z } | jstddidfSt|z } | jrtdd|didfSt d| j D} t | | tjdd t|z } tjt| d | jdd  | j D]} | jrc| jjd k(s| j dk(r@tj"t| t| | j z v| jstj$t| t| | j z t'| |z ddd5}t)j*|}|j-t.|j1|ddd|||||t3j4j7||d}t'| dz dd5}t9j:||ddddt=| | jr3tdd|didftjt| d Stjdd tj$t| t|  tjt| d tAdrMtCddtEjFdxsijGdd|d|d |||tI||d!"t||d#S#t$rtdd id fcYSwxYw#1swYxYw#1swYIxYw#t$r<}tdd|id fcYd}~tjt| d Sd}~wt>$r<}tdd|id fcYd}~tjt| d Sd}~wwxYw#tjt| d wxYw)$uHImport an externally-built (CSV-only, no metadata) project as a NEW project: copy its drawings, write a fresh CSV carrying over the J/K/L URLs, and write project_metadata.json — leaving the source folder untouched. The target folder name must be unique; never edit/overwrite an external project in place (DVI-387).rzSource project folder not foundrzA project folder named "r?r9c3~K|]5}|js|jjdk(s2|7ywr r rs r1r/z%_sp_import_project..4Ws+`qQYY[QXX^^EUY_E_`r TrMrjrrO rrrr7rrN)rrrrarr imported_fromrgrrrrkrlrimportedr'r9zProject imported: r:z) from )rarnr r rn)%r rrrrrYrrrrrr r:r*rr!rEr9r7 rr?rrrsrorrrrrrrtrr r rrrC) source_folderrrrurrrrargr$rrrvr rrrrls r1rqrq&Ws } $C ::<!BCDcII  #D {{}#;K=HY!Z[\^aaa`CKKM``K[*5`   =$k1J MM#j/6TD1&;KKM HD||~;;$$&&0DIIAX4X SYJ,B(CDD 3zDII/E+FG  H*|+S"w O )SUZZ^F OOO ,   Z ( ) +(#6,&(,,.88:*   *66g N .RT IIh1 - . j) ;;=G'? }L]%^_`bee  c*oT: 5JT3  c*oT:"#45 z;;v&,"11&9(b W]O\&4c*o+-   k,? @@q `!XYZ\___`  ) ) . . D#6se!<=>CC  c*oT: D#6se!<=>CC c*oT:D  c*oT:sM+BN#-A N#6P.# P+/P&P+P.&P++P.."Qc t|z } | jstddidfSt|z } ||k7rV| jrt j t | t jt | t | td| jD} t| |t| |z ddd5} tj| } | jt| j!|d d d | D]"}|j"|k7s|j%$| d z }|j'rw t)j*|j-d }t/|t0rA|j3d |k7r-||d <|j5t)j6|d d | dz }i}|j'r? t|dd 5} t)j<| }d d d t/t0r|}|j?||||||d|jAdtCjDjGtCjDjG|d<t|dd 5} t)jH|| d d d d tK| tOdrJtQddtSj2dxsij3dd|d|d||tU|dt||d S#1swYxYw#t(j8t:f$rYwxYw#1swYUxYw#t(j8t:f$rYbwxYw#1swYxYw#tL$r}tdd|idfcYd }~Sd }~wt:$r}tdd|idfcYd }~Sd }~wwxYw)!zUpdate an opened project in place: rewrite its CSV (preserving the J/K/L drawing URLs already written by the Take-off Bridge), refresh project_metadata.json, and leave every other file (drawing PDFs) untouched (DVI-323).rr rc3~K|]5}|js|jjdk(s2|7ywr r rs r1r/z._sp_update_existing_project..Ws+gQAIIKAHHNNL\`fLfqgr rr7rrNrhrrrrrr)rrrrarrgrrrkrrlrr r'r9zProject edited: r:r7rmr rn)+r rrrr r:r*r rrYrr?rrrsrorr9r/rrrrrrrrrrrloadrr}rrrrrtrrr r rrC)rhrrrurrrrarg src_folderr existing_csvsrrrr` rorr existing_metarls r1rprptWsn,J    !;<=sBB  #D8D [ ({{} c$i( KKJT 3g$,,.gg   ; $%sB I )RZZ^F OOO ,   Z ( ) % !G|||+  !L(      :#7#7#7#IJeT*uyy/HL/X,8E.)))$**U1*EPW)X22      )S7;2r$(IIbMM2mT2,H *(#6,&    L.*<*<*>*H*H*JK!/!3!3!5!?!?!A )S7 3 .r IIh1 - . d# ##45 x;;v&,"11&9&|nB{m1E&4c*oN   k,? @@q ) ) (('2  22(('2   . . D#6se!<=>CC D#6se!<=>CCDsBN .Ws@Q@Qr3Tr rrr9has_metar) r rrrYr9rwrirrrU s r1project_builder_list_projectsrWsGJ..06Q[_` E||~ejj&;&;C&@!JJ!&)@!@ I I K   Iw' ((r3)rurv) rrrr.gif.tif.tiffrrz.xlsrN z.dwgz.dxfc,tfddDS)u4-tuple identity for a CSV/product row: tranId, structure, item, part ref (cols A,B,C,H / idx 0,1,2,7) — matches _sp_preserve_url_columns.c3dK|]'}t|kDr|jnd)ywr}rrs r1r/z_sp_row_key..Ws*PaCHqL#a&,,.b8Ps-0rr )rs`r1 _sp_row_keyrWs P<P PPr3c d}|Dcgc]/}|||jdd|jdddd1}}t|D]n\}}t|tsd}||}|D]} | dr | d |k(s| }n||t |kr ||ds||}|Zd |d<|d|d<|d|d<pycc}w) aCopy shop/submittal URLs from the CSV rows onto the metadata products list so the builder's row model surfaces drawing links on load. Matches first on the row key (tranId, structure, item, partRef); falls back to positional alignment for unmatched products (DVI-658).c,tfddDS)Nc3xK|]1}tj|dxsdj3ywr}r*rr)r,rrns r1r/z8_sp_overlay_drawing_urls..key..Ws6  a " # ) ) + s7:rEro r partRefrr s`r1r)z%_sp_overlay_drawing_urls..keyWs ?   r3shopUrlr7 submittalUrlF)r)rrrNrr)T)rrrrrC) rgcsv_rowsr)rpoolrprodrGpkrs r1_sp_overlay_drawing_urlsrWs     1v55B'nb1   D X&94$%  Y E=U5\R%7  =QT]476?GE   E&M#I.DO#(#8D 9 s4B;c|dz }|jrS tj|jd}|j d}|r||z jr||z dfStd|jD}t|dk(r|ddfSt|dkDry y #tj t f$rY`wxYw) uReturn (csv_path, None) for a project folder's CSV — state.json csv_filename first, else the sole *.csv — or (None, error_message). Mirrors scs-save-to-project.rhrrrNc3~K|]5}|js|jjdk(s2|7ywr r rs r1r/z!_sp_locate_csv..Xs+dIY]cIc!dr r^r)Nr )NzNo CSV found for this project) rrrrrrrrrYrC)r r` ror9r s r1_sp_locate_csvrXs ,.J JJz33W3EFE99^,D$.779%,d22 d^335d dD 4yA~Aw} 4y1}O 0$$g.   sAB..C  C c|dd}t|}t|tr,d|cxkrt|krnn|rt |||k(r|S|r%t |D]\}}t ||k(s|cSy)zIndex (0-based, among data rows) of the CSV row a drawing belongs to. Prefers row_index when its key matches the supplied key, else first key match. Returns None when no row matches.r^Nr)r2rrrCrr)rn row_indexr)rhas_keyrrs r1_sp_match_data_rowrXs{ 8D#hG)S!a9&@s4y&@+d9o6#= dO DAq1~$  r3c|dz }|jsy tj|jd}|j d}t|trd|cxkrt|ksyy||}t|tsy|||dk(rdnd < |jtj|d dy#tjt f$rYywxYw#t $rYywxYw) zBest-effort: reflect a drawing add/clear on the matching products entry in project_metadata.json so metadata stays consistent with the CSV.rNrrrgrrurrrr) rrrrrrrrrrCrrr)r data_indexrrJrrrgrs r1_sp_update_meta_productr)Xs!88I    zz)--w-?@xx #H h %a:.MH .M/N J D dD !ADDi6)~> TZZQ7'J  ' *    s#%C(C CC C,+C,z/project-builder-upload-drawingc dtjvrtddidfStjd}|jstddidfStj j |jdj}|tvrtddidfStjjdxsdj}tjjd xsdj}|tvrtdd idfS|rtj|rd |vrtdd idfSt|z j!}t#|j%t#tj!tj&zr|j)stdd idfSt+|\}}|td|idfSt-|j}|stddidfStjjdt.}t1ddD} t3|dd5} t5t7j8| } dddt; || } | tddidfS|j=t#||z t|} t?jAd}|dtC|ddtC|d}| | dz}tE|dkr |jGdtE|dkr ||| <t3|ddd5} t7jH| jK| dddtM|| ||tOdrCtQddtSjd xsijd!d"|d#|d$||||d%&td'||d(S#1swYixYw#1swYxYw))aAttach (or replace) a shop/submittal drawing on a Project Builder product row: store the file in the existing project folder and write its public URL into CSV col J (shop) or K (submittal). Mirrors Take-off /upload-file scoped to a SHARED_DIR project folder (DVI-658).rrrr`r^zUnsupported file typerr7rrrrr rNzInvalid file namerr c3~K|]5}tjj|xsdj7ywr})rrgrrr,rs r1r/z1project_builder_upload_drawing..dXs-h!!!$*113hs;=rrr*Could not match the product row in the CSVr9r6rr-rrrzdrawing-attachedr'r9zDrawing attached to r:): )rrr T)rUrJr)*rrrrrrbrrE_SP_DRAWING_EXTSrgrr_SP_DRAWING_COLrarGr r,r*rwrrrrrr r?rrrOrrr+r8rrCrirrrr r r)rrrrr rwarnrrr)rrnrr6rrJrs r1project_builder_upload_drawingr@XsW]]"!345s:: fA ::!345s:: ''  1:: &q ) / / 1C ""!89:C??<<##H-3::.Xs,eQTXXa[&B'..0es69rrrrr9r^rrrU)rrrrrrrarGr r,r*rwrrrrrrrrr r?rrrOrrCrrr) rrr rrrr)rrnrr6rrs @r1project_builder_detach_drawingrXs]   4 ( .BD88H%+224K+&,"335I'!456;; l00=AT!123S88 ;.779N ~  ) )#j.@.@.B*Cbff*L MUcUjUjUl!;<=sBB#N3NHd',,%I i % II e:de eC h[ 9$RCJJrN#$ y#6G!MNOQTTT ) $C w{ C 3x#~C hR' :'b 2  &'NGYC D$<  %:& I $$''s* I I$%I0 I! I!$I-0I9)rrrrz \b(2[4-7])-?(\d{4})([A-Za-z]?)\bctj|xsd}|sy|jdd|jd|jdxsdS)zPull the first iCast tranId out of arbitrary text and normalize it to ##-####[letter]. Returns "" when no match. The trailing letter's case is preserved (b-versions are conventionally lowercase).r7r^rc rrP) _PB_TRANID_RErrb)r&rs r1_parse_tran_idrXsQ TZR(A ggaj\1771:,qwwqz'7R&8 99r3cddl}|jt|} |j}|j t |j |y#|j wxYw)uConvert a raster image to a one-page PDF so the title-block OCR path (which expects a PDF) can read it. Raises on failure — callers guard.rN)r=r?r*convert_to_pdfr[rr-)rr r=rr s r1_pb_image_to_pdfrXsT ))CM "C&&(  Ny) s AA-cZ|jj}|tvriS|}d} |dk7rFtjd\}}t j | t||t|}i}t|gd}|jdr|d|d<|jdr|d|d< ddlm}||}t!|xs2t!|jd d xst!|j"} | r| |d <||r t j|SS#t$r-icY|r& t j|S#t$rYSwxYwSwxYw#t$rd }YwxYw#t$rYSwxYw#|r& t j|w#t$rYwwxYwwxYw) zOCR one PDF/image for Project Builder prefill. Returns any subset of {customer_name, project_name, tranId}. Images are converted to a one-page PDF first. Best-effort: never raises, returns {} for non-OCR types.Nrr!)rrrrrrextract_title_block_textr7rrE)r!rE _PB_OCR_EXTSrrrr[rrryr/rr rr"rrr9) rbrrtmp_pdfrrlabeledrrtrans r1_pb_discover_fieldsrXs ++   C , HG! &="**&9KB HHRL  w/=* E  ;; '#*?#;C ;;~ &")."9C   ;*84Cs#-!'++lB"?@-!$)),   CM   '" -  *   '"   -  C      '"   s3FD'5AF8E AFE1' E2F6E  EEEF E.+F-E..F1 E=<E=F*FF* F&#F*%F&&F*ci|D]T}t|jD]\}}|s j|r||<!tfddDsSSS)zOCR each path in order; first non-empty value per field wins. Stops once all three target fields are filled to keep large folders responsive.c3@K|]}j|ywrTr)r,r suggesteds r1r/z*_pb_aggregate_discovery.. YsUAy}}QUr)rrrE)rrrr)pathsrrrrs @r1_pb_aggregate_discoveryrYssI '*002 !DAqq) !  ! U)TU U    r3ctjd}|rtjdt |s't j j}|td<|S)zStable per-browser-session id for scoping temp uploads. Stored in the Flask session so a user's staged files never collide with another user's. pb_upload_sidz^[a-f0-9]{32}$)rrrFrGr*rWrXrY)rs r1_pb_session_idrYsG ++o &C bhh0#c(;jjl#& Jr3createctdz j}|tz j}t|j t|t j zsy|r|jdd|S)zResolve PROJECTBUILDER_DIR/_uploads//, rejecting traversal. Returns the Path (creating it when asked) or None on a bad session id._uploadsNTrM)rr,rr*rwrrr)rrrns r1 _pb_temp_dirrYsg  + 4 4 6D  ))+A q6  SY/ 0  t, Hr3ctd}g}|r{|jrkt|jD]O}|j s|j |j |jjtvdQ|S)znList this session's staged uploads: [{name, ocr}] where ocr flags a PDF/image that OCR Discovery can read.Fr)r9ocr) rrrrYrrir9r!rEr)rnrr s r1_pb_temp_listingr%Ysx E"A CQXXZ199;' ID||~ DII#';;#4#4#6,#FHI I Jr3 dest_folderctd}|r|jsy |jD][}|js||jz }|j r4t jt|t|] t jt|dtjddy#t$r+}tjjd||Yd}~fd}~wwxYw)zMove this session's staged uploads into dest_folder (on Submit), then clear the session temp dir. Files whose name already exists in dest are skipped (e.g. the CSV/metadata written by the submit handler).FrNz%PB temp upload move failed for %s: %sTrO r)rrrYrr9rr r r*rrmrnror:rr)rr$r rrls r1rtrt2Ys e $C cjjl VKKM 0D<<> 499,F}} KKD 3v; /  0 MM#c($/ KK& V BKQTUUVsA.C C;!C66C;z/project-builder/upload-tempc$tjjdxstjjd}|stddfSt d}|tddfS|D]}|r |j st |j }|s*||z j}t|jt|tjzsr|jt|tdt S) uStage one or more uploaded files in a session-scoped temp dir. They are not in the final folder yet — Submit moves them into SHARED_DIR//. Any file type is accepted (DVI-661).rrNo files providedrr`TrzInvalid sessionrUr)rrr rrrrr,r*rwrrrr)rrnrr9rs r1project_builder_upload_temprGYs MM ! !' * Kgmm.C.CF.KE 01366D!Ay./44   qzz* d(##%6{%%c!frvvo6  s6{  d"2"4 55r3z/project-builder/remove-tempctjdxsi}t|jdxsdj }|st ddfSt d }|rx|jrh||z j}t|jt|tjzr!|jr |jt dt! S#t$rY wxYw) z=Remove one staged upload from the session temp dir (DVI-661).Trrr7rL rr`Frr)rrrrrrrrr,r*rwrrrr/rr)rr9rnrs r1project_builder_remove_tempr`Ys   4 ( .BD DHHZ06B==? @D /0#55E"AQXXZd(##% v; ! !#a&266/ 2v~~7G   d"2"4 55  s C22 C>=C>z/project-builder/temp-filesc*ttS)z4List the current session's staged uploads (DVI-661).r )rrrXr3r1project_builder_temp_filesrsYrr3z/project-builder/discover-tempc"td}g}|rf|jrVt|jDcgc]4}|j r"|j j tvr|6}}tt|Scc}w)z|OCR the session's staged PDF/image uploads and return suggested, user-editable Project Information values (DVI-661 A.1).Frr ) rrrrYrr!rErrr)rnrrs r1project_builder_discover_temprzYsz E"A EQXXZ"199;/FqIIKAHHNN$4 $DFF 1%8 99Fs9B z /project-builder/discover-folderctjdxsi}|jdxsdj}|rtj |rd|vrt ddfSt|z j}t|jttjtjzr|jst d d fSt|jDcgc]4}|j!r"|j"j%t&vr|6}}t t)| Scc}w) uOCR the documents in an opened/imported project folder to discover Project Information — primarily the Customer/Contractor name (DVI-661 B).Trrr7rrrr`r rr )rrrrrarGrr r,r*rwrrrrrYrr!rErr)rrr rrs r1project_builder_discover_folderrYs   4 ( .BD88M*0b779K l00=AT-.33 ;.779N ~  ) )#j.@.@.B*Cbff*L M!((*78#==~5578 B1  0L @ BE B 1%8 99 Bs=9E rz c|jj}|tvry|}d} |dk7rFtjd\}}t j | t||t|} ddl m }||xsd}tjdd|j!}|dt"|r t j|SS#t$r+Y|r& t j|y#t$rYywxYwywxYw#t$rd}YwxYw#t$rYSwxYw#|r& t j|w#t$rYwwxYwwxYw) zShort, whitespace-collapsed title-block text snippet for one document, capped at _PB_CORR_SNIPPET_CHARS. Only OCR-able types (PDF/image) yield a snippet; everything else returns "". Best-effort: never raises.r7Nrrrrz\s+r\)r!rErrrrr[rrryr/rr"rrFr\r_PB_CORR_SNIPPET_CHARS)rbrrrrrrs r1_pb_doc_snippetrYs^ ++   C ,HG &="**&9KB HHRL  w/=  ;*84:CffVS#&,,.**+   '"     '"      C      '"   s3D%C5D-D%7D DD%C11 C=<C=DD% DD%DD% D"!D"%E)D?>E? E E E  Ec gt dtf fd }td}g}|rtj |rd|vrt |z j }t|jtt j tjzrG|jr7t|jDcgc]}|js|}}g}|rG|jr7t|jDcgc]}|js|}}||z}t|dD] }|| Scc}wcc}w)zCollect the documents currently in scope for correlation: this session's temp uploads plus the opened/imported project folder's files. OCR-able docs are listed first so they win the _PB_CORR_MAX_DOCS budget for snippets.rc|jj}|vr4|jr#j|j |yyyrT)r9rErrri)rr)rrs r1rz#_pb_correlation_paths.._addYs>fflln d?qyy{ HHSM LLO +?r3FrrcB|jjtvSrT)r!rErrs r1r z'_pb_correlation_paths..Ysahhnn.>l.Rr3r)rrrrarGr r,r*rwrrrrrYr) rrtemp_dir folder_pathsr r temp_pathsrBrrs @@r1_pb_correlation_pathsrYs* E 5D 5)HL|))+64{;R${2;;= ~  ) )#j.@.@.B*Cbff*L M"))+'-n.D.D.F'GW!199;AWLWJHOO%!'(8(8(:!;KAqyy{aK Kl*J J$R S Q LXLs E#EE.Erc\gd}t|dD]\}}|jd|jd|d|jt|}|r4|jd|j||jdy|jddj |S) zBuild the Assistant seed prompt: a correlation instruction followed by a markdown list of each in-scope document with a short OCR snippet.)z}I'm setting up a project in our Project Builder and need help understanding how the following documents relate to each other.r7z%For each document, help me determine:zR- which is the **submittal** package vs **shop drawings** vs other reference docs,zP- which **product line** each drawing maps to (e.g. by transaction/part number),z[- the overall **project identity** (customer/contractor, project name, transaction number).r7z## Documents in scoper^r7z### z. z```u=_(no readable text extracted — non-OCR file type or empty)_r0)rrir9rr)rrPrrr! s r1_pb_build_correlation_promptrYs E%# Z1 R tA3b)*!!$  LL  LL ! LL  LLX Y Z 99U r3z/project-builder/correlate-docsctjdxsi}|jdxsdj}t |dt }|st ddfSt t|t| S) u_Build a correlation seed prompt from the documents currently in scope — this session's temp uploads plus any opened/imported project folder — for the Assistant chat surface (DVI-662, Feature D1). Returns the prompt text and a doc count; the frontend pre-seeds the existing Assistant with it. No LLM call or auto-apply happens here.Trrr7NzINo documents in scope to correlate. Upload files or open a project first.rr`)r doc_count) rrrrr_PB_CORR_MAX_DOCSrrrC)rrrs r1project_builder_correlate_docsrYst   4 ( .BD88M*0b779K !+ ./A0A BE hiknnn 6u=U TTr3z/project-builder-load-projectctjdxsi}|jddj}|rtj |rd|vrt ddidfSt|z }|jst dd id fS|dgd }|d z }|jr0 t|d d5}tj||d<dddd}|jD]4}|j j#dk(s!|js2|}n|r t|d d5}t%j&|}|D]} i} t(D]F} dddddddddddddddddddddd d!dd"d#df D]} | d$| k(s | | vs| | | | d%<H| jt(d&xsdj| d'<| jt(d(xsdj| d)<t+d*| j-Ds|d+j/|  dddt3|dt4r7t3|djd,t6rt9|dd,|d+t |S#1swYxYw#tjtf$rYwxYw#1swYxYw#tt$j0f$rYwxYw)-NTrrr7rrr r`rr)rrrrrrrrrrE)rrrFro rGr rHquantityrI salesPricerJrrKitemSizerLrrMrrrryrrrc3 K|]}|ywrTrXr,rs r1r/z/project_builder_load_project..?Zs616s rrg)rrrrrarGrr rrr?rrrrrYr!rEr DictReaderror2rrir] rrrr) rrrr>rrrrrOrmappedr sp_fields r1project_builder_load_projectr Zs   4 ( .BD((="-335K l00=AT!678#=={*K    !345s::($B GF55I iw7 /2!%2v / H  " 88>> v %!))+H   hg6 :"+!:CF!0 D$,H=$?{S$36B$7zJ$9N$5XF$/zB$4IF$:-P ) DH (%7ESL9*6fmmo66z*11&9-: :<&.$'Jvf~7I7I*7UW[,\  !;VJ=OP 6?c / /$$g.    : :2#   sh)J7JJ%K3AJ; J;B J;J;1KJJJ87J8;KKK#"K#z/searchctjjdxsdj}g}|r t jdi}|jds|jdrt j r|j}tt jddD]}|j r|jjd r/||jjvr/|j|j|d z jd t|d k\snt||d S)Nr r7r'rrc6|jjSrTrS rT s r1r zglobal_search..^ZsAFFH4E4Er3Tr rrrrx)r#projects)rrhrrrr rrErrYr9rwrirrCr)r rrneedlers r1 global_searchrTZs   #  $"++-AH KK # EE$ %})=:CTCTCVWWYF""$*Et ||~)>)>s)CUZZ--//OO % %*-D%D$M$M$O%x=B&  QH5 66r3z/var/www/html/togen/tutorialsz/togen/tutorials/manifest.jsoncLtdz }|jr/ tj|j }t |Sg}tjrttjD]}|jjdvs |j|jjddjddjdt!|j"ddt |S#t $rt gcYSwxYw) zJReturn the list of available tutorial videos from the tutorials directory.z manifest.json).mp4z.webmz.movrc r\r z/togen/tutorials/r7)rerJrN)_TUTORIALS_DIRrrrrrryrrrYr!rErirrrerr9) manifest_pathr tutorialsrs r1tutorials_manifestroZs#_4M ::m5578D4= I..01 Axx~~#<<  VV^^C5==c3GMMO.uQVV}o>!#"  9  2;  s-D D#"D#c(|jjd}d|jdvs|jdryt|z j }t |jt tj sy|S)zBResolve a relative path under _FB_ROOT; return None if it escapes.r6rN)rrrwr8 r,r*)rcleanedrs r1r6 r6 Zstiik$G w}}S!!W%7%7%<7"++-H x= # #C(8(8(:$; < Or3z /fb/browsec tjjdd}|r t|nt}||j st ddidfSg} t|jdD]}|jjdr|j}|j|j|j |jr |jnd tj |j"j%d  t)|j+t}|dk(rd}t ||d S#t&$rt dd id fcYSwxYw)z?List files and folders in the given directory under SHARED_DIR.rbr7rInvalid directoryr`cX|j |jjfSrT)rr9rErs r1r zfb_browse..Zs NAFFLLN;[r3rrr)r9rrdmodifiedPermission deniedr)rbr)rrhrr6 r8 rrrrYr9rwrrirr&rr rrrrr*r{)rrrr r rel_displays r1 fb_browser%Zs; ,,  62 &C#&]3 HF ~V]]_!456;;G <6>>+1[\ Dyy##C(99;D NN ++-(,  A*88GQQS   f((23Kc KG< == <!456;;s,CDIIKK  "srrrrrmrnrros r1_fb_save_watcher_staterC[sEH((E!)DE H FGHrz /fb/watcherscRt}ttt|S)z*Return the current user's folder watchers.)r()r8rr)rr]s r1fb_watchers_listrE[s#  E 67J57QR SSr3c " t}tjdxsi}|jdxsdj j d st ddfSt }||jst d dfS|jd xsdj }|rt|t d dfSt|}tt|}t fd |Drt ddfStjj}|j!| t# j$xs dt'j(j+|xsd d||d< t-||t1}| t3|t'j(j+d||<t5|t d|S#t.$r}t d|dfcYd }~Sd }~wwxYw)zECreate a folder watcher for the current user on a folder in the tree.Trrbr7r6zA folder path is required.rr`NzFolder not found.r.Invalid expiration date.c3FK|]}|jdk(yw)rbNr)r,rrs r1r/z"fb_watchers_add..)[s 2A155=C  2!z%That folder is already being watched.r9)rrbrr~rr.r'Failed to save watcher: rownerrbsnapshot last_checkedrUr()r8rrrrrr6 rr+rrr)r2rWrXrYrirr9rrrrrr?r<rC) rrr expires_rawrr(r1rlrors @r1fb_watchers_addrQ[s  E   4 ( .BD 88F  !r ( ( * 0 0 5C 9:C?? 3 F ~V]]_0136688L)/R668K' 4<78#=="5)H.x89H 2 22DEsJJ **,  C OOc&3$((*446!)T 'H]DE8, # $E'/&**,668 E#J 5! dX .. D7u=>CCDs G** H3H H Hz/fb/watchers//togglect}tjdxsi}t|j d}t |}t t|}d}|D]}|j d|k(s||d<d}n|stddfS||d < t||td| S#t$r}td |d fcYd }~Sd }~wwxYw)zEEnable/disable email notifications for a watcher (keeps the watcher).Trr~FrWatcher not found.rrr'rJrNrO) r8rrrrrrr)rrr) r1rrr~rr(r rrls r1fb_watchers_togglerTG[s  E   4 ( .BD488I&'G"5)H.x89H E  55;# "AiLE   12C77&H]DE8, dX .. D7u=>CCDs B33 C<C CCz/fb/watchers/PUTct}tjdxsi}|jdxsdj }|rt |t ddfSt|}tt|}d }|D]#}|jd |k(s|xsd|d<d}n|st d d fS||d < t||t d|S#t$r}t d|dfcYd}~Sd}~wwxYw)z=Edit a watcher's termination date (set, change, or clear it).Trr.r7NrGrr`FrrSrr'rJrrO) r8rrrrr+rrrr)rr) r1rrrPrr(r rrls r1fb_watchers_updaterW`[s  E   4 ( .BD88L)/R668K' 4<78#=="5)H.x89H E  55;# )1TAlOE   12C77&H]DE8, dX .. D7u=>CCDs C C?$C:4C?:C?crt}t|}t|Dcgc]}|jd|k7s|}}||d< t ||t}||vr|j|dt|t d|Scc}w#t $r}t d|dfcYd}~Sd}~wwxYw) z4Delete a watcher automation and its stored snapshot.rr'zFailed to delete watcher: rrNTrO) r8rr)rrrrr?rrC)r1rrrr(rlros r1fb_watchers_deleterY{[s  E"5)H5h?Va155;RUCUVHV&H]FE8, # $E e| #tu% dX ..W F9#?@#EEFs(B B  B B6B1+B61B6z /fb/uploadc 4tjjdd}|r t|nt}||j st ddidfStjjd}|st ddidfSg}|D]}|jst|j}|s)||z }|jjd r|d tjjd |z } |j!t#|t%j&t#|5}|j)D]G} || z j+} t#| j-t#|j+rHI|j/t#|ddd|j1|d |j7sQ|j9c|j!t#||j1||rit;dr^t=ddt?jdxsijddtA|d|xsd|xsdtA||xsddt d|iS#1swYxYw#t$j2$r@|j5d |j!t#||j1|Y(wxYw#|j7r|j9wwxYw)zQUpload one or more files to the given directory. Extract ZIP files automatically.rbr7Nrr r`rrr_tmp_r z (extracted)rrrH r'r9z Uploaded z file(s) to r6)rrr uploaded)!rrgrr6 r8 rrrr rrrEr|rWrXrYrr*rrrr,rwrri BadZipFilerrr/r r rrC) rrruploaded_namesrrrtmp_pathrr member_dests r1 fb_uploadra[s ,,  62 &C#&]3 HF ~V]]_!456;; MM ! !' *E !456;;N -zz #AJJ/   ! ??  % %f -% (8(8'99+ FFH &s8}%__S]3/r"$++-%'-&?&?&A ";/::3v~~?O;PQ$%MM#f+. / %% <&@A ??$OO% FF3t9   ! !) ,9-<5nE H;;v&,"11&9N 34L M s 0D   J/ 005//%% 1q s4y!%%i0 1 ??$OO%%sD?8J7AJJ,JJ JAK1-K40K11K44#Lz /fb/downloadc tjjdd}|stddidfSt |}||j stddidfS|j rhtd rrJrrr1rzrwrr{r)rrr2rr;s r1 fb_downloadre[s" ,,  62 &C !456;; 3 F ~V]]_!123S88 ~~ &~ 6  {{6*0b55f=%cU+'  VD TT }} >> x//1 1G%EFGL Ljjl __S#w';'; < Ic* I==?5::+@+@+EHHSZU->->v-F)GH I I  &~ 6  {{6*0b55f=,SE8)  D6;;-t@T"35 5 G23 4c 99! I Is%I:I5II!z /fb/deletectjdxsi}|jdd}|stddidfSt |}||j stddid fS|j tj k(rtdd idfS |jrtjt|n|jtd r9td dt!jdxsijdd||td|iS#t$rtdd id fcYSwxYw)zDelete a file or folder.Trrbr7rrcr`rrzCannot delete root directoryr#rrrr'r9Deleted r r rr )rrrrr6 rr,r8 rr r:r*r/rrr r r)rrrs r1 fb_deleteri[s=   4 ( .BD ((62 C !456;; 3 F ~V]]_!123S88 ~~8++--!?@A3FF< ==? MM#f+ & MMO#>2 H;;v&,"11&9se$  Is# $$ <!456;;!345s:: 3 F ~V]]_!123S88 ~~8++--!?@A3FF}}x88H!QRSUXXX< h#>2 H;;v&,"11&9v{{m5@  Ix}}- .. <!456;;C C Ds8%G99HHz/news/posts/ctjdxsi}|jddj}|jddj}|jdxsdj}|r|st dd fSt }t fd |Dd }|t d d fS|jddk7rt dd fStjdi}|jdxsdj}|jdxsdj|k7rt ddfStjjd} |st dd fS tj|jdd} | j/| j!t"j$jd } | jd} | | krt dd fS||d<||d<| |d<| |d<t'|t d|S#t$rt dd fcYSwxYw)aEdit a scheduled (not-yet-published) news post. Original poster only. Allows changing title, body, and the scheduled publish time before the post goes live. Published posts are immutable here. Only the user who authored the post may edit it. Trrer7rrtr}rr`c3LK|]}|jdk(s|ywr r)r,rpost_ids r1r/znews_update..\s Escape HTML special chars so user content can't inject markup.&&<<>>rr%s r1 _md_escaper\s- LLg &f%f%'r3c p d fd}|jddjddjd}gggdfd}fd}|D]<}|j}|s||%tjd |}|ri||t |j d }d d d d} jdj|| |||j dtjd|} tjd|} | s| rI|| rdnd} r | k7r|| j|| xs| j d |j||?||djxsdS)aConvert a lightweight Markdown subset to email-safe HTML. Supports: ATX headings (#, ##, ###), unordered (-, *) and ordered lists, blank-line-separated paragraphs with single newlines as
    , **bold**, *italic*, [text](url) links, and bare http(s) autolinks. All text is HTML-escaped first, so the source is untrusted-safe. Explicit block tags are emitted (rather than relying on white-space:pre-wrap) because Outlook ignores pre-wrap and collapses the post's spacing. z(color:#0077A8;text-decoration:underline;cht|}gfdfd}tjd||}fd}tjd||}tjdd|}tjdd |}tD]&\}}|j d j ||}(|S) Nc`j|djtdz S)N{}r^)rir rC)tag_htmlrs r1_stashz6_render_news_markdown.._inline.._stash\s,    )&&s<'81'<= =r3c rdj|jd|jdS)N{}rr^)r rb)rr link_styles r1_md_linkz8_render_news_markdown.._inline.._md_link]s5:AA J 45 5r3z"\[([^\]]+)\]\((https?://[^\s)]+)\)cX|jd}dj||S)Nr^r)rbr )rrJrrs r1 _bare_linkz:_render_news_markdown.._inline.._bare_link ]s2''!*C:AAZ&' 'r3z(?=])(https?://[^\s<]+)z\*\*([^*]+)\*\*z\1z(?\1r)rrFr\rrr )rrrr html_fragrrrs @@r1_inlinez&_render_news_markdown.._inline\s qM  >  5 FF8(A F ' FF4j! D FF%'=q A FF5~q I' 5 ?NC ,--c2I>A ?r3z r0 Ncxr7jddjzdzjyy)Nz,

    z
    

    )rirrR)parar0 sr1 flush_paraz)_render_news_markdown..flush_para]s<  LLG!;;t,-/56 7 JJL r3crIdjdD}jdj|jdy)Nr7c3>K|]}dj|yw)z3
  • {}
    • Nr r,r| s r1r/z<_render_news_markdown..flush_list..%]s$&FLLRP&sz9<{0} style="margin:0 0 14px;padding-left:22px;">{1})rrir rR)r list_itemslist_tagr0 s r1 flush_listz)_render_news_markdown..flush_list"]sO GG&$&&E LLT &51 3    r3z^(#{1,3})\s+(.*)$r^22px18px16px)r^rrPzX{2}rz ^[-*]\s+(.*)$z^\d+\.\s+(.*)$ulolr7z

     

    ) rrrrFrGrCrbrir r)r&rrPrrrsstrippedheadingr sizesrrwantrrrrr0 s @@@@@r1rr\sD E  XX& 1 XX' 2  L44DH, H   grxR&6&6q&9: ;   GH%&?'BLL 775> >>>r3c.dj|||||S)zAWrap content in a branded, Outlook-safe (table-based) HTML email.a8
    togen
    News Update

    {title}

    {meta}
    {body}{cta}
    {footer}
    )rerrctafooterrre meta_html body_htmlcta_html footer_htmls r1_news_email_shellrS]s* 3B f5yyh !E#!r3ab

    You are receiving this email because you subscribed to Togen News updates.
    Unsubscribe from future updates.

    c^fd}tj|djy)zNSend a news post to all subscribers via Microsoft Graph API (fire-and-forget).c x djtjddtjdddd}d}ttd|t jd d|t }t jtd d|y#t$rYywxYw) NzR

    Posted by {author} on {date}

    r r7rr)r rarerrz Togen News: ) r rrrr_NEWS_UNSUBSCRIBE_FOOTERr=rrry)rrrrrxs r1_do_sendz"_send_news_email.._do_send]s 3396%dhhx&<=#DHHVR$8"$=>4:4@  ( g/#/0DE!4 G  ) )[!\$w-#A7 L   sB)B-- B98B9TrNrrrq)rrxrs`` r1rvrv]s#8HT288:r3cZfd}tj|djy)z9Send a subscription confirmation email (fire-and-forget).cD tjttt}|j dg}d|vryd}d}t dd||t }d d |d d diigddd}tjdtdd|ddd|dy#t$rYywxYw)Nrrrrz

    You will now receive email notifications when new posts are published on Togen.

    az You're subscribed to Togen News!r7rz"Togen News: Subscription ConfirmedHTMLrrrrrrrrrrrrr) rrrrrrrrrrrry)rrrrrrrs r1rz._send_subscribe_confirmation.._do_send]s3 ;;);z[J%>>>??AL\1Q   (8#!4 G D'-#* ()U);<% $+ J   9/9J)T'.|N/K.L%M$6     s;BAB BBTrNr)rrs` r1_send_subscribe_confirmationr]s$4lHT288:r3z/news/subscribersctjdi}|jddj}t}t ||Dcgc]}|jc}vScc}w)z(Check if the current user is subscribed.r'rr7) subscribed)rrrErr)r'rrrs r1news_subscribers_getr]sY ;;vr "D HHWb ! ' ' )E  D e4'@a '@@ AA'@s A+ z/news/subscribectjdxsi}|jddjj }|rd|vrt ddfSt }|Dcgc]}|j }}||v}|r|j|t||rtr t|t dd Scc}w) z)Subscribe an email to news notifications.Trrr7rz Valid email address is required.rr`rUr) rrrrrErrrirrr)rrrrris_news r1news_subscriber]s   4 ( .BD HHWb ! ' ' ) / / 1E Cu$?@#EE  D#'(a (H( ( "F  E$ /$U+ dt ,,)s+Cz/news/unsubscribec&tjdxsi}|jddjj }t }|Dcgc]}|j |k7s|}}t |tddScc}w)z-Unsubscribe an email from news notifications.Trrr7Fr)rrrrrErrr)rrrrs r1news_unsubscriber^s}   4 ( .BD HHWb ! ' ' ) / / 1E  D 2!qwwyE1A 2D 2d du -- 3s B0Bz/togen-admin/public-versionc*ttS)z)Return the current public version string.)r )rr!rXr3r1togen_admin_public_version_getr^s /1 22r3c0tjdxsi}|jddj}|st ddfS t j |dzt d| S#t$r}t d |d fcYd }~Sd }~wwxYw) z-Update the public version string. Admin only.Trr r7zVersion text is required.rr`r0zFailed to save version: rN)rUr )rrrrrr rr)rr rls r1togen_admin_public_version_postr!^s   4 ( .BDhhy"%++-G 893>>D&&w~6 dG ,, D7u=>CCDs A11 B:B BBz/togen-admin/aboutc*ttS)zDReturn the editable About popup text (Markdown). Any logged-in user.)r)rr'rXr3r1togen_admin_about_getr5^s .0 11r3ctjdxsi}|jdxsdj}|st ddfS t |t d| S#t $r}t d|d fcYd }~Sd }~wwxYw) z(Update the About popup text. Admin only.Trrr7zAbout text is required.rr`zFailed to save About text: rN)rUr)rrrrrr)r)rrrls r1togen_admin_about_postr<^s   4 ( .BDxx "(b//1G 67<<GG$ dG ,, G:3%@A3FFGs A'' B 0BB B z/togen-admin/site-textc(ttS)z=Return the editable header title/tagline. Any logged-in user.)rr0rXr3r1togen_admin_site_text_getrK^s ?$ %%r3ctjdxsi}|jdxsdj}|jdxsdj}|st ddfS|st d dfS t ||t d|| S#t $r}t d |d fcYd }~Sd }~wwxYw)z,Update the header title/tagline. Admin only.Trrer7r+zTitle is required.rr`zTagline is required.zFailed to save title: rN)rUrer+)rrrrrr2r)rrer+rls r1togen_admin_site_text_postrR^s   4 ( .BD XXg  $" + + -Exx "(b//1G 12C77 34c99Bw' d% 99 B5cU; ?FzBackup already in progressrUrr9Trr8)rUro) rUrPrLrtrur[rryrrrmrq)rerOrvs r1togen_admin_backup_runr^s  | M ZZ\1 1 3  (*  e+GH#M M .t<BBD d) ,,    sA B B*)B*z/togen-admin/backup/historyc8tttjj ddd}ttjj dd} t }|j d|dz|fj}|jt||kD}g}|d|D]H}t|}t|d|d<t|d xsdxsd|d <|j|Jt||| S#t$rg}Y{wxYw) Nr rxrdoffsetrzuSELECT id, started_at, finished_at, status, exit_code, duration_s FROM runs ORDER BY started_at DESC LIMIT ? OFFSET ?r^rqrr)rhas_morer)rLrrrhrrPrLrr[ryrCrrir)r rrOrnrrrrns r1togen_admin_backup_historyr^s GLL$$Wb12C 8E !!(A. /F ||| C QY   (* 4y5 H D &5\ Ga o.,q/415=- A  x ?? s?D DDz /togen-admin/backup/log/c" t}|jd|fj}|j|st ddfSt |dxsd|dS#t $r!}t t |d fcYd}~Sd}~wwxYw) Nz.SELECT log_text, status FROM runs WHERE id = ?rKrrlog_textr7rd)rkrdr)rPrLrur[rryr*)rfrOrrls r1togen_admin_backup_logr^s ,|ll ->DGCNN<#3#34>>@TKN#,,'FG UY r3z/togen-admin/backup/schedulec<tttS)Nr )rrrrXr3r1togen_admin_backup_schedule_getr^s 45J5LM NNr3c Bddlm}tjdxsi}t |j d}|s0t }d|d<t|tdt|St|j dd j}|d vrtd d fSt|j ddj} |jdddDcgc] }t|c}\}}d|cxkrdkrnJd|cxkrdksJJ |dd|d}|j d} |dk(rK t!| D chc]%} dt| cxkrdksnn t| 'c} } | std d fSgd} t|j dxsdjxsd} || } d||| | dd}t#j$| } | j'||dd }|d k(xs| j)| v}|r| |k\r| j+d!|d"<t|tdt|Scc}w#t$rtd d fcYSwxYwcc} w#t$rg} Y wxYw#t$r d} || } YwxYw)#aSave the recurring-backup schedule (DVI-966). Body: {enabled, frequency: daily|weekly, time: "HH:MM", days: [0-6], timezone: IANA name}. The time is interpreted in the setter's timezone (auto-detected in the browser), defaulting to America/Chicago (CST/CDT). rrTrr~Fr rr)rrz&Frequency must be 'daily' or 'weekly'.rr`rUrzrSNrrrz%Time must be in HH:MM 24-hour format.rQrrrz$Select at least one day of the week.r{rr7r|r}rrr)rrrrrrrrrrr*rErrrryrrrrrr)rrr~rrtime_strrrrrrntznamer now_localr fires_todays r1 togen_admin_backup_schedule_postr^s"   4 ( .BD488I&'G %' ie$$)A%)HIIDHH['2399;I++EFKK488FG,-335HK"*.."5bq"9:Q#a&:BB||,,R " ,, ,, S2c(#H 88F DH 4Da1A3C!3C3q6DED!GH#M M$ *%+ , 2 2 4 I8IF f    E""2&I''R1RS'TOw&E)*;*;*=*EKyO3#,#5#5j#A % d%=e%D EEU; KDEsJJKE D  " f s`I(I:%I I6 I1#I13I6?JII.-I.1I66 JJJJz/togen-admin/shared-url-prefixc4tttS)z;Return the current shared URL prefix and available options.)rr )rrSHARED_URL_PREFIX_OPTIONSrXr3r1togen_admin_url_prefix_getr7_s &() r3c$tjdxsi}|jdxsdjj d}t Dcgc]}|d }}||vrt dd fSt|t d| Scc}w) z)Update the shared URL prefix. Admin only.Trrr7r6rzInvalid URL prefix selected.rr`)rUr)rrrrr8rrr)rropt valid_valuess r1togen_admin_url_prefix_postrA_s   4 ( .BDhhx &B - - / 6 6s ;F,EFSCLFLF \!;); 404 if absent.rrpr )rrr rrXr3r1togen_admin_branding_logor_s%  & & ( c (? CCr3z/dashboards/logo/icast.svgctjrttdStdz }|jrtt |dSt dy)uzServe the iCast / Infrastructure Precast mark for the Logo dashboard tile (DVI-1280). No auth — it is referenced by from the SPA, the signage kiosk (no session), and report snapshots. Prefers the admin-uploaded corporate logo; falls back to the repo-committed mark (logo-black.svg, the same file baked into the MTS Label PDFs) so the tile always renders.rpr logo-black.svgrN)rrrr r*r )fallbacks r1dashboards_logo_icastr_sM""$,GG 00HXAA #Jr3z"/togen-admin/branding/bg-light.svgcbtjs tdttdS)zGServe the corporate light-theme background SVG. No auth; 404 if absent.rrpr )r rr rrXr3r1togen_admin_branding_bg_lightr_s% # * * , c , GGr3z!/togen-admin/branding/bg-dark.svgcbtjs tdttdS)zFServe the corporate dark-theme background SVG. No auth; 404 if absent.rrpr )r rr rrXr3r1togen_admin_branding_bg_darkr_s% " ) ) + c +o FFr3z/togen-admin/subscribersc.t}t|S)z.Return all news subscriber emails. Admin only.)rx)rrrs r1togen_admin_subscribers_listr_s  D t $$r3cdddd}tjr tjtj }t |t rut |jdtr|d|d<t |jdtr|d|d<t |jdtr|d|d<|S|S#tjtf$rY|SwxYw)a\Return default printer settings: {document_printer, label_printer, enabled}. ``enabled`` (DVI-764) gates whether the Print system is offered to non-admin users. It defaults to ``True`` so existing deployments keep working; an admin can clear the checkbox to hide/disable Print for regular users (Togen admins always retain access).r7T)document_printer label_printerr~rrr~) PRINTING_SETTINGS_FILErrrrrrrr*rrr)rrs r1_load_printing_settingsr!_s%'MH%%' JJ5??ABE%&eii(:;SA389K3LH/0eii8#>05o0FH_-eii 2D9*/ *:HY' O8O$$g.   O sB,C C)(C)c6tjddS)zBTrue when the Print system is enabled for regular users (DVI-764).r~T)r!rrXr3r1_print_system_enabledr#_s " $ ( (D 99r3c>|r|jdrytS)zWhether ``user`` may use the Print system (DVI-764). Togen admins always may; everyone else only when the system is enabled.rT)rr#r-s r1rr_s ' ""r3zsales@icastinc.com&Infrastructure Precast Inc_ - TakeoffszAmerica/Indiana/IndianapolisQuoteXQuoteYQuoteZLP)XYrr)) SPCACBWBCBRESEMHRWSHWQWW)rYstandard) draft_mailboxclickup_api_keyclickup_list_idazure_client_idazure_tenant_idazure_client_secret onedrive_usertakeoffs_folder report_to report_ccshared_quotes_locationshared_quote_takeoff_locationschedule_timezonedry_runtag_mapctt}tjr} t j tj }t|trCtjD],\}}||vs t||t|us%||||<.|S|S#tjtf$rY|SwxYwrT) r_WINSTON_DEFAULTSWINSTON_SETTINGS_FILErrrrrrrTrr)rrrr.s r1_load_winston_settingsrJ_s%&H$$& JJ4>>@AE%&"3"9"9";/JAwEzd58nW &E&+Ah / O8O$$g.   O sAB#;B# B##C?CcXtjtj|dyr)rIrrrrfs r1_save_winston_settingsrL `s$$TZZ%CDr3c@ii}}t} |jdj}|j|D]t}|dxsdj xs|dxsdj }|s6|j }|dr|j |||dsc|j ||vt|jtj t|jtj dS#|jwxYw) uPrinters published by active Print agents, split for the two dropdowns. Returns ``{"documents": [...], "labels": [...]}`` — sorted, de-duplicated lists of ``published_name`` strings drawn from included printers flagged ``for_documents`` / ``for_labels``. A printer with no published_name falls back to its raw_name so it is still selectable. Only printers belonging to agents in the ``active`` status are offered (pending/revoked agents are not trusted). (DVI-668 / DVI-657 P2) zSELECT p.raw_name, p.published_name, p.for_documents, p.for_labels FROM print_printers p JOIN print_agents a ON a.machine_id = p.machine_id WHERE p.included = 1 AND a.status = 'active'published_namer7raw_name for_documents for_labelsr) documentsr) _print_dbrLrr[rrEr}rrr*)docsrrOrnrr9r)s r1_available_printersrU `sr&D ;D|| < (*  )"#)r002Sq}7J6Q6Q6S jjl _  OOC & \?   c4 ()DKKMsyy9cii8  s D D __default__ct|xsijdxsi}|jd}|jd}t|tr|r|ntt|tr|r|dStdS)zReturn the user's stored printer overrides, defaulting to the sentinel. Stored under ``user_settings/.json`` -> ``printing: {document_printer, label_printer}``. Missing keys default to ``__default__`` (use global).printingrrrr)rrrr*PRINT_USER_DEFAULT)rr4rlbls r1_user_printing_overridesr\6`sv "%(.B 3 3J ? E2F **' (C **_ %C#-c3#7CCEW *3 4 BT r3c^tt|fd}|d|ddS)aResolve the effective default printers for a user (DVI-668 / P2). A user override (a non-sentinel, non-empty published_name) wins; otherwise the global default from ``printing_settings.json`` is used. Shared helper for the print-dispatch (P3) and tool Print buttons (P4).cdj|}|r |tk7r|Sj|dSr)rrZ)r)chosenrr's r1_pickz*_effective_default_printers.._pickM`s1# f 22MxxR  r3rrrY)r!r\)rr`rr's @@r1_effective_default_printersraD`s9 # $D #E *D!""45/ r3z/togen-admin/printingcVt}t|d|d|dtS)zAReturn default printer settings + available printers. Admin only.rrr~)rrr~available_printers)r!rrUrfs r1togen_admin_printing_getrdY`s8'(H !"45/#.0  r3z/user-settings/printingctdjdd}t}tt |d|ddt |t S)zReturn the user's printer overrides + global defaults + the picker lists. Each dropdown offers a "Use Default" sentinel (``__default__``) plus the published printers for that kind. (DVI-668 / DVI-657 P2)r'rr7rrrY)rcglobal_defaultsr'default_sentinel)rrr!rrUr\rZ)rrs r1user_settings_printing_getrhf`sX FO   ,E " $D .0 $%7 8!/2 &e ,+ r3c0tdjdd}tjdxsi}t }|dDchc]}|j c}|dDchc]}|j c}d}t |}t|jd xsi}dD]{}||vr||}|d dtfvr|j|d +t|tstd |d  dfcS|j ||vrt|d dfcS|||<}|r||d <n|jd d  t||tdt|Scc}wcc}w#t$r} td|  dfcYd } ~ Sd } ~ wwxYw)zPersist the user's default-printer overrides. The sentinel ``__default__`` (or a blank value) clears the override so the global default applies.r'rr7TrrRrrYrXNzInvalid value for rrr`z is not an available printer.rrrUr')rrrrrUrErrrZrrr*rrrr\) rravailrrrrXr)rQrls r1user_settings_printing_postrlz`s FO   ,E   4 ( .BD  !E05k0BC1QWWYC-28_=!'')=G#5)HHLL,23H4  d? 3i 4/0 0 LLd # #s##5cU!!<=sB B 99;gcl *C5(E!FGL L  ' Z&EE8, d!9%!@ AA3D=, E8>?DDEs*E'%E, E11 F:F FFcLtjdxsi}t}d|vrt|dxsd|d<d|vrt|dxsd|d<d|vrt |d|d<t j tj|dtd|d S) z;Save default document/label printer selections. Admin only.Trrr7rr~rr)rUr~) rrr!r*rr rrrrrrs r1togen_admin_printing_postro`s   4 ( .BD&(HT!'*40B+C+Ir'J#$$$'_(=(C$D!D"4 ?3%%djj!&DE dHY$7 88r3z/togen-admin/quotes-locationcpt}t|jdd|jddS)zHReturn the admin-configured shared quotes paths (completed + take-offs).rBr7rCrBrC)rJrrrfs r1togen_admin_quotes_location_getrr`s8&'H '||,DbI&.ll3RTV&W r3ctjdxsi}t}dD]B}||vs||}t|tst |ddfcS|j ||<D t|t d|jd d |jd d  S#t$r}t d|dfcYd }~Sd }~wwxYw)zDPersist the shared quotes paths (completed + take-offs). Admin only.Trrq must be a string.rr`r; rNrBr7rC)rUrBrC) rrrJrr*rrrLrr)rrr)rQrls r1 togen_admin_quotes_location_postru`s   4 ( .BD%'HJ( $;s)Cc3'u,>%?@#EEIIKHSM (<x(  '||,DbI&.ll3RTV&W  </u56;;Persist the user's personal documents settings (quotes paths).r'rr7TrrRryrtrr`Nrrrwrx)rUrwrx) rrrrrrrr*rrrrr)rrrrTr)rQrls r1user_settings_documents_postr|`sA FO   ,E   4 ( .BD"5)H  [)/R 0D<$ $;s)Cc3'u,>%?@#EEyy{IIKS d#$ $ [$'EE8,  !2B7#xx(@"E  E8>?DDEs" D E%D;5E;Ez/winston/quote-pathsc "t}tdjdd}t|jdxsi}t |jdd|jdd|jdd|jdd S) uAggregate read-only view of all four resolved quote path values for the current user. Returns: shared_completed — shared_quotes_location from admin settings shared_quote_takeoff — shared_quote_takeoff_location from admin settings personal_completed — quotes_location from the user's documents settings personal_quote_takeoff — quote_takeoff_location from the user's documents settings r'rr7rRrBrCrwrx)shared_completedshared_quote_takeoffpersonal_completedpersonal_quote_takeoff)rJrrrr)re r user_docss r1winston_quote_paths_getras$ %F FO   ,E$U+// <BI $rr| rs r1winston_files_listr%as+ LL  V $ 2 9 9 ;D &&23S88 # %F FO   ,E#E*..{;ArI z%(?(?(AA**rJ)rritem_idr9r rDrrs r1winston_files_previewras + LL  V $ * 1 1 3D||%+224G LL  V $ . 5 5 7 A6D &&) &";;JE  # # %E 8 **5':##GR0**5%A/ RZZ( ==r3)rweekdaysrY)prev_bizr )winston_scheduler_winston_active_runsc0tjr\ tjtj }t |t r!|Dcgc]}t |ts|c}S gSgScc}w#tjtf$rYgSwxYwrT) WINSTON_SCHEDULES_FILErrrrrrrrr)rrs r1_load_winston_schedulesras%%' ::4>>@AD$%#'?a:a+>??& I2I@$$g.   I );A8A3'A3+A83A88BB schedulescXtjtj|dyr)rrrrrs r1_save_winston_schedulesras%%djj1&EFr3c0tjr\ tjtj }t |t r!|Dcgc]}t |ts|c}S gSgScc}w#tjtf$rYgSwxYwrT) WINSTON_RUN_RECORDS_FILErrrrrrrrrrvs r1_load_winston_run_recordsras'') ::6@@BCD$%#'?a:a+>??& I2I@$$g.   I rr= cXtjtj|dyr)rrrrr= s r1_save_winston_run_recordsras'' 71(EFr3rc t5t}|Dcgc](}|jd|jdk7s'|*}}|jd||dt}t |dddycc}w#1swYyxYw)zDThread-safe append + trim to _WINSTON_MAX_RUN_RECORDS, newest first.rrN)_WINSTON_RUN_LOCKrrr_WINSTON_MAX_RUN_RECORDSr)rr= rs r1_append_winston_run_recordrasy ++-%It 48H)H1IIq&!334!'* ++I++s!A9(A4A4(A94A99Brrc$|jdxsdj}|syt|dkDry|jdxsdj}|tvrdd d j td fSd}|d k(rd|jd xsg}t |t sy t|Dchc]%}dt|cxkrdksnn t|'c}}|sy t|jdd}d|cxkr dks tt t|jdd}d|cxkr dks tt |jdxsdj} ddl m } | jttz} | | vryt!j"j%} |xsijdxst't)j*|||||| t-|jddt-|jd d!|xsijd"xs| | d# } | dfScc}w#ttf$rYywxYw#ttf$rYywxYw#ttf$rYywxYw)$z:Build/validate a schedule dict. Returns (schedule, error).r9r7NzSchedule name is required.rNz/Schedule name is too long (max 120 characters).cadencerN!Invalid cadence; expected one of rrrY custom_days)Nzcustom_days must be a list.rr)Nu<custom_days values must be integers 0–6 (Mon=0 … Sun=6).)Nz'custom_days must have at least one day.r)Nuhour must be an integer 0–23.r;)Nu!minute must be an integer 0–59.profiler winston_date_logic)Nz0Invalid Date Logic; select an existing pipeline.rr~TrEFr) rr9rrrrrr~rErr)rrrC_WINSTON_SCHEDULE_CADENCESrrrrrrrrZrvalid_pipeline_idsr_WINSTON_SCHEDULE_PROFILESrrrr*rWrXr)rrr9rrraw_daysrnrrr_wdlvalid_profilesrr s r1_winston_schedule_from_bodyras HHV  " ) ) +D 1 4y3Fxx "-g446G008C]9^8__`aaaK(88M*0b(D)6 X (!OQa3q6>NQ>N#a&!OPKB7488FA&'TR    9TXXh*+V!r! " " xx "-g446G0,,.5O1PPNn$G     ( ( *C~2""4(=C ,="D12E23~2**<8?CH T>S"P:& XW X z "767 z "989sN* I3I II(3I(3I=II%$I%(I:9I:=JJz/winston/configcddlm}t}|jddxs |j}|jddxs |j }t |jddxs |j}|jddxs.tjjddj}|jd dxs |j}|jd dxs$tjjd dxsd }t tjjd xs|jdd}t |xr|xr|} t|jdd||| |||rdnd|||jdg|jdgt |jdd|jdtd S)z9Return Winston configuration status for the Settings tab.rrr;r7r<r=r:CLICKUP_LIST_IDr>r?WINSTON_TAKEOFFS_FOLDERr%CLICKUP_API_KEYr9r8z****r@rArEFrF) r8clickup_api_key_configuredr:azure_configuredr;r<r=r>r?r@rArErF)rZrrJrr _AZ_TENANTrrrr rWINSTON_ONEDRIVE_USERrrH) rrr;r<azure_secret_setr:r>r?clickup_key_setrs r1winston_config_getr.bs+%'Hll#4b9NS=N=NOll#4b9KS^^OHLL)>CUs~~Vll#4b9jRZZ^^L]_a=b=h=h=jOLL"5R9R9RM &+ 4 ::>>3R 8 4 3  ()PX\\:KR-POOT0@T_U ll?B7#2')''&6FB#',,{B/,,{B/X\\)U34 Y(9)(DE r3c`tjdxsi}t}d|vr%t|dxsdj }||d<d|vrt |d|d<dD]/}||vst||xsdj }|s+|||<1dD]}||vs||}t |tst|d d fcSg}t}|D][}t |ts|j j}|s5||vs:|j||j|]|||<d |vr|d }t |tstd d fS|jd } |jd} | t | tstd d fS| t | tstd d fSi} t | tr| jD cic]v\} } t| j rXt| j r?t| j j!t| j xc} } | d <t | trit}g}| D]S}t|j j!}|s-||vs2|j||j|U|| d<| |d < t#|tdScc} } w#t$$r}td| dfcYd}~Sd}~wwxYw)z>Save Winston configuration (mailbox, ClickUp key, recipients).Trr8r7rE)r9r:r>r?r;r=r<)r@rA must be a list.rr`rFztag_map must be an object.rYr7Nz!tag_map.custom must be an object.z tag_map.standard must be a list.r; rrY )rrrJr*rrrrrrrErrirrrrBrLr)rrrQr)rrrrBtmrYr7saved_tmrrseen_stdstd_outrtvalrls r1winston_config_postrVbs   4 ( .BD%'H$$'-2.446$'!D"4 ?3 $ $;d3io2&,,.C #  $*$ $;s)Cc4(u,<%=>CCG5D &!!S)GGIOO%$HHQKNN1%  &$HSM$"D )_"d#!=>C C!66*%  j&>!DEsJ J   8T(B!CDcI I fd ##LLN"Aqq6<<>c!fllnA $$&A 6"HX  h %!$H!#G )1v||~++-D0LL&NN4(  ) $+HZ &<x( d )"$ </u56;;CC0c;CHJ  @  # #CS # 9 d 3 @#3C5!9:C? ? @. @#3C5!9:C? ? @s;D:E D="D82D=8D= E$ EE$E$z/winston/email-template/previewcddlm}tjdxsi}|j dxsdj xsd}t |j|}d|vr1t|dxsdj rt|d|d<d |vr1t|d xsdj rt|d |d <|j}|j||\}}t||| S) uRender a subject/body preview from a candidate template + sample data. Never sends mail — renders against sample pipeline data so admins can see the output before saving. rrTrrr7Nrr)rrr) rZrrrrrrrr*sample_email_context render_emailr)rrr rctxrrs r1winston_email_template_previewr !cs.   4 ( .BD 88M " (b / / 1 9TC s&&s+ ,CDSi!6B7==?T)_-Ids4 #4#:;AACtK01K " " $C))#s3GY 7i EEr3z/winston/schedulesc*ttS)Nr)rrrXr3r1winston_schedules_listr9cs 46 77r3ctjdxsi}t|\}}|rt|dfSt }|j |t |t|dfS)NTrrr`r )rrrrrrirrr rrs r1winston_schedules_creater?csh   4 ( .BD/5MHc S!3&&')I XI& H %s **r3z/winston/schedules/c&tjdxsi}t}tfdt |Dd}|t ddfSt |||\}}|rt |dfS|||<t|t | S) NTrc3RK|]\}}|jdk(s| ywr rr,rrsched_ids r1r/z+winston_schedules_update..Qc$NdaaeeDkX6MNr Schedule not found.rrrr`r )rrrrrrrrrrrrr rs` r1winston_schedules_updaterLcs   4 ( .BD')I Ni 2NPT UC {23S88/y~NMHc S!3&&IcNI& H %%r3ct}|Dcgc]}|jd|k7s|}}t|t|k(rtddfSt |tdScc}w)NrrrrTrY )rrrCrrrrrrs r1winston_schedules_deleter\csh()I%Aqt)@AIA 9~Y'23S88I& d  B A+A+z/winston/date-logicc ddlm}t|j|jj Dcgc] \}}||d c}}|j Scc}}w)zGList Date Logic pipelines + the canonical process order and base rules.rrr)r base_rules process_keys)rZrrr BASE_RULESr PROCESS_KEYS)rrrs r1winston_date_logic_listr%gcsP1 %%'9=9N9N9PQAa!,Q&& QsA cddlm}tjdxsi}|j |j d|j dxsdj \}}|rt|d fSt| d fS) NrrTrr9 base_ruler7rr`rr)rZrrrrrrr)rrrrs r1winston_date_logic_creater)scss1   4 ( .BDKK 0488K3H3NB2U2U2WXMHc S!3&& H %s **r3z!/winston/date-logic/cddlm}tjdxsi}d|vr|j dnd}d|vr|j dnd}|j |||\}}|r|dk(rd nd }t | |fSt | S) NrrTrr9process_labels)r9r+zDate Logic not found.rr`rr()rZrrrrrr)rrrr9r+rrrds r1winston_date_logic_updater,~cs1   4 ( .BD%~488F 4D3Ct3KTXX./QUNKK $~KVMHc 66CS!6)) H %%r3cddlm}tfdtD}|j |\}}}|st ||fSt dS)Nrrc3FK|]}|jdk(yw)rNr)r,rrs r1r/z,winston_date_logic_delete..csXQUU9%4XrIrTrY )rZrr2rrr)rr referencedrUrrds` r1winston_date_logic_deleter0csP1X>U>WXXJkk+z:OBV S!6)) d r3z/winston/run-historycLdtdtfd}tjdt}|Dchc]}|d }}|Dcgc] }|| }}t D]'}|j d|vs|j |)|dt}t|Scc}wcc}w)Nrr$ci}|jdr tj|d}|jdxsd}|r3t j |tjjnd}|d||jdxsd|jdxsd|jd xsd t|jd d |jd d|jdd|jdd|jdd|jdd|jdd|jd|jdgdS#tjtf$rYMwxYw)zOTransform bot_diagnostics DB row to the legacy run record shape the UI expects. summary_jsonrqr)rr7r target_datetriggerrdrrEF quotes_founddrafts_createddrafts_skipped drafts_failed pdf_routedpdf_route_failedrquotes)rran_atrr rdrEr6r7r8r9r:r;rr<) rrrrrrr r rrr)rr rgr=s r1_db_run_to_recordz.winston_run_history.._db_run_to_recordcsX 55  **Q~%67%% %*  ( (\5E5E F P P R  D'EE-(.BEE),2eeHo/GKK 59:#KK:%kk*:A>%kk*:A>$[[!<!++lA6 ' ,> BUU7^kk(B/  (()4  sEE;:E;winstonr rr)r _diag_mod list_runsrrrrir)r>db_runsrdb_idsr>old_recs r1winston_run_historyrFcs T d <!!)3KLG& '!ag 'F ',3 4q" 4F 4-.# ;;t F * MM' "#-- .F 6 ""( 4s BB!z/winston/run-nowcdddlmtjdxsi}|j dxsdj }|s#t jjd} t j|dttj}d |vrt|d }n#tt!j d d }fd }t#j$||||fd}|j't|d||dfS#t$rtd d fcYSwxYw)zFKick off the Winston pipeline for a given date in a background thread.rrTrrr7r"Invalid date; expected YYYY-MM-DD.rr`rEFc j|d||j |y#t$r#tjj d|Y=wxYw#j |wxYw)Nr')r5rfrEz*Winston run-now background error run_id=%s)r:ryrmrnr _clear_cancel)ridrdryrs r1_run_bgz winston_run_now.._run_bgcse # GGBsCG @   c " T JJ !Ms S T   c "s!*)AAAAA,r(r8)rfrdrrEr)rZrrrrrrrrrrrr*rWrXrrJrrrq)rr rfrErMrrs @r1winston_run_nowrNcs.   4 ( .BD &B--/H !%%'00<H*5 FDtI'-/33IuEF# vx.IRVWAGGI &7 SUX XX- HABCGGHs+DD/.D/z/winston/stop-runcddlm}tjdxsi}|j dxsdj }|st dd fStj|}|r|j d d k7rt d d fS|j ddk7rt d|j ddfS|j|tj|t d|ddfS)zRequest cooperative cancellation of a running Winston pipeline (DVI-893). The pipeline checks the cancel flag between quote tasks and stops with a 'cancelled' status. Only currently-running Winston runs can be stopped. rrTrrfr7zrun_id requiredrr`botr?r rrdr8zRun is not runningrrdr9r)rUrfrdr) rZrrrrrrrAget_runrequest_cancel force_cancel)rrrfr:s r1winston_stop_runrUcs.   4 ( .BDhhx &B - - /F ./44   F #C #''%.I-_-s22 wwxI%1#''(:KLcQQv 6" d6+ > CCr3c^ddlm}tjddxs |jS)zIEffective mailbox whose Drafts folder Winston shows (sales@icastinc.com).rrr8r7)rZrrJrWINSTON_MAIL_FROM)rs r1_winston_draft_mailboxrXds&* ! # ' ' < U@U@UUr3z/winston/draftscddlm}t}|j}|st ddfS|j ||d}|t dd fSg}|D]}g}|j d xsgD]}|j d r|j|j d d |j dd|j dd |j dd|j dd dk(xs/|j dd jjdd|j|j d d |j dd xsd|j dd |j dxsgDcgc]$}|j dij dd &c}|j dd |j dd t|j d|dt ||Scc}w) aList messages in the Winston mailbox's Drafts folder (DVI-848). Returns lightweight message records for the Drafts tab. Attachment metadata (id/name/contentType/size) is expanded so the UI can offer inline PDF viewing without a second round-trip per message. rrzEMicrosoft Graph is not configured. Set Azure credentials in Settings.rrd)mailboxtopz'Could not load Drafts from the mailbox.rU rS isInlinerr7r9rrrdrr)rr9r5rdis_pdfr (no subject) bodyPreviewrrrrcreatedDateTimehasAttachments)rrrL rX modified_atrhas_attachmentsrS )r[r= ) rZrrXrrmail_list_draftsrrirEr|r) rr[rDmessagesr= rattsrrs r1winston_draftsrh ds+$&G  # # %E degjjj##E7#DHFGLLG  %% &," AuuZ  KKeeD"ofl3 !mR 8fa(5537HHHUU62.446??G    %%b/uuY+=~uu]B/UU>28b;55,00B?;55!7<%% 126#AEE*:$;<   0 7G 44;s?)G=z8/winston/drafts//attachments/cddlm}t}|j}|st ddfS|j ||||}|t ddfS|\}}}t tj||xsd d | S) zAStream a Drafts-folder attachment inline (PDF viewing) (DVI-848).rrrrrZ)r[z0Attachment not found or could not be downloaded.rrFr ) rZrrXrrmail_get_attachmentrr>rJ) message_id attachment_idrr[rDr>rr5r9s r1winston_draft_attachmentrm8ds+$&G  # # %E ABCGG  $ $UJ w $ WF ~OPRUUU"(G\4  7;!;  r3imiPctjttd}tj|_|j d|jd|S)zEOpen history.db, creating the schema on first use. Caller must close.FrDrFaZ CREATE TABLE IF NOT EXISTS tool_history ( id INTEGER PRIMARY KEY AUTOINCREMENT, tool TEXT NOT NULL, action TEXT NOT NULL, actor TEXT, summary TEXT, ref TEXT, detail TEXT, created_at TEXT NOT NULL ); CREATE INDEX IF NOT EXISTS idx_hist_tool_time ON tool_history (tool, created_at DESC); CREATE TABLE IF NOT EXISTS tool_history_quarantine ( id INTEGER PRIMARY KEY AUTOINCREMENT, orig_id INTEGER, tool TEXT, action TEXT, actor TEXT, summary TEXT, ref TEXT, detail TEXT, created_at TEXT, quarantined_at TEXT NOT NULL, quarantine_reason TEXT, quarantine_key TEXT ); CREATE INDEX IF NOT EXISTS idx_hist_quar_key ON tool_history_quarantine (quarantine_key); )rGrHr*HISTORY_DB_PATHrJrKrLrMrNs r1rrUdsJ ??3/5 ID{{DLL*+ < Kr3c6tjdixsi}|jdt}|jdt}t |t r|dkDr|nd}t |t r|dkDr|nd}||t |jddfS)avEffective retention/archival config (DVI-1045). Returns ``(retention_days, max_rows_per_tool, archive)``. A non-positive or missing day/row value means "unlimited" for that dimension (``None``). Falls back to the module defaults when nothing is saved. ``archive`` defaults True so pruned rows are rotated to compressed archives, never silently deleted. retentionretention_daysmax_rows_per_toolrNarchiveT)_load_history_settingsr_HISTORY_RETENTION_DAYS_HISTORY_MAX_ROWS_PER_TOOLrrr)rrcaps r1_history_retention_cfgry{ds  $$["5;A 55!#: ;D %%#%? @CdC(TAX44DC%#'#tC d155D12 22r3c|syddl}ddl}tjddt j j d}td|dz }|j|dd 5}|D]F}|j|j|d |d |d |d|d|d|d|dddzH dddy#1swYyxYw)a?Append pruned tool_history rows to a monthly gzipped JSON-lines archive. Concatenated gzip members are valid gzip, so ``gzip.open(..., 'at')`` safely appends across prune runs; readers streaming the whole file get every row. Called before the DELETE so a write failure aborts the prune (no data loss). NrTrMz%Y-%m tool_history_z .jsonl.gzatrrrrrr r rr r)rrrr r rr rr0) gziprHISTORY_ARCHIVE_DIRrrrrr?rr)rn_gzip_jsonmonthrbrrs r1_archive_history_rowsrds dT:  ! ! # , ,W 5E =y!A AD D$ 1R A HHU[[gqyAhK7) QuXH+Q|_"   s 'A B==Cc N d} t\}}}||yt tgc  fd}|=tjt |z j d}||dz|f|D jdjDcgc]}|d }}|D]}||d z||fs jy|r tt } tdt| d D];} | | | d z} jd d jd t| zd| = j jycc}w# jwxYw#t $r"t"j$j'dYywxYw)aArchive + remove rows older than the retention window or beyond the per-tool cap (DVI-789 / DVI-1045). Rows selected for pruning are first rotated into a gzipped JSON-lines archive (unless archiving is disabled) and only then deleted, so history is retained off the live DB instead of silently discarded. Retention is admin-configurable via ``history_settings.json``; both dimensions may be set to unlimited. zRSELECT id, tool, action, actor, summary, ref, detail, created_at FROM tool_historyNcj||jD]/}|dvs j|dj|1yNr)rLrrri)sqlrrrO doomed_ids doomed_rowss r1_collectz#_prune_history_db.._collectdsPc62;;=.Awj0"qw/#**1-.r3rrz WHERE created_at < ?z&SELECT DISTINCT tool FROM tool_historyrz: WHERE tool = ? ORDER BY created_at DESC LIMIT -1 OFFSET ?rz&DELETE FROM tool_history WHERE id IN (rr]r7zhistory prune error)ryrrrrrrrLrr[rrrrCrrZryrmrnr)_SELrrxrtrr rr rr| rrrOrrs @@@r1_prune_history_dbrds !D0435c7 ??r3r c |dk(r!t|r|xsijdsy ddl}t} t j j d}||j|nd} |jd||||xsd|xsd| |f|j|jy#|jwxYw#t$rYywxYw)z8Insert one history event. Fire-and-forget; never raises.rr NrrzmINSERT INTO tool_history (tool, action, actor, summary, ref, detail, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)r7) rrrrrrrrrLrZr[ry) rrr r rr rrOr detail_strs r1r r ds  0 5\r&&'78 } '..099:NOJ060BV,J LL0vugmSYB JW  KKM JJLDJJL    s)CA)B1 C1CC CCcddittddd}tjr t j tj }t|trt|jdtr4|djD]\}}t|ts||d|< t|jdtr_|d}dD]+}||vs||t||ts!|||d|<-t|jdtr |d|dd<|S|S#tjtf$rY|SwxYw) zReturn {capture: {tool: bool}, retention: {...}} settings. Capture defaults all-on; retention defaults to the module constants with archiving enabled (DVI-1045). rAT)rrrsrt)capturerqrrqrrrsrt)rvrwHISTORY_SETTINGS_FILErrrrrrrrrrrr)rrrrrets r1ruruesVT?5!; H$$& JJ4>>@AE%&eii 2D9 %i 0 6 6 871%a.56HY/27eii 4d; ,CD>8Q:c!fc;R7:1vH[1!4>"#'')"4d;;>y>-i8 O8O$$g.   O s$A?D6*7D6"D6;7D66EEc t\}}}|||ddddgddgd }dD]S}ttt|z}|j s/|dxx|j j z cc<U t} |jdjd|d<|jdj}|d |d c|d <|d <|jd jDcgc]}|d|d|d |d dc}|d<|j t j#ryt%t j'd} t)| |d<t+d| D|d<| D cgc])} | j,| j j d+c} |d<|Scc}w#|jwxYw#t$r"tjjdYwxYwcc} w)zISize/age telemetry for history.db and its compressed archives (DVI-1045).rN) rrrsrtdb_bytes total_rowsoldestnewestper_tool archive_files archive_bytesarchives)r7z-walz-shmrz!SELECT COUNT(*) FROM tool_historyrz?SELECT MIN(created_at) mn, MAX(created_at) mx FROM tool_historymnmxrrzoSELECT tool, COUNT(*) n, MIN(created_at) mn, MAX(created_at) mx FROM tool_history GROUP BY tool ORDER BY n DESCrr)rrnrrrzhistory telemetry errorztool_history_*.jsonl.gzrc3PK|]}|jj ywrT)rr&rs r1r/z%_history_telemetry..^es"C1668#3#3"Cs$&r)r9bytesr)ryrr*rorrr&rrLrurr[ryrmrnrr~rrrrCsumr9) rrxrtrr!rrOrrrrs r1_history_telemetryr9es/1D#wSWQ$$QB C '0 _%. / 99;  Oqvvx// /O08}  $ 3!hj!C ,,Qhj ,/t9c$i (CM3x=G(* 6AcFT7ag7C O JJL!!#*//0IJK"5zO""CU"CCOAF <=QVVaffh&6&6 7 J J' JJL 8 678  sC6 GA6F<7F7F<G.G?7F<<GG(G<;G<c<tdj|dS)zBTrue when history capture is enabled for this tool (default True).rT)rur)rs r1r r ees ! #I . 2 24 >>r3cZgg}}|r&|jd|jd|d|r&|jd|jd|d|rddj|znd}t} |jd|z|j d}|jd |zd z|||gzj } |j g} | D]} | d xsd} tj| | xsd } | d xs | dxsd}| d| dxs| d}|r|d|z }| j| dd| xsd| dxsd|| dxsd| dr0tjt| djdnddd| |fS#|j wxYw)z6Adapt print_jobs into the generic history entry shape.LOWER(j.created_by) LIKE ?%zLOWER(j.source) LIKE ? WHERE  AND r7&SELECT COUNT(*) AS n FROM print_jobs jraSELECT j.id, j.created_by, j.source, j.file_ref, j.published_name, j.kind, j.copies, j.created_at, a.hostname AS machine_name, c.acked_status FROM print_jobs j JOIN print_commands c ON c.id = j.id LEFT JOIN print_agents a ON a.machine_id = j.machine_id, ORDER BY j.created_at DESC LIMIT ? OFFSET ?r r rN machine_namer file_refrrlrAr rrNrrrr r rrr ) rirrSrLrurr[_PRINT_SOURCE_LABELSrrrr r)r rf_userf_actionwhererclauserOr@ rnrrr$rprinterr s r1_print_history_as_genericrmes6E  12 &m$ -. (1o&27i',,u--RF ;D 4v =v (*S|| G   = = eV_ $   (*  G  kR$((clU;$%@>):@bG5:!9!D' :;  wi( (GD'nW|_*Z=&B12,)99a o&h+,R   & E>- s 8AFF*zEmailed (internal)zTest run (no email)Dry runzNo email (notifications off)zNo email (no recipients)zNo email (attachment too large)zEmail send failedzExternal held for approvalz,Emailed internal; external held for approvalu(External held — no approver configuredu:Emailed internal; external held — no approver configured) sentmanual_no_emailrEskipped_notify_offskipped_no_recipientsskipped_oversized send_failedpending_approvalzsent+pending_approvalpending_approval_no_approverz!sent+pending_approval_no_approverctj}t|dd}fd}|Dcgc] }||s |}}t|}||||z} g} | D]}|j dd} |j dxsg} |j dxsg} d}|j d s|j d r'|j d d d |j d d }|j d xsdg}|r|j ||j |j dddt j | | xsd}dj|d|z}| j |j dxs|j dxsdd|j dxsd|j dxsd||j dxsd|j dxsd|j d| | | |j d|j dd|j dd|j dddd| |fScc}w)aoAdapt scada_report_log.json run records into the generic history entry shape (DVI-1164 D4). Read-only: the standalone scheduler owns the log; the Auditor sub-tab and CSV export never write history.db for these. ``f_user`` filters on the run source (schedule/manual) or schedule name; ``f_q`` filters on the schedule name, report file, or status. c&|jddSN recorded_atr7rrx s r1r z5_scada_reporting_history_as_generic..eAEE-$<r3Tr cr:|jddd|jddj}|vryrM|jddd|jddd|jddj}|vryy) Nr r7r\ schedule_nameF report_file email_statusTr< )r~hayf_qrs r1_matchz3_scada_reporting_history_as_generic.._matches WWXb)*!CGGOB,G+HIOOQCS  ggob12!CGGM"4M3NaggnR01349EG #~r3rr7 recipientsexternal_recipients date_fromdate_tor]u – rz(unnamed schedule) row_countrz rowsr r r rrscada-reportingr r schedule_id approval_idrun_date)rrrrrrr rr)scada_report_scheduler load_run_logrrCrri!_SCADA_REPORT_EMAIL_STATUS_LABELSr)r rrrrkrrfilteredr@ rOrrdrecipsrrngr0 rr s `` r1#_scada_reporting_history_as_genericres9 ! - - /C  *DG  ~r*|$*ee)*0b 55 y!1UU;s+,E!%% #2F1GHC'?+?@  LL  k1-.e45155ffoN++e$ug6%% &D!%% *>D"%eeHo3UU8_*55'-2%% .4" uu]3 &$'* uu]3 uu]B7%%"-EE*b1    @ E>K-s II) asset_added asset_edited asset_viewedassets_imported assets_syncedassets_sync_settingsasset_model_addedasset_model_editedasset_model_deletedsub_assembly_addedsub_assembly_editedsub_assembly_deleted part_added part_edited part_deletedpart_stock_adjusted part_linked part_unlinkedr parts_notify_config_savedc0ddjdttzzg}tt}|r&|j d|j d|d|r&|j d|j d|d|r |j d|d|dd|dgz }dd j|z}t } |j d |z|jd } |j d |zd z|||gzj} |jddl } | D cgc]D} | dd| d| dxsd| dxsd| dxsd| d| dr| j| dnddF} } | | fS#|jwxYwcc} w)zFiltered adapter over history.db for the Assets sub-tab: matches the asset_* action set across every tool key. Same generic entry shape as the history.db path in history_tool, so the frontend renders it unchanged.action IN (%s)rr] LOWER(COALESCE(actor,'')) LIKE ?r!LOWER(COALESCE(action,'')) LIKE ?F(LOWER(COALESCE(summary,'')) LIKE ? OR LOWER(COALESCE(ref,'')) LIKE ?)rr&SELECT COUNT(*) AS n FROM tool_historyrLSELECT id, action, actor, summary, ref, created_at, detail FROM tool_history* ORDER BY created_at DESC LIMIT ? OFFSET ?rNrrrr r7r rrr r) rrC_ASSET_HISTORY_ACTIONSrrirrLrurr[rr)r rrrrrrrrOr@ rnrrrs r1_assets_history_as_genericrfss3I/J)J K K LE ( )F  78 &m$ 89 (1o&  ]^Qse1:3%qz** e, ,F =D  4v =v (*S|| !#) * 8 9 eV_ $  (*     gx1X;7!ra l.@bx~2Q|_./k%++ak*t G E> sAE>/A F>F)dashboard_source_addeddashboard_source_value_setdashboard_source_renameddashboard_source_editeddashboard_source_deleteddashboard_sources_savedc ddjdttzzg}tt}|r&|j d|j d|d|r&|j d|j d|d|r |j d|d|dd|dgz }dd j|z}t } |j d |z|jd } |j d |zd z|||gzj} |jddl } g} | D]x} | dr| j| dnd}| dxsd}|st|trt| d|}| j | dd| d| dxsd|| dxsd| d|dz| | fS#|jwxYw)zFiltered adapter over history.db for the Data sources sub-tab: matches the dashboard_source_* action set across every tool key. Same generic entry shape as the history.db path in history_tool, so the frontend renders it unchanged.rrr]rrrrrrrrrrrNr r r7rr datasourcesr rrr)rrC_DATASOURCE_HISTORY_ACTIONSrrirrLrurr[rrrr_datasource_history_summary)r rrrrrrrrOr@ rnrrrr r s r1_datasources_history_as_genericr8fs c-..!00 1E - .F  78 &m$ 89 (1o&  ]^Qse1:3%qz** e, ,F =D  4v =v (*S|| !#) * 8 9 eV_ $  (*  G   -.x[Qx[)dI,$":fd31!H+vFGD'=AhKwZ%2'U8>r<      E>! s AF..Gc|jdxs|jdxsd}|jdxsd}ddddj||}|d k(r>d |xsd d |d }|dk(r*|jddvr|d|jdz }|S|dk(rd|d|jddS|dk(r)d|jddd|jddd S|dk(rUdjt|jdxsij}d|xsd d |d |rd|dzSdzS|d k(r d!|xsd d |d S|d"k(rd#|jd$d%dS|xs|S)&z  ))V'x(4& 2 H G!4J!F 3vzz'*+, ,A --tfDGR!8 9:: ++6::fb12'&**T2:N9OqQQ **66::i#8#>B"D"D"FGH+8,BtfA6FBvha.[[XZ[[ ++&,H-RvQ77 **%fjj!&<%=Q?? >6r3z/history/c tttjj ddd}t ttjj ddd}tjj d d jj}tjj d d jj}tjj d d jj}|d k(r$t||||xs|\}}t||||S|dk(r$t||||xs|\}}t||||S|dk(r!t|||||\}}t||||S|dk(r!t|||||\}}t||||Sdg|g} }|r&|jd| jd|d|r&|jd| jd|d|r |jd| d|dd|dgz } ddj!|z} t#} | j%d| z| j'd}| j%d| zdz| ||gzj)} | j+ddl} g}| D]V}|j|d|d|d |d xsd |d!xsd |d"xsd |d#|d$r| j/|d$ndd%Xt||||S#t tf$rtddfcYSwxYw#| j+wxYw)&zGeneric history endpoint. Print is served by an adapter; others from history.db. Query params: limit, offset, user (actor substring), action (action substring), q. r rdrrrInvalid limit or offset.rr`r'r7rr rArr@ rr rrrtool = ?rrrrrrrrzRSELECT id, tool, action, actor, summary, ref, created_at, detail FROM tool_historyrNrrr r rrr r)rLrrrhrrCrrrrrErrrrrirrrLrurr[rr)rr rrrrrr@ rrrrOrnrrs r1 history_toolrfsk>C ((#67=S))(A67;\\  fb ) / / 1 7 7 9F||"-335;;=H ,,  3 # ) ) + 1 1 3C w25&&(/VYZweF%PP   < 668?s4weF%PP x3 668S2weF%PP }8 668S2weF%PP L4&6E  78 &m$ 89 (1o&  ]^Qse1:3%qz** e, ,F =D  4v =v (*S|| !#) * 8 9 eV_ $  (*  G   D'fIkwZ%2|)rU8>rL/23H+ekk!H+.4     7%e LLE z ">78#==>f sA&L"AM"MMMc P|xsdj}|rd|vsd|vryt|}i}|r$ tj|j }|jd}t|ts2tjd|}|rt|jd}|g}t|tr|jd|d t} d jd t!|z}|j#d |zd z|j%} |j'ddl} g} | D]R} | j| d| d| dxsd| dxsd| dxsd| d| dr| j| dnddTt)|} | r t+| nd}|jdxsd}|jdxsd}d}| r.| j,| j.dzz }|j1r|}t3|xs|xsijd}|rt5||xsd|n|}|t|trd|d n|||| ||t7|t3| || |d }|dfS#tj t f$ri}YrL/23H+ekk!H+.4    !*H-5)4H ((6  "dC-(0DJL(--*"<= <<>L|A ry'ABKMQ x)B]D IW_E,6vs,CtF3<( !$'8n"$ G D=$$g. D , s#I1AJ1JJJ%z/history/wor/rct|\}}|rt|dfS|jDcic] \}}|dvr||}}}tdi|Scc}}w)z=Aggregate the full audit trail for one Work Order (DVI-1040).rr`)rr rX)rrr)rrrrrpublics r1history_wor_detailr+gsk&c*LGS S!3&&&}}8tq!66d8F8  V 8sAz/auditor/searchc 2 ddl}tjjdxsdj }t |dkrt ddfSttttjjd d xsd d d }d |jd }ggggf\}}}} t} |jd||||fj} |j i} | D]<} d} | dr |j!| d} | ddk(rd} t'| t(r| jdr| d} n'| dr"t+| dj-ds| d} | s{| j| }|[t/j0d| }|rdt|j3d dn| }| || d| dxsd| dxsd| dddx}| | <|dxxd z cc<t ||ks|j5| d| d| dxsd| dxsd| dxsd| dd?t7| j9d|} t;j<} |jd||||||fj}|j |D]} d}| d rQ |j!| d }t'|t(r,d!Dcgc]}||vr |d"||}}d#j?|}|j5| d$| d%| d&xsd| d'xsd| d(xsd| d)|xs | d*xsdd+ tA}tC} |jd,j}|j|j}|D]} | d-}|j|xsd}| d.xsdd/|d/|j}||vsA|j5||xs | d.xs|| d.xsd| d(xsd| d0d1t ||k\snt |t |t |t |d2}t ||tE|j9||||3S#|jwxYw#t$rg} YwxYw#t"t$f$rd} YwxYw#|jwxYw#t$rg}Y4wxYwcc}w#t"t$f$rd}YwxYw#|jwxYw#t$rYwxYw)4ucUnified cross-tool audit search by reference (DVI-1043). A single query string is matched against the three audit stores and the hits are returned grouped by source so the Auditor UI can deep-link each one into its existing per-tool view: * ``wor`` — Work Order lifecycle events in ``history.db`` (grouped per WO, links to the WO audit-trail popup). * ``history`` — every other tool's ``tool_history`` rows (links to that tool's History sub-tab). * ``bot`` — bot pipeline runs in ``bot_diagnostics.db`` (links to the Diagnosis → Bots run view). * ``vision`` — Vision agents matched by machine/friendly name (links to the Diagnosis → Vision agent view). Typical refs: a WO number (``47260``), a machine name, or a quote number. rNr r7rz&Enter at least 2 characters to search.rr`r rM r^rdraSELECT id, tool, action, actor, summary, ref, detail, created_at FROM tool_history WHERE LOWER(COALESCE(ref,'')) LIKE ? OR LOWER(COALESCE(summary,'')) LIKE ? OR LOWER(COALESCE(detail,'')) LIKE ? OR LOWER(COALESCE(actor,'')) LIKE ? ORDER BY created_at DESC, id DESC LIMIT 2000r rrrrr rrrrr r r)rr latest_actionlatest_summary latest_actorrr:r:)rrr r rra@SELECT id, bot, trigger, target_date, started_at, status, summary_json, error FROM runs WHERE LOWER(COALESCE(summary_json,'')) LIKE ? OR LOWER(COALESCE(error,'')) LIKE ? OR LOWER(COALESCE(trigger,'')) LIKE ? OR LOWER(COALESCE(target_date,'')) LIKE ? OR LOWER(id) LIKE ? ORDER BY started_at DESC LIMIT ?r3)r6r7r:rrrPrr5r4rdrqr)rPrfr5r4rdrqr z_SELECT machine_id, hostname, last_seen_at, status FROM vision_agents ORDER BY last_seen_at DESC machine_idr!r\ last_seen_at)r!r9r!rdr")worrrPr)r countsr@ r#rrPr)#rrrhrrrCrrLrCrrErrLrr[ryrrrrrr*rwrFrrbrirrrA_open_dbr_load_vision_agent_names _vision_dbr)rr rxlikewor_hits history_hitsbot_hits vision_hitsrOrn wor_groupsrr rrrr browssummsjrr0 r.arowsr# midfriendlyrr$s r1auditor_searchr47gs(   #  $"++-A 1vzEFKK c#gll&&w39r:A> DC qwwyk D46BN1HlHk} <<tT4( hj  JJLJ & X; Qx[1 V9 #E&$'FJJz,Bz*5#ah-":":5"A%u%AyIIne4;r"#L/ %?&NJ%%'(#.H!!# LL4tT4s3 hj  JJL  ^  [[>!23b$'M) !R!"s!BqE7^)E) 99U+D U8g|)r]+1rk'RL/1' 0b   . (*| LLAhj  JJL WWY AL/Cyy~+Hz](b)8*AcU;AACCSy"""%$<* < !* 3k/R$%n$5 ${#s* $8}|$8}k" F  &--/"   w JJL  *  j JJL ) *  , JJL    s3 R>$Q2"RRS)&R1S-(SS*ST S56A"T AT T 2RR RRR.-R.1SS SSSS21S25TT TTctjttd}tj|_|j d|jd|S)zGOpen diag_timeline.db, creating the schema on first use. Caller closes.FrDrFuN CREATE TABLE IF NOT EXISTS diag_events ( source_key TEXT PRIMARY KEY, -- ":" — idempotent upsert key source TEXT NOT NULL, -- 'bot' | 'vision' tool TEXT NOT NULL, -- bot name / 'vision' event_type TEXT NOT NULL, -- 'run.' | 'agent.event' | 'recovery' ts REAL NOT NULL, -- epoch seconds status TEXT, -- raw source status (normalized to a badge on read) actor TEXT, ref TEXT, -- machine name / target date / WO ref, for search title TEXT, -- one-line human summary detail TEXT, -- JSON blob link_kind TEXT, -- 'bot' | 'vision' — how the UI deep-links link_id TEXT -- run id / machine id ); CREATE INDEX IF NOT EXISTS idx_diag_events_ts ON diag_events (ts DESC); CREATE INDEX IF NOT EXISTS idx_diag_events_source_ts ON diag_events (source, ts DESC); )rGrHr*DIAG_TIMELINE_DB_PATHrJrKrLrMrNs r1_diag_timeline_dbr7hsK ??345 OD{{DLL*+ $ Kr3c|xsdjdvrydvrytfddDryd k(ry d k(ry y ) z.#hs Ka16 Kr)rfailcrashr7deniedrr8rrl)rEr2)rdrs @r1 _diag_badger@hs[ 2A .. 22 KJ KKI~K r3cjddl}g} tj} |jdj }|j  |D]%}|dxs |dxsd}g}|drt |j|d}t|trOt|ddD]>}||} t| ttttfs)|j|d| @d j%|xs|d xs |d xsd } |jd |dd|dxsdd|dxsdt|xsd|dxsd|d xsd|dxsd| |d r|j'd |d indd|df (|S#|j wxYw#t $r|cYSwxYw#t t"f$rYwxYw)uJAdapter: bot pipeline runs (bot_diagnostics.db) → normalized event rows.rNzSELECT id, bot, trigger, target_date, started_at, finished_at, status, summary_json, error FROM runs ORDER BY started_at DESC LIMIT 1000rqrrr3rrrrr5r:zbot:rrPzrun.rdr2r7r4)rrAr%rLrr[ryrrrrr*rr rrirrrr) rrrOrnrr_bitsr0rrres r1_diag_ingest_botrC,hs C !!# <<Ahj  JJL  |_ 5- 0 5A ^  [[>!23b$'!"Xbq\4qE%a#sE4)@A KK1#Qqc 34  $HAgJ$G!I,$G% 1T7) eQuX%61X;+), -uRW1~ hK 2q|1r1]3C3Ir 23G*EKK!G*- .$ 1T7    , J3 JJL   *  s@FE:F+AF F :F  F FF F21F2cddl}g} t} t} |j dj }|D]}|d}|j |xs|}|dxs |dxsd}|dxsddd xsd} |jd |d d d d t|xsddd||dxsd| r|jd| indd |f  |j dj } | D]}|d}|j |xs|}|dxsd} |dxsd} |jd|d d d dt|dxsd| |dxsd|d| d| dj|j|d|ddd |f  |j|S#t$ri}YwxYw#t$r|cYSwxYw#t$rg}YwxYw#t$rg} YwxYw#|jwxYw)zGAdapter: Vision agent error events + auto-recovery actions (vision.db).rNzwSELECT id, machine_id, signature, detail, ts, received_at FROM vision_agent_events ORDER BY received_at DESC LIMIT 1000r!r_ received_atr r7rz vision-ev:rrz agent.eventr signaturez agent eventz{SELECT id, ts, machine_id, signature, action, actor, outcome, detail FROM vision_recovery_audit ORDER BY ts DESC LIMIT 1000routcomez vision-rec:recoveryr z auto-recoveryzAuto-recovery: r:r7)rFr ) rr&ryr'rLrrrir rrr[) rrr.rOerowsrr2r9r_detrrowsrrGs r1_diag_ingest_visionrLUhsb C(*|( LLQhj   AL/C99S>(SD41Am,1BX;$"ds+3tC JJQtWI&(MbgAT+/-03 XsO,#    LLJhj   AL/C99S>(SDx[&BF l(bG JJagY'8Zagl#Waj.KOT"6("WIQ7>>@ !K.AhKPQ#    J_    E & E  sp F F*F;B G G +BG F'&F'* F87F8; G G G  G GGGGG0cg}tD]} |j|t} |5|jd|jd|ddd|jtja t|S#t$r-tjj d|j YwxYw#1swYqxYw#|jwxYw)zBackfill/refresh the unified store by running every ingestion adapter and fully replacing `diag_events` in one transaction (idempotent).zdiag timeline adapter %s failedzDELETE FROM diag_eventszINSERT OR REPLACE INTO diag_events (source_key, source, tool, event_type, ts, status, actor, ref, title, detail, link_kind, link_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)N)_DIAG_ADAPTERSrryrmrnrrr7rL executemanyr[rU_diag_timeline_built_atrC)rnadapterrOs r1_diag_timeline_rebuildrRhs D!V V KK "V  D    LL2 3   ?    "iik t9! V JJ !BGDTDT U V   s3B C$CC 3CCC CC$ct5|s"tjtz tkDr t cdddSdddy#t $r"t jjdY3wxYw#1swYyxYw)zuRebuild if forced or the cache is older than the TTL. Serialized so concurrent requests don't stampede a rebuild.Nzdiag timeline rebuild failed) _diag_timeline_lockrUrP_DIAG_TIMELINE_TTLrRryrmrnrrs r1_diag_timeline_maybe_rebuildrVhsy E TYY[#::>PP E-/EEE  E $$%CD E E s(%A7 A  (A41A73A44A77Bz/auditor/diagnostics/timelinercddl}ttjj ddk(tjj dxsdj j }tjj dxsdj j }tjj d xsdj j }ttttjj d d xsd d d }d}gg}}|dvr"|jd|j||r,d|d}|jd|j|gdz|r|ddj|zz }|dz }t} | j||j} | j!gddd} } | D]} t#| d }|r||k7rt%| |k\rn| j | ddd z| | d<d}| dr |j'| d}| j| d| d| d| d| d xsd|| dxsd| dxsd| dxsd|| dxsd| dxsdd t-| | t%| t.!S#| j!wxYw#t(t*f$rd}YwxYw)"aUnified cross-tool diagnostics timeline (DVI-1047). Serves the merged, time-ordered event stream from the `diag_events` cache (lazily rebuilt when stale, or forced with ``?refresh=1``). Supports free-text search (``q``) across title/ref/actor/tool/detail, a ``source`` filter (bot/vision) applied in SQL, and a normalized ``status`` badge filter applied after mapping raw statuses. rNrefreshrErr r7r rdr rKr^rs zkSELECT source, tool, event_type, ts, status, actor, ref, title, detail, link_kind, link_id FROM diag_events)rPrz source = ?rz(LOWER(COALESCE(title,'')) LIKE ? OR LOWER(COALESCE(ref,'')) LIKE ? OR LOWER(COALESCE(actor,'')) LIKE ? OR LOWER(COALESCE(tool,'')) LIKE ? OR LOWER(COALESCE(detail,'')) LIKE ?)rrrz ORDER BY ts DESC LIMIT 2000r r event_typer_r rre link_kindlink_id) r rrYr_rdbadger rrer rZr[)r:r$r@ built_at)rrVrrhrrrErLrCrrirrr7rLrr[r@rCrrrrrP)rr r rdrxrrrr(rOrnr:r$rr\rJs r1auditor_diag_timeliner^hs  (8(8(Cs(JL   #  $"++-335Allx(.B 5 5 7 = = ?Fllx(.B 5 5 7 = = ?F c#gll&&w4; ?  tfqj!  y7<<... ))C  D||C(113 a0FF  AhK( evo  v;#  $jj8a81<q{ X; kk!H+.  kfIL/D'k'RwZ%2U8>rwZ%2;-2|)r   6 &s6{3 55=  *  s2 K:KKK)(K)ReopenedAccepted Completed Cancelledrp Preventative)rrrrrs rt c|jdxsi}|jd}|dk(ry|dk(r%tj|jddS|dk(r|jd rd Sd S|d k(ry |dk(ry|xsdS)Nr rrCreatedrX rW zStatus changedr r zRtS approved (finalized)z RtS approvedr~ z RtS rejectedr EditedEvent)r_WOR_STATUS_LABELS)r-rnrs r1_wor_event_labelriis xBA VVH F  !!!%%aeeL&9;KLL -.UU>-B)VV    Wr3ct|tr|syg}|jD]$\}}|ddgifvr|j|d|&dj |S)z "//T :CCDXY  !%%"%quu^R'@ EE*b !1552#6lA8N EE/ "AEE-$8 EE$a (!%%0A1*E EE(B 155r+B!C EE'2       ! ! # , ,X 6E 4UG4@&) TTr3z/winston/run-history/export.csvct}t|dr$|jxsijdgng}gd}|Dcgc]}|jdd|jdd|jdd|jdd|jd rd nd |jd d |jdd |jdd |jdd |jdd |jdd |jdxsdg }}t j j d}td|d||Scc}w)uBExport the Auditor History → Bots (Winston runs) sub-tab as CSV.rr= ) zRan atz Target datez Triggered byrrz Quotes foundzDrafts createdzDrafts skippedz Drafts failedz PDF routedzPDF route failedr] r=r7rr rdrErfr r6rr7r8r9r:r;rrOhistory_bots_winston_r)rFrrrrrrrq)rr= ry rr}r~s r1winston_run_history_export_csvrisA  DRPR I  ! ! # , ,X 6E 25'> RRsCEz/history/wor//export.csvc t|\}}|rt|dfSgd}|jdgDcgc]k}|jddt||jdd|jdd|jd dt |jd gm}}t |jd xs|d d }t d|d||Scc}w)zBExport one Work Order's recorded event timeline as CSV (DVI-1044).rr`)rK rgrwr^rxrzr:rr7rr r r r r work_orderaudit_r)rrrrirlrtrq)rrrry r-r}r9s r1history_wor_export_csvris&c*LGS S!3&& FF Hb)+  |R "22"6x8L wRVVIr2OBFF8DT4U+I+ gkk*-D1Dl SD VD6. BB +sA0Cz/history/wor//export.pdfc l !"#$t|\}}|rt|dfSdd}tddd!!jd d !j !j d z "d #d$d  !"#$fd}!"fd}!j ddd!jdddd!j ddd!jdddd!j ddd!jddd!jdd |d!d"tjjd#zd$td%jd&dxsd'zd!j !jd(|d)|d*|jd+|d,|jd-|d.tj|jd/|jd/xsd0|jd1}|jd2xsi}|s$|jd3s|jd4r|}|r|jd3s|jd4r|d5|d6|jd3|d7|jd4|jd8xsd}||jd9} |s| r[!j dd:d;!jddd!j"d || rd<| zndd!j |r|jd=sgr|d>|jd?xsi} d@dAdBdC} !j ddd!j"d dD| j|jdE|jdExsd0zdt D]} | |jd=xsgvr| j| xsi} | jdF}|dGk(rdAn|dHk(rdBndI}| jdJxs| jdKxsd}|| jdL} !j ddd;!jddMt"j| | !j ddd;|}|r|d<|z }| r|d<| z }!j%"dz dM|| jdNs)!j dd:d;!j'!j(dz!j%"dz d |dHk(rdOndP| dNz|jdQrh!j ddd;!jddRd!j"dMdS||jdQzd!j |dT|jdUxsg}|s0!j ddd!j"dMdVdn |D]}!j ddd;!j"dWzd t+|!j ddd;!j"dXzd ||jdYdZd[|jd\xsd0}t-|jd]}|r|d<|zz }!j ddd;!jddd!j%"d^|!j !jdt/!j1}t2j4jd_d`v}g}|sJ|jdar|j7|da|jdbr|j7|db|}|r ddclm}|}|j7t=j>||D]} |j7tA|t=j>}|jE||jG}tI|jd!xs|d-dd}tKt=j>|ded df|dghS#tB$rYwxYw#tB$r|}YdwxYw)iajPrintable PDF audit packet for one Work Order (DVI-1044). Renders a summary page (metadata + completion details + Return-to-Service sign-offs + event timeline) then, where the source PDFs exist, appends the WO Request PDF and the EVH form PDF so the packet is a self-contained compliance record. ``?summary_only=1`` skips the appended PDFs. rr`ct|xsd}dD]\}}|j||}|jddjdSrb rh ri s r1rl z#history_wor_export_pdf.._l1isT RL8 %IC #t$A %xx 9-44Y??r3c|sy tjt|jddj dS#t t f$rt|cYSwxYw)Nr7rr%Y-%m-%d %H:%M)rrr*rrrr)r_s r1_fmt_tsz'history_wor_export_pdf.._fmt_tsis[ !//BX.0089I0J KI& r7N s.section_headerism q D!E" [#r* Qs5z);E"r3cjdddjd|jdjdddjd|xsdjd y) Nr r rrr7ryr rc r^)r r r r )rrrl r6r s r1r z%history_wor_export_pdf..fieldisf [#q) QE # q  ["a( r3ELS 12 q r3r r #rr rr r> zWork Order Audit Packetr^r7ryr rr z - generated %Y-%m-%d %H:%M UTCz by r'rr rrn TitlereFilerTyperrc rj rrq rr zCompletion Detailsrp zOutstanding Follow-uprg rh r rz - rkzReturn-to-Service Sign-offsrzAwaiting approvalApprovedRejected)r rr| z Overall: rdrrrz Pendingru rrv r rmrw zNote: rrzReleased to production - zEvent Timeline (recorded)r:z'No recorded events for this work order.gffffff?g333333?rr4 )r6 r r r r summary_onlyrr rr rrr audit_packet_rr )&rrrr r rr r r rrrrrr _WOR_TYPE_LABELSrO_RTS_DEPT_LABELSr r r rirlrrrrhrirJrr>rJr*ryrrprtr)%rrrrr r comprr rr status_lblrPrrror rsr:r-rrJ summary_bytesr attach_paths out_bytesrrrrr9rl r r6r r r s% @@@@@@r1history_wor_export_pdfris*&c*LGS S!3&&@ 3T( ;Cb1LLN B D E E##LLc2&HHRWH#LLc2&HHQ-!H4LLb!$r2r"HHQ3 :  /    ! * *+? @ A '&/%%gr2CmD E FGLM NCFF1I<  '7;;w'( &'++j)* &"&&w{{:'> J@W@^[^_` ;;| $D ++e  "C SWW/0CGG",*F  ["a( QK*..9JCGGT\L]Ldad*eefklm qDCGG$45;<t$*BVVH%F"(I"5J&T\J\JbkEvvo.P"&&9I2JPbH266+./D LLc1 - HHRc"2"6"6tT"BC D LLb! ,D%z**%v& NN27CT 3vvh [#q1 #,,+,rBw3f>P V^bdembn/n+op) q* 77. / LLb! ,   q#q ) HHRc"=PkHl@m"mnstH u C   &./ [[ " (bF  ["a( S#GHQO B LLc1 - HHR#Xq#&6r&:"; < LLb! , HHR#Xq#gbff\.B&C"DCTUH V66'?)cD!"&&"23C# % LLb! ,   r2r * NN2sCI . C   & FF1I #**,'M<<##N37KKLL  ;;z "    3 4 ;;~ &    7 8I & '[F MM"**]3 4! MM#a&)  ZZ\F LL )I gkk*-D1Dl SD RZZ *5F#'tfD7Q SS!  &%I &s66b%=b7b% b"b%!b""b%% b32b3z/togen-admin/historyc(ttS)z Return history capture settings.)rrurXr3r1togen_admin_history_getrnjr r3ctjdxsi}t}t|j dt r4|dj D]\}}t|ts||d|< t|j dt rx|d}dD]>}||vs||}|(t|tr|dkDst|dd fcS||d|<@d |vr,t|d tstd d fS|d |dd <tjtj|d td|d|dS)zMSave per-tool history capture toggles + retention/archival policy (DVI-1045).Trrrqrrz# must be a positive integer or nullrr`rtzarchive must be a booleanrr)rUrrq)rrrurrrrrrrrrrr)rrrrrs r1togen_admin_history_postrujsU   4 ( .BD%'H$((9%t,O))+ +DAq!T")*#A& +$((;'.;8 -ACxF=*Q*<Q"A3.Q)RSUXXX+,%a(  -  c)nd3%@A3FF/29~H[ !) ,$$TZZ%CD dHY$78KCX YYr3z/togen-admin/history/telemetryc(ttS)zHHistory.db size/age + archive telemetry, surfaced in Auditor (DVI-1045).)rrrXr3r1togen_admin_history_telemetryrjs %' ((r3z/togen-admin/history/prunec@ttdtS)zLRun the archive+prune sweep now, then return refreshed telemetry (DVI-1045).T)rU telemetry)rrrrXr3r1togen_admin_history_prunerjs d&8&: ;;r3open_enroll_secret)rrvrevokedctjttd}tj|_|j d|jd|S)zJOpen the Print SQLite DB, creating tables on first use. Caller must close.FrDrFak CREATE TABLE IF NOT EXISTS print_enrollment_tokens ( token TEXT PRIMARY KEY, machine_id TEXT, issued_at REAL NOT NULL, expires_at REAL NOT NULL, consumed_at REAL ); CREATE TABLE IF NOT EXISTS print_agents ( machine_id TEXT PRIMARY KEY, hostname TEXT, agent_token TEXT UNIQUE NOT NULL, enrolled_at REAL NOT NULL, last_seen_at REAL, revoked INTEGER NOT NULL DEFAULT 0, status TEXT NOT NULL DEFAULT 'active', os_version TEXT, logged_in_user TEXT, agent_version TEXT ); CREATE TABLE IF NOT EXISTS print_printers ( id INTEGER PRIMARY KEY AUTOINCREMENT, machine_id TEXT NOT NULL, raw_name TEXT NOT NULL, driver TEXT, port TEXT, is_default INTEGER NOT NULL DEFAULT 0, printer_status TEXT, included INTEGER NOT NULL DEFAULT 0, for_documents INTEGER NOT NULL DEFAULT 0, for_labels INTEGER NOT NULL DEFAULT 0, published_name TEXT, first_seen_at REAL, last_seen_at REAL, UNIQUE (machine_id, raw_name), FOREIGN KEY (machine_id) REFERENCES print_agents (machine_id) ); CREATE TABLE IF NOT EXISTS print_kv ( key TEXT PRIMARY KEY, value TEXT, updated_at REAL ); CREATE TABLE IF NOT EXISTS print_commands ( id TEXT PRIMARY KEY, machine_id TEXT NOT NULL, action TEXT NOT NULL, params_json TEXT, created_at REAL NOT NULL, delivered_at REAL, acked_at REAL, acked_status TEXT, error_message TEXT, FOREIGN KEY (machine_id) REFERENCES print_agents (machine_id) ); CREATE TABLE IF NOT EXISTS print_jobs ( id TEXT PRIMARY KEY, created_by TEXT, source TEXT, file_ref TEXT, file_path TEXT NOT NULL, machine_id TEXT NOT NULL, printer_raw TEXT NOT NULL, published_name TEXT, kind TEXT NOT NULL, copies INTEGER NOT NULL DEFAULT 1, created_at REAL NOT NULL, FOREIGN KEY (id) REFERENCES print_commands (id), FOREIGN KEY (machine_id) REFERENCES print_agents (machine_id) ); CREATE INDEX IF NOT EXISTS idx_print_printers_machine ON print_printers (machine_id); CREATE INDEX IF NOT EXISTS idx_print_jobs_creator ON print_jobs (created_by); )rGrHr* PRINT_DB_PATHrJrKrLrMrNs r1rSrSjsM ??3}- GD{{DLL*+II T Kr3cV|jd|fj}|r|dSdS)Nz(SELECT value FROM print_kv WHERE key = ?rrLrurOr)rs r1 _print_kv_getrjs/ ,,AC6 J S S UC3w<(D(r3cR|jd||tjfy)NzINSERT INTO print_kv (key, value, updated_at) VALUES (?, ?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_atrLrUrOr)rs r1 _print_kv_setrk%LL , eTYY[! r3ct|t}|sA|r?tjj}t |t||j |SzGReturn the current open-enroll shared secret, minting one on first use.)r_PRINT_OPEN_ENROLL_KEYrWrXrYrrZrOrsecrets r1_print_get_open_enroll_secretr ks@ 4!7 8F f!!d2F; Mr3c |tj}|xsgD]}t|ts|jdxsdj }|s:|j d|||jdxsd|jdxsd|jdrdnd|jd xsd||fy ) zUpsert agent-reported printers. Raw fields (driver/port/is_default/status) refresh on every check-in; admin-set config (included / for_documents / for_labels / published_name) is preserved across reports.rOr7a INSERT INTO print_printers (machine_id, raw_name, driver, port, is_default, printer_status, first_seen_at, last_seen_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(machine_id, raw_name) DO UPDATE SET driver = excluded.driver, port = excluded.port, is_default = excluded.is_default, printer_status = excluded.printer_status, last_seen_at = excluded.last_seen_atrport is_defaultr^rrdN)rUrrrrrL)rOr!printersrrrOs r1_print_upsert_printersrks ))+C ^ !T" EE*%+224   ;155?#8b!%%-:M2%% %Q1aeeHo.C #   r3z/print/agents/enrollctjdxsi}|jdxsdjxsd}t t j }tj}t} |jd||||tzf|j|jt|||rd Sd S#|jwxYw) uIssue a short-lived enrollment token. machine_id optional: supplying it pre-binds the token (quick-enroll → active); omitting it lands the agent pending (admin approval required).Trr!r7NzbINSERT INTO print_enrollment_tokens (token, machine_id, issued_at, expires_at) VALUES (?, ?, ?, ?)quickselfenrollment_tokenr!rO)rrrrr*rWrXrUrSrL_PRINT_ENROLL_TTL_SrZr[rrr!rDrrOs r1print_agents_enrollr1ks   4 ( .BD((<(.B557?4J  E ))+C ;D  # JS+>%> ?  Ej#- ;;39 ;; s >-CC$z/print/agents/registerc tjdxsi}tjjdd}|jdxs&|j dr|ddj nd}|jd xsdj }|jd xsdj }|jd xsdj xsd}|s|st d dfStj}t} t|d}t|xr ||k(xs||k(} | r%|st d df|jS|d} } n|jd|fj} | st d df|jS| dt d df|jS|| dkDrt d df|jS| d r0|r&|| d k7rt d df|jS| d d} } n$|st d df|jS|d} } |jd||f|jd| fj} | r | d}| d } n>#r!56<"CCExx -3::BK..Lz/print/checkinc >tjjdd}|jdr|ddj nd}|st ddfSt } |jd |fj}|st d df|jS|d }|d }tjd xsi}tj}|jd||jd|jd|jd|jd|f|dk(rt|||jd|jd|fj}|r|jd||df|j|jd} |r,d} |dr tj|d} |d|d| d} t d d| |S#|jwxYw#tj t"f$rd} YMwxYw)uAgent → server check-in. Validates the bearer agent_token, refreshes the agent fingerprint, upserts reported printers, and dequeues the oldest unacked command (acking the prior delivery).rr7rrNMissing bearer agent_token.rrzQSELECT machine_id, status FROM print_agents WHERE agent_token = ? AND revoked = 0Invalid or revoked agent_token.r!rdTrzUPDATE print_agents SET last_seen_at = ?, hostname = COALESCE(?, hostname), os_version = COALESCE(?, os_version), logged_in_user = COALESCE(?, logged_in_user), agent_version = COALESCE(?, agent_version) WHERE machine_id = ?r! os_versionlogged_in_user agent_versionrvrz|SELECT id, action, params_json FROM print_commands WHERE machine_id = ? AND acked_at IS NULL ORDER BY created_at ASC LIMIT 1zOUPDATE print_commands SET delivered_at = COALESCE(delivered_at, ?) WHERE id = ?r params_jsonrrrrr)acknext_interval_scommand agent_status)rrxrrwrrrSrLrur[rrUrrZrrrr) rrDrOagentr!rrrcmd_rowrrs r1 print_checkinrks ??   3D $ :DHNN E :;S@@ ;D* _ H  (* !BCSHH E<( X t,2iik  $ $((:&(> XX& '/)BJ P  8 # "4TXXj5I J,, /M  (*   LL gdm$   G = ! GM$:;!'(2CvV tR , .. (()4  s%"0G)#C7G)6G>)G;>HHz/print/commands//ackcntjjdd}|jdr|ddj nd}|st ddfStj d xsi}|jd xsdj }|d vrt d dfS|jdxsd}tj}t} |jd|fj}|st ddf|jS|jd||dfj} | st ddf|jS|jd||||f|j|jt d S#|jwxYw)4Agent acknowledges execution of a delivered command.rr7rrNrrrTrrdrstatus must be 'ok' or 'error'.r` error_messageISELECT machine_id FROM print_agents WHERE agent_token = ? AND revoked = 0rz=SELECT id FROM print_commands WHERE id = ? AND machine_id = ?r!Command not found.rzXUPDATE print_commands SET acked_at = ?, acked_status = ?, error_message = ? WHERE id = ?r) rrxrrwrrrrUrSrLrur[rZ cmd_idrrDrrdrrrOrris r1print_command_ackrks ??   3D $ :DHNN E :;S@@   4 ( .BDhhx &B - - /F _$>?DDHH_-5M ))+C ;D W H  (* !BCSH ll K U<( )  (* !56;    &- 0  t  0F"4F" &F""F4z /print/agentsctj}t} |jdj}|j g}|D]n}|d}|j |d|d|d|r t |ndt|xr ||z tk|dt|d|d|d |d |d d d pt|S#|j wxYw)zList enrolled print agents with last-seen + status. Pending agents carry their fingerprint so the Print pane can render an approval card.zSELECT machine_id, hostname, enrolled_at, last_seen_at, revoked, status, os_version, logged_in_user, agent_version FROM print_agents ORDER BY enrolled_at DESCr"r!r! enrolled_atNrdrrrrr!rrr)r!r!r last_seenonlinerdr fingerprintagents) rUrSrLrr[rirrPRINT_STALE_SECONDSr)rrOrnrrrs r1print_agents_listr ls ))+C ;D|| ;  (* F  n%  L/* ]++4Y$9oR3??R*RkAiL)jM o"#$4"5!"?!3    " & !!' s CC"c|xsdj}t} |jd|fj}|sddidf|j S|r%|ddk7rdd|dd id f|j S|jd ||d k(rd nd|f|j |j d||ddfS#|j wxYw)zFShared approve/deny/revoke transition. Returns (payload, http_status).r7z4SELECT status FROM print_agents WHERE machine_id = ?rmachine_id not found.rrdr machine is '', not pending.r9zDUPDATE print_agents SET status = ?, revoked = ? WHERE machine_id = ?rr^rTrUr!rdrK)rrSrLrur[rZ)r!rW require_pendingrOrs r1_print_set_agent_statusr$ls"))+J ;Dll BZM (* 45s:  s8} 9|CM?/JKSP R jI51j I   jJ G LL s(CC,CCz"/print/agents//approvec>t|dd\}}tdi||fS)u9Approve a self-enrolled print agent (pending → active).rvTrrXrrr!rr3s r1print_agent_approver:ls*,JRVWMGT  W t ##r3z/print/agents//denyc>t|dd\}}tdi||fS)u7Deny a self-enrolled print agent (pending → revoked).rTrrXrrs r1print_agent_denyrBls*,J SWXMGT  W t ##r3z!/print/agents//revokec:t|d\}}tdi||fS)zHRevoke a print agent's token (status=revoked); future check-ins refused.rrXrrs r1print_agent_revokerJls',J BMGT  W t ##r3z/print/agents/c&|xsdj}t} |jd|fj}|st ddf|j S|dst ddf|j S|jd |f|jd |f|jd |f|jd |f|j |j t d |d S#|j wxYw)zDelete a revoked print agent and its orphan rows (printers/commands/jobs). Only revoked agents are removable (409 otherwise) so a live agent can't be silently dropped out from under an active check-in loop.r7z5SELECT revoked FROM print_agents WHERE machine_id = ?r rrr0agent is not revoked; revoke it before deleting.r9z+DELETE FROM print_jobs WHERE machine_id = ?z/DELETE FROM print_commands WHERE machine_id = ?z/DELETE FROM print_printers WHERE machine_id = ?z-DELETE FROM print_agents WHERE machine_id = ?TrUr!r )rrSrLrurr[rZr!rOrs r1print_agent_deleterRls "))+J ;Dll Cj] (* !893> 9~!STVYY BZMR F V F V DzmT  dz4 @@ s0C>!C>AC>>Dz#/print/agents//printerscj|xsdj}t} |jd|fj}|st ddf|j S|jd|fj }|j |Dcgc]i}|d|d|d |d t|d |d t|d t|dt|d|dxsd|drt|dndd k}}t ||d|d|S#|j wxYwcc}w)zAList the printers discovered by an agent with their Togen config.r7zJSELECT machine_id, hostname, status FROM print_agents WHERE machine_id = ?r rrzSELECT id, raw_name, driver, port, is_default, printer_status, included, for_documents, for_labels, published_name, last_seen_at FROM print_printers WHERE machine_id = ? ORDER BY raw_name COLLATE NOCASErrOrrrprinter_statusincludedrPrQrNr"N) rrOrrrr!r"rPrQrNrr!rd)r!r!rdr) rrSrLrurr[rrr)r!rOrrnrrs r1print_agent_printers_getr#llsf"))+J ;D X M  (* !893> || YM  (*    gjMH+& 1\?+,-:'a011\?+,-3/0/@S>*+d  H  j53D/H >>  s0D!!DA.D0D-c \|xsdj}tjdxsi}|jd}t |t st ddfSt} |jd|fj}|st d d f|jS|D]}t |trd |vr t|d }|jd rd nd}|jdrd nd}|jdrd nd} t|jdxsdj} |jd||| | ||f|j!|jt dS#ttf$rYwxYw#|jwxYw)zSave per-printer Togen config: included / for_documents / for_labels / published_name. Body: {printers: [{id, included, for_documents, for_labels, published_name}, ...]}. Only printers belonging to this agent are updated.r7Trrzprinters list required.rr`z8SELECT machine_id FROM print_agents WHERE machine_id = ?r rrr"r^rrPrQrNz}UPDATE print_printers SET included = ?, for_documents = ?, for_labels = ?, published_name = ? WHERE id = ? AND machine_id = ?rY )rrrrrrrrSrLrur[rrrrr*rZ) r!rrrOrr| r r"rPrQrus r1print_agent_printers_postr%ls "))+J   4 ( .BD HHZ E eT "67<< ;D F  (* !893>& % Bb$'4r> "T(mFF:.qAH!#!8AaM ff\2JBFF#34:;AACI LLV=*ijQ    d z*   s7)0F*FFBFFFFFF+z/print/enroll-secretct} t|d}|jt|S#|jwxYwzDReturn the current open-enroll shared secret (minted on first read).Trr)rSrr[rrOrs r1print_enroll_secret_getr*ls= ;D.tDA f -- 5Az/print/enroll-secret/rotatectjj}t} t |t ||j |jt|S#|jwxYwzRotate the open-enroll secret. Prior secret stops working immediately; already-enrolled agents keep their agent_token (unaffected).r() rWrXrYrSrrrZr[r new_secretrOs r1print_enroll_secret_rotater0lsX !!J ;Dd2J?  j 11 !A''A9PRINT_SPOOL_DIRtogen_print_spool)watchprojectbuilderre mtslabels>.bmprrrrrrr cRtjtjtjtjt jt jg} |jdtdD|S#t$rY|SwxYw)zGAbsolute roots a resolved print file may live under (defense in depth).c3<K|]}|jywrT)r,)r,rns r1r/z)_print_roots_allowlist..ls?QQYY[?r{N) rbr,rr2r rrBrrry)rootss r1_print_roots_allowlistr;ls    "4"<"<">@W@W@Y    !>#9#9#;[=P=P=R TE  ?.*>?? L   L s6!B B&%B&ctt|j}tD]6}t|}||k(s#|j |t j zs6yy)NTF)r*rr,r;rwrr)rbrrootrs r1_print_path_within_allowlistr>lsV DJ   !A&( I 6Q\\!bff*- r3ct|}|jj}|dk(r|dfS|tvr tj ddtt jjdz }tj|5}|jdjt|ddddd|dfSdd |xsd fS#1swYxYw#t$r}dd |fcYd}~Sd}~wwxYw) zReturn a printable PDF path for ``path``. PDFs pass through; raster images are wrapped into a one-page PDF in the spool dir. Returns (pdf_path, error).rNTrMr9PDFgr@)r z Could not convert image to PDF: z$Unsupported file type for printing: rl)rr!rE_PRINT_IMAGE_EXTSr2rrWrXrYrIr?rLrr*ry)rbr$rrrrls r1_print_ensure_pdfrBms t*C **   C f}Dy  B  ! !$ ! >!tzz|'7'7&8$==C% J 5!&&s3x5&I J9  7x7HI II  J J B;C5AA A Bs6AC -C9 CCC C6%C1+C61C6c|xsdjj}|xsdj}|sy|dk(rt|}|syt|S|dk(r<|j d\}}}|r |rd|vsd|vryt ||}|sy t|St j|}| d d |xsd fSd|vry|j}||jdz j}||k7r5t|jt|tjzsy |jsy t|S)aZResolve a (source, file_ref) pair to a server-side PDF path. Sources are allowlisted directory roots; ``file_ref`` is always treated as a path relative to that root and is traversal-guarded. The ``wor`` pseudo-source delegates to the WOR file finder. Non-PDF raster images are converted to PDF. Returns (pdf_path, error_message).r7)Nzfile_ref is required.r#)NWOR file not found.r r6r)NzInvalid file_ref.)NFile not found.NzUnknown print source: rl)Nz!file_ref escapes the source root.)rrErrB partitionr/ _PRINT_SOURCE_ROOTSrr,rVr*rwrrr) r rrr^r rr= root_resolvedrs r1_resolve_print_filerImsRl ! ! # ) ) +FB%%'H , $X.. ** $--c25Udfn ,%fe4* **  " "6 *D |-f.@-ABBB x(LLNM!55>>@IM!#i.*C*CC DVY[Y_Y_D_*`8    & Y ''r3c|xsdj}|syt} |jdj}|j |j }|D]6}|dxsdjj |k(s,|d|dfcS|D]6}|dxsdjj |k(s,|d|dfcSy#|j wxYw)zMap a published printer name to (machine_id, raw_name) for an included printer on an active agent. Falls back to matching raw_name. Prefers the most-recently-seen printer when several match. Returns None if unresolved.r7NzSELECT p.machine_id, p.raw_name, p.published_name, p.last_seen_at FROM print_printers p JOIN print_agents a ON a.machine_id = p.machine_id WHERE p.included = 1 AND a.status = 'active' ORDER BY p.last_seen_at DESCrNr!rO)rrSrLrr[rE)rNr9rOrnrKrs r1_resolve_published_printerrK>ms  b ' ' )D  ;D || , (*  **,C 2   %2 , , . 4 4 6# =\?AjM1 122 jM R & & ( . . 0C 7\?AjM1 12  s CC+c|dk(rdSdS)zSumatraPDF -print-settings string per document kind. Documents shrink to the printable area; labels print at native size (no scaling) so barcodes and QR modules keep their exact dimensions.rnoscaleshrinkrX)r! s r1_print_kind_settingsrO[ms95X5r3c2|d |ddk(rdSdS|dyy) z@Derive a job status from its command row's lifecycle timestamps.acked_at acked_statusrUrrr rXqueuedrX)rs r1_print_job_statusrTbms5z& 0D8vEgE~* r3z/print/optionscptdjdd}ttt |S)a0Printer choices + the caller's effective defaults for the print popups. Returns ``{available_printers: {documents, labels}, effective_defaults: {document_printer, label_printer}}``. The tool Print buttons (DVI-670 / P4) use this to pre-select the effective default and populate the dropdown.r'rr7)rceffective_defaults)rrrrUrar]s r1 print_optionsrWkms5 FO   ,E .06u= r3z /print/jobsc ttjdstddfStdjdd}t j dxsi}|jd xsd j j}|d vrtd d fS t|jdxsd}|dks |tkDrtdtdd fS|jd}|ddtfvr8t|}|j|dk(rdndd}|s+td|dd fSt|j }t|}|std|d fS|\}} t!|jd|jd\} } | r| dvrdnd } t| | fStt#j$} t'j&}| ||dt)|id }t+} |j-d!| |t/j0||f|j-d"| ||jdxsdj |jdxsdj t| || ||||f |j3|j5t| d#||||$d%fS#ttf$rtdd fcYSwxYw#|j5wxYw)&zCreate a print job: resolve the file + target printer, then enqueue a ``print`` command for the owning agent. (DVI-669 / DVI-657 P3) Body: {source, file_ref, printer|"__default__"|"", kind: document|label, copies?} r'z'The Print system is currently disabled.rrrr7Trr! r2 )r2 rz#kind must be 'document' or 'label'.r`copiesr^zcopies must be an integer.zcopies must be between 1 and rrNrrrz No default z printer configured.zPrinter not available: r r)rErDrprint_settings)rr! rYr ziINSERT INTO print_commands (id, machine_id, action, params_json, created_at) VALUES (?, ?, 'print', ?, ?)zINSERT INTO print_jobs (id, created_by, source, file_ref, file_path, machine_id, printer_raw, published_name, kind, copies, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)rS)r^rdrr!r! rYr)rrrrrrrrErrr_PRINT_MAX_COPIESrZrar*rKrIrWrXrUrOrSrLrrrZr[)rrr! rYr rruresolved_printerr!rOrferrr3r^rrrOs r1print_jobs_creater^zms 7;;v. /FGLL FO   ,E   4 ( .BD HHV  * 1 1 3 9 9 ;D ((BCSHH@TXXh',1-zV//<=Nhhz"(b / / 13x=* y$ 5    &9(tF DEH IIm z "@9:C??@h s$K B!K0 K-,K-0Lz/print/jobs/c tdjdd}t} |jd|fj }|j |st ddfS|d|k7r&tdjd st d d fSt |d t||d xsd|d|d|d|dxsdS#|j wxYw)zGReturn a print job's status. Visible to its creator or any Togen admin.r'rr7zSELECT j.id, j.created_by, j.published_name, j.kind, j.copies, j.created_at, c.delivered_at, c.acked_at, c.acked_status, c.error_message FROM print_jobs j JOIN print_commands c ON c.id = j.id WHERE j.id = ?Job not found.rrr r Forbidden.rrrNr! rYrrN)r^rdrr! rYrr)rrrSrLrur[rrT)r^rrOjobs r1print_job_statusrcms FO   ,E ;D ll  I   (*  -.33 <E!'&/*=*=m*L\*C// 4y %$%+ [8}|$/*2d  s !C Cz/print/jobs//filectjjdd}|jdr|ddj nd}|st ddfSt } |jd |fj}|st d df|jS|jd |fj}|j|st d d fS|d|dk7rt ddfS|d}t|rtjj|st dd fSt|dd|dS#|jwxYw)zzAgent download of a job's PDF. Gated by the agent bearer token; the job must belong to the requesting agent's machine.rr7rrNrrrrrz9SELECT machine_id, file_path FROM print_jobs WHERE id = ?r`rr!rarrizJob file unavailable.rTrr )rrxrrwrrrSrLrur[r>rrbr r)r^rrDrOrrbris r1print_job_fileremsY ??   3D $ :DHNN E :;S@@ ;D  W H  (* !BCSH ll G& (*  -.33 <E,//\*C//K I ' 2"''..:S45s:: Y):#'& HH s"0E #!E E/enroll/print-agent.zipcttz }|jstddtdtddfSt t |dtS) zServe the frozen print-agent bundle (exe + installer). 404 with guidance until the artifact is built and deployed. No auth: the ZIP has no secrets.z%Print agent bundle not available yet. Expected z in PRINT_AGENT_DIST_DIR (z`); run build_print_agent.ps1 on a Windows host to produce the bundle, then deploy to the server.rr rTrn )r_r`rrrr*rbs r1print_enroll_agent_ziprknsh "6 6D <<>9345+,-TU    SYdBV WWr3z/enroll/print-bootstrap.ps1c t}tjjdxsdj }|r|d}}n_t jdrt djdsdddd d fSt } t|d }|jd }|d}|jdd}|jdd}d|dtjdd|d|d|d }|dddd dfS#|jwxYw)uRender a PowerShell onboarding script that downloads the Print Agent bundle and enrolls it. ?token= embeds a per-machine token (quick-enroll → active); otherwise the current open-enroll secret is embedded (self-enroll → pending). Mirrors /enroll/bootstrap.ps1 but targets the Print bundle and install-print.ps1. Auth: the script runs on a fresh machine with no Togen session cookie, so the quick-enroll path authenticates via the ?token= enrollment token itself (the same bearer credential /print/agents/register already trusts). The token-less self-enroll path embeds the open-enroll secret, so it stays gated behind a Togen Admin session to avoid serving that secret anonymously. Requiring an admin session unconditionally would 302-redirect the sessionless machine to the Microsoft SSO page, whose HTML then gets piped into `iex` (DVI-674).rDr7rr'rzWrite-Host 'ERROR: This bootstrap URL needs a ?token= enrollment token (generate one via Togen Admin -> Agents -> Print -> Enroll), or download it from an authenticated Togen Admin session.' -ForegroundColor Red exit 1 rtext/plain; charset=utf-8no-storerrvTrrrfrd ''z# Togen Print agent bootstrap (-enroll) — generated %Y-%m-%d %H:%M:%Sz # Run as Administrator. Downloads the agent bundle and delegates to install-print.ps1. $ErrorActionPreference = 'Stop' $Server = '' $Credential = 'a' $Zip = Join-Path $env:TEMP 'togen-print-agent.zip' $ExtractDir = Join-Path $env:TEMP 'togen-print-agent' # -- Download (no auth required; ZIP contains no secrets) ------------------- Write-Host 'Downloading Togen Print agent...' try { Invoke-WebRequest -Uri 'a' -OutFile $Zip -UseBasicParsing } catch { Write-Host "ERROR: Download failed: $_" -ForegroundColor Red Write-Host 'Ensure the print agent bundle has been built and deployed. Contact your IT admin.' exit 1 } $ZipSize = (Get-Item $Zip -ErrorAction SilentlyContinue).Length if (-not $ZipSize -or $ZipSize -lt 4096) { Write-Host 'ERROR: Print agent bundle not available on this server yet.' -ForegroundColor Red Write-Host 'The Windows build step must be run first. Contact your IT admin.' Remove-Item $Zip -Force -ErrorAction SilentlyContinue exit 1 } # -- Extract ---------------------------------------------------------------- if (Test-Path $ExtractDir) { Remove-Item -Recurse -Force $ExtractDir } Expand-Archive -Path $Zip -DestinationPath $ExtractDir -Force Remove-Item $Zip -Force -ErrorAction SilentlyContinue # -- Install (enroll + Scheduled Task via install-print.ps1 from the bundle) - $Installer = Join-Path $ExtractDir 'install-print.ps1' if (-not (Test-Path $Installer)) { Write-Host 'ERROR: install-print.ps1 missing from agent bundle.' -ForegroundColor Red exit 1 } Write-Host 'Running installer...' & powershell.exe -ExecutionPolicy Bypass -NonInteractive -File $Installer -Server $Server -Enroll $Credential Write-Host '' Write-Host 'Bootstrap complete.' -ForegroundColor Green Write-Host 'If this machine registered as PENDING, visit Togen Admin' Write-Host ' -> Agents -> Print -> Status tab -> Approve this machine.' rKz&attachment; filename=install-print.ps1rrrv) _vision_server_base_urlrrhrrrrSrr[rrUr rrDrrOrOzip_urlps_credps_basescripts r1print_enroll_bootstrapr{ns@ # $D \\  g & ," 3 3 5E  'D  F#(;(;M(J1!.n;aqEz;rrc3$K|]}|dv ywrrXrs r1r/z-togen_admin_assistant_post..n"?!1:"?rrrY )rr~rrrrrrr*rrrrrrr) r~rrrrrJocr_valkey_valr4prov_idrQs r1togen_admin_assistant_postrns   4 ( .BD ! #CDd9o.I$%)$/D*E%F !"t#$'-A(B$C !$"4#89??AOdd;'-2.446 w/&C  C K D26y/#d9o&,,.r 3;7;;$C N#''*-34F")F; $C O ]yC/ITjj)94@cggj)/R0zz+&3779+="%i.F;  $Z 0 6 6 8 $ GW11.5c'l((*2Gs"?w"??")wB7f#47O $!J ::k "#K0C N # IT!j6H1I4&Pcgg017R8 !34::< ,LGS--"&s)w ,#) C d r3z/assistant/connectionc ddlm}m}m}m}m}m}tdd}t|}||}t|jdxsi} | jds|jdr|d| d<||} t||jd|| |||jdd |jd xs|jdd t|j| d  S) z=Return the current user's assistant connection (keys masked).r)get_user_assistantrrruser_provider_enabled_mapavailable_modelsr'rr,rrmodelr7rr)rr,rrrrr)rrrrrrrrrrrrrr) rrrrrrruser_cfgua user_keysrks r1assistant_connection_getrns FOG $E"5)H H %BRVVF^)r*I == %"&&*;!#I + X &E  *+ y !28<ffWb!ff_-D1D*1134x r3z/assistant/statuscddlm}tdd}tdjdd}t |}||||}t |dS)aLive status for the topbar Assistant indicator dot (DVI-629). available -> MCP/provider connection usable (drives green vs red) busy -> a background prompt/workflow is running (drives yellow). No background processes exist yet, so this is always False today; the field is here so the future feature flips it without a frontend change. rrVr'rrF) availablebusy)rrWrrrr)rWrrrrs r1assistant_statusrnsP1 FOG $Ev""=%8H"5)H&uhAI YU 33r3c2ddlm}m}m}tdd}t j dxsi}t|}t||}d|vrt|dj|d<d|vr't|dj|d<|d|d<d |vr||d rt|d jnd }|r@td |Ds.||d <t|jd xsi}||d <||d <n|d k(r|jd dd |vrt|d trt|jd xsi}|jd s|jd r|d |d <|d jD]O\} }| |vr |rt|jnd }|rtd|Ds||| <B|d k(sH| |vsM|| =Q||d <|jd r |d |d <n|jd dd|vrdt|dtrQt|jdxsi}|djD]\} } | |vs t!| || <||d<|||}t#||t%dS)zSave the current user's assistant connection (provider + keys + model). Accepts: api_key (legacy), keys {anthropic, google}, model (legacy), default_model. Keys are write-only; omit to leave unchanged, send empty to clear. r)rset_user_assistantrr'rTrrrrr7c3$K|]}|dv ywrrXrs r1r/z,assistant_connection_post..orrr,rNc3$K|]}|dv ywrrXrs r1r/z,assistant_connection_post..)orrrrY )rrrrrrrrrr*rrrrrrrrr) rrrrrrrrr4rrQs r1assistant_connection_postrosVU FOG $E   4 ( .BD"5)H  * +B$$w-(..07 $!$"78>>@?)7 D26y/#d9o&,,.r 3;7;;#ByM"&&..B/F")F; BvJ ] FF9d # ~*T&\48bffVn*+zz+&266)+<"$Y-F;  $V 2 2 4 $ GW11.5c'l((*2Gs"?w"??")wB7f#47O $6 ::k "";/ByM FF9d #T!j6H1I4&Pbff/06B7 !34::< ,LGS--"&s)w ,"( !(B/Hx( d r3z/assistant/contextc`ddlm}tdd}t|}t ||S)z;Return the effective context markdown for the current user.r)_effective_context_mdr'r) context_md)rrrrr)rrrs r1assistant_context_getr@os00 FOG $E"5)H 3H= >>r3cddlm}m}tdd}t j dxsi}t |}t||}t|jdd|d<|||}t||td S) z+Set the current user's context md override.r)rrr'rTrrr7rY ) rrrrrrrrr*rrr)rrrrrrs r1assistant_context_putrJosA FOG $E   4 ( .BD"5)H  * +B488L"56B|!(B/Hx( d r3z/assistant/chatcddlm}m}m}m}m}m}m}m}td}|d} t|jd} t| } || | | stddfStjd xsi} | jd xsg} t!| t"r| std d fS| jd}||| }|r|j%nd}t'| jdxsdj%xsd}| xs||} |r|| ||| |}n || || |}t||S#|$rO}t|j(|j*|j,|j.d|j0d cYd}~Sd}~w|$r!}tt'|dfcYd}~Sd}~w|$r!}tt'|dfcYd}~Sd}~wwxYw)uProxy a chat request to the configured LLM provider. Request body: { messages: [{role, content}], context_md?: str } context_md overrides the effective context for this request (optional). Returns: { reply: str, agentic: bool } OR { pending_action: {token, tool, display_name, display_args}, partial_reply: str, agentic: bool } when a Tier-1 (mutating) tool needs user confirmation. Agentic mode (DVI-557/560/561): any user with at least one authorized tool gets tool-calling via chat_agentic() — each user sees only the tools their role permits. Users with no tool access fall back to plain chat(). r)rWchat chat_agentichas_any_tool_accessAssistantUnavailableAssistantErrorPendingActionRequiredrr'rrz=Assistant is not available. Configure an API key in Settings.rrTrrfz"messages must be a non-empty list.r`rNr7r)r'r9rr9rrDr display_name display_argspending_action partial_replyagenticrU replyr)rrWrrrrrrrrrrrrrrrrrr*rDrrrr)rWrrrrrrrr'rrrrrfctx_mdr|model_override is_agenticrrls r1assistant_chatrYos  6?D MEDHH]+,H"5)H !%8 <\]_bbb   4 ( .BDxx #)rH h %XABCGG XXl #F ~&x0%V\\^2F'*0b1779ATN606J,  6H\jkE6XE"  33! !   # # # 0 0 # 0 0  ++   ,SX&++ ,SX&++,sCEG  AF G G F71G 7G ?GG G z/assistant/confirmcddlm}m}m}m}m}t d}|d}t|jd}t|}||||stddfStjd xsi} t| jd xsd j} t| jd d} | stddfS || | ||} t| d S#|$rO} t| j| j | j"| j$d| j&d cYd} ~ Sd} ~ w|$r!} tt| dfcYd} ~ Sd} ~ w|$r!} tt| dfcYd} ~ Sd} ~ wwxYw)aExecute or cancel a pending Tier-1 tool action (Phase B+C). Request body: { token: str, confirmed: bool } Returns: { reply: str, agentic: bool } OR { pending_action: {...}, partial_reply: str, agentic: bool } when the resumed loop hits another Tier-1 tool. Security: the token is bound to the requesting user's email in _pending_consume(); any user who reached the agentic loop can confirm their own pending actions. r)rWresume_agenticrrrr'rrzAssistant is not available.rrTrrDr7 confirmedFztoken is required.r`)r'r9rrNrU r)rrWrrrrrrrrrrrr*rrDrrrr)rWrrrrr'rrrrrDrrrls r1assistant_confirmrosk 6?D MEDHH]+,H"5)H !%8 <:;S@@   4 ( .BD !'R ( . . 0ETXXk512I 12C77,uid(S"  --! !   # # # 0 0 # 0 0  ++   ,SX&++ ,SX&++,sC C%%F*AD4.F4F<EFF E<6F<Fz/auditor/policies>rrrcjttttt t S)asConsolidated read-only snapshot for the Auditor Policies pane (DVI-1052). Aggregates the four policy datasets the pane used to fetch from their owning tools' role-gated endpoints. Serving them from one Auditor-gated route lets a non-admin holding only ``policies.*`` view them without needing the WOR/RPM/ admin roles those source endpoints require. )r# rpmApproval rpmSettingsrvisionDefaults)rrr r _load_vision_policy_VISION_POLICY_DEFAULTSrXr3r1auditor_policiesros,  ! #&(&("$.  r3z/auditor/accessc t}t|jDcgc]\}}||d|d|dd}}}t|tScc}}w)zHList per-user Auditor grants + the grantable resource tree (admin only).rxryrzrrxryrz)rr)rrrr_AUDITOR_RESOURCE_TREEaccessrr~rs r1auditor_access_getrosk" #F!0  E3c+&6_#j/ C E  %; <<  sAc tjdxsi}t|jddj j }|rd|vrt ddfS|jd }t|tst d dfS|Dcgc] }|tvs |}}|r.t d d jtt|zdfStjd ijdd}t}||v}tDcgc]}|t|vs|}}|s@|j|dt!|t#dd|d||d|it ddS||j|xsijdxs#t%j&j)d|j|xsijdxs|d||<t!|t#d|rdnd||rdndd|dt+|d|||dt dd|i|| Scc}wcc}w)!zUpsert one user's Auditor grant. Body: {email, resources:[keys]}. An empty resource list removes the user (revokes Auditor entirely).Trrr7rrrr`rxresources must be a list.Unknown resource keys: rr'Nr auditor_access_revokeRemoved Auditor access for r rUrryrrzr{auditor_access_updateauditor_access_grantUpdatedGrantedz Auditor access for r:z resource(s))rrxrj)rrr*rrrErrrr}rmaprrrrrr rrrrC) rrrxrinvalidr rexistedrs r1auditor_access_postrosB   4 ( .BD "% & , , . 4 4 6E Cu$ABCGG%I i &893>>#GQq0F'FqGGG63sGCT9UUVX[[[ KK # ' ' 4E ! #FvoG- E!c)n1DA ED E  5$V$}&=U!>!#J#;Qq ':q;G;63sGCT9UUVX[[[ KK # ' ' 4E  FvoGj) A!Q#i.-@A AD A  5$&!}&:%!9%Au&. 0$--ZZ&,"11*=wAVAVAXAaAabvAwZZ&,"11*=FF5M f='"6GZ+2i BBSTYSZZ\]`ae]f\ggxyu4%HJ d'5!BF5M!B CC5< Bs# I-I$I7Ic tjdxsi}t|jddj j }|st ddfSt}||vrW|j|dt|td d tjd ijddd ||d|i t dS)z4Remove a user's tool access entirely. Body: {email}.Trrr7rrr`Nr rr'rr rY ) rrr*rrrErrrrr rrs r1tool_access_deleterwps   4 ( .BD "% & , , . 4 4 6E 12C77  F  5$&!}&:$[[488"E!9%Au&. 0 d r3z/tool-access/groupsc t}t|jdDcgc]\}}||d|d|d|dd}}}t|t Scc}}w) zaList Azure AD group -> tool-capability grants + the grantable tree (DVI-1373 P3, admin only).c^|djdxs|dj|dfS)Nr^r9rr< kvs r1r z(tool_access_groups_get..ps11 &0A0JRU/Q/Q/SUWXYUZ.[r3rr9rxryrz)rLr9rxryrz)rr)rrrrr)rrr~rs r1tool_access_groups_getrpsz '(Gw}}#[] C#f+C >!#J#;Qq ':q;G;63sGCT9UUVX[[[ KK # ' ' 4E&(GWnGj) A!Q#i.-@A AD A {{3% )}&@!HIpRVR\Z\QaQabhQiIpmpHqrC'F H$--BS)/R44V<B[[%+00<v@U@U@W@`@`au@v[[%+00<E GCL W%=18->W+2i BBbcjkncopvcwc~{~b@BCFGKCLBMM^_WS\&=Q`d#e g d:s"Cgcl"C DD9< Bs KK KKc tjdxsi}t|jddj j }|st ddfSt}||vrn|j|d}t|td d tjd ijd dd |xsijdxs||d|it dS)zBRemove an Azure AD group's tool access entirely. Body: {group_id}.TrrLr7zgroup_id is required.rr`Nr rr'rrr9r rY ) rrr*rrrErrrrr r)rrrr s r1tool_access_groups_deleter ps   4 ( .BD dhhz2& ' - - / 5 5 7C 45s::&(G g~{{3% )}&@$[[488"E!H$*RTIYIYZ`IaIhehHij C'8 : d r3c 8ddlm}|xsdj}|xsdjj}|xsdjj}|xsdj}g}|j s|S|j d5}|D];}|j}|s t j|} t| jdd} |r| dk(rP|r| jd|k7rg|r,|t| jd djvr|r| j|s|rd jt| jd dt| jdd| t j| jd id gj} || vr+|j| > ddd|j|S#t j$rYpwxYw#1swY5xYw)aRead + filter the Assistant tool-use audit log (``tool_audit.jsonl``), newest first. Shared by ``/auditor/entries`` and its CSV export so the downloaded compliance packet always matches the on-screen filtered view. Raises OSError if the log exists but cannot be read. r)TOOL_AUDIT_LOGr7rrrGr9rr'r\rhF) ensure_asciiN)rrrrErr?rrrr*rrwrrrir ) rq f_toolrr f_outcomerrrrsrrGrs r1_read_tool_audit_entriesrps)l ! ! #Fl ! ! # ) ) +F 9"    # # %Cb'')IG  ! ! #   g  ."" "D::hh &"-. &"-.JJuyy45I   57  c> NN5 !7 "": OO N/''  ""s1H4G6 DH6H  H H  HHz/auditor/entriesc  tttjj ddd}t ttjj ddd} ttjj d d d k(tjj d d tjj d d tjj dd tjj dd }t|}||||z}t||||S#t tf$rtddfcYSwxYw#t$r}td|dfcYd}~Sd}~wwxYw)a Return Assistant tool-use audit log entries. Admin only. Query params: limit: max rows to return (default 100, max 500) offset: skip N most-recent rows (default 0) failures_only: '1' to return only non-success outcomes tool: exact tool name filter user: substring match on user email (case-insensitive) outcome: outcome prefix filter (e.g. 'denied', 'handler_error') q: free-text substring across user/tool/outcome/args r rdrrrrrr`rq r7rErr'r rGrq rrrrCould not read audit log: Nr) rLrrrhrrCrrrrrrC)r rrrlr@ rOs r1auditor_entriesr qsB>C ((#67=S))(A67; F*!,,**?B?3F<<##FB/<<##FB/   b)ll&&y"5   LE 6&5. )D 4uV5 II! z ">78#==> F9#?@#EEFs1A&D4)B)E4EE E; E60E;6E;z/auditor/entries/export.csvc H ttjjdddk(tjjddtjjddtjjddtjjddd t}gd }|Dcgc]}|jdd|jdd|jddtj|jdidd|jdrdnd|jddg}}tjjd}td|d||S#t $r}t d | d fcYd }~Sd }~wwxYwcc}w)zFExport the Auditor Assistant tool-use trail (with its filters) as CSV.rq r7rErr'r rGrNrrr)rK r^rvArgsAccessOutcomer_rhFT)rrauthzgrantedr?rOassistant_tool_trail_r) rrrhrr|rrrrrrrrq)rrlry rBr}r~s r1auditor_entries_export_csvr0qsv F*!,,**?B?3F<<##FB/<<##FB/   b)ll&&y"5     CF   dBvr*AEE&",= 155$5DIUU7^  i I  ! ! # , ,X 6E 25'> RR F9#?@#EEFs%B0E8:BF8 FFFFzCarrier Sheet / File BrowserzWork Order AdminzProduction Runz MTS Labels)re r#r r6z/auditor/print-historyrc tttjj ddd}t ttjj ddd}tjj d d jj}tjj d d j}gg}}|r&|jd |jd |d |r"|jd|j||rddj|znd }t} |jd|z|jd}|jd|zdz|||gzj!} |j#g} | D]y} | d xsd } | j| d| dxsd | t$j | | xsd| dxsd | dxsd | dxsd | d| d| dt'| | dxsdd {t| |||!S#t tf$rtddfcYSwxYw#|j#wxYw)"uReturn Print-system job history for the Auditor → Printing tab. Admin only. Every Print button funnels through ``POST /print/jobs``, which records the job in ``print_jobs``; this endpoint is the read side of that audit trail. Query params: limit: max rows (default 100, max 500) offset: skip N most-recent rows (default 0) user: substring match on creator email (case-insensitive) source: exact source filter (shared|wor|prodrun|mtslabels) r rdrrrrrr`r'r7r rrz j.source = ?rrrra5SELECT j.id, j.created_by, j.source, j.file_ref, j.published_name, j.kind, j.copies, j.created_at, a.hostname AS machine_name, c.delivered_at, c.acked_at, c.acked_status, c.error_message FROM print_jobs j JOIN print_commands c ON c.id = j.id LEFT JOIN print_agents a ON a.machine_id = j.machine_idrrr r rrNrr! rYrrN) rr'r source_labelrrrr! rYrrdr)jobsr@ rr )rLrrrhrrCrrrrrErirrSrLrurr[rrT) r rrf_sourcerrrrOr@ rnr"rr$s r1auditor_print_historyr$Tqsj>C ((#67=S))(A67;\\  fb ) / / 1 7 7 9F||"-335H6E  12 &m$ ^$ h27i',,u--RF ;D 4v =v (*S|| G    ; ; eV_ $   (*  D  kR D'lO)r044S#,G* +)*0bn-3fIkL/'*/74   E& FFg z ">78#==>@ sA&H5AI5III*z /auditor/tagsc"ddl}|j}t}|jdi}i} |j 5}|j dD] }|d||d< dddg}|jdgD]}|jdd} |j| i} |j| | jdxs| |jd |jd |jd |jd |jd |jd|j| dd |jd|j} t|| S#1swYxYw#t $rYwxYw)uLoRaWAN tag telemetry snapshot for the Auditor → Tags tab. Returns the latest uplink per device (from thingpark_store.latest_snapshot) plus device metadata from the ThingPark config and ingest health.rNdevicesz6SELECT dev_eui, COUNT(*) FROM uplinks GROUP BY dev_euir^dev_euir7r9rrssisnrr latlng) r'r9r_r(r)r r*r+rcN|jdxs|djS)Nr9r'r< r s r1r zauditor_tags..qs f =9DDFr3r)r&health) thingpark_storelatest_snapshot_load_thingpark_configr_connectrLryrir ingest_healthr) _tpsrMrJdev_meta count_map_conn_rr&rr'rr-s r1 auditor_tagsr8qs|###%H "Cwwy"%HI ]]_ )mmLN )#%a5 "Q%  ) ) G||Ir*  '')R(||GR(HHV$/''+&GGFO775>wwy)775>775>]]7A.     LLFLG    !F 76 22/ ) )    s)F"E4'F4E>9F F Fz/simple-qr/generatectjdxsi}|jdxsdj}|st ddfS t j t jjdd }|j||jd |jd d jd}|jdtj}t!j"}|j%|d|j'dt)j*|j-j/d}t d|S#t0$r}t d|dfcYd}~Sd}~wwxYw)z)Generate a QR code PNG from a URL string.TrrJr7zURL is required.rr`rrerror_correctionbox_sizer fitr r  fill_color back_colorr9)r`r`PNGrrascii)rUr~ zQR generation failed: rN)rrrrr _qrcode_modQRCode constantsERROR_CORRECT_Madd_datamake make_imagerLresizerILANCZOSr>rJrrrrZ r rry)rrJqr_objrRr2img_b64rls r1simple_qr_generaterOqsD   4 ( .BD 88E? b ' ' )C /0#55B##(22BB    7wGOOPUVjjZ%7%78jjl U#  ""388:.55g>$g.. B5cU;> STVYYY33!3zSJ666779L\)2L4D4DWi4XY=cUCDcIIdV$G%>fBse$LL )X!67  #J$    1/1B)L&|N'C&DE.  D z)"-11)TYYt_M09:C?? d r3rM z https://graph.microsoft.com/v1.0>rrrrr6rqdocxrsxlsxc trtsy tjttt}|j dg}|j dS#t$r"tjjdYywxYw)z@Acquire the shared app-only Graph token, or None if unavailable.Nrrrrz$Email: Graph token acquisition error) rrrrrrrryrmrnrrs r1_email_graph_tokenrY8rsw j77 %7:W 44:;5=zz.))  CDsAA(BBc\tjdxsijddxsdS)z=Return the signed-in user's mailbox address from the session.r'rr7rrXr3r1_email_current_mailboxr[Grs( KK  %2 * *7B 7 =2=r3c   tjtd|d|d|dd|id}|jdk7r9tj j d |j|jd d y |j}|jd }|sy |jdxsd|jdxsdtj|fS#t$r"tj jdYy wxYw)zTFetch one attachment. Returns (name, content_type, raw_bytes) or (None, None, None)./users/z /messages/z /attachments/rrrr;rKz&Email attachment fetch failed (%s): %sNr)NNNrQ r9rrrzEmail attachment fetch error) rr _GRAPH_BASErgrmrnrr&rr b64decoderyr)rDr[rkrlrr content_b64s r1_email_fetch_attachmentraLrs !!m77):j\}o ^$w&78    s " JJ  E!--tyy# @#yy{hh~. # 0L'E+E  -/ /   ;< sA3C6#C=C(DDz/email/messagesct}|stddfSt}|stddddfStd d d d } t j t d |ddd|i|d}|jdk(rtdd|ddfS|jdk7rf|jr=|jj dij d|jddn |j}td|dfSg}d}|jj dgD]~}|j d d!s|d"z }|j d#xsgDcgc]_}|j d$sL|j d%|j d&xsd'|j d(d|j d)xsd*d+a} }|j|j d%|j d,xsd-|j d.xsij d/xsij d0d*|j d.xsij d/xsij d&d*|j d1|j d d!|j d2xsd*dd| t| d3 td!|||4S#t$r0tjjdtddfcYSwxYwcc}w)5zIReturn the signed-in user's recent inbox messages (attachments expanded).(No mailbox associated with this session.rr`Mail service is not configured.FrcrrrmrKzreceivedDateTime desczBid,subject,from,receivedDateTime,isRead,hasAttachments,bodyPreviewz6attachments($select=id,name,contentType,size,isInline))$top$orderbyr$expandr]/mailFolders/inbox/messagesrrrrzEmail messages fetch errorz!Could not reach the mail service.rU r permissionzMailbox access has not been granted. An administrator must grant the Mail.Read application permission to the Togen app registration in Azure AD.rrmr[rrrNrT rrisReadTr^rS r]rr9rrdrr7)rr9rdrrr_r2rrreceivedDateTimer`) rrr2 from_namereceivedis_readrL rS rd)rr[rfunread)r[rrY_EMAIL_INBOX_TOPrrr^ryrmrnrrgr&rrir) r[rDrrr rfrqrrrgs r1email_messagesrsdrs%&G GH#MM  E >%&(),- -!+WK F G!!m77)+F G$w&78   3|WCDFII I 3QUQZQZ"-11)TYYt_M`d`p`p09:C??H F YY[__Wb ) uuXt$ aKFeeM*0b  55$ eeDkf 5fa( uu]39r       %%+uuY'9>eeFm)r..~>D"II)UWX55=.B33NCIrNNvWYZ01uuXt,m,2DS9#Dz   0 T7Xf UUO G 9:@A3FFG$  s(J5A$K156K.-K.z/email/unread-countc t}|s tddSt}|s tddSdd|i} tjt d|d|dd id }|jd k7r$tdd|jd k(rdSdS|jj d d}d}d} tjt d|d|dddddd }|jd k(r|jj dgD]h}|j dxsgD cgc](} | j ds| j dxsd*} } | sL|dz }td| Dsd|dz }jt|||d !S#t $rtddcYSwxYwcc} w#t $r"tjjdYZwxYw)"zCounts for the Tools page tile badges: total unread, unread with attachments, and unread with a workflow-supported attachment (DVI-635).rF)rrrrr]z/mailFolders/inboxrunreadItemCountrrrKrrjr)rrrmriz*isRead eq false and hasAttachments eq truerdrz"attachments($select=name,isInline))z$filterrfrrh-rrS r]r9r7r^c3vK|]1}d|vr+|jdddjtv3yw)rr^rN)rj rE_EMAIL_WORKFLOW_EXTS)r,r9s r1r/z%email_unread_count..rs=9C4K{{3*2.446:NN9s79z(Email unread-count attachment scan errorT)rrS workflowr) r[rrYrrr^ryrgrr2rmrnr) r[rDrxrr@ unread_attachunread_workflowa_resprrr.s r1email_unread_countr}rs' %&G Q%00  E Q%00'% 12G1!!m77)+= >01   3Q%.2.>.>#.ElT TKRT T IIKOO-q 1E MOI##m77)+F GG?        $[[]&&w3 )78uu]7K7Qr3 !j 1v,",33" 9#(99#q(O ) M+t ==K 1Q%00143 I GHIs<%F 8A1F*)-F%F*3F* F"!F"%F**(GGz/email/attachmentct}tjjdd}tjjdd}|r|r|st ddfSt }|st ddfSt ||||\}}}|t d d fStjjd d k(}ttj|||| S)z@Stream an attachment's bytes (inline preview / direct download).rkr7rl*message_id and attachment_id are required.rr`rdrU "Attachment could not be retrieved.rrdrEr ) r[rrhrrrYrarr>rJ)r[rkrlrDr9r5r as_attachs r1email_attachmentrrs%&G!!,3JLL$$_b9M  }IJCOO  E >?DD5eWjR_`D, {ABCGG   ,3I RZZ_|#,D BBr3z/email/save-attachmentcZtjdxsi}|jdxsdj}|jdxsdj}|jdxsdj}|jdxsdj}|r|st d d fS|r t |nt }||jst d d fSt}t}|st d d fSt||||\}} } | t d dfSt|xs|xsd} || z } | jrOtjj| \} }|| dt!j"j%d|z } | j'| t1| j3t }t d|| j4S#t($r0t*j,j/dt d dfcYSwxYw)zKSave an email attachment into the shared Projects tree (File Browser root).Trrkr7rlrd rrrr`zInvalid destination folder.rdrU rrrr z%H%M%Sz!Email save-attachment write errorz,Could not write the file to the destination.r)rUrS r)rrrrrr6 r8 rr[rYrarrrrbrrrrr-rrmrnrr*r{r9)rrkrldest_relrrr[rDr9_ctrrrrr saved_rels r1email_save_attachmentrrs   4 ( .BD((<(.B557JXXo.4";;=M%+224H$*113H =IJCOO*2}X&Hx0:;S@@$&G  E >?DD,UGZWND#s {ABCGG 0D1A\I i D {{}GG$$Y/ cTF!N$6$6$8$A$A($K#LSERRR D$$X./I dy499 EE R @AKLcQQRs*G116H*)H*z/email/share-attachmentc tjdxsi}|jdxsdj}|jdxsdj}|jdxsdj}|r|st dd fS|st d d fSt st d d fSt }t}|st d dfSt||||\}}}|t ddfSt xsd} tjdd j| d| j|dd} tj|d|| |||} | st ddfSt dS)z>Forward an email attachment to a recipient via Graph sendMail.Trrkr7rlrrrr`z&A recipient email address is required.rM rrdrU rrz a colleaguezA file was shared with youz

    z shared the file z7 with you from the ICAST Togen Email tool.

    zShared attachmentsubtitleuShared file — )rrr5z&The mail service rejected the message.rY ) rrrrrrr[rYrar=render_email_shellrNsend_email_with_attachment) rrkrlr[ r[rDr9r5rsenderrrUs r1email_share_attachmentrss   4 ( .BD((<(.B557JXXo.4";;=M!'R..0H =IJCOO EFKK STVYYY$&G  E >?DD5eWjR_`D, {ABCGG # % 6F  + +$ kdkk&! "";KDKK?DD,UGZWND#s {ABCGG ''  4  # ) ) +C %%))F#678FwiPQSVVV$6 4 4X^D""$--o>?q GF@ 6 !..s3y&$ F0C0IrJ% dV4&,>v,F HH @ ?@9:C??@s%H6I?Iz/calendar/eventsc t}|stddddfStjj dxsdj }tjj dxsdj }|r|std d fSt }|stddd dfS||dddd} tjtd|dd|dd|d}|jdk(rtdd|ddfS|jdk7rf|jr=|jj dij d |jd!dn |j}td"| dfSg}|jj d#gD]}|j!|j d$|j d%xsd&|j dxsij d'|j dxsij d't#|j d(|j d)xsij d*xsd|j d+xsij d,xsij d-xsd|j d.xsdd!dd/d0 td1||2S#t$r0tjjdtd dfcYSwxYw)3zReturn the signed-in user's M365 calendar events within a window. Query params ``start`` and ``end`` are ISO-8601 datetimes bounding the requested range (the client passes a padded window around the visible view). rcFrcrerKrqr7rstart and end are required.rr`#Calendar service is not configured.)rrmrz > \\  g & ," 3 3 5E <<  E " (b / / 1C c:;S@@  E xBDEHI IQ$ F K!!m77)= 9#*5'!22    3|WGHJMM M 3YY))+//'2.229diioN$($4$4 09:C?? Fiikoogr*   &&,vvi(8LffWo+00<FF5M'R,,Z8BFF:./&&,277 FL"FF;/52::>JPbUUV\]cac}-3Tc:!     T76 BB7 K :;DEsJJKs6)J996K21K2cddddd}g}tjD]\}}|jdds|jdd }|jd xsi}t|||}t |jd d |jd d|jdd ||D]m} | j d} |j d|d| || | d|jdxs|jdxsd |dd||j||dd odD]}t|} dD]v} | j| } | r| js(| jdD]:}|jd}|js& tj|jxsi}t|j"||}dD]\}}|j|xsd j%}|s, t'j(|dddj+}||ks||kDr_|j |d|j"||dd|ddd|jdxs|jdxsd |j"d|||j||dd =y|S#tt f$rYXwxYw#tt,f$rYwxYw) aWork Order date events within [win_start, win_end] (date objects) as a list of event dicts. Two kinds: recurring-schedule due markers and active (new/in-progress) WOs carrying a Desired Completion Date or Date Promised. Shared by /calendar/wo-events (the Calendar tool) and the Calendar dashboard tile (DVI-1196) so both stay in lockstep. Caller enforces the WO access gate. rrr Preventiver#r~Trrr rr7rrrrz recurring:rSrrr` z Recurring due workorder) rrrqrrrwo_filewo_kind wo_date_typerwor_type_labelr r$rr+r))rzDesired completion)r@ z Date promisedNrrw)rrrrrrrir rrr rrrrrrr9rrrrr)rr _type_labelr:r r~rr rerisorrv rrrrr rrQrns r1_wo_calendar_eventsrss%)" K F!9 : @ @ Bwwy$' 77:}577?+1r"?HhG1 b)3773CQ+G B'G= H##J/C MM"?"31SE: $LL4V Z8PVTV*& /$"-//(H"E%     4M'h'0% J,II$4$4$6^^G,! --0(G$5$5$78>BB+1668R@%ILE566%=.B557C !*33CHjINNP9}G  MM!&q1#(!$Sb"3Bx#'$&FF:$6$R"&&:L$RPR#$66#((-$,*5//(H*M"- # !  % 'P M9#G,' 2! !s$'J2'K2K K K K z/calendar/wo-eventsctjdxsi}t|stddgdfStj jdxsdj }tj jdxsdj }|r|std d fS tj|jd d j}tj|jd d j}tdt||S#ttf$rtd d fcYSwxYw)uaWork Order date events for the Calendar tool (DVI-630). Returns two kinds of all-day events within the requested window: * recurring schedules — one marker per due date across the window, and * active (new / in-progress) WOs that carry a Desired Completion Date or Date Promised. Visible only to Work Order Admins and Togen Admins (the ``togen_admin`` role already maps to both the iCast and Voyage Togen-Admin Azure groups), matching the PM-access gate. Non-privileged users get ``available:false`` so the client never renders the Work Orders filter for them. r'Frj)rrmr:rKrqr7rrrr`rrzInvalid start/end.T)rr:)rrrrrrhrrrrrrrr)r'rqrrrs r1calendar_wo_eventsrts ;;v  $"D t $|BGLL \\  g & ," 3 3 5E <<  E " (b / / 1C c:;S@@8"00sH1MNSSU  ..s{{3/IJOOQ T-iA CC  "812C778s*A&D''EEz/simple-qr/emailctjdxsi}|jdxsdj}|jdxsdj}|jdxsdj}|st dd fS|st d d fSt st d d fSt jttt }|jdg}d|vr3|jd|jdd}t d|d fS|rd|nd}|dd|dddd|iigddd|d gd!d"d#}tjd$t d%d&|dd'd(|d)*} | jd+vrN| jjdijd,| j d-d.} t d/| d0fSt d1S)2z=Email a QR code PNG as an attachment via Microsoft Graph API.Trrr7r~ rJrRrr`zNo QR code image provided.rM rrrrrr4rr2rN u QR Code — zQR Coderz&Please find the attached QR code for: rSrrrrO z qr-code.pngrnrP rR rrrrrrrrrrrNrKrT rU rY rT) rr[ image_b64rJrrrrrrr s r1simple_qr_emailr0ts-   4 ( .BD!'R..0H'"(b//1I 88E? b ' ' )C 9:C?? 9:C?? STVYYY33!3zSJ666779L\)2L4D4DWi4XY=cUCDcII&) SE"yG%=cUCLL )X!67 $E)#.$-  *#-J2    1/1B)L&|N'C&DE.  D z)"-11)TYYt_M09:C?? d r3z /mts/productsc g}tjrtjdD]} tj|j d}t |jdz j}|j|jd|j|jdd|jdd|d |jd t| S#tjtf$rYwxYw) z;Return a list of all stock products sorted by product code.rrrrrrr7r)rrr has_drawingc(|djS)Nrrsrs r1r z#mts_products_list..ts. 1 7 7 9r3r)rg)rrrrrrSTOCK_DRAWINGS_DIRrrrirrrrr)rgrrrs r1mts_products_listrytsH  "#((2 A zz!++w+"?@1qvvhdOCLLN $(HH^QVV$D#'88M2#>"hhx4#. !  MM9M: H %%(('2  sBC**DDz/mts/product/cht|}|stddfSt|dz }|js tdS t j |j d}t|d z j}d |d <||d <t|S#t$rtdcYSwxYw) zDReturn stored product data (description, weight) for a product code.Invalid product coderr`rFr rrrTr r) rrrrrrrryr)rrr rrs r1mts_product_getrts < (D 34c99"vU^3I    U##$zz)--w-?@&4& 5>>@KDM%D 4= $U##$s%BB10B1z /mts/productctjd}|jddj}t |}|st ddfSt jddt |d z }||jd dj|jd djd }|jtj|d dt dS)z.Save / update product data for a product code.Trrr7zProduct code is requiredrr`rMrrr)rrrrrrrrY ) rrrrrrrrrrr)rnr3rr rs r1mts_product_saverts t$A 55 $ * * ,D 4 D 78#==TD9"vU^3Iuu]B/557%%"%++-G GA6I d r3z/mts/drawing/ct|}|stddfSdtjvrtddfStjd}|jr)|jj j dstddfStjdd t|dz }|jt|td S) z(Upload a drawing PDF for a product code.rrr`rhzNo drawing file providedrzDrawing must be a PDF fileTrMrY ) rrrrrrEr|rrrr*)rrrrs r1mts_drawing_uploadrts < (D 34c99 %78#== i A ::QZZ--/88@9:C??TD9 4& -DFF3t9 d r3ct|}|s tdt|dz }|js tdt t |dS)z)Serve the drawing PDF for a product code.r`rrrr )rr rrrr*)rrrbs r1mts_drawing_getrtsJ < (D  c 4& -D <<> c SY): ;;r3z /mts/labelc v tjd}|jddj}|jddj}|jddj}|jddj}t jdijd d }|r|r|r|st d d fSt |}|st d d fSt |}|d|d}tjddt|z } t|dz } | j} d} d} | rt}|dt|d} tjtjj dd}|j#| |j%d|j'ddj)d}t+j,d\}} t/j0||j3| d t9d#d$d%&}|j;d'(|j=|j>}|j@}d}|d|zz }tBd)z }d*}|d+z}||z dz }|jr|jEtG||||,||zd-z}d.}|jId/d0||jK||d1z kDr:|d2kDr5|dz}|jId/d0||jK||d1z kDr|d2kDr5tM|d3zd2}|jO|||jQ|||d45||d1zz }|jSd6|jU||||z ||d7z }d8}d9} ||z |z }!||z | z }"d:}#||#z }$d}%d;|fd<|ffD]\}&}'|jId/d0d=|jO|||jQ|#|%|&d>5|jId/|&d5|jYdz}| rG|"d1z }(|(|z })t[d?|)d1z }*|*d@kDr)||*z dz }+||)|*z dz z},|jE| |+|,|*|*A|jId/ddB|jO|!|"dCz|jQ|d-dD|dE5|jO|!|"dz|jQ|d-dF|dE5|j]tG| | r5t.j^ja| rt/jb|  tdjddtd|dGz }-|||| dH}.|-jgtijj|.dIdJKtmdLrtodLdM|dN|d!||||||dOPt d|QS#t4$r }t7d |d!|d"d} Yd}~d}~wwxYw#| r6t.j^ja| rt/jb| wwwxYw)Rz4Generate an MTS label PDF and return it for preview.Trrr7rrrr'r9rzAll fields are requiredrr`rr rrMNz/stockproducts/drawings/rrr:r=r r r?r9rrrBrz[MTS] QR generation failed for r>r8r r)g9f@g s@r Fr rHg g?Cr5 ?rrrN $z Description:zWeight: Lr{ rxrr| rr} ryrPzDate: r4 z Created by: r)rrrqr_urlrrrrruMTS label created — )rrrrr )rUr)8rrrrrrrrrrrrrrDrErFrGrHrIrJrLrrrr[rryrArr r rr} r r~ r*r get_string_widthrCr r set_line_widthrsr r rLrrbrr/rrrrr r )/rnr3rr label_dater safe_code safe_daterr drawing_pathrr qr_tmp_pathrrMqr_imgrrlr6WHr` r logo_pathlogo_hlogo_wlogo_xr| font_sizecell_hbox_wbox_hbox_xbox_y label_col_w val_col_wr rr qr_bottomrqr_sizeqr_xqr_y prod_path prod_datas/ r1mts_label_creatertsL t$A 55 $ * * ,D%% r*002K UU8R & & (Fvr"((*JVR(,,VY?J {& 67<<%I 34c99 +IAi[-H5(H%9+T(::L&&(K FK(*83E)4D3ETJ  ''!,!6!6!F!FF OOF # KKDK !&&'g&NVVW\]F&..f=OB HHRL KK EK 2 K#snE U+  EE EE V^#%55 9%f*!     IIc)n&FI C VOa   [#y1""4(261i"n NI LLc9 5""4(261i"nY%r* 61 VT- VaZ 3 AJ* QF U"F U" $  . QR NGU LLc2 . JJvq ! HH[%H < LLW -Acr2 N JJv +Q / NN9eU#N > aA   I!A I$ A .G|G q(I/144 +G L ["a( 5%!)$ VJ<0< 5%"*% \*6cB 3x=! 277>>+6 IIk "TD9" {%%88I" I Ia87K";/ ,TF"[MB$(FJ\de   dX ..I  3D6C5A NK \ 277>>+6 IIk "7;s-B6WDW>G9W> W;W66W;>:X8z/mts/label/preview/ct|}|s tdt|z }|js tdt t |dS)z5Serve a generated MTS label PDF for preview/download.r`rrr )rr rrrr*)rrrbs r1mts_label_previewrhusD 8 $D  c D D <<> c SY): ;;r3z /mts/emailcXtjdxsi}|jdxsdj}|jdxsdj}|st ddfS|st d dfSt |}|st d dfSt |z }|jst d d fStst d dfS|j}tj|jd}tjtt t"}|j%dg}d|vr3|jd|jdd} t d| dfSd|} | dd|dddd|iigd|d |d!gd"d#d$} t'j(d%td&d'|dd(d)| d*+} | j*d,vrN| j-jdijd-| j.d.d/} t d0| d1fSt d2S)3z@Email an MTS label PDF as an attachment via Microsoft Graph API.Trrr7rrRrr`zNo label filename provided.rD zLabel file not found.rrM rrCrrrrr4rr2rN uMTS Label — rz$Please find the attached MTS label: rSrrrrO rrP rR rrrrrrrrrrrNrKrT rU rY )rrrrrrrrrr.rrZ rrrrrrrrrrgrr&)rr[ rrrbr pdf_b64rrrrrrr s r1mts_email_labelruusw   4 ( .BD!'R..0H$*113H 9:C?? :;S@@ 8 $D 01366 D D <<>45s:: STVYYY!Iy)009G33!3zSJ666779L\)2L4D4DWi4XY=cUCDcIItf%G%:4&ALL )X!67 $E #4$+  *#-J2    1/1B)L&|N'C&DE.  D z)"-11)TYYt_M09:C?? d r3zscadalogs@icastinc.comz /scada/logsctjttt}|j dg}d|vr3|j d|j dd}td| d fSd |dd d }tj dtd|d}|jdk(rtdt|z dfS|jdk7r^d} |jj dij d|jdd}td|jd| dfS|jj dg}g}|D]}|j dd} | r7 tj | j#dd} | j%d } d} |j d!i} | j d"d#k(r| j d$d} n|j d%d} |j'| |j d&d'| d(t|)S#t$r|jdd}Y+wxYw#t$rYwxYw)*uFetch recent messages from the SCADA logs mailbox via Microsoft Graph API. Requires the Azure AD app registration to have the application-level Mail.Read permission (or Mail.ReadBasic) and admin consent for the target mailbox. The app already authenticates with client credentials for sendMail, so the same credential works here — the only addition is the Mail.Read (or Mail.ReadBasic.All) scope in Azure AD > App registrations > API permissions. rrrrr4rr2#Failed to acquire Graph API token: rrrrrrzb/messages?$top=50&$orderby=receivedDateTime desc&$select=subject,receivedDateTime,bodyPreview,bodyrr;r#SCADA mailbox access denied (403): rKr7rNrGraph API error (rrU rrmrrrrrr&rr`rr_)rrrrJ)rrrrrrrrr SCADA_MAILBOXrg_scada_graph_error_detailrr&ryrrrrri) rrrrxrr rfrJmsgror body_contentbody_objs r1 scada_logsrus33!3zSJ666779L\)2L4D4DWi4XYB3%HI3NN#<#?"@A*G    1-A= =  D 37:STX:YY   3 %YY[__Wb155i4CQF01A1A0B#fXNOQTTTyy{w+H D 77-r2  #11(2B2B32QR;;'78 7762& << && 0#<< 26L77="5L wwy.9    *  7 %YYt_F %  s$=H",6I"H>=H> I  I cg}d}|jD]}|j}|s|jjdr$|j dddj}Yd|vs^|j d\}}}|j}|j}|s|s|j ||d||fS)zAParse a SCADA email body into (timestamp, [{label, value}, ...]).Nztime:rSr^rr)rrrErwrrFri)rreadingsrv rsrr rs r1_parse_scada_bodyrvsHI$$& Bzz|  ::< " "7 + 3*1-335I  $;"nnS1OE1eKKMEKKME%% @A B h r3c|jdi}|jddk(r|jddS|jddS)z.xv&Rq 21553C D QR",,live)rrUr )rrrrrrrrrrryrgrr_scada_persist_messagesrmrnrrrrr) rrrrxrrlrfr5rv rs r1 scada_statusrBvsQ77 %7:W !:::;;=   -""#6 8H8HR[8\]C),OPSu*UWZ[ [ '|N'C&DE. !!5m_EA A   3% 14Md4S SUXZ Z 3% 0 01 58QRV8W WY\^ ^yy{w+HI)RHR Gf==+,?,HIIx H9V DD/ Q%(DSE&JCPPQ I GHIs6A+E).+E) F) F 2FF F (F98F9z/scada/historyc tj}|r?t |td|jDdtjStjttt}|jdg}d|vr3|j!d |j!d d }t d | dfSd|ddd}t#j dt$d|d}|j&dk(rt dt)|z dfS|j&dk7r(t d|j&dt)|z dfS|j+j!dg} t-|i}|D]}t/|j!d} |j!dd } | } | r7 t1j2| j5d!d"} | j7d#} | d$k(rZt9t;|\} }| xs| }|D]7}t=|d%}|j?|gjA||dd&9| d'k(stCtE|}|d(}tG|d)k\r|d*d+ng}|d,D]}|j!d-} | r| j7d#n| }|D]i}|j!|d xsd jI}|r|jKd.k(r=|j?t=|gjA||d&k|jD]}|jMd/0t |tG|1S#t$r%tjj di}YtwxYw#t$r#tjj dY=wxYw#t$rYwxYw)2uPer-label time series for the History tab. Reads scada.db when it has data (populated by the collector, status fetches, and agent ingest — DVI-1095 P1), so history survives mailbox outages and stops re-parsing ~200 emails per call. Only while the store is still empty does it bootstrap by deriving series from the mailbox directly (persisting what it parses). z!SCADA history: store query failedc32K|]}t|ywrT)rCr s r1r/z scada_history..vs AAQ Ar)seriesrr rrrrrr4rr2rrrrrrrzc/messages?$top=200&$orderby=receivedDateTime desc&$select=subject,receivedDateTime,bodyPreview,bodyrr;rrrKrrrU rz)SCADA history: failed to persist readingsrrmr7rrrr5r)rUrrkrrr^rrn_dtx.xc |dS)NrUrXrs r1r zscada_history..vs !F)r3r)rr)'r query_seriesryrmrnrrrrrrrrrrrrrrrgrrrr rrrrrr_scada_norm_sensorr}ri_parse_scada_log_email_scada_log_body_textrCrrEr)r4rrrrxrrfrrr! ro time_labelr_tsr point_timerr)rLcols sensor_colsrr6rQpointss r1 scada_historyr%vs))+f A AA"!,!=!=!?A A 33!3zSJ666779L\)2L4D4DWi4XYB3%HI3NN#<#?"@A*G    1-A= =  D 37:STX:YY   3%d&6&6%7s;-d34569: :yy{w+HJ)F<!#'')"4577-r2  #11(2B2B32QR[[)9:  9 -.A#.FGMC* J ?(74!!#r*11'!G*=? ?U]+,@,EFF)$D(+D Q$q*BKf~ <WWU^>@R[[)9:j &>#"))'2$%$$g. C   ;    G EFGsfE=E='EAE=E) 5AE=:A E.E&"E=%E&&E=. E:7E=9E::E==(F('F()rM r rdrKz/assetsc tj} tdt|j dd} t|j dd}|tvrd}tj|j dxsdj|j dxsdj|j dxsdj|j d xsdj|j d xsdj||dz |z }t|d |||d S#t t f$rd}YwxYw#t t f$rd}YwxYw)u>Paged, filtered asset search for the Equipment → Assets tab.r^rOper_pager r r7rTareaform_idsheet)r asset_typer:r;r<r rr@ r)r@ rOr9r) rrhrCrrrr_ASSETS_PAGE_SIZESr search_assetsrr)rhrOr9r>s r1 assets_searchr@PwsM </equipmentc &tj|}|stddfStj|}tj|}g}|D]}|j |d|df|j d|fD]=}t|xsd}|s||Dchc]}|d c}vs+|j ||f?gt} } |D]^\}} t|D]K} | j d | j d f} | | vs*| j| | j | M`| jd d d}|D]\}}t|xsd}|snttd}t||| ||dud|vScc}w)uDVI-1472 P2 D4: the equipment view for one asset — the RtS defaults, Service Status, Oversight/LoRaWAN binding, WO history, and linked manual the old Equipment tab showed, now folded into the Assets detail. Read-open (like the asset browser); editing is gated by assets.edit on the routes it calls. WO history + linked manual are gathered across every equipment name (alias + the asset's description/tag) that could reference this asset.Asset not found.rr norm_namer9rr7rrrc,|jdxsdSrrrx s r1r z!asset_equipment..ws!%%-"52r3Tr Nr'r)raliases wo_historyrtrackedrB)rr requipment_record_for_assetequipment_aliases_forrirrrrrrrr#r)r assetrrNrBrextrarHrrOr_namerr)r_normr9rHs r1asset_equipmentrWws  " "3 'E /0#55  4 4S 9F005GJ 71[>1V9567))M*C0-#EKR0 Dz :!1 ::   tUm ,-35J!' e(. 'C77:& (;/equipment/trackrc tj|stddfStjdxsij d}tj ||\}}|rt|dfStj|}tdd td j d d |z||d t||S)a,Link an inventory asset to an equipment alias so its RtS/Oversight/ Service settings become editable (and it enters the registry consumers). Idempotent: an already-tracked asset returns its existing equipment record. Editing the ops fields afterward reuses PATCH /equipment/registry/.rKrrTrr9r`requipment_trackedr'rzTracked asset %s as equipment)r rr)rr) rr rrrrensure_equipment_aliasrQr r)r r9rHrrs r1asset_equipment_trackr[ws  ! !# &/0#55   D ) /R 4 4V @ A & !!-   ; 78se45s::   (#    ;     (#   s:E E +)EG EE G/F<GGF,, F87F8<GG GGG=G-,G=- G96G=8G99G=z /assets/savecptjdxsi}t|jdxsdj }t j Dcic] }||vs|||}}d|vr|d|d<|stddfSt j||xsd \}}}|rt|dfS|rm|d |d }|r ||d k7r||d <td |rdndtdjd|d d|d d|rdndddjt||t||Scc}w)aCCreate or update one asset from the Assets tab editor (DVI-1185 P2). Requires the `assets.edit` leaf (DVI-1472 P1 D5; admins + grantees). The base browser view stays open to all logged-in users; only management actions are gated. Every real change is audited to history with actor + per-field before/after.Tr original_tagr7model_idzNo fields provided.rr`Nr )r r  renamed_fromr rrr'rAsset r\r r r>rr )rSr ) rrr*rrrEDITABLE_FIELDSr save_assetr rrr)rrgrrrSr rr s r1 assets_savermwsY   4 ( .BDtxx/526<<>L".">"> LQ!t)aaj LF LT!*-z 23S88(33 $&E7E U#S(({+@ LE+,>>%1F> " \>}&/%%g.k"k"(g5 &/*,   001Ms  D3#D3cdjd|jd|jd|jdfDS)Nr c3$K|]}|r| ywrTrXr,rs r1r/z'_asset_model_summary..xs1./ 1rr9 manufacturermodel_norrrs r1_asset_model_summaryruxsE ;;1IIf%uyy'@IIj)+1 11r3z/assets/modelschttd}ttjd|vS)zEAll asset models (read-open, feeds the editor dropdown + catalog UI).r'r)rrC)r#rrrlist_asset_modelsrHs r1asset_models_listry$xs2 $GFO 4C ,88:/36 88r3rc tjdxsi}tj|\}}}|rt |dfSt ddt djdd |d zd t|z|d |d  t |S)NTrrr`r rr'rmodel:%srzAsset model added: %srhr r rt) rrrsave_asset_modelrr rrru)rrr rs r1asset_model_creater~-xs   4 ( .BD(99$?E7E U#S((*fo!!'* U4[0H'*>u*EE!$KG< >  r3z/assets/models/cPtjdxsi}tj||\}}}|rt |dfS|rTt ddt djd d |zd t|d d jt|||dt |S)NTrrhrr`r rr'rr{z Asset model edited: rr|r rt) rrrr}rr rrrurr)rhrrr rs r1asset_model_updater/sub-assembliesctj|stddfStj|}t t d}tddd|vi|S)zCOwn + model-inherited sub-assemblies for one asset (D7, read-open).rKrrr'rCrrX)rr rsub_assemblies_for_assetr#r)r r>rHs r1asset_sub_assembliesr]xsZ  ! !# &/0#55  2 23 7F #GFO 4C  A/36 A& AAr3z/assets/sub-assembliesctjjdxsdj}tjjdxsdj}t t j ||S)uHSub-assemblies for one parent (?parent_kind=asset|model&parent_ref=…). parent_kindr7 parent_ref)sub_assemblies)rrhrrrrlist_sub_assemblies)r! rs r1sub_assemblies_listrhxs` LL  ] + 1r 8 8 :D <<  L ) /R 6 6 8C ,"B"B4"M NNr3c|sy|jddk(rAtj|jd}d|r|dzS|jdzSd|jdzS)Nr7rrrzmodel %sr9zasset %s)rrr)r\rs r1_sub_assembly_scoperqxsh  ww}(,,SWW\-BCeU6]OO9NOO  - --r3c :tjdxsi}tj|\}}}|rt |dfSt ddt djdd |d zd |d d t||d |d|d|dt |S)NTrrr`r rr'rsub:%srSub-assembly 'r9z ' added to rr)sub_assembly_idrrr r  sub_assembly) rrrsave_sub_assemblyrr rrr)rr\r rs r1sub_assembly_createrzxs   4 ( .BD&88>C% U#S((+fo!!'*3t90D K,S13#&t9S=O!,/GE F  $$r3z#/assets/sub-assemblies/cDtjdxsi}tj||\}}}|rt |dfS|rNt ddt djd d |zd |d d djt|||dt |S)NTr)sub_idrr`r rr'rrrr9z ' edited: r)rr r r) rrrrrr rrrr)rrr\r rs r1sub_assembly_updaterxs   4 ( .BD&88fMC% U#S(( 0&/%%g.Hv4EF TYYvg79'-'B  D  $$r3c tj|\}}|rt|dfStddtdj dd|zd|j d d t |d |i td S)Nrr`r rr'rrrr9z' deleted from rr TrY )rdelete_sub_assemblyrr rrr)rrrs r1sub_assembly_deleterxs!44V.xs5Q235rr r9rsrs r1 _part_summaryrxs?  ;;5 TXXf-#/5 55r3c t|}|t |k(rtt |Sd|zS#ttf$rt|cYSwxYw)Nz%g)r rrr*r)rrs r1_parts_fmt_qtyrxsR !Hs1v+3s1v;5D1H5 z "1v s 4AActj}|jdxs|jdxsd}d|z}|r||nd}g}|D]}|jdrdnd} |jdrd nd } |jd ||jdxsd d |jdrd||jdznd d||jdxsd dt |jddt |jdd| d| ddd j |zdz} d||d|d| d} tj d| d} || fS) z=Build (subject, html) for the low-stock reorder digest email.r r9rzLow stock reorder alert: %sza stock changer Negativez Below minimumz#b91c1cz#b45309zJr7z r zCrzTr r zGz a[z
    PartLocationOn handMinStatus
    z$

    z. has reached its reorder point after zL. The parts below are at or under their minimum and should be reordered.

    u

    Manage stock in Togen → Equipment → Assets → Parts & inventory.

    Low stock — reorder neededzParts & inventoryr)r=_escrrirrr) trigger_part low_partsr escr r trig_labelrnrrocolortablerrs r1_parts_low_stock_emailrxsq   C   ) $ J (8(8(@ JFB+b0G&2\"8HJ D  uuZ0oUU:. I AEE)$*+23%%-3quuV}--RGAEE*%+,quuY/0quuY/0u!  , %(*wwt} 58B B ( GZ  (   + +&7J LD D=r3c g}|ddD]}|jd|jdxsdd|jdxsddt|jd d t|jd d |jd rdnd |jdxs|jdxsd}dddddd|ddj|d}t j ||d}|j y)uPOST a MessageCard to a Teams Incoming-Webhook URL. Self-contained (no Graph permissions) — an admin pastes a channel webhook URL in Settings.NrM z- **r r7z** r9u — on hand r z (min r r7r u ⚠ NEGATIVEzA part MessageCardzhttps://schema.org/extensionszLow stock reorder alertD9534Frz**z1** reached its reorder point. Parts to reorder: r0)z@typez@contextr themeColorrer&rrr7)rirrrrrr)webhookrrrPrr rrs r1_parts_low_stock_teamsrys E s^; EE)  " "AEE&M$7R$7 155+ ,nQUU9=M.N uuZ0Ob 8: ;;   ) $ L (8(8(@ LHB3,/ %(* G   wWb ADr3r cv |r|jdy|d}|jdstj|ytj}|jdsyt |jdddz}tj ||sy|jdxsg}|jd xsd }|s|sytj }|r( t|||\}} tj||| |r t|||tj|gy#t$r"tjjd YQwxYw#t$r"tjjd YowxYw#t$r"tjjd YywxYw)aBest-effort low-stock reorder notification, called after any stock change. If the part is now low (below reorder point / negative) and due per the per-part cooldown, send the reorder digest to the configured recipients (+ optional Teams webhook) and stamp the cooldown. If the part is no longer low, clear its cooldown stamp so a future dip alerts immediately. Never raises.rNrKr~cooldown_hoursrgN@rA teams_webhookr7zlow-stock email send failedzlow-stock Teams post failedzlow-stock alert check failed)rrclear_low_stock_alertget_parts_notify_configr part_alert_duelow_stock_partsrr=rryrmrnrrrecord_low_stock_alert) rr r rJ cooldown_minrArrrrs r1r r ys"=txx~- 4jxx  . .s 3 224wwy! SWW%5r:;dB **3 = "(b''/*0bg  002  D 6tY7C!E --fgtD  D&wi@ ++SE2 D $$%BC D  D $$%BC D = ;<=svF +F %F (4F .F F #'D1 F EF 1(EF EF (F F F  F (F87F8z /assets/partsrc tjjdxsdjxsd}tjjdxsdjdv} t dt tjjdxsd}d}tj||||dz |z}td ||ttjd |S#t tf$rd}Y^wxYw) Nr r7 low_stockrr r^rOrdr rr r)rOr9low_stock_countrX) rrhrrrCrrrr list_partsrrCr)r rKrOr9r>s r1assets_parts_listrHys   #  $"++-5A <<  K ( .B 5 5 7;O OC1c',,**627a89H  $ $ s(D1H3HJF  Rx#&|'C'C'E#F RJP RR z "s*6C++C?>C?z/assets/parts/low-stockc>ttjS)uEThe low-stock digest — parts below their reorder point or negative.r0 )rrrrXr3r1assets_parts_low_stockrXys 557 88r3z/assets/parts/notify-configc>ttjS)zkLow-stock reorder-notification config (recipients, optional Teams webhook, per-part cooldown, enabled).rc)rrrrXr3r1assets_parts_notify_config_getr_ys ,>>@ AAr3cZtjdxsi}|jd}t|trt j d|}tj|jd|xsg|jdd|jdd d }td d td jddd|drdndt|dt|ddk(rdndt|d|drdndfz|d|d|dt|ddt|S)NTrrAz[,\s;]+r~rr7rr)r~rArrr rr'rz parts:notifyu=Low-stock notifications %s — %d recipient%s, cooldown %sh%sdisabledr^rz, Teams webhook set)r~rrrr r)rrrrr*rFrrsave_parts_notify_configr rrCrrr)rrArs r1assets_parts_notify_config_postrgys:   4 ( .BD XXh F&#*f-  1 188I&,B/26((#3R8 3 E 2fo!!'*Oy)Iz h E(O(<(A"s 5!12 3%*?%; ! SEE !+5?"'(8"9!%eO& ?H   JJ !C DH s$<8C#7D#*DD*E?Ec Xtjdxsi}tj|\}}}|rt |dfSt dj d}tdd|d |d zd t|z|d |d  t|j dxsdj}|dvr^tj|d |d|\}}}|s<|r:|}tdd|d |d zdt|d|d|dd|d ||ddd t|dt |S)NTrrr`r'rr rr rzPart added: %sr r r r r7)r7rFz Opening stockrmr rzOpening stock for r>r r7)r rr rmz opening stockr r) rrr save_partrrrr rr*r adjust_stockr ) rrr rr openingadj_mvadj_errs r1assets_part_createrysF   4 ( .BD'11$7D'5 U#S(( FO   (E|5i$t*6L =#66:':< $((9%+,224Gi(55 JuFS'3D 4ET *!$'$y/C#':#' ?oO  P4o>  r3z/assets/parts/ctj|}|stddfSt|tj|tj|S)NPart not found.rr)r movementslinks)rget_partrlist_part_movementspart_links_detail)r rs r1assets_part_detailrysU   )D ./44 )==gF%77@ BBr3cjtjdxsi}tj||\}}}|rt |dfS|rTt ddt djd d |zd t|d d jt|||dt|dt |S)NTr)r rr`r rr'rr r rrrr za reorder-point changer r) rrrrrr rrrrrr )r rrr rs r1assets_part_updaterys   4 ( .BD'11$HD'5 U#S(( =0C0CG0LG#d#TYYvg%?A&7;  =4.FG  r3c tj|\}}|rt|dfStddtdj dd|zdt |zd |i td S) Nrr`r rr'rr zPart deleted: %sr r TrY )r delete_partrr rrr)r rrs r1assets_part_deleteryss**73KD% U#S((~WV_-@-@-I  "]4%887# % d r3z"/assets/parts//adjustctjdxsi}tj|}|st ddfS|j dt |j djdk7rU ttj|j dd}|t d dfS|t|d xsd z }n|j d }|j d xsdj}tj|||tdj d\}}}|rt |dfStddtdj dd|zdt|d|r |d d kDrdnd|r|d ndd|d d|rd|znd ||r|d nd|d ||d|ddt!|dt || S#ttf$rt d dfcYSwxYw)!zManual stock adjustment. Accepts a signed ``delta`` OR ``set_to`` (an absolute new on-hand, converted to a delta). Below-min/negative flag, never block.Trrrr`set_toNr7zEnter a number.r rrrmr'rrr rr zStock adjusted for r>rr r7u — %sr r )r rr rmr r r za manual adjustmentr )rmovement)rrrrrrr*rr _coerce_qtyrrrrr rr ) r rrrrrmupdatedrrs r1assets_part_adjustrys    4 ( .BD   )D ./44 xx%#dhhx.@*A*G*G*IR*O 9<33DHHX4FMNF >!23S8 8tI3!44!hhx &B - - /F+88vWV_-@-@-I KGXu U#S((,GFO4G4G4P   ' "'!2Q!6CR ?!)HW r 1793E$*Y  2 4 #(Xg->PT"9-$[1wz?RT U71FG ( 331:& 9!23S8 8 9s=.GG76G7z /assets/parts//linkc ztjdxsi}tj||j dxsdj |j d\}}|rt |dfStdd td j d d |zd |d|dd|d||dt |S)NTr target_kindr7 target_refrr`r rr'rr r z linked to r\r rr )r) rrr link_partrrrr r)r rrrs r1assets_part_linkrzs   4 ( .BD(($((=)/R668  KD% U#S((}GFO,?,?,H   T-($|*<>"D1 3  r3z!/assets/parts/links/c tj|\}}|rt|dfStddtdj dd|dzd |dd |d d |d |d|dtdS)Nrr`r rr'rr r r z unlinked from rr\rrr TrY )r unlink_partrr rr)r[r~rs r1assets_part_unlinkr*zs))'2JC U#S((gfo.A.A'.J I &  NC .L0ACy>37 9 d r3rc:tjd|dS)z7Absolute deep link a scanned label opens (part detail).z /?open_part=r)r=r;rs r1_part_label_deeplinkrBzs!.!8!8!:DJ GGr3cL|xsdjddjdS)z{FPDF core fonts are latin-1 only; replace anything outside it so an exotic part name can never 500 the label generator.r7rg r)rrr%s r1 _label_latin1rGzs& JB  y) 4 ; ;I FFr3crtjtjjdd}|j ||j d|j ddjd }tjd \}}tj||j|d |S)zBRender a QR PNG to a temp file (caller unlinks). Returns the path.rrr:Tr=r r r?r9rrrBr) rDrErFrGrHrIrJrLrrrr[r)rrMrRrrbs r1_make_label_qr_pngrMzs   $..>>AF OOD KKDK   w7  C K KE RCv.HBHHRLHHT%H Kr3cd}t|jdxsd} t|jdxsd} t|jdxsd} |jddd|jd|j |dz|dz|d z |d z |j d d d |rt |d |zz |d zd } ||| z d z z} ||zd z}|j|| || | || zdz}d}|jdd||j| |d |zz kDr=|dkDr8|dz}|jdd||j| |d |zz kDr|dkDr8|j||z||j|d |zz |dz| d||dzdzz }| rC|jddd|j||z||j|d |zz d| d| rb|jddd|j ddd|j||z||z|z d z |j|d |zz dd| zdyt |d |zz d} |j|||z||z| | ||z| zdz}||z|z |z }||z}d }|jdd|| rM|j| |kDr9|dkDr4|dz}|jdd|| r|j| |kDr|dkDr4|j|||j||dz| ||dzd!zz }| rN|jddd"|j|||j|d#| dd$|jdz}| re|jddd|j ddd|j|||j|dd%| dd&z|j d d d yy)'zjDraw one part label (QR + human-readable part no / name / location) inside the box (x, y, w, h) in mm.g@r r7r9rr;r* r^rg?gW@rrrrr r rrrr5 rrrnrz Location: N>@rPr-g?ryr rzLoc: r)rrr rrDr rLr~ r rr r r r )r6rr| rr} rqr_pathsinglepadr r9locqrrrtyfstxtws r1_draw_part_label_cellr[zs  CDHHY/526G &)/R 0D ,2 3CsC%sHHQUAE1q5!a%(r2r" QWa$h -AFa<3w{ 'TTR2 6 BY]  [#r*""7+q1s7{;R !GB LLc2 .""7+q1s7{;R 1s7B QWb3hs; b3hl  LLb" - JJq3w # NN1q3w;4sN ;  LLb" -   sC - JJq3wA a 0 HHQS[!\C%7sH C QS[$ BIIgSAGrRI8 S2 B Qr B SB BLLc2& c**73b8R!V a [#r* c**73b8R!VJJr2HHRc7#"s(S.B  ["a( 2r r3Tc + YY[3   ["a( 3S) 2r r1gCR01 2r2&  r3c g} tddd}|jdd\}}d}|rd nd \}}|d |zz |z } |d |zz |z } ||z} t|D]p\} } | | z}|d k(r|j||z}||z}||| zz}||| zz}t t | }|j |t|||| | | ||rt|j|D]} tj|S#t$rY'wxYw#|D]'} tj|#t$rY%wxYwwxYw) zReturn PDF bytes for a Letter-size label sheet. ``single`` renders one large label; otherwise a 2x5 grid flows across pages.r rLetterr Fr )gj@gfffffvq@g$@)r^r^)rrrr) rr rr rrrirrrrr/r)r0 r rSr6w_pageh_pager` r"rncell_wrr9rrslotrrrr| r rs r1_render_part_labels_pdfrzs Csh? U+%%V6 d1v:%-1v:%-$; ' TGAtxrJr) r ids_argwant_allr0 tokrr rKonerrldls r1assets_part_labels_pdfr!zs llx(.B 5 5 7;O OF||&,"335G   '-2446:NNH E==% #C))+C;;=((S2D T"  #  \\  c " (b / / 1 9T|| ,299;?SS''3&6qBBIK 12C77 ## $E  $SZ1_CG&uS99< a 3 3ARB RZZ%0A#22#6#K:K MM G ?@:S@A3FFGs< H I /I>I I z/assets//partsctj|stddfStditj|S)zParts associated with one asset (direct + via model + via sub-assemblies), each with stock. Gated with the rest of the stock UI (assets.inventory).rKrrrX)rr rparts_for_asset)r s r1 asset_partsr$zs<  ! !# &/0#55  7\11#6 77r3z#/assets/models//partsctj|stddfSttjdt |S)NzModel not found.rrrr)rrrparts_for_targetr*rs r1asset_model_partsr'zs?  ' ' 1/0#55 66wH N OOr3rctjttz j d}t } |j d|||fj}|j|duS#|jwxYw)zxTrue when this user already has an asset_viewed event for this tag within the dedupe window (so we skip re-logging).hoursrz{SELECT 1 FROM tool_history WHERE action = 'asset_viewed' AND ref = ? AND COALESCE(actor,'') = ? AND created_at >= ? LIMIT 1N) rrr_ASSET_VIEW_DEDUPE_HOURSrrrLrur[)r r r rOrs r1_asset_view_recently_loggedr,zs##%$<=>-.  =Dll eV,./7hj d? s #A77B z/assets/view-logc tjdxsi}t|jdxsdj }|syt djdxsd}t ||stdd ||d |z y) zRecord that the caller opened an asset's detail view (usage tracking). Fire-and-forget beacon from the Assets tab; throttled per user + tag so it never floods history. Always returns 204 (never blocks the UI).Trr r7)r7r'rr rzAsset %s viewed)r rr )rrr*rrrr,r )rr r s r1assets_view_logr/ {s}   4 ( .BD dhhuo# $ * * ,C  FO   ( .BE &uc 2}nEs036 8 r3z/assets/photo//cddlm}|ttj||}|rt j j|s tdt|dS)z;Serve one recovered asset photo from the asset_photos tree.r safe_joinrr )rM) werkzeug.utilsr2r*rASSETS_PHOTO_DIRrrbr r r)r rr2rbs r1 assets_photor5{sF) S667h GD rww~~d+ c T5 ))r3>r7rrrrrrz/assets/photo-uploadc Nddlm}m}ttj j dxsdj}|stddfStj|std|zd fStjjd Dcgc]}|s|js|}}|std dfS|ttj|}|std dfStj j#d }gg}}t%|D]\} }t&j(j+|jdj-} | t.vr|j1|jd||jxsd| z} d|| | fz} t'j2|d|j5t&j(j7|| |j1| |s-tddj7t9t.zdfStj:||t=ddt>dj d|d|tA|fz||dttjB||Scc}w)zAttach photos to one asset from the Add/Edit dialog. Same gate as /assets/save (assets.edit; admins + grantees, audited). Files land in the asset_photos tree beside the workbook-extracted ones.r)r2rr r7zAsset tag is required.rr`zUnknown asset tag %s.rrzNo files provided.zInvalid asset tag.rr^rz%s_%d_%sTrz/No image files among the upload (accepted: %s).rr rr'rzAsset %s: %d photo(s) attached)r photos_addedr )rr)"r3r2rr*rrgrrrrr rr rr4rrrrrrbrrE_ASSETS_PHOTO_EXTSrirrrr add_photosr rrC photos_for) r2rr rrrr~rrrrrr9s r1assets_photo_uploadr;,{sI: gllu%+ , 2 2 4C 56;;  ! !# &4s:;S@@ --h7 L11Q LE L 12C77\::;SAH 12C77    ) )/ :E7E% 1ggqzz*1-335 ( ( NN1:: & qzz*=w}UAt,, Ht, rww||Hd+, T  N6*<#=>?@ADE EC'~fo!!'*0CU3DDE2 4 ,11#6 HH7 MsJ"" J"/J"z/assets/photo-deletec ddlm}tjdxsi}t |j dxsdj }t |j dxsdj }|r|std d fStj||std d fS|t tj||}|r5tjj|r tj|t'ddt(dj d|d|d|d||gdttj*|S#t$r$t j"j%d ||Y}wxYw)z:Detach one photo from an asset (index row + file on disk).rr1Trr r7rztag and filename are required.rr`zPhoto not found.rz#Asset photo file not removed: %s/%sr rr'rrjz: photo removed (r7)r photos_removedr )r)r3r2rrr*rrrr remove_photor4rrbr rrrmrnror rr:)r2rr r9rbs r1assets_photo_deleter?W{sG)   4 ( .BD dhhuo# $ * * ,C txx #)r * 0 0 2D d=>CC  $ $S$ //0#55 S667d CD t$ Q IIdO~fo!!'*25t<tf5 7 ,11#6 77 Q JJ  Dc4 P Qs2E*FFc:tdjdxsdSr7rrXr3r1 _qc_actorrA{s 6?  w ' -2-r3c ttjdxsi}d|vd|vd|vd|vd|vd|vtjd Dcic] }|d |z|v c}d Scc}w) u2Per-user QC capability flags (DVI-1373 P2 + DVI-1410 P3). Admins implicitly hold every leaf; a granted non-admin holds whatever leaves are on their tool grant. These drive which QC tabs the SPA reveals — but the route decorators are the real boundary; a hidden tab is never the security gate.r'rrrrrrTrr)rrmixturesrr filebrowser production)r#rrrr)rHrs r1_qc_capsrF{s $GKK$7$=2 >C 3;3&!S($!S('3.!) 4 4d KM+a/C77M Ms A!cV|xsijdryd|zt|xsivS)zTrue if the user may capture Daily Production for ``segment`` (admin, or holds the per-segment qc.production. leaf).rTr)rr#)r'segments r1_qc_can_productionrI{s3  & w &+DTZR+P PPr3z/qc/metact}ttjdtjtj dtj tjDcgc]}|dj|dr|c}tjtjttj|t|dxr |dxr|d  Scc}w) alEverything the QC pane shell needs: active materials, active mixtures (with current per-yd3 targets), segments, and the caller's granular caps. Gated on ANY qc-family leaf (DVI-1410 P3) so a Daily-Production-only operator can load the reference data their form needs; /qc/batches stays {qc}-gated so a scoped operator can't enumerate other batches.Finclude_aggregatesT) with_targetsrErHrCrr) materials aggregatesrCr-daily_productionbatch_ticket_fields scan_settings ocr_templates custom_fieldscaps can_manage)rFrrlist_materialslist_aggregates list_mixturesrdaily_production_segmentsrget_batch_ticket_fieldsget_scan_settings_qc_ocr_segment_template_nameslist_custom_fieldsr)rUrns r1qc_metar_{s :D ))UC++-''T:))+&.%G%G%IC!,/33AiLAC %<<>00256113 Z(PT(^PZ@PQ? SSCs6 C<z /qc/batcheschtjjdxsdj}tj j |stddfStjjdxsdjxsd}tt j||S)Nrr7date must be YYYY-MM-DDrr`rH)r) rrhrrr_DATE_RErGr list_batchesrrHs r1qc_batches_listre{s LL  V $ * 1 1 3D    " "4 (67<<|| *0b779ATG 800w? @@r3cXtjdxsi}tj||j dt \}}|rt |dfStddt d |d xsd |d zd |dxsdd|dd|dd|d it |S)NTrrPr rr`r qc_batch_added QC batch batch_number#%drr: mixture_nameno mixryardsz yd3) captured for batch_datebatch_idrbatch)rrr create_batchrrArr )rrrrs r1qc_batch_creatert{s   4 ( .BD&&tTXXg->-6[:JE3 S!3&&'y{ . ! 8UU4[%8 8 . ! -X -uW~ , !E$K( *  r3z/qc/batches/cdtj|}|stddfSt|S)NBatch not found.rrrq)r get_batchr)rprrs r1 qc_batch_getrx{s3   x (E /0#55  r3c Ltjdxsi}tj|||j dt \}}|rt ||dk(rdfSdfStd d t d |d xsd |dzd|ddd|dit |S)NTrrPrgrrvrr`r qc_batch_editedrirjrkrr:roz) editedrprrq)rrr update_batchrrArr )rprrrrs r1qc_batch_updater||s   4 ( .BD&&xtxx7H-6[:JE3 S!#1C*C3LLLL( . ! 8UU4[%8 8% :MOE$K( *  r3rctj|t}|rt|dfSt ddtd|zd|itd S) Nrgrrr qc_batch_deletedzQC batch #%d deletedrprTrY )r delete_batchrArr )rprs r1qc_batch_deleter|sZ    ??r3z/qc/report/daily.csvc ^tjjdxsdj}tj j |stddfStjjdxsdjxsd}t j||}|dDcgc] }|d|d |d |d |d |d |df"}}|jd|ddddddf|jd|ddddddf|xsd}td|d|dgd|Scc}w)Nrr7rarr`rHrNr9captured_total capture_unitconsumption_totalconsumption_unit n_capturedn_out_of_range (batches) batch_count (total yards) total_yardsyd3rz qc-daily-rc r)MaterialCaptured total Capture unitConsumption totalConsumption unitBatches captured Out of range) rrhrrrrbrGrrrirq)rrHreprrnsegs r1qc_report_daily_csvr/|sT LL  V $ * 1 1 3D    " "4 (67<<|| *0b779ATG   g .C %  ' vY  !N"3 " #Q'9%: |_a 01 3 'D '  KKc-0"b"b"EFKK#m"4eRRLM  UC  $c* ABF HH 's1%D*cd}|dr$tj|d}|||dSg}|dD] }|j||d|d"|S)uFlatten a (already report-option-filtered) qc_store.range_totals result into report/CSV rows: [Plant, Material, captured, capture_unit, consumption, consumption_unit, batches, out_of_range] — per-plant rows when no segment filter, else the one chosen plant. This is a PURE flatten: row inclusion (DVI-1424 per-material "include in reports" exclusion + the zero-capture omission, formerly hard-coded here) is applied upstream by qc_store.filter_range_report(rep, get_report_options()) — the callers below filter first so the JSON viewer, CSV export, and Auditor report all agree. Shared by the /qc/report/range.csv route and the Auditor report.c f|Dcgc]!}||d|d|d|d|d|d|dg#c}Scc}w)Nr9rrrrrrrX) plant_labelrNrs r1mat_rowsz'_qc_range_report_rows..mat_rowsO|sa # $ ai#$a&7&'+=)><!$4"57$ $$s&.rHrNr-r)r segment_labelr)rrrrnrs r1_qc_range_report_rowsrE|so$  9~&&s9~6s;/00 D:> HS\3{+;<=> Kr3z/qc/report/rangectjjdxsdjxsd}tjjdxsdj}|-tj j |stddfStj j |stddfS|||kDrtddfStjjd xsdjxsd}t j|||}t j|t j}t| S) Nrqr7rstart must be YYYY-MM-DDrr`end must be YYYY-MM-DDzstart must be on or before endrHr]) rrhrrrrbrGr range_totalsfilter_range_reportget_report_options)rqrrHrs r1qc_report_ranger^|s\\  g & ," 3 3 5 =E <<  E " (b / / 1C !2!2!8!8!?78#==    " "3 '56;; US[=>CC|| *0b779ATG   sG 4C  & &sH,G,G,I JC # r3z/qc/report/range.csvc Ftjjdxsdjxsd}tjjdxsdj}|-tj j |stddfStj j |stddfStjjdxsdjxsd}t j|||}t j|t j}t|}|jdd |d dddddf|jdd |d d ddddf|xsd}td|dxsdd|dd|dgd|S)Nrqr7rrrr`rrHrrrrrrzqc-consumption-rr rrc r)Plantrrrrrrr)rrhrrrrbrGrrrrrrirq)rqrrHrrnrs r1qc_report_range_csvrq|s}\\  g & ," 3 3 5 =E <<  E " (b / / 1C !2!2!8!8!?78#==    " "3 '56;;|| *0b779ATG   sG 4C  & &sH,G,G,I JC  %DKK[#m"4b"b"bIJKK_c-&8%RRPQ  UC    ( (#j/3 @    r3z /qc/materialscBttjdS)NTr)rN)rrrWrXr3r1qc_materials_listr|s X44dK LLr3c  tjdxsi}|jd}tj||\}}|rt |dfSt ddtd|d d |rd nd | t |S)NTrrrr`r qc_material_savedz QC material 'r9z' rr r)material)rrrr save_materialrr rA)r material_idmatrs r1qc_material_saver|s   4 ( .BD((4.K%%dK8HC S!3&&*)+ Kkw>@  C  r3z/qc/materials/ctj|}tj|}|rt|dfSt ddt d|r|dn|zd|itd S) Nrr`r qc_material_deletedzQC material '%s' deletedr9rrTrY )r get_materialdelete_materialrr rA)rrrs r1qc_material_deleter|sn    ,C  " "; /C S!3&&,IK*Sc&kkR{+- d r3z/qc/report-optionschttjtjdS)NTr)r rN)rrrrWrXr3r1qc_report_options_getr|s, 8668%44dK MMr3c $tjdxsi}|jd}t|trO|j D]<\}} t |}tj||\}}|s.t|dfcStj|jd|jdd}td d td t|d|drd nd fz|t|S#ttf$rYwxYw)NTraggregate_modesrr`exclude_material_idsshow_zero_capture)rrr qc_report_options_savedzDQC report options updated (%d material(s) excluded, zero-capture %s)r hiddenr)r )rrrrrrrrrrset_report_modersave_report_optionsr rArC)rmodesr2rOmid_intr rr s r1qc_report_options_saver|s"   4 ( .BD HH& 'E% /IC c(--gt.|s15 ZZ\5515s#%r qc_batch_ticket_fields_savedz;QC Batch Ticket field tunables updated (%d field(s) hidden)rr ) rrrsave_batch_ticket_fieldsrrrr rAr)rrrs r1qc_batch_ticket_fields_saver|s   4 ( .BD  . .txx/A/GR HF5 55H5Y[')12  & !!r3z/qc/scan-settingsc>ttjSNrf)rrr\rXr3r1qc_scan_settings_getr|s H668 99r3c tjdxsi}tj|j dxsi}t ddt d|d|drd nd fz| t| S) NTrrr qc_scan_settings_savedz:QC Scan Tickets settings updated (thumb %dpx, auto-OCR %s) thumb_sizeauto_ocrreoffrrf)rrrsave_scan_settingsrr rArrns r1qc_scan_settings_saver|sx   4 ( .BD**488J+?+E2FH/y{LL)8J3G4UST  H %%r3z/qc/custom-fieldsctjd}|D]}tj|d|d<t|tjt tj S)zThe full custom field registry (incl. inactive) + an in_use flag per field so the manager can offer Deactivate vs Delete (delete only when unreferenced), plus the segment list + supported field types for the editor.Trrin_use)rr- field_types)rr^custom_field_in_userrrCUSTOM_FIELD_TYPES)rrs r1qc_custom_fields_getr }sf  ( ($ ?F <221T7;( < &$446#H$?$?@ BBr3c &tjdxsi}tj|\}}|rt |dfSt ddt d|dd |d d |d |d d t d|tjdS)zwAdd a custom field. Body: {label, type, choices?, required?, segments?}. The id is minted and immutable thereafter.Trrr`r qc_custom_field_addedQC custom Batch Ticket field 'rz ' added (rTr7r)r rTrrrUr r)rrradd_custom_fieldrr rAr^)rr rs r1qc_custom_field_addr}s   4 ( .BD**40JE3 S!3&&="9GneFm5$)$KvGI d%"55tL NNr3z/qc/custom-fields/reorderctjdxsi}tj|j dxsg}t ddt dtd|S) z+Reorder custom fields. Body: {order:[ids]}.Trrr qc_custom_fields_reorderedzQC custom fields reorderedr rUr)rrrreorder_custom_fieldsrr rAr)rrs r1qc_custom_fields_reorderr,}sZ   4 ( .BD  + +DHHW,=,C DF=">".JL d6 **r3z/qc/custom-fields/c 8tjdxsi}tj||\}}|rt ||dk(rdfSdfSt ddt d |d d |d rd nd||d dt d|tjdS)uEdit a custom field. Body may carry label/type/choices/required/segments/ active. The id is immutable — a referenced field is deactivated, not renamed away or deleted.TrrUnknown field.rr`r qc_custom_field_updatedrr ' updatedrvr7 (deactivated))r rvrrr)rrrupdate_custom_fieldrr rAr^)field_idrr rs r1qc_custom_field_updater7}s   4 ( .BD--h=JE3 S!32B+BCLLLL=";9;GnE(ObAQ&QS$,hHJ d%"55tL NNr3ctj|}|r|dn|}tj|\}}|st||dk(rdfSdfSt ddt d|zd |i td tj d  S)uiHard-delete a custom field — only when it has no captured values (otherwise deactivate it instead).rrrrr`r qc_custom_field_deletedz)QC custom Batch Ticket field '%s' deletedr rTrr)rget_custom_fielddelete_custom_fieldrr rAr^)rr rrUrs r1qc_custom_field_deleterI}s  % %h /E#E'NE**84GB S!32B+BCLLLL=";9;FN"H-/ d"55tL NNr3z /qc/segmentsctjd}|D]}tj|d|d<t|S)zThe full segment registry (incl. inactive) + an in_use flag per segment so the manager can offer Deactivate vs Delete (delete only when unreferenced).Trrrr-)r list_segmentssegment_in_user)segsrs r1qc_segments_getr`}sF  ! !4 8D 7--ag6( 7 D !!r3c Htjdxsi}tj|j d\}}|rt |dfSt ddtdtj|zd |i t d|tjd  S) znAdd a Production Segment. Body: {label}. The id is minted from the label slug and is immutable thereafter.Trrrr`r qc_segment_addedz QC Production Segment '%s' addedrHrr)rU segment_idr-) rrr add_segmentrrr rArr)rrrs r1qc_segment_addrk}s   4 ( .BD##DHHW$56HC S!3&&="4IK=++C01$c*, ds$22DI KKr3z/qc/segments/reorderctjdxsi}tj|j dxsg}t ddt dtd|S) z&Reorder segments. Body: {order:[ids]}.Trrr qc_segments_reorderedz QC Production Segments reorderedr rUr-)rrrreorder_segmentsrr rAr)rrs r1qc_segments_reorderr|}sX   4 ( .BD  $ $TXXg%6%<" =D="9=? dT **r3z/qc/segments/c tjdxsi}tj|d|vr|j dndd|vr|j dnd\}}|rt ||dk(rd fSd fSt d d td |dd|drdnd||ddt d|tjdS)uRename and/or (de)activate a segment. Body: {label?, active?}. The id is immutable — a referenced segment is deactivated (hidden from new capture), never renamed away or deleted.TrrNrv)rrvrUnknown segment.rr`r qc_segment_updatedzQC Production Segment 'rr7r)rHrvrr)rUrHr-) rrrupdate_segmentrrr rAr)rrrrs r1qc_segment_updater }s   4 ( .BD&&#*d?dhhw%-%5txx!4AHC S!32D+DCNN#NN="6ik7|3x=R>N%NP&0CMJL dC$22DI KKr3ctj|}tj|\}}|st||dk(rdfSdfSt ddt d|zd|i td tj d  S) ulHard-delete a segment — only when unreferenced by any batch/mixture (otherwise deactivate it instead).rr rr`r qc_segment_deletedz"QC Production Segment '%s' deletedrHrTrr)rrdelete_segmentrr rAr)rrrUrs r1qc_segment_deleter}s  " ": .E%%j1GB S!32D+DCNN#NN="6ik?%G$j13 d$22DI KKr3z/qc/ocr-templatesc ttjtjtjDcgc] \}}||d c}}tj dDcgc] }|d|ddc}tj Dcgc]}d|dz|d|d d c}tj Scc}}wcc}wcc}w) zEverything the OCR Region Template builder needs: existing templates, the per-segment assignments, and the templatable field catalog (header fields + a row per active material, D7-A).rFrKrr9rr9z custom:%srrTr)rrT) templates assignments header_fieldsrNrTr-)rrlist_ocr_templatesget_ocr_template_assignmentsOCR_TEMPLATE_HEADER_FIELDSrWr^r)rr[rrs r1qc_ocr_templates_getr}s --/99;%-%H%HJ!1c !3/J%33uMOD'1V95O!) ; ; =? +QtW4qz !& +?))+ - -JO ?sC)C Cc tjdxsi}tj|j d|j d|j dxsid\}}|rt |dfSt d d td |dt|dfz|dt|dd  t |S)NTrrr9r)rr9rrr`r qc_ocr_template_savedz6QC OCR region template '%s' saved (%d field region(s))) template_idrr)r ) rrrsave_ocr_templaterrr rArCr)rrrs r1qc_ocr_template_saver}s   4 ( .BD))hhtndhhv&6((8$*+,-HC S!3&&.ikH KS]+L--"4yF3x=4IJ L C  r3z/qc/ocr-templates/deletectjdxsi}t|jdxsdj }t j |}|stddfSt j|tdd td |d zd |i tdt jS)NTrrr7Template not found.rrr qc_ocr_template_deletedz#QC OCR region template '%s' deletedr9rr)rUr) rrr*rrrget_ocr_templaterdelete_ocr_templater rAr)rrrs r1qc_ocr_template_deleter%}s   4 ( .BD dhhtn" # ) ) +C  # #C (C 23S88   %0 5F Cs#% d(M(M(O PPr3z/qc/ocr-template-assignmentsc tjdxsi}tj|j dxsi}t ddt dt|z|t|S) NTrrr qc_ocr_template_assignedz3QC OCR template assignments updated (%d segment(s))r)r) rrrsave_ocr_template_assignmentsrr rArCr)rassignss r1 qc_ocr_template_assignments_saver*}si   4 ( .BD44TXXm5L5RPRSG1Eg,  w ''r3z /qc/mixturesrcBttjdS)NTr)rC)rrrYrXr3r1qc_mixtures_listr,}s H22DI JJr3c ftjdxsi}|jd}tj||t \}}|rt |dfStddt d |d tj|d |rd nd |dfz|d|ddt |S)NTrrrgrr`r qc_mixture_saveduQC mixture '%s' (%s) %s — v%dr9rHrr r ) mixture_idr r)mixture) rrrr save_mixturerArr r)rr/mixrs r1qc_mixture_saver3}s   4 ( .BD$J$$T:Y[IHC S!3&&)1 K//I?#I#i.5BB"$iC NC E 3 r3z&/qc/mixtures//versionsctj|stddfSttj|S)NzMixture not found.rr)versions)r get_mixturermixture_versions)r/s r1qc_mixture_versionsr8 ~s9    +12C77 H55jA BBr3z/qc/import/pipe/mappingcttjtjddtjtj S)zuThe admin's saved column->material overrides + the material list the Import panel's mapping editor binds against.TF)rrL)rrN ignore_value yards_value)rrget_pipe_material_maprW _PIPE_IGNORE _PIPE_YARDSrXr3r1qc_import_pipe_mapping_getr?~sE ..0))4=BD**(( **r3c tjdxsi}tj|j dxsi}t ddt dt|zd|it|S) NTrrr qc_pipe_map_savedz1QC Pipe import column mapping updated (%d mapped)rr) rrrsave_pipe_material_maprr rArCr)rrs r1qc_import_pipe_mapping_saverC&~sj   4 ( .BD  + +DHHY,?,E2 FE*)+Cc%jP5!# 5 !!r3z/qc/import/pipecTtjjd}| |jst ddfS|jj j dst ddfStjjdxs#tjjdxsd }t|jd v} tj|j}tj |t#| }|jd s!t |jdxsddfS|st%ddt#d|jdxsd|jdd|jdd|jdrdt'|dznd fzt)|jdDcic]}||j|c}dt |S#t$r}t d |zdfcYd}~Sd}~wwxYwcc}w)aImport (or, with analyze=1, dry-run analyze) a daily Pipe Mix Log .xlsx. The parsed batches land as `pipe` batches with source='import'; a same-day re-upload updates in place. Unmapped columns are returned in the report, never silently dropped.rNzNo spreadsheet uploaded.rr`rN z.xlsmz+Upload the daily Pipe Mix Log .xlsx export.analyzer7rr zCould not read the upload: %sr rErUrImport failed.r qc_pipe_importz0Pipe Mix Log import for %s: %d new, %d updated%sror]rrrunmapped — %d unmapped column(s)rodatesrrrskipped_no_date line_countrrJignored yards_column yards_blank yards_totalmix_code_columnmixtures_matchedunmatched_mix_codes)rr6rr])rrrrrrEr|rhrgr*rr>rJr ryrimport_pipe_mix_logrAr rCr)rrFrErrlr6rs r1qc_import_piperX2~s  &!Ay 78#== ::    & &'9 :JKSPP|| *Ogll.>.>y.IORG'l  "&::GIzz!&&(# ) )$ik29;F ::d VZZ0D4DEsJJ  +9;F <(/CJ1J 9a(::j).F:4F0GG/1 J33 ,AJJ7++D,%&6::a= D,- . & !!+ IH%> H"HH"H"cddlm}|j}|sydd|zi}dt|dd t|dd } t j ||d }|jdk7rd d d|jzfS|jj dxsd}|jjdsydt|dd t|dd} t j | |dd} | jdk7rd d d| jzfStj} | jdD]} | s| j| | j!d| |d fS#tj $r}d d t|dfcYd }~Sd }~wwxYw#tj $r}d d t|dfcYd }~Sd }~wwxYw)aFetch a SharePoint spreadsheet (by drive_id+item_id from a prior File Browser listing) into memory via the app-only Graph token. Returns (BytesIO, name, error). PDFs/other types are rejected. Mirrors the Open-in-Scan-Tickets download path (qc_scan_import_sharepoint).rr)NNrrr(https://graph.microsoft.com/v1.0/drives/r7r/items/?$select=name,file,sizerr;Ngraph.microsoft.comrKfile lookup failed (%s)r9z mixlog.xlsxrE)NNz6Only .xlsx/.xlsm spreadsheets can be opened in Import./contentTrrrxrr7file read failed (%s)r r )rZrrrrrr?_powerbi_request_errorrgrrEr|r>rJrrr) drive_idrrrDhdrmeta_urlrrlr9 content_urlrr2rs r1_qc_fetch_sharepoint_xlsxriZ~s +  # # %E ? I- .C+U7-DFHN   xb A }}T4q}}DDD 668<<  0=D ::< !3 4S 5H2.gB0GIKN   {C'0 2 }}T2Q]]BBB **,C73  IIe HHQK d?+  * *NT1#7LMMMN  * *NT1#7LMMMNs<E,F,F?F FFG.G<GGz/qc/import/pipe-sharepointc tjdxsi}t|jdxsdj }t|jdxsdj }|r|st ddfStj jd xs|jd xsd}t|j d v}t||\}}}|rt |d |vsd |vrd fSdfStj|t|}|jds!t |jdxsddfS|stddtd|jdxsd|jdd|jdd|jdrdt|dzndfzt|ddD cic]} | |j| c} dt | Scc} w)!uDVI-1410 P2 — the File Browser "Open in Import" workflow for a Pipe Plant .xlsx. Fetch the spreadsheet by ``drive_id``+``item_id`` (from a prior File Browser listing) and run it through the SAME Pipe Mix Log importer the local upload uses (``analyze=1`` for the dry-run preview + mapping editor; a bare POST commits). The file is re-fetched server-side on the final Import by the remembered ids, so nothing large round-trips through the browser.Trrer7r"drive_id and item_id are required.rr`rFrr GraphrVrU rGrUrrHr rIz=Pipe Mix Log import (SharePoint) for %s: %d new, %d updated%sror]rrrrJrK sharepointrL)rr r6rr])rrr*rrrrhrirrWrAr rCr) rrerrFrErr9rr6rs r1qc_import_pipe_sharepointrn~s   4 ( .BD488J'-2.446H$((9%+,224G ABCGG|| *Gdhhy.AGRG'l  "&::G/'BOD$ S!'S.HO3TTQTTT  ) )$ik29;F ::d VZZ0D4DEsJJ  +9;S <(/CJ1J 9a(::j).F:4F0GG/1 W33 ,D1\:/0Aq&**Q-/01 2 & !! 0sHz/qc/daily-production/configc ttjDcgc]<}|d|dtj|dDcgc] }|d|ddc}d>c}}tjScc}wcc}}w)zhThe per-segment Daily Production config + each segment's assignable mixtures, for the Settings card.rrrHr9r)rrrC)r-rc)rrrrYget_daily_production_config)rrs r1qc_daily_production_config_getrr~s $113541W:)1)?)?$)P R$%()w& B RS5335  77 R5s(A? A:A? :A? c\tjdxsi}tj|j dxsi}t ddt dt|jDcgc]\}}|j ds|c}}zd|it| Scc}}w) zISave the per-segment Daily Production config (enable + assigned mixture).Trrcr qc_daily_production_configz:QC Daily Production config updated (%d segment(s) enabled)r~rr) rrrsave_daily_production_configrr rArCrr)rrrrBs r1qc_daily_production_config_postrv~s   4 ( .BD  1 1$((82D2J KE39;L U[[]?TQaeeI.>q? @A% " %  @s ,B(B(z/qc/daily-productionctjjdxsdj}t j |st ddfSttjdxsi|st ddfStjjd xsdj}tjj|st d dfSt t j|| S) zThe Daily Production form context for one (segment, date): the assigned mixture's ingredients + any already-captured entry. Requires the per-segment qc.production. leaf (or admin).rHr7r rr`r' leaf (or admin).TrrHr7r rr`r'rxrrrorgrr qc_daily_production_savedzQC Daily Production for z captured for r:rnrz yd3)r)rHrrprry) rrrrrrzrrIrupsert_daily_productionrAr r)rrHrrrrs r1qc_daily_production_postr~sO   4 ( .BDxx "(b//1G   w '/0#55 gkk&17R A-./23 3 HHV  < 6 <" C C ED00$7@{DID# S!3&& HHW  #E2)+  " "7 +T IIgq !##D!IIdO- .  r3QC_OCR_SETTINGS_FILEzqc_ocr_settings.json QC_SCAN_DIRqc_scan_uploadsr z[0-9a-f]{6,40}\Zc ddlm}m} tjt j }t|jdxsdj}||vr|S |S#ttf$r Y|SwxYw)zThe effective QC OCR backend id: the QC-scoped override if set, else the global OCR-tool backend. Values are ocr_engine backend ids (local|claude).r)r) r$ r% r7) r"r) r$ rrrrr*rrrr)r) r$ rbs r1_qc_ocr_backendrs6 zz.88:; #)r * 0 0 2 H  > Z   > sAA++BBcddlm} tjtj }t |jdxsdj}||vr|SdS#ttf$rYywxYw)zGThe stored QC override ('' = inherit the global backend), for the pane.rr) r% r7) r"r) rrrrr*rrrr)r) rrs r1_qc_ocr_backend_rawrsl'zz.88:; #)r * 0 0 2%q-2- Z sAA#!A##A54A5cdtjtjd|xsdidy)zGPersist the QC OCR backend override. '' clears it (inherit the global).r% r7rrN)rrrr)r% s r1_qc_ocr_save_backendr)s'## Iw}"-a8:r3QC_FILEBROWSER_PATHS_FILEzqc_filebrowser_paths.jsonc Z tjtj}i}t |tr|jD]\}}tj|rt |ts,t|jdxsdj}|s[|t|jdxsdjt|jdxsdt|jdxsdd||<|S#tt f$ricYSwxYw)z{segment: {share_url, label, added_by, added_at}} for segments with a folder configured. Self-heals: drops entries for unknown segments or without a share_url. share_urlr7rrzryrrrzry)rrrrrrrrrrrzr*rr)rrrentrJs r1_qc_fb_load_pathsr:szz3==?@ C$ HC&&s+:c43Hcggk*0b1779C SWWW-34::< 3 9r: 3 9r: CH  J! Z  s'DD*)D*cXtjtj|dyr)rrrr)rs r1_qc_fb_save_pathsrSs((E!)DEr3c|xsdjj}|jdxs|jdS)Nr7r?r@)rrErw)rJrs r1 _qc_fb_url_okrWs: !!#A << " >all:&>>r3c ddlm}|j}|sydd|zi}dt|dd t|dd }gg}} |rt j ||d }|j d k(ry|j dk7r"ddd|j d|jddfS|j} | j dgD]4} | j drk|j| j d| j dxsd|| j d| j dxsij dd| j ds| j dxsd} | j} | jdrd} n| jdrd} n|j| j d| || | j d| j d| j d d!7| j d"}|r|jd$%|jd&%||dfS#tj$r}ddt|d#fcYd}~Sd}~wwxYw)'uTList a SharePoint folder's children — subfolders + PDF/spreadsheet files. Returns (folders, files, error). ``drive_id``/``item_id`` identify the folder (the segment root resolved from its share URL, or a subfolder id returned by a prior list). Each file carries a ``kind`` ('pdf' | 'sheet') so the client can type-filter and pick the right workflow (DVI-1410 P1/P2); folders carry ``modified`` so "Newest first" can order them too. Never raises — a Graph/transport failure comes back as ``error`` so the route degrades to a clear message rather than a stack trace.rr)NN>Microsoft Graph is not configured — cannot reach SharePoint.rrrZr7rr[zO/children?$top=400&$select=id,name,size,folder,file,lastModifiedDateTime,webUrlrr;r)NNuPfolder not found — it may have been moved or renamed, or the app lacks access.rKNzfolder listing failed (rrrrr9r childCount)rr9rer" child_countrrr6rEr<rdr)rr9rer! rdr"rz@odata.nextLinkr]c0|dxsdjSr; rsrZ s r1r z#_qc_fb_graph_list..& R668r3rc0|dxsdjSr; rsrZ s r1r z#_qc_fb_graph_list..saio2446r3)rZrrrrrrgr&rrirEr|r?rdr)rerrrDrfrJrrrrr| r9rKr! rls r1_qc_fb_graph_listr\sM+  # # %E + I- .CH2&gB(? ACUG!N""3R@A}}#I}}#T'(}}affTcl%DEE668Dhhw+ 666(#NN ffTlBFF6N4Hb$,$&FF+A$B(*x(8(>B'C'CL'Q $ST VVF^66&>/RD**,C||F+$&89& LL ffTlDh $bffVn$&FF+A$B#%66(#3 "56! 6*((,-C=B LL8L9 JJ6J7 E4   * *NT1#7LMMMNs2*H;00H;!B3H;B9H;;I'I"I'"I'c6 tjtz }tjdD]G} |j r4|j j |krtj|dIy#t$rYVwxYw#t$rYywxYw)z;Best-effort removal of scan upload dirs older than the TTL.r1TrO N) rU_QC_SCAN_TTL_Srrrrrr r:r)r rns r1_qc_scan_pruners  ~-!!#& A 88:!&&("3"3f"<MM!48       s53B AA=:B = B B B  B BBc2tj|xsdrtj|xsdsytj}||z |dzz j}t |j t |sy|j r|SdS)zResolve a stored scan PDF path, guarding against traversal. Ids are hex minted server-side; a non-hex id or an escape attempt returns None.r7Nr)_QC_SCAN_ID_RErGrr,r*rwr)scan_idfile_idr=rbs r1_qc_scan_file_pathrs    2 .    2 .    D 7Ng. / 8 8 :D t9  D *;;=4*d*r3c\ddl}|jt|} |dks||jk\r |j y|j |} |r t |nd}t|t|jjdz dxsd}|j||} t|xsddz}|r| j|} |j!| } | j#d |j S#ttf$rd}YwxYw#|j wxYw) u-Render one PDF page to PNG bytes for preview/vision. Full render fits to ~2000px like the Take-off preview; DVI-1460 P1 passes a smaller `width` for fast thumbnails (lower DPI) and an optional `rot` (0/90/180/270°) to correct a mis-oriented scan. Returns None if the page is out of range.rNr r^r r hr7rq)r=r?r*r@r[rAr rrrLrCrDrErHr prerotaterGrK) rr rErotr=rrOtarget_wrPrrQs r1_qc_scan_render_pngrs  ))CM "C Q;'S^^3 }}W% ',uU|&H8c$))//155s;Bskk$%#(mc! --$CooSo){{5! :& H  s6DDD'B DDDDDD+)rz batch date)rrz batch numberzbatch noticketz ticket numberz ticket no)r2r0z mix designdesign)rnyardagez cubic yardscyyds)z rock moisturerockzstone moisture)z sand moisturesand)initialsoperatorby)r|notecomments)rorjr0rn rock_moisture sand_moisturerr|cftjddt|xsdjS)uMatch the SPA's _qcNorm — lowercase, strip non-alphanumeric — for aligning template material actuals with the whole-page extractor's name-keyed rows.z [^a-z0-9]r7)rFr\r*rErs r1 _qc_norm_namers( 66,CRL$6$6$8 99r3g~jt?gQ?ctd|d|z td|d|z td|d|ztd|d|zdS)Nr r r r r r )r r r r )rCrL)rDr s r1 _qc_pad_rectrsX#tDzC'(#tDzC'(#tDzC'(#tDzC'(  r3cddlmfd}||}tD]'}|jr|S|t ||})|S)uRead one normalized 0-1 rect via targeted OCR (backend-aware). A failed region degrades to '' (blank) — never raises — so a bad template rect just leaves the field for the operator's manual correction, never blocks (D8-A). Exact-first, then progressively-padded retries so a slightly misaligned/ twisted scan or a tight box still captures the value (DVI-1442 fix #2/#4).rr c  |d|d|d|dfdxsdS#t$r*}tjjd|Yd}~yd}~wwxYw) Nr r r r Trr% r7z!QC template region OCR failed: %s)ryrmrnro)rrlr% r r rs r1_readz_qc_region_ocr.._readso !'4!D'1T7AdG4'+1/1 1  JJ  BC H s $ A AA)r"r _QC_REGION_OCR_PADSrr)rr rDr% rrQr r s`` ` @r1_qc_region_ocrrsR * +C"- 99;  JLs+,- Jr3ctjDcic] }|d|d }}tjjDcic]\}}||vr|||c}}Scc}wcc}}w)u{segment: template_name} for segments with an assigned OCR region template (DVI-1442) — surfaced in /qc/meta so the Scan Tickets tab can show which template a segment's scans use without needing the qc.settings-gated catalog.rr9)rrrr)rr.rrs r1r]r]sx*2)D)D)F GAQtWai  GE G$AACIIK Se| sO  H s A&A+c  |rtj|nd}|xsijdxsi}|st||||St tj }|Dchc] }||vs| } }|j D cic]\}} tj||| } }} |j D cic]\}} tj||| } }} t|| z xs| } ig||jd|jdd}| rit||||}t|jdxsi|d<t|jdxsg|d<|jdr|d|d<ttj}g}d}| D]I}t|||||}||d|<|j|d |j|||d |sE|d z }K| rtjd Dcic]}|d| }}t g}}| j D]\}}|jtj|}|s-t||||}|j!t#|d|j|d|d|j|d|d|d|d|s|d z }|dDcgc] }t#|jd|vr|"c}|d<|dj%|| rtj&Dcic]}|d| }}i}| j D]g\}}|jtj|}|s-t||||}|||d<|j|d|d|d|d|sc|d z }i|r||d<||d<t)| t)| zt)| z|d<||d<| ss|dk(rnt||||}t|jdxsi|d<t|jdxsg|d<|jdr|d|d<d|d<|Scc}wcc} }wcc} }wcc}wcc}wcc}w)uTemplate-aware structured extraction of QC batch fields from one scanned page (DVI-1442 D8-A). When the segment has an assigned OCR region template, each templated field is read via a targeted per-rect OCR call and un-templated fields fall back to the whole-page extraction; otherwise it's whole-page only. Never raises — returns {fields:{...}, materials:[{name, actual}], engine, error?, template?}.Nrr9r)rrNenginer rrNrrry )r)r! rrr^FrK)r9actualr)r)r! rr2rrYr)r)r! rrr custom_valuesregionstemplate_regions template_hitsTtemplate_fallback)rget_assigned_templater_qc_scan_extract_wholepagerOCR_TEMPLATE_HEADER_FIELD_KEYSrocr_field_material_idocr_field_custom_idrrrrrrirWrrrr^rC)rr r% material_namesrHr fields_map header_keysrtemplated_headersr mat_rects custom_rects run_wholerr header_labelsr region_hitsr)rQrmatsoverride_names region_matsrDrrcfieldsrcfs r1_qc_scan_extractr s;Bx--g6tH.b%%h/52J ) gw8 8h==>K$.Cq!{2BCC","2"2"4C$!Q2215AACIC&0%5%5%7DTQ33A6BqDDLD [#445FYIbG||F+HLL?C 7D'BC   }S[9 :   F sC D NN3 %([T3P Qq  !(+;'7S!,QUU6];>QSK K ,'/'B'B'DE!1T7A:EE %++- !ICX99#>?B 7D'BC&)M"T( # NN32g;#%d8C9 :q  ! #0C C N"#45IF!$\!2 3C&C )) gw8TXXh/526H  5 ;<K 88G =CL#'  JIDCDHC SFs* Q"*Q""Q';"Q- Q3%Q8) Q=c4ig|d}|dk(rLt|||}|< ddlm}|||}|jdi|d<|jdg|d<|S dd l m } | ||d d |xsi} | jD cic]1\} } t| xsdjj| 3c} } fd}tjDcic]\}}|||c}}|d<|S#t$r:} t j jd | t| |d <|cYd} ~ Sd} ~ wwxYwcc} } wcc}}w#t$rF} t j jd| |jd t| Yd} ~ |Sd} ~ wwxYw)u Best-effort structured extraction of QC batch fields from one scanned page. The `claude` backend uses the vision provider for structured JSON (all header fields + per-material actuals); the `local` backend OCRs the whole page and parses "LABEL: value" lines (no per-material mapping). Never raises — returns {fields:{...}, materials:[{name, actual}], engine, error?}. DVI-1460 P1/R2: `rot` rotates the vision pixmap for a mis-oriented scan (the local Tesseract path reads the upright page — rotation is vision-only).)rrNrclauderNr)extract_batch_ticketrrNz!QC scan vision extract failed: %srr )r r r r Frr7cD|D]}j|s|cSyrr)r,rrKs r1pickz(_qc_scan_extract_wholepage..picks+ "771:q6M "r3z QC scan local extract failed: %s)rrrrryrmrnror*r"r rrrE_QC_SCAN_LABEL_MAPr})rr r% rrrrqrrrlr rLrrrrr,rKs @r1rrsbG J41as17|!!#))+Q.J  7I6N6N6PQ71dDJQH  J)  ""#FL"3xG   KR * =sC wC)) J*sS:C6*E6D<: EE-E6 D9?/D4.D94D9< E F;FFz/qc/ocr/backendcdddlm}m}tt t ||S)zQC-scoped OCR backend (mirrors the OCR tool's pane). Returns the stored override ('' = inherit), the effective backend, the global backend, and the registered backend list.rr" )r% effectiveglobal_backendr& )r"r# r$ rrrr" s r1qc_ocr_backend_getrs* 7 .0Oy&I#CY S!3&&+J BGUC S!3&& 7%%/IF HHr3z/qc/filebrowser/filecddlm}tjj dxsdj }tjj dxsdj }|r|st ddfSdd lm}|j}|st d d fSd d |zi}dt|ddt|dd} tj||d}|jdk7rt d|jzd fS|jj dxsd} | j!j#dst ddfSdt|ddt|dd} tj| |dd} | jdk7rt d | jzd fS|| j%d!"d#$} d%| j'd&dz| j(d'<| S#tj$r"}t t|dd fcYd}~Sd}~wwxYw#tj$r"}t t|dd fcYd}~Sd}~wwxYw)(uStream one SharePoint PDF inline for preview. ``drive_id``+``item_id`` come from a prior list. PDFs only — defence in depth on the broad app-only token.r)Responserer7rrkrr`rrrU rrrZrr[r\rr;r]NrKr^r9r rz Only PDF files can be previewed.r_Tr`rarbr rcrr zinline; filename="%s"rr)r%rrrhrrrrZrrrrr?rdrgrrEr|rrrx) rrerrrDrfrgrrlr9rhrrs r1qc_filebrowser_filer8sE    ,299;H|| *0b779G ABCGG*  # # %E ABCGG I- .C+U7-DFHV   xb A }}6FGLL FFHLL 2ND ::<  (?@#EE )H2.gB0GIKV   {C'0 2 }}4q}}DEsJJ ANNgN6. 0D $,,sB"77 LL&' K)  * *V3C9NOPRUUUV  * *V3C9NOPRUUUVs<G;:H3;H0H+%H0+H03I(I#I(#I(z/qc/scan/import-sharepointc\tjdxsi}|jdsdt|vrtddfSt t j dxsi}t|jd xsd j}t|jd xsd j}|r|std d fSddl m }|j}|stddfSdd|zi}dt|d dt|d d} tj||d}|j dk7rtd|j zdfSt#|j%jdxsd} | j'j)d std!d fSdt|d dt|d d"} t+j,j.dd#} t0| z } | j3dd$t+j,j.dd#}| |d zz } tj| |dd%&}|j dk7r2t5j6| d'td(|j zdfSt9t|d)5}|j;d*+D]}|s|j=| dddddl} |j9t|}|j@}|jC|d-kr%t5j6| d'td.d fSt| || |d/g0S#tj$r"} tt| ddfcYd} ~ Sd} ~ wwxYw#1swYxYw#tj$r9} t5j6| d'tt| ddfcYd} ~ Sd} ~ wwxYw#tD$r2} t5j6| d'td,| zd fcYd} ~ Sd} ~ wwxYw)1uDVI-1383 P3 — the File Browser "Open in Scan Tickets" workflow. Download a SharePoint PDF (identified by ``drive_id``+``item_id`` from a prior list) into QC_SCAN_DIR and return the EXACT {scan_id, files:[{id, name, pages}]} shape /qc/scan/upload returns, so Scan Tickets loads it into its page queue with zero change to the downstream OCR/save pipeline. Requires qc.filebrowser (to have browsed the file) AND qc.import (Scan Tickets is qc.import-gated).r'rrz2Opening in Scan Tickets requires QC Import access.rrTrrer7rrkr`rrrrU rrrZrr[r\rr;r]NrKr^r9r rz-Only PDF files can be opened in Scan Tickets.r_r$ rMr`rarO rbrr rcz%Could not read the downloaded PDF: %sr^zThe PDF has no pages.rr9rrr)#rrr#rrrrr*rrZrrrrr?rdrgrrrEr|rWrXrYrrr r:r?rrr=r@r[ry)r'rrerrrDrfrgrrlr9rhrscan_dirrrbrrrr=rrs r1qc_scan_import_sharepointrcs ;;v  $"D 88M "3D99QRTWWW   4 ( .BD488J'-2.446H$((9%+,224G ABCGG*  # # %E ABCGG I- .C+U7-DFHV   xb A }}6FGLL 1668<</A> BD ::<  (LMsRR )H2.gB0GIKjjls#GW$H NN4$N/jjls#G w' (D V   {C'0 2 ==C  MM($ 7!81==!HI3N N #d)T " $b7; $HHUO $ $QiiD "  qy hd345s:: 7!($GH JJM  * *V3C9NOPRUUUV( $ $  * *V hd33C9NOPRUUUV Q hd3DsJKSPPQs!MAN!N!1N NN!+6O0N0N N NNN!!O-4.O("O-(O-0 P+9'P& P+&P+z/qc/scan/uploadcttjjd}|s&dtjvrtjdg}|Dcgc]}|s|js|}}|st ddfS|D]Q}|jj jdr-t dt|jzdfcSdd l }tjjd d }t|z }|jd d g}|D]}tjjd d }||dzz }|jt!| |j#t!|}|j$} |j'| dkr=t+j,|d t dt|jzdfcS|j/|t|j| dt ||Scc}w#t($rJ} t+j,|d t dt|jd| dfcYd } ~ cSd } ~ wwxYw)zAccept one or more PDFs; store each and return {scan_id, files:[{id, name, pages}]}. The client builds an ordered page queue across the returned files.rrzNo PDF uploaded.rr`rz'Only PDF files can be scanned (got %s).rNr$ TrMrO zCould not read r>r^z%s has no pages.rr)rrrr rrrEr|rr=rWrXrYrrrr*r?r@r[ryr r:ri) rrr=rrrrrbrrrls r1qc_scan_uploadrs.  MM ! !' *E Vw}},v&' 21qzzQ 2E 2 /0#55 ?zz!**62!J,QZZ8"9:;>? ??jjls#GW$H NN4$N/ C %**,""3B'7V+, s4y F))CI&CNNE IIK 19 MM($ 7!3,QZZ8"9:;>? ? '?1::+F"$ %!%$ 7# ..= 3( F MM($ 7-ajj93"@ABEF F Fs0H H+H#6H I* =I%I*%I*z /qc/scan/pagec Dttjjddtjjdd}|y t tjjdd}d}tjjd rd }n\tjjd r= t d td t tjjd } t tjjdd} t||||}|yttj|ddS#t $rYywxYw#t $rd}YzwxYw#t $rd}YawxYw#t$r}d|dfcYd}~Sd}~wwxYw)zDRender one page of an uploaded scan PDF to PNG for the preview pane.rr7rNrJrOrFr r4rrri` rr)rErr rr rnz scan-page.pngr ) rrrhrrrrCrLrryrr>rJ)rbr rErrqrls r1 qc_scan_pager ԁsu gll..y"=%ll..y"= ?D |#gll&&vs34 E||    #  Cc',,*:*:3*?&@ABE',,""5#./4!$u#F {' RZZ_{#2 44- #"# E   4(.334sT )E:s r1qc_scan_extractr sn   4 ( .BD c$((9b"9:!$((9b"9: "$1BE*13  V ' z "2^,c112 : z "s**D> E!E&>EE&E:9E:z/qc/scan/regionc tjdxsi}tt|j ddt|j dd}|t dd fS t |j d d }|j dxsi} t|j dt|j d}}t|j dt|j d}}ttdtd|tdtd|f\}} ttdtd|tdtd|f\} } | |z dks| | z dkrt dd fSd dl m}  | |||| | | fdt} t | xsdS#ttf$rt d d fcYSwxYw#ttf$rt dd fcYSwxYw#t $r-}t"j$j'd||d} Yd}~d}~wwxYw)uFRe-OCR a user-drawn rectangle on a scan page → {text} for one field.Trrr7rNr rrrOrr r`rDr r r r r r r r r r rzQC region OCR failed for %s: %sr%)rrrr*rrrrrr rrCrLr"r rryrmrnro)rrbr rDr r r r r r r r r r&rls r1qc_scan_regionrs   4 ( .BD c$((9b"9:!$((9b"9: @R[[)9:h &BC773+1r88:C#))+"6 KK+=c+B'1C!AB B BB,  & &tG <.parse_dates$&&sJ7<<>>r3rr7r)NNNrH)NNNz'date_from must be on or before date_to.sensorsr^rrN)rhrrrr rCr)reqr#rrr$rs r1_scada_parse_report_argsr&s? Fsxx||K<BBDE SXX\\)R8>>@AWW!4Jhhy)G 7|qSGAJ.!*""3'")7QQWWYqwwy7G7 gw ,, FEF8sA C'7C6 C6' C32C3ct|xsd}|jdr2|ddjdxsd}tdt |zd fStd t |d fS) z@Map a _build_scada_report error string to a JSON Flask response.r7rrPNrSz access deniedrrrr rU )r*rwrVrr)rr s r1_scada_report_error_responser(sy ciR.C ~~eQR$77:J6:RR   78H8M7NO PRU UUr3z/scada/report/typescvttDcgc]}|jc}tScc}w)zARegistered report types for the Log Reports picker (DVI-1095 F3).)rVr.)rr)rlr&rs r1scada_report_typesr+ʂs. ,=,?@q!&&(@1 33@s6z /scada/reportc tt\}}}}|rt|dfSttjj d}|j |||}|drt|dSd}|jrDtj |j}|j||}|d|d|dd }t|j|d |d |d |d |d|S)zPreview JSON for the SCADA report: per-day tables + available sensors + earliest available date, honoring the {date_from, date_to, sensors[]} filter. The optional ``report_type`` selects the registered engine (defaults to Kiln Temp).rr` report_typerNrpassr$)rr.r$rravailable_sensors earliest_dater)r-rrr/r0rcriteria) r&rrr(rhrbuildr( has_criteria_load_scada_configcriteria_config_keycriteria_summaryr) rrr$rr~r6 criteria_outrr s r1 scada_reportr8҂s(@'H$Iw S!3&& GLL,,]; .fmts2:;!''!AEE7!AJJt$4#56FFr3r*rN TAapplication/vnd.openxmlformats-officedocument.spreadsheetml.sheetr0)r&rrr(rhrr2r(r3r6r4r5workbookr) rrr$rr~r6r r2r;r9s r1scada_report_downloadr>s (@'H$Iw S!3&& GLL,,]; .% qwr3Tr )r)r:rrrrrrir9r&rr rrrr)rrr{ s r1scada_reports_listrCs G!"''1 A99; VVX NN *88ENNO_`kk    LL&L5 7 ##  sC CCz/scada/reports/downloadctjjdd}|r7|t|jk7s|j j dstddfSt|z j} |jtj|jstddfSt|d |d S#t$rtddfcYSwxYw) zHStream a single persisted XLSX report by filename (path-traversal safe).r9r7rN Invalid report name.rr`zReport not found.rTr<r0)rrhrrr9rEr|rr:r,r{rrrr9rbs r1scada_reports_downloadrG)s <<  FB 'D 44:??*$**,2G2G2P34c99  $ - - /D: *2245 <<>01366  T   :34c99:s#CC*)C*z/scada/report-viewctjjdd}|r7|t|jk7s|j j dstddfSt|z jdj} |jtj|jstdd fS tj|j!}t|| S#t$rtddfcYSwxYw#tj"t$f$rtd d fcYSwxYw) uReturn the normalized view-model JSON for a persisted report (DVI-1163). The report scheduler writes a sibling ``.json`` next to each generated ``.xlsx`` at generation time (scada_report.write_report_view_model); this reads it back for the in-app read-only viewer without re-parsing the XLSX. ``name`` is the XLSX filename (path-traversal safe). Reports generated before this feature shipped have no sibling JSON and 404 with a hint — their XLSX can still be downloaded. r9r7rN rErr`ruNo saved view for this report — it was generated before the viewer was added. Regenerate the report to view it in-app (the XLSX can still be downloaded).rzReport view is unreadable.r)r9 view_model)rrhrrr9rEr|rr:r r,r{rrrrrrr)r9r vms r1scada_report_viewrK@s1 <<  FB 'D 44:??*$**,2G2G2P34c99"T)66w?GGII:/779:    89;>> >@ ZZ ++- .  ,, :34c99:  ' *@9:C??@s$#D#DDD'EE)check_interval_minutesstale_after_minutesc <iiiiiitttigtiddid }tj r2 t jtj}t|jdtr|d|d<t|jdtr|d|d<t|jdtr|d|d<t|jdtr|d|d<t|jdtr|d|d<t|jd tr|d |d <t|jd tr4|d jtDcic]}||d vr ||d |c}t|jd trt|d |d <d |vrtj|d |d <t|jd trt|d |d <t|jdtr-|djd}dt|tr|ndi|d<|S|Scc}w#t jt f$rY|SwxYw)zReturn shared SCADA config: {ranges: {label: {low, high}}, enabled: {label: bool}, aliases: {label: str}, reporting: {label: bool}, notify: {label: bool}, meta: {label: {type, location, unit}}, collector: {check_interval_minutes, stale_after_minutes}}.planr7) rangesr~rNrrrrreport_criteriareport_approvers report_emailrrPr~rNrrrrrQrRrSr)rSCADA_COLLECTOR_DEFAULTSr,r*SCADA_CONFIG_FILErrrrrrrr normalize_approversr*rr)rrrrOs r1r4r4fsWY!":;#8#<$& 5b 9$b\ +H  "# JJ0::<=E%))H-t4%*8_"%))I.5&+I&6#%))I.5&+I&6#%))K0$7(-k(:%%))H-t4%*8_"%))F+T2#(= %))K0$7%,,5.E+..u[)!,,. %))$56=.C+,/.*+!U**>>013+,%))N3T:+@.),+(%))K0$7[)--f5JtS$9Dr)C% O8O+.&$$g.   O s&EI> I9#CI>9I>>JJcXtjtj|dy)z$Persist shared SCADA config to disk.rrN)rUrrrrs r1_save_scada_configrXs  F1!=>r3r7c&gggdddddddgdddd S)Nr7Tr~rOlayersstyle show_legend) facilitiesplansstylesstyle_default_lightstyle_default_darkequipment_plan visitor_planlogistics_planoverview_dashboardrXrXr3r1_oversight_default_configrgs5rR#'t "/3B",.t#E F Fr3cddgdddS)NTr7rZrXrXr3r1_oversight_overview_defaultsrisR2 !!r3c D|jdxsgDcgc]6}t|tr$|jdr|jdr|8}}|s tdddg}||d<|Dcgc]}|d }}|jd|vr|d|d<|jd|vr|d|d<|jd gD]}t|jd tr|jd ni}|j Dcic]-\}}||vr$t|tr|jd r||/}}}|j d d }|j dd |j dd } } |r|d|vr || | d||d<||d <|Scc}wcc}wcc}}w)u]Normalize styles in-memory on every load (pure — no write on read). Seeds a "Standard" style when none exist, folds a legacy per-plan `image` into it, sanitizes each plan's `images` map, and repairs dangling light/dark default style ids. The migrated shape persists the next time any admin write calls _save_oversight_config. r`rr9Standardrrr9rrarbr_imagesrr~ Nimg_wimg_hrrr} )rrrOVERSIGHT_SEED_STYLE_IDrr) rJrr`r| rrmrrrblwlhs r1_oversight_migrate_stylesrtÃs''(+1rHAAt$tvHFH 0*qQRCM" #q1T7 #C # ww$%S0%(V !" ww#$C/$'(=$> ! WWWb !$.quuX$Ex2)/Mgc2CZJr4$8RVVF^r'MMw%w%quuWd';B c/0>:@rPR1SF3,- .(  J'H $Ms;F+ F 2Fc t}tjr tjtj }t |jdtr7|dDcgc]%}t |tr|jdr|'c}|d<t |jdtr7|dDcgc]%}t |tr|jdr|'c}|d<t |jdtr|d|d<dD]*}t |j|ts#||||<,t |jdtr|d|d<t |jdtr|d|d<t |jdtr|d|d<|jd }t |trt}t|jd d |d <t|jd xsd |d <t |jdtr+|dDcgc]}t|st|c}|d<t|jdxsd |d<t|jdd |d<||d <t|St|Scc}wcc}wcc}w#tjtf$r Yt|SwxYw)zJHelper-gated read of the Oversight config (never touch the file directly).r^rr_r`)rarbrcrdrerfr~TrOr7r[r\r])rgOVERSIGHT_CONFIG_FILErrrrrrrrr*rirrrrt)rJrrrr)rrls r1_load_oversight_configrxs # %C$$& JJ4>>@AE%))L14805l0C%M1(21d(;d &'%ML!%))G,d3+0> Ha#-a#6155;!" HG %))H-t4 %hH D *eiinc2$SzCH *%))$45s;(-.>(?$%%))N3S9&+N&;N#%))$45s;(-.>(?$%/0B"d#57$( 4)@$Ay!!$RVVF^%9r!:vbffX.58:8 'O1AA'OF8$"%bffWo&;"<w(,RVVM4-H(I}%,2() %S )) $S ))9%M H&(P$$g.   $S )) sKA K.*K ,K*K.AKDKK K-A K KLLcXtjtj|dy)z+Helper-gated write of the Oversight config.rrN)rvrrrrNs r1_save_oversight_configrzs$$TZZA%>?r3ctjr tjtj }t |t rL|Dcgc]@}t |tr.|jr|jjBc}S gSgScc}w#tjtf$rYgSwxYw)z@Return the list of granted Oversight-editor emails (lowercased).) OVERSIGHT_EDITORS_FILErrrrrrr*rrErrrVs r1_load_oversight_editorsr} s%%' **3==?@C#t$36=a%a-!'') )==% I2I =$$g.   I rXc:tg}}|xsgD][}t|ts|jj }|s5||vs:|j ||j |]tjtj|d|S)zJPersist the editor list, de-duplicated and lowercased. Returns saved list.rr) rrr*rrErrir|rrrrZs r1_save_oversight_editorsrsE2'Dl!!S! wwy  D$ HHTN NN4 !%%djj&CD Nr3cX|sy|jjtvS)zGTrue if the email is on the Oversight editors list (per-request check).F)rrEr}r]s r1_is_oversight_editorr's&  ;;=   $;$= ==r3ch|xsi}|jdryt|jddS)a]Whether a user may use the Oversight Locations/plan editor (DVI-1103). Togen Admins always qualify; other users qualify only if their email is on the granted editors list. Evaluated per request, so grants take effect without a re-login (mirrors the DVI-1024/1052/1082 pattern). Managing the grant list itself stays Togen-admin-only.rTrr7)rrr-s r1rr.s2 :2D xx  " 5 66r3cN|dtjjddS)Nr r)rWrXrYrs r1_oversight_new_idr;s'XQtzz|'',- ..r3cT|xsi}g}t|jdtr|jdni}|G|j|}t|tr|jdr|j|dnr|j Dcgc]4}t|tr"|jdr|jd6}}|jdr|j|d|D]} t |z j ycc}w#t$rY.wxYw)uDelete a plan's image files — one style's file, or all when style_id is None (plan/facility delete cascade). Legacy `image` handled too.rmNrr~ )rrrrirOVERSIGHT_PLANS_DIRr/r)rOstyle_idrrmrrs r1_oversight_delete_plan_imager?s :2D E#-dhhx.@$#GTXXh RF ZZ ! b$ BFF6N LLF $*0--/=Br4(RVVF^== 88G  LLg '  5 ( 0 0 2 =   s9D<D D'&D'c |jdd}tjdd|tj}tjdd|tj}tjdd|tj}tjdd|tj}tjd d|tj}tjd d|tj}tjd d|tj}|j dS#t$r|cYSwxYw) zStrip
    Togen Signage
    Connecting…
    rcBtt}d|jd<|S)uvToken-authed full-screen kiosk page (plan D4). The device token is passed as ?token=…; all rendering + polling is client-side (plan D3 — the agent is thin, all display logic lives here) so reassignment/edits take effect live with zero agent-side logic. Served as a self-contained page (no SPA boot, no MSAL) so an unattended Chromium kiosk can render it.ztext/html; charset=utf-8r)r_DISPLAY_KIOSK_HTMLrxrs r1 display_kioskr s" , -D#=DLL Kr3z/oversight/datac td}tjjdxsdj tjjdxsdj dDcgc]}|s| }}t }tfd|dDd}|td d fSt}ti}}|D]?}|j|} | r | d |s"|j|| d ||<Ag} |jdgD]} | jd}|tk(rg| j| jd|| jd| jd| jd| jddddd||vr|j|i} | jd} | j| jd|| | jd| jd| jdd| | v| j| d|jdxsijDcic])\}}||jd|jdd+}}}t|d|jdd|jdt||d| t!|Dcgc] }|||ddc}Scc}wcc}}wcc}w) uLive marker data for one plan, filtered server-side by layer access. Placements on layers the user can't access are omitted entirely — the client layer checkboxes are a display convenience, never the gate.r'rOr7r[rc34K|]}|dk(s |ywr rXrs r1r/z!oversight_data..?qAdGw,>?r r_Nrrrrrdrrrrrr| rTrrmrr} rr9r)rr9rrrmr)rOrr[)rrrhrrrrxrrrrrrrirrr)r'rwrrJrOrrrrrrrr{ rrrrmrs @r1oversight_datar s 6?D||'-2446G%ll..x8>BEEcJPa!PJP "C ?CL? FD |-.33 "H"ub J-||C >4>$/ s*DN, S - Jhh|R( ffWo * *   ffTlvve}VVC[VVC[,    j    c2 &ffUm&&,VVGR(BYFF3K  + @#hhx06B==?A#r266#;77AFA J(<((:.<6;!*-/Xc]7%;</  00_QZA/s0K,8K,.K1K7 c` t}tfd|dDd}|sy|jdxsi}|sy|xsdj}|j|xs|j|d}|s;t |dDcic] \}}|d | c}} |t | fd  d }t |d z } | jsy| jjdj} tj| d} tt| | Scc}}w)aResolve and serve a plan's image for one style. Falls back to the light default, then any imaged style, so a stale/unknown style id still renders something rather than a broken viewer. Shared by the login-gated tool route and the device-token display route (DVI-1213 P3).c34K|]}|dk(s |ywr rXrs r1r/z1_oversight_plan_image_response..Tr r r_NrJrmr7rar`rc(j|dS)Nir)rrs r1r z0_oversight_plan_image_response..^s1c1Br3rrrrrr )rxrrrrrrrr!rVrEOVERSIGHT_IMG_EXT_MIMESrr*) rr\rJrOrmrrrrrrr:rs ` @r1_oversight_plan_image_responser Ns ! "C ?CL? FD  XXh  %2F  ;B   C C BFJJs+@'ABB (1#h-(@A14!A F6'BCAF G r&z )B ::< ))  3  % % 'C " & &s,F GD SWt ,,BsD*z/oversight/plan-image/c\t|tjjdxsdS)zEServe a plan's image for one style (?style=), login-gated (the tool).r\r7)r rrhr)rs r1oversight_plan_imager gs& *'7<<3C3CG3L3RPR SSr3z/display/plan-image/ct}t|t)tjdxsij dsyt |t jj dxsdS)uDevice-token-authed plan image for the kiosk Oversight tile (P3). The kiosk has no user session, so it can't use the login-gated route above; a valid (non-revoked) display token is required. A logged-in session also passes (DVI-1217 fullscreen preview) — the same exposure as the login-gated tool route above. Plan images are not sensitive (people layers are stripped from the display data path — D3).r'rrr\r7)rrrrrr rrh)rr s r1display_plan_imager ns^ ! "Eu&;&=>F F#)r..w7( )'7<<3C3CG3L3RPR SSr3z/oversight/style-savectjdxstj}|jdxsdj dd}|jdxsdj |st dd fSt }r.tfd |d Dd}|st d d fS||d<n/td|d j|t|d dt|t dS)NTrr9r7rrzStyle name is requiredrr`c34K|]}|dk(s |ywr rXr's r1r/z'oversight_style_save..sAA!D'S.aAr r`Style not foundrstyrlrUr rrrgrrrrxrrrirCrz)rr9rJr\rs @r1oversight_style_saver }s   4 ( 8GLLD HHV  " ) ) +CR 0D 88D> R & & (C 56;; "C AXA4H!23S8 8f & H s3x=/A B D3 ds ##r3z/oversight/style-deletec~tjdxstj}|jdxsdj t }t fd|dDstdd fSt|dd krtd d fS|dDcgc] }|dk7s |c}|d<|d D]<}|jdxsivst||djd>|ddd}|dk(r||d<|dk(r||d<t|tdScc}w)NTrrr7c3.K|] }|dk(ywr rXr's r1r/z)oversight_style_delete..5!qw#~5rr`r rrr^zAt least one style must remainr`r_rm)rrrarbrY ) rrrgrrrxr2rrCrrrz)rrJrrrrs @r1oversight_style_deleter sL   4 ( 8GLLD 88D> R & & (C "C 5s8}5 5./44 3x=Q=>CC #H @14CQ@CM \' 155?(b ) (S 9 hKOOC &'8}Q%H !S(%- !"  C'$, !3 d As " D:0D:z/oversight/style-defaultsctjdxstj}t}|dDchc]}|d }}|j dxsdj }|j dxsdj }||vs||vrt d d fS||d <||d <t|t d Scc}w)NTrr`rr{r7rzzUnknown style for defaultrr`rarbrY )rrrgrxrrrrz)rrJrr| r{rzs r1oversight_style_defaultsr s   4 ( 8GLLD "CM *q1T7 *C * XXg  $" + + -E HHV  " ) ) +D C4s?893>>!&C $C3 d  +s Cz/oversight/facility-savectjdxstj}|jdxsdj }|jdxsdj |st ddfSt }r.tfd |d Dd}|st d d fS||d<n/td |d j|t|d dt|t dS)NTrr9r7rzFacility name is requiredrr`c34K|]}|dk(s |ywr rX)r,rfids r1r/z*oversight_facility_save..ŮsC!AdGsNACr r^Facility not foundrfacrlr r )rr9rJr r s @r1oversight_facility_saver s   4 ( 8GLLD HHV  " ) ) +D 88D> R & & (C 893>> "C Cs<0CTJ!56; ;F & L  s3|3D/E F H3 ds ##r3z/oversight/facility-deletectjdxstj}|jdxsdj }t }|dDcgc] }|d|k7s |c}|d<g}|dD]3}|jd|k(r t |#|j|5||d<t|tdScc}w) NTrrr7r^r_rrY ) rrrgrrrxrrirzr)rr rJrrI rs r1oversight_facility_deleter Ѯs   4 ( 8GLLD 88D> R & & (C "C$' $5Hq4CHC  D \ 55  # ( + KKN  CL3 d Is  C+Cz/oversight/plan-savec ,tjdxstj}|jdxsdj }|jdxsdj |jdxsdj xsd}|jdxsdj |st d d fSt }r%tfd |d Dst d d fS|r|k(rt d d fSr8tfd|dDd}|st d dfS||d<|d<||d<n3td|dj||t|digdt|t dS)NTrr9r7rrrzPlan name is requiredrr`c3.K|] }|dk(ywr rX)r,rrs r1r/z&oversight_plan_save..sKAAdGx/Krr^r zA plan cannot be its own parentc34K|]}|dk(s |ywr rXr s r1r/z&oversight_plan_save..s?1$3Q?r r_rrrO)rrr9rrrmrr ) rrrgrrrrxr2rrrirCrz)rr9rrJrOrr s @@r1oversight_plan_saver s   4 ( 8GLLD HHV  " ) ) +D$*113Hhhx &B - - / 74F 88D> R & & (C 45s:: "CK\9JKK12C77 &C->?DD ?G ?F!12C7 7V #ZX' G 8TVW&"BH I3 ds ##r3z/oversight/plan-deletectjdxstj}|jdxsdj t }t fd|dDd}|r t||dDcgc] }|dk7s |c}|d<|dD]}|jdk(sd|d<t|tdScc}w) NTrrr7c34K|]}|dk(s |ywr rXr s r1r/z(oversight_plan_delete..;qAdGsN;r r_rrY ) rrrgrrrxrrrzr)rrJrOrr s @r1oversight_plan_deleter s   4 ( 8GLLD 88D> R & & (C "C ;CL;T BD $T*"7|>!qw#~A>CL \ 55?c !AhK3 d  ?s  CCz/oversight/plan-imagec tjjdxsdj t }t fd|dDd}|st ddfStjjdxsdjxs|d tfd |d Dst d dfStjjd }| |jst ddfSd|jvr-|jjdddjnd}|tvrt ddfS|j}t|tkDrt ddfS|dk(r t!|}t#||\}}t$j'dd dd|}|j)di}|jxsijd} | r| |k7r t$| z j+t$|z j/|d} |rc|ra|j1D]N} | jdr| jds& | d| dz } | rt3| ||z z d| zkDrd} nP|||d|<t7|t d|||  S#t,$rYwxYw#t4$rYwxYw)!NrOr7c34K|]}|dk(s |ywr rXr s r1r/z.oversight_plan_image_upload..r r r_rrrr\rac3.K|] }|dk(ywr rXr's r1r/z.oversight_plan_image_upload..r rr`r r~ zNo image providedr`rr^rz'Unsupported type. Use PNG, JPG, or SVG.zImage too large (max 10 MB).rvTrM__rmrrr} g{Gz?znAspect ratio differs from this plan's other images; shared marker positions were kept but may need adjustment.rp)rUrnrorr\)rrgrrrxrrr2rrrj rEr r rCOVERSIGHT_IMG_MAX_BYTESrrrrr}r/rr-rr+ZeroDivisionErrorrz)rJrOrrrrr} rrmrrrother_arr rs @@r1oversight_plan_image_uploadr s <<  F # )r 0 0 2C "C ;CL;T BD -.33 <<  G $ * 1 1 3 Qs;P7QC 5s8}5 5./44 '"Ay 0136636!**3D!**  C #B ' - - /"C ))FGLL 668D 4y**;.Zr r r_Nrrr r rr| rrr rrr)rrrrr| r)rUr)rrrrrrrrxrrrr,rrrLrCr rrr*rrirzrC) rrrJrO known_layersrFrrr| rrr s @r1oversight_placements_saver Ms    4 ( .BD 88F  !r ( ( *C,'J j$ '893>> "C ;CL;T BD -.33(*//126N5OOL E "d#  CS%s "456ACS%s "456ABFF7O)r*002"&&-%2&,,.  $ 00'. &&,9"3D"93QQ.B/557  ) 2D3 d#e* --+:&   s#AH;;I Iz/oversight/editorsc*ttS)zReturn the granted Oversight-editor email list (DVI-1103). Managing this list is Togen-admin-only; the grant itself lets a non-admin use the Locations/plan editor.)r)rr}rXr3r1oversight_editors_getr }s 24 55r3c tjdxsi}|jdd}|jdxsdj}|dvrt dd fS|j }|d k(r(d |vsd |j d d vrt dd fSt}|d k(r||vr'|j|n|Dcgc] }||k7s | }} t|}tdd|tjdxsijdd|d|d|||dt d|Scc}w#t$r}t d|dfcYd}~Sd}~wwxYw)zFAdd or remove a granted Oversight editor (DVI-1103, Togen-admin-only).Trrr7rrrrr`rrrrrr; rNr oversight_editor_r'r9zOversight editor r\rrr )rUr) rrrrrrErr}rirrr r)rrrrHrrBrls r1oversight_editors_postr su   4 ( .BD XXh #F XXg  $" + + -E &&./44 ;;=D CtOs$**S/":M/MABCGG%'G  w  NN4 %3d133<)'2*6(3{{6"(b--f5#D66("5 0  dG ,,4 </u56;;rrelaydigitalr rrT)rr Nrrr^rQrSrr'rrO)rrr4rrrrrr*_scada_is_sensor_labelrXrrrrErTrrrrCr,r*r)rrcrr r r rPrrr allowed_typesrrrmtyper)rQrrOs r1scada_config_postr sU   4 ( .BD  !F xx (#&$'F#-dhhv.>#Etxx2+5dhhz6JD+Q488J'WYdhh'789H%+H%+ +EeS)1G1N E/$xC$'GGE2$6PR@STF5M*F5M  + "x!x6"$4JtH~t<>xDZY> OyDZY> Oydz${*;TB";/{4JtH~t<>x ~*T&\48Q V **, 'HE1eS)At1DEf +,224::>@"E!%j..0"57 8 8?..tFC dX AA ? ?@893>>?s<I!!6JJTHINGPARK_INGEST_TOKENrzthingpark_config.json)rr rrMcidddddttd}tjr t j tj }t|jdtr|d|d<t|jdtr;|dD]3}t|dj|ts&|d||d|<5t|jdtr@|djd}t|ttfr|dkDrt||dd<|S|S#tjtf$rY|SwxYw) z0Return ThingPark config with defaults filled in.r7)r( token_url client_id client_secret)r&dx_corerr&r rrMr)rTHINGPARK_SETTINGS_DEFAULTSTHINGPARK_CONFIG_FILErrrrrrr*rr rr)rJrrsams r1r0r0UsK"246&M78 :C$$& JJ4>>@AE%))I.5!&y!1I%))I.5Y@A!% "2"6"6q"93?,1),?r3cb|jdij|xsi}|jdtvr|jdnd}|jdxsdj||jdxsdjt|jddS)zJNormalized registry entry for one device (empty defaults if unregistered).r&r! r7r9rrr9r! rr)rTHINGPARK_DEVICE_KINDSrr)rJr'rr! s r1_thingpark_device_metar ps '')R $ $W - 3C!ggfo1GG3776?RD&B--/WWZ(.B557 $SWW-C%D E  r3c|sy tjt|d}tj |z j |dzkDS#ttf$rYywxYw)zTrue when last_seen ("YYYY-MM-DD HH:MM:SS") is older than the window. Unparseable/absent stamps are treated as stale so a broken clock never masquerades as a live device.Trrr)rrr*rrrr)rrMrs r1_thingpark_is_staler |sj &&s9~7JK    4 ' 6 6 8;NQS;S SS  "sAA! A!ct|tsyt|jdtr|jdn|fd}|dddd}|sytjdtrjdni}d}t|jd tr%|d r t|d d tr|d d nd}t |j |d d d d|dddd|ddd|dddd|dddxs|xsijd|dddxs|xsijd|d d!d"|d#d$d%d&|d'd(d)d*d+d, S)-aMap one ThingPark uplink object to a thingpark_store row dict, or None. Accepts either the Actility `{"DevEUI_uplink": {...}}` envelope or the inner object directly. Pulls the common fields tolerantly (case-insensitive keys vary by connector format) and keeps the whole object under ``decoded`` so no telemetry is lost before per-model columns are pinned in Phase 2. N DevEUI_uplinkc:|D]}|vs|dvs|cSy)NrrX)r,rrs r1rz'_thingpark_extract_uplink..picks2 ADyT!WJ6Aw r3DevEUIdevEUIr'devEuiLrrsLrrrrK rUrv r_FCntUpfCntUpfcnt FrameCounterFPortfPortfport payload_hex payloadHexrrLrrRSSIr(RSSILrrSNRr)SNR BatteryLevelr  batteryLevelLrrLATr*rNDevLATLrrLONr+rrPDevLON) r'r_fcnt_upr!r!r(r)r r*r+decoded)rrrrr*r)rrr'lrrslrrrs @r1_thingpark_extract_uplinkr!sp c4 '1  $((377? #-0  8Xy(;G )$((6*:DA488F rD C$((5/4(T%[ *4;q>4 @d5k!ndw<%%'66;5(FNCgw0M<FKY/MCI2??93MHeU+H rx/H >BHeZ:HeUKB  r3z/thingpark/ingestc|tstddfStjj dd}|j dr|ddn@tjj d xs tj j d d}|rtj|tstd d fStjd }t|tr%t|j dtr|d}n5t|tr|}n"t|tr|g}ntddfS|stddfSt|tkDrtdtddfSgd}}|D]&}t|}||dz }|j!|( t#j$|d}t#j&d t||td ||S#t($rN} t*j,j/dt#j&d| tddfcYd} ~ Sd} ~ wwxYw)uoAccept LoRaWAN uplink(s) pushed by ThingPark's Generic HTTPS connector. No session auth — the caller is Actility's Application Server; it presents a bearer/header/query token (constant-time compared). Body is either a single uplink object or a list; ThingPark posts one uplink per request in the normal case. Responds {ok, inserted, rejected}. z=Ingest is disabled: THINGPARK_INGEST_TOKEN is not configured.rrZrr7rrNzX-Thingpark-TokenrDr rTruplinksz0Body must be an uplink object or a list of them.r`zNo uplinks in request.r rrr^ thingparkr)ror z$ThingPark ingest: store write failedFzFailed to store uplinks.rr )r rrrxrrwrhr r rrrrrCTHINGPARK_INGEST_MAX_BATCHr!rir.insert_uplinks record_ingestryrmrnr) rr rrrnr| r| rr rls r1thingpark_ingestr!s "\]_bbb ??   3D??95tABx/0 ) <<  GR (  711("11${K%%dSZ(S dX AA > CD%%e3778#==>s8G$$ H;-AH60H;6H;z/thingpark/healthc|t}tj}td|t t |dS)zHIngest health + whether the ingest token is configured (enables writes).Tr)rUr-token_configuredr)r0r.r2rrr )rJr-s r1thingpark_healthr!s= ! "C  * * ,F  45Z  ""r3z/thingpark/devicesct}|dd}tj}i}|dD] }|||d< g}tt |t |j dizD]}|j |i}t ||}|j d} |j||d|d|d|d ||j div||v| ||vr t| |nd |j d |j d |j d |j d|j d|j ddtd||dtj|S)zLatest reading per device joined with the registry (name/kind/location). Includes registered-but-never-seen devices (so an admin can pre-name a device before it reports) and auto-discovered ones absent from the registry. rrMr&r'rr9r! rrNr(r)r r!r*r+)r'r9r! rrrrrrr(r)r r!r*r+TrU)rUr&rr-rM) r0r.r/rrrr rir rr2) rJ stale_minr:rrnr&euirrrs r1thingpark_devicesr"!s ! "CJ 56I  * * ,D D )_Qy\Gc$i#cggi&<"==> xxR %c3/HH[) LLZ($()?$@B!774K"BE+(I>SWHHV$88E?xx *xx *88E?88E?   *  F|,,.%  ''r3z/thingpark/device/c t}|xsdjdd}tjj dt xsd}t dt|d}td |t||tj||  S) zBRecent uplinks for one device (newest first) + its registry entry.r7N r r rKr^rs Tr@)rUr'rr!) r0rrrhrrrCrLrr r.device_uplinks)r'rJr s r1thingpark_device_detailr&!%s ! "C}"##%cr*G LL  W3  / 63E 3ud# $E   #C 1..weD  FFr3z/thingpark/configc t}t|d}t|jdd}t d|d|||dt t S)zCConfig for the admin pane. client_secret is redacted to has_secret.r r r7Tr&r)rUr&r has_secretr device_kinds)r0rrrrrr )rJdxr(!s r1thingpark_config_getr+!4s\ ! "C c)n Bbff_b12J  IZ01  33r3c Ztjdxsi}t}t|j dt ri}|dj D]\}}t|t st|jdd}|s6|j d}t|j dxsdjdd |tvr|ndt|j d xsdjdd t|j d d ||<||d<t|j dt r|d}dD];}t|j |ts#||j|d|<=t|j dtr,|djr|dj|dd<t|j dt r@|dj d} t| ttfr| dkDrt| |dd< t|t |d}t|j!dd} td|d|| |dS#t$r} td| dfcYd} ~ Sd} ~ wwxYw)aSave device registry / DX-Core creds / settings. Body keys are all optional (partial merge): {devices, dx_core, settings}. A blank/omitted dx_core.client_secret keeps the stored one (so the redacted GET can round-trip without wiping the secret).Trr&Nr$!r! r9r7rrrKrr r )r(r r r rrMrFailed to save config: rr)rUr&r r(!r)rrr0rrrrr*rr rrr r rrr) rrJrr!!rr)r! r*!rr rlr(!s r1thingpark_config_postr.!Dsw   4 ( .BD "C$((9%t,Y--/ HCc4(c(.."3B'C776?DCGGFO1r288:4C@ $(> >B 3 9r:@@B4CH(,SWW5K-L(M GCL !I$((9%t, )_7 2A"&&)S)$&qEKKMIq! 2 bff_-s 3?8K8Q8Q8S.0.A.G.G.IC N? +$((:&-:""#89 cC< (S1W58XC O1 2Cs# c)n Bbff_b12J dC NB(3z? DD C6se<=sBBCs< J J*J%J*%J*z/thingpark/dx-testc.t}|d}|jddj}|stddfS|jdr|jdstd dfS t j |d |d|dd d }|jdzdk7r*tdd|j|jdddfS |j}|jdstddt|dddfStd|jd|jdS#tj $r}tdd|dfcYd}~Sd}~wwxYw#t$r tdd|jdddfcYSwxYw)aTest DX-Core OAuth2 client_credentials against the configured token URL. Proves the stored creds can mint a token (the prerequisite for the future device/tag inventory pull). Does not persist anything. Returns {ok, token_type, expires_in} on success, or a descriptive error.r r r7z Set the DX-Core token URL first.rr`r r z+Set the DX-Core client id and secret first.client_credentials grant_typer r rrr7FzRequest failed: rrU NrdrzToken endpoint returned HTTP )rUrr z"Token endpoint did not return JSONrzNo access_token in responseT token_typer)rUr4!r) r0rrrrrr?rgr&rrr*)rJr*!r rrlrs r1thingpark_dx_testr5!ws ! "C YB{B'--/I ?@#EE 66+ bff_&=JKSPPF""  4!+#%o#68  3!#%!rr^r?!rr9!rr:!)IDENCIA_LOGIN_URL_DEFAULTIDENCIA_GRAPHQL_URL_DEFAULTrIDENCIA_SETTINGS_DEFAULTSIDENCIA_CONFIG_FILErrrrrrr*rrr rrr)rJrrrQivs r1_load_idencia_configrF!ڱs!rR@&?)D%')56  8C ""$ JJ2<<>?Eyy N2#FmF %))E*D1U8A!%,"2"21"5s;(-e QE 1 8%))K0$7[):A ,003C!#s+ .1iikK(+:%))J/6:&**+BCb3,/BF?B2wC O$;<!U:%666:j).97;C ON3 J3J$$g.   J s&B G AG #G 4BG G*)G*ctjtj|d tj t j t jzy#t$rYywxYwr) rD!rrrrrrrrrNs r1_save_idencia_configrH!M""4::c!#<= !!$,,"=>    rc|xsdj}|syd|vr|jdsd|dfS|dddfS|jdrtfd d Drd|d fSdvr dzdddfSdzt|zdddfS) uNormalize an endpoint setting to a full https URL. Accepts a full https:// URL, a bare tenant domain (icast.idencia.net — derives the standard API path for ``kind``), or a domain-with-path. Returns (url, error); blank input returns ("", None) meaning "use the fallback".r7r}r>r@Nz must be an https:// URL.rr6c3&K|]}|v ywrTrXr,rr$s r1r/z._idencia_normalize_endpoint..5QqDy5r "'<>\zC must be an https:// URL or a bare domain (e.g. icast.idencia.net).)rrwr2_IDENCIA_ENDPOINT_PATHS)rr! rQr$s @r1_idencia_normalize_endpointrP!s ;B   C  |~~j)D6!:;; ;4Cy$ 99S>D 35*55223 3 d{T!4C($..   7 = =t Dd JJr3c|xsdj}|syd|vr(|jdsy|jddddfS|jdrtfd d Dry dj dd zdddfS) zNormalize the web sign-in base URL (mode "web"). Accepts a full https:// URL or a bare tenant domain (icast.idencia.net); no API path is ever appended. Returns (url, error); blank returns ("", None).r7r}r>r@)Nz0The Idencia web address must be an https:// URL.r6Nrc3&K|]}|v ywrTrXrL!s r1r/z-_idencia_normalize_web_url..%rM!rrN!)NzZThe Idencia web address must be an https:// URL or a bare domain (e.g. icast.idencia.net).r)rrwr8r2r)rrQr$s @r1_idencia_normalize_web_urlrS!s ;B   C  |~~j)Kzz#t$d** 99S>D 35*55? C+ +Tc 2D 88r3cddlm}||xsdjxs|xsd}t|}|j }d|vs d|vsd|vsd|vrd |d St |t jsd |vr)t |t jsd |vr|d Sd|dSt |t jr d|d|dddS|ddS)uCondense a requests exception into an actionable one-liner — the raw text buries the cause (DNS, timeout) inside a connection-pool stack, which is what the board saw on the DVI-1226 prod-verify reject.rrr7zthe Idencia servernameresolution getaddrinfoname or service not knownnodename nor servnamecould not resolve host 'uG' — check the Idencia API endpoints in Services → Idencia settings. timed outzread timed outux took too long to respond — the site is reachable but slow; cached data will serve once a fetch or sync has succeeded.timed out contacting rcould not connect to r:Nrr) r r rIr*rErrTimeout ReadTimeoutConnectionErrorrlrJr r$r&lowereds r1_idencia_request_errorrc!+s& CI2  % % F#*E1ED s8DjjlGG#}'?*g5&'1*4&1>> ?#~--.+2H sN66 7#w.f33 4'tfA..#~556&tfBtDSzl"== :r3c|xs t}|d}|jdrR|jdrA|d|d|jdd|jdd|djd dd Sy ) z!r?!r)rFrsr=!rOrN)rF!rrJr^s r1_idencia_org_credsrf!Gs '%'C e*C wwzswwz2 OZ''(B/.{+// 2>@ @ r3c*|syt|}t|jdtr|jdni}t|jdtr|jdni}|jdr|jdr|d|d|jddd}d D]L}t|j|ts#||j s7||j ||<Nt }|jd d vr|jd nd}|xs|jd d |d <t |jd xsdj xs|djd d|d <|Sy)zCThe user's personal Idencia connection from user_settings, or None.NrrrrFrsr=!r7r!rr?!)rrrrr*rrF!)rrrviderOrrJrOs r1_idencia_user_connectionri!Ss^ "5)H&0j1I4&P(,,z "VXC *3779+=t D#'') "C wwzswwz2 OZ''(B/1 . )A#''!*c*s1v||~a&,,.Q )#$"%''&/^"Cswwv5swwvu5V swwy17R8>>@B!+.229bA Y r3c|xsijdd}t|}|rtj||ddfSt }|rtj |ddfSy)uResolve which Idencia connection a request runs under (D1-C). Returns (scope_key, creds, source, error): the viewer's personal connection when configured, else the org service account. source is "user"/"org" so callers can label the data's visibility. A configured personal connection is ALWAYS used — if its login fails downstream the error surfaces; it never silently falls back to org scope, so a user is never shown org-visibility data believing it is their own.rr7r'Nr^)NNr7uIdencia is not configured. Connect your account in User Settings → Services, or ask an admin to configure the organization account.)rri! idencia_store user_scoperf! ORG_SCOPE)r'rpersonalr^s r1_idencia_resolve_connectionro!psgZR  Wb )E'.H''.&$FF  C &&UD88 Cr3c:t|tr|dkDry|D]D}|jD]/\}}|j|jk(s(|s+|ccSF|j D])}t|tst |||dz}|s'|cSy)uDepth-first search of a nested dict for the first of ``names`` with a truthy value — absorbs envelope drift (e.g. AuthenticationResult) in the login response without pinning its exact shape.rNr^)rrrrEr_idencia_find_key)rr.depthr9r)rQr s r1rq!rq!s c4 EAI  HCyy{djjl*s  zz| c4 %c5%!))Nz"Idencia login did not return JSON.) AccessTokenr)IdTokenid_token) RefreshToken refresh_token)Nz/Idencia login response carried no access token.) ExpiresInr )rrrXr)rrF!_IDENCIA_NOT_CONFIGURED_MSGrrr?rc!rgr&rErrrq!rr) rFrsr7!r7rJrrlr rrrw!rXrs r1_idencia_loginr}!s ? ! ! # W';'=k'J;'WC 000:"" 8B  3!#4C   z )B4CSCSBTTVWW W   s "*dii7!TYY__%66#tyy'8#'>>43D4D4D3ERxPPP:yy{t%D EF '>?H&GHG (F"4)DEJ_ l(.b}"J @AE FFM  * *:6.sC89: ::4 :9: z " sAE"<F F""F5F F F FF"F65F6ctj}t5tj|}|r|s|d|kDr|ddfcdddSdddt |d|d|jd\}}|r)t5tj |ddddd|fS|dxs|d }t5||t d |d d z zd t|<ddd|dfS#1swYxYw#1swYd|fSxYw#1swY|dfSxYw) uCached bearer token for a scope, logging in when missing/expired. Returns (token, error). Prefers the IdToken — AppSync Cognito user-pool auth validates the id token's audience (confirm against the board's API references; the access token is kept as fallback).r.rDNrFrsr7!r7!rrrrrDr.)rU_idencia_token_lock_IDENCIA_TOKENSrr}!rrC) scope_keycredsr rrrrrDs r1_idencia_get_tokenr!ղs- ))+C &!!), u\!2S!8w<%&&&!z!2E*4E+099[+ACKFC  1    4 0 1Sy 4L ,F8,E DB|(djd| ddD} td| D}|r|d k(rdd| fcS| jdxsidfcSy#t j$r} dd t| |zfcYd} ~ cSd} ~ wwxYw#t$rYywxYw)zRun one GraphQL query under a scope's connection. Returns (data, error). One re-login retry on an auth failure (expired/revoked token).r8!r7r?!Nrr^rr)r# variablesrzIdencia request failed: rrrdrzIdencia GraphQL returned HTTP r>r)Nz$Idencia GraphQL did not return JSON.r? rkc3`K|]&}t|xsijd|dd(yw)rNrK)r*rr,rBs r1r/z#_idencia_graphql..s2L;<QW"MM)Q/0#6Ls,.rPc3K|]<}dt|jvxsdt|jv>yw)rrDNr%r!s r1r/z#_idencia_graphql..s>, "SV\\^3Pw#a&,,.7PP,sAAzIdencia GraphQL error: r)Nz,Idencia authorization failed after re-login.)rrrF!r|!r!rrrr?rc!rgr&rrrr2)r!r!r#r!r7gql_urlattemptrDrrrlrr? rauth_errs r1_idencia_graphqlr!s -(.B557E&(5mD 000!,' 5W N s 9  B!&&)%0$9?C !D   z )gl    s "a ':4;K;K:LB!YYt_-/0 0 @99;D(# ))L@Fr LLC,$*,,HGqL23%88 8xx%2t++C!,D @-.. B423@AB B B @? @s0)"EFF$E<4F<F FFuNo Idencia web address is configured. Set it (e.g. icast.idencia.net) in Togen Admin → Services → Idencia, or your own under User Settings → Services → Idencia.rs iz5name="__RequestVerificationToken"[^>]*value="([^"]+)"z*validation-summary-errors.*?
  • (.*?)
    • z<[^>]+>z$/(?:Details|Edit)/([0-9a-fA-F-]{36})cft5tj|ddddy#1swYyxYwrT)_idencia_web_lock_IDENCIA_WEB_SESSIONSr)r!s r1_idencia_web_clear_sessionr!<s* 3!!)T2333s'0ctjdt||nd}djt j |j S)uPlain text from a grid cell value — the site returns HTML-laced cells (serials wrapped in Details links, action buttons). Tags stripped, entities unescaped, whitespace collapsed.r\r7)_IDENCIA_WEB_TAG_REr\r*rrunescaper)rQr&s r1_idencia_web_textr!AsB  " "33?C(K LD 88DMM$'--/ 00r3ctjt|xsd}|r|jdj SdS)z>#% %    s$A  AAc "t|jd\}}|rdd|fS|s ddtfStj}|dz} |j||}t j |jxsd}|sdd|dfS|j|dz|jd|jd d|jd dd d | }|jdzdk7rddd|jdfS|jxsd} d| vrLd| vrHtj | } | rt| jdnd} ddd| r d| ddzfSdzfS||dfS#tj$r}dddt||zfcYd}~Sd}~wwxYw)aSign into the Idencia website. Returns (session, base_url, error). ASP.NET anti-forgery: GET the login page for the token field/cookie pair, then POST the form; a failed login re-renders the form (detected by the Password field still being present).rNz/Account/Loginr7r7ze does not look like an Idencia web login page (no sign-in form found). Check the Idencia web address.z?ReturnUrl=%2Fr^rFrsr)__RequestVerificationTokenr Password RememberMer3!zIdencia web sign-in failed: rdrz"Idencia web sign-in returned HTTP rzname="Password"r!z Idencia rejected the web sign-inr>rKz (check the email and password).)rS!r_IDENCIA_WEB_NOT_CONFIGURED_MSGrSession_IDENCIA_WEB_TOKEN_RErr&rrbr?rc!rg_IDENCIA_WEB_ERROR_REr!) r!r7ruerrsess login_pagerrrlr&emr s r1_idencia_web_loginr!\s ,EIIi,@AJD$ T4 T:::  ! ! #D((JAxx Gx4 ! ( (b 9&JJK Kyy ) )01  99Z4#ii B7 ')  3!#T@#//034 4 99?DD %AT%I " ) )$ /35"288A;/2T>6<F4CL>2CD DACD D t   * *AT:4S$?@A AAs% ?E A EF2F F Fc.t|\}}}|rd|fSddd} |j|dzdddddd d dd dd d d }|j}t|jdt|d<|dfS#t t jf$rY|dfSwxYw)aTest-button path for web mode: sign in, then one 1-row grid probe so "connected" means data access, not just an accepted password. Returns (info, error); a failed probe after a good login is reported in info (the site may have moved its grids) rather than as a hard error.NTF) signed_ingrid_okz/ItemTypes/PagedIndexDatarErFNamer7rr) sEchoiColumns iDisplayStartiDisplayLength mDataProp_0sSearchbRegex iSortCol_0 sSortDir_0 iSortingColsrvrrr7aaDatar!)r!rrrrrrr?)r!r!rrrlrrs r1_idencia_web_checkr!s )/OD$ Sy% 0D  xx . . cC&)&!WC"'% ' yy{$TXXh%7>Y : 77 8  : sAA55BBcttj}t5tj|}|r|s|d|kDr|d|ddfcdddSdddt |\}}}|rt |dd|fSt5|||t zdt|<ddd||dfS#1swYRxYw#1swYxYw)zICached signed-in web session for a scope. Returns (session, base, error).r.rrN)rrr.)rUr!r!rr!r!_IDENCIA_WEB_SESSION_TTL_S)r!r!r rhitr!rrs r1_idencia_web_sessionr!s ))+C 5#'' 2 u\!2S!8y>3v;4555)/OD$ "9-T3 <T ::,<i(< t 55<#xx8><=?3t9+= S^ #EI$ $J: "9-[-.\ D9"22 B< 6sC @ABBB B   1 z*  sH0GG8)H 1HG5G0&G50G58 HHH#"H#c|dk(rtdgd\}}|rd|fSg}|D]}|jd}|jt|t |t |jdt |jdt t |jd t |jd d |dfS|d k(rtd gdddi\}}|rd|fSt dfd} i} | jdxsgD][} t| xsijdxsdjj} | sD| j| ddz| | <]g}|D]}|jd} t | }t |jd}|r| j|jnd}|jt| |xs|xsd|t |jd|t t |jd t t |jdd|dfS|dk(rtdgd d!d"i\}}|rd|fSg}|D]}|jd} t t |jd#}|jt| t |jdxst | xsdt | |t t |jd$|rd%nd&d'|dfS|d(k(rtd)gd*d+di\}}|rd|fS|Dcgc]S}t|jdt |jdxst |jdd,Uc}dfSdd-|d.fScc}w)/uWeb-mode equivalent of the GraphQL dataset fetch: rows normalized to the SAME tolerant field names the providers/reports already walk, so the tile, Auditor reports, sync, and cache work unchanged. Because the web grids carry display names (not ids), the name fields go straight into the *Id slots — the id→name map lookups miss and fall back to the raw string, which already IS the name.rr) Attachments SerialNumberItemType JobNumber CreatedOnUtc CreatedByr!Nr!r!r!r!r!)rr9 itemTypeId projectId createdAt createdByrJobs)Numberr!rr!CompletedOnUtc activeJobsr)rTr7c"tdS)Nrr!)_idencia_web_fetch_dataset)r!r!r7sr1r z,_idencia_web_fetch_dataset..s.y%7>@r3rr!r7rr^r!r!Unnamedrr!)rr9rer quantityProducedr! completedAtrr)rwr!r! ScheduledDate ShippedDate IsShippedShowAllShipmentsrdr!r!Shipped Scheduled)rr9rshipDate scheduledDaterd item_types ItemTypes)r!r!DefaultProcessUrlrvrzUnknown Idencia dataset 'z'.) r!rrir!r!r!_idencia_fetchr*rrE)r!r!rr7rrrnr serial_cell items_resby_jobr| r) number_cellrr9producedshippeds`` ` r1r!r!s'$ ug *3:<S 9  A%%/K KK' 4)+6/j0AB.quu[/AB-.?EE.)/+,.quu[/AB   Tz*$ uf L)7<S 9  # ug @A ==(.B 5BrxRnn[17R8>>@FFHC$jja014s  5 A%%/K&{3F$QUU6]3D5;vzz&,,.1H KK' 43$3)-aeeJ.?@$,-.?EE.)/+,/0AEE*+1- .     Tz+$ uk "4f!= S 9  A%%/K&'8}9M'NOG KK' 4*155=9H-k:H>G+K8#!12CEE/*3,"-'.)K   Tz,$ uk 7W%w8S 9 )x9+AEE&M:@.quuX?B $$ $ ,WIR8 88 s.AOct5tj||f}|r(|dtjkDr|dcdddStj ||fddddy#1swYyxYwNrr^)_idencia_memo_lock _IDENCIA_MEMOrrUrr! query_keyr!s r1_idencia_memo_getr!Zp 8I 67 3q6DIIK'q688 9i0$7 8  8 8A* A**A3ct5tjtz|ft||f<dddy#1swYyxYwrT)r!rUIDENCIA_MEMO_TTL_Sr!r!r!rs r1_idencia_memo_putr"c< 7 IIK, ,g17 y),-777 '7AcPt||}||ddddS|\}}|,t||| tj||||ddddStj||}|r |dd|d|dSddd|dS#t$r"t j jdY]wxYw)a'Live-first data fetch for tiles/reports (D2). fetch_fn() returns (payload, error). Returns {data, cached, as_of, error}: - memo hit (<60 s old live result) -> live data, no badge - live success -> memoized + written through to the scope's cache; no badge - live failure w/ cached last-good -> cached payload, cached=True + as_of (renderers show the badge) - live failure, nothing cached -> data=None + the error NFrr rrz"Idencia cache write-through failedrT fetched_at) r!r"rk! cache_putryrmrnr cache_getr!r!r!fetch_fnrrrr!s r1r!r!is Y 2D tLL:LGS {)Y8 G  # #Iy' B 54$OO  ! !)Y 7C I$\*S: :ED3 GG G JJ !E F GA::(B%$B%zquery ListProjects($limit: Int, $nextToken: String) { listProjects(limit: $limit, nextToken: $nextToken) { items { id name status quantityRequired quantityProduced quantityRemaining } nextToken } }zquery ListItemTypes($limit: Int, $nextToken: String) { listItemTypes(limit: $limit, nextToken: $nextToken) { items { id name } nextToken } }zquery ListItems($limit: Int, $nextToken: String) { listItems(limit: $limit, nextToken: $nextToken) { items { id name status itemTypeId projectId createdAt updatedAt } nextToken } }zquery ListShipments($limit: Int, $nextToken: String) { listShipments(limit: $limit, nextToken: $nextToken) { items { id name status shipDate projectId } nextToken } }rr!rrc:t|tr|jD]J}t|tst|jdts4|d|jdfcS|jD]}t|ts|dfcSgdfS)uPull (items, nextToken) out of a GraphQL data payload regardless of the operation name — the first dict value carrying an ``items`` list wins.r nextTokenN)rrrrr)rrQs r1_idencia_result_itemsr"s$;;= :C#t$CGGG4Dd)K7|SWW[%999 :;;= !C#t$Dy  ! t8Or3c<|xsijddk(rt||||St|}gd}}ttD]S}t |d}t |||||\} } | rd| fcSt| \} }|jd| D|rP|dfS|dfS)uFetch one dataset fully (paginated). Returns (rows, error). This is the single mode fork: connections with mode "web" read the Idencia website's grid endpoints instead of the GraphQL API — everything above (memo/cache, tile provider, reports, sync, vocab) is mode-blind.rOrr!N)r r ")r!r7c3BK|]}t|ts|ywrT)rr)r,rs r1r/z)_idencia_fetch_dataset..s c   % %gU#-3 59 4yt tT23+8G+<=M%-j%9; ! a P VTVW]]_;>@TBC'/ '=?"#"-6:w"O"USUV\\^?BDFG=)  EE7E2   ! * *+> ?F fM5hz6JKgs8K#89:6Kd%? 4<%;?s ;0H0H )r8rqr c  tj5t|\}}|r!tjj d|n tjj d|dddt5dtd <dddy#1swY"xYw#t $r:tjjdtjd|dYgwxYw#1swYyxYw#t5dtd <dddw#1swYwxYwxYw) zEThread body around _idencia_run_sync: always clears the running flag.zIdencia sync failed: %szIdencia sync ok: %sNzIdencia sync worker crashedrworker crashed (see server log)r#"Fr8) rm app_contextr-"rnrorlryrrk!r*"_idencia_sync_lock_idencia_sync_stater r$rs r1_idencia_sync_workerr4"( 3 __  ?-e4MFE ""#  ?  3-2  * 3 3 ? ? K :;!!'(I KK  3 3  3-2  * 3 3 3`BAB (B6 C BBACC'CC'C$'D . D8 D D D ch|ddr t|sytdt|dddz}tjdxsi}|j d}|sy t j|d }t j|z j|k\S#ttf$rYy wxYw zTrue when a scheduled sync should fire now (enabled + org configured + interval elapsed since the last attempt, success or failure).rr:!Frr9!r last_syncr|Trr) rf!rCrrk!r3rrrrrrrrJ interval_srr|r s r1_idencia_sync_duer<": z?> *2DS2IQC O,CDEFKJ  ! !+ . 4"D $B &&r+>?    4 ' 6 6 8J FF  "!BB10B1cddl} |jd tts(t5t dr dddBt j ddtjjddddtd#1swYxYw#t$r"tjjd Y7wxYw) zBackground thread (togen-worker only): org-scope sync on the configured cadence. Checks each minute; the interval gate lives in _idencia_sync_due so config changes apply without a restart.rNTrr8 schedulerrrr8r rqzIdencia sync loop error)rUrr<"rF!r1"r2"rrrrr4"ryrmrnrrUs r1_idencia_sync_looprC"K  2 <$%9%;<# S&y1 S S$** -113<<=PQ+S S ! -   S S < JJ !: ; <8B B BB 9BB BB (C  C ct5tt}dddtj}d|d|d|d|ddS#1swY4xYwzCSync state block for the Admin pane (running flag + last outcomes).Nr8rqr rlast_ok)r8rqr rrH")r1"rr2"rk! sync_healthror-s r1_idencia_sync_publicrK"`a *()*  & & (FY'u\7J7^VF^i( **** A  Az(project|type|status)\s*:z%\s*"([^"]*)"|\s*\'([^\']*)\'|([^,;]+)cJi}t|xsd}ttj|}t |D]\}}|dzt |kr||dzj n t |}||j|}g}tj|D]@\}} } |xs| xs| j} | s"|j| jB|s|j|jdjgj||S)zParse the tile filter DSL into {key: [lowercased values]}. Tolerant: unknown text between keys is ignored, empty values dropped, repeated keys merge. Matching downstream is case-insensitive (hence the lowercasing).r7r^)r*r_IDENCIA_FILTER_KEY_REr>rrCrqr_IDENCIA_FILTER_VAL_REfindallrrirEr}rbr) r&rrrrrrrq1q2plainrs r1_idencia_parse_filtersrU"ss  C tzr?D)22489G'" @1()AG (.s&y%/;=r3)rIDENCIA_WEB_LIVE_TIMEOUT_SIDENCIA_LIVE_TIMEOUT_Sr!)r!r!rr["s```@r1_idencia_fetch_rowsr^"sD  ((0E9// 5' = >>r3ci}|xsgD]J}t|ddd}t|dddd}|#|s&t|j|t|<L|S)z>{str(id): name} over a dataset's rows (projects / item types).rr!r!r9r"r$"re)r"r*r)rnrrrKr9s r1_idencia_name_mapr`"sb C ZR.At[,?Q z7K ?tIOO-CCM . Jr3c |D]}tjdt|j|xsd}|s8t |j dt |j dt |j dfcSy)u(yyyy, mm, dd) date tuple from the first parseable of several timestamp fields, or None. Tolerant of ISO / epoch-less formats — only the leading date part is compared.z(\d{4})-(\d{2})-(\d{2})r7r^rrPN)rFrr*rrrb)rr.rrs r1_idencia_row_daterb"sqG II0#cggaj6FB2G H  OS_c!''!*oF FG r3)rrrctj|}|syt|g|}|ytjt |z }||j |j|jfk\S)uRange filter predicate. Rows with no parseable date are KEPT (tolerant — the schema is unconfirmed, so an unrecognized timestamp format must not silently empty the tile).Tr) _IDENCIA_RANGE_DAYSrrb"rrrrrr )rr date_fieldsrrnr s r1_idencia_range_keeprf"sg  " "3 'D #, ,Ay    !O$> >F fllFJJ7 77r3c t|jd}|Dcgc] \}}||d }}}|rHt||kDr:|d|||d}}|jdt d|Dt|d|}|Scc}}w)uOrdered chart slices from a {label: count} map, largest first. With a cap, the tail folds into one "Other" slice carrying `more` (the folded slice count) so renderers can show "+N more" — data is never silently dropped.c4|d |djfSNr^rrsrs r1r z!_idencia_slices..εsbeVRU[[]4Kr3rrNr@c3&K|] }|d ywrNrXr&s r1r/z"_idencia_slices..ҵs3M1AgJ3Mrrmore)rrrCrir)r$rrGrrslicesr.r&s r1_idencia_slicesrp"ɵs V\\^)KLG3: ;41aA& ;F ;c&kJ.KZ(&*=d g3M3M0M Y( ) M .row_projects5A{L9||CH#/c#hrJWiWr3cxt|ddd}jt|| t|ndxsdS)Nr! item_type_idtypeIdr7rru")rrKtype_maps r1row_typez(_dash_provider_idencia..row_types7A|^XF||CH#/c#hrJWiWr3c\tt|dddxsdjxsdS)Nrdr"rr)r*r"rrx s r1 row_statusz*_dash_provider_idencia..row_statuss3=HlHE !!&6,5 6r3cldk(r~tt|dddxsdj}jdr|j dvryjdr|j dvryy jdr|j dvryjdr|j dvryd k(r-jd r|j d vryd k(r t |d Sd k(r t |dSy )Nrr9r"rer7r FrdTrrTr! updatedAtrr!r!)r*r"rrrErf")rr9r(rrrw"r~"r|"s r1rI z$_dash_provider_idencia..keep s*  }Q wGM2NTTVD{{9%$**,gi>P*P{{8$A)<)<)>ghFW)W ;;y !k!n&:&:& =&q#/IJ J  &q#/HI Ir3r{ rr r) rrr rr|r{ r rrr@ c<|dxsd |djfS)Nr!rr9rsrs r1r z(_dash_provider_idencia..+s"q}'9%:AfIOO.5A1AjM.Q.Ac3.K|] }|dxsdywr!rNrXrps r1r/z)_dash_provider_idencia..6r"r"c3.K|] }|dxsdywrrNrXrps r1r/z)_dash_provider_idencia..7sCQQ{^0q0Cr")rr!rrr^)ro!rr^"rrrrX"rU"r`"rrCr!"rrp"r)rJr'r r!r rr*rrKrrn filt_textrI rrrrgroup_fnr$r)r(rrv"rrw"r~"r|"r{"s @@@@@@@@r1rrصs!!*Q*=A >D >#)r002Y6STX6YI$Y/GRHh ZY'1bGmi!#{!2rY$&9% &S',)+SS[&?<>@ W}&G+r[/@$&9% &U',)+SS[&?<>@XX6* '!tAwA 'D 'TV2#'')2D2U wx()GG4D%,X%6!DT G Z,T2 N O #h-*4H 2I ,H& ( +6> ?QvY:+! + ?DAAAAAAC(CC  H W}{* y F -qkjja(1,s -( ;GH No ?b (( @s!K87K8 K=+K=Lrz&https://api.open-meteo.com/v1/forecastz.https://geocoding-api.open-meteo.com/v1/search)z Clear skyrR)z Mainly clearz mostly-clear)z Partly cloudyz partly-cloudy)Overcastcloudyrv)Fogfogr)zRime fogr"3)z Light drizzledrizzle5)Drizzler"7)z Dense drizzler"8)zFreezing drizzler"9=)z Slight rainrain?)Rainr"A)z Heavy rainr"B)z Freezing rainr"CG)z Slight snowsnow)Snowr")z Heavy snowr")z Snow grainsr")z Rain showersr")zViolent rain showersr")z Snow showersr")zHeavy snow showersr") Thunderstormthunder)zThunderstorm w/ hailr") IKMrQr;UV_`ccp t|}tj |dS#ttf$rYywxYw)uK(label, icon-category) for a WMO weather code; unknown → a neutral cloud.)rr")rrr _WMO_WEATHERr)r3rs r1_weather_code_metar"zs?% I   A4 55 z "%$%s #55ct|xsdxsijd}t|trX|jdG|jd6t |jdxsdj |d|ddSy)uThe resolved regional location for a viewer (system baseline → org default → the user's own override) as a weather location dict, or None. Backs the ``my_location`` / ``org_default`` tile location sources (DVI-1364 P3). An empty email resolves the org location only (never a person's) — the signage identity has no email, so a wall always lands on the org location.r7rrNNrPrr|)rrrrr*r)rr s r1_weather_regional_locationr"s U[b ) /R 4 4Z @C#t!4!@ $0SWWW-34::< O#k:JL L r3ct}t|trX|jdG|jd6t |jdxsdj |d|ddSt dS)a)The org-default location dict, or None. Only used when a manual tile has no location of its own. Prefers the explicit ``_WEATHER_ORG_DEFAULT`` constant if set, else falls back to the org regional location (DVI-1364 P3), so the plant's regional location is the natural facility default.rNrPrr7r|)_WEATHER_ORG_DEFAULTrrrr*rr"r s r1_weather_default_locationr"sr A!TquuZ0<k".QUU7^1r288:jM+H H %b ))r3c6ddlm}||xsdjxsd}t|}|j }d|vs d|vsd|vsd|vrd |zSt |t jsd |vrd |zSt |t jrd |d dzS|d dS)uCondense a requests exception into an actionable one-liner (mirrors the Idencia/Power BI condensers — the raw text buries the cause in a pool stack).rrr7zthe weather servicerU!rV!rW!rX!z0could not resolve the weather service host '%s'.rZ!z2the weather service (%s) took too long to respond.z.could not connect to the weather service (%s).NrrK r r rIr*rErrr^!r`!ra!s r1_weather_request_errorr"s& CI2  % % >)>D s8DjjlGG#}'?*g5&'1ADHH#~--.+2HCdJJ#~556?$t*LL :r3ct5tj|}|r(|dtjkDr|dcdddStj |ddddy#1swYyxYwr!)_weather_memo_lock _WEATHER_MEMOrrUr)r)r!s r1_weather_memo_getr"sf %$ 3q6DIIK'q6%% #t$ %  % s6A&A&&A/ct5tjtz|ft|<t |ft |<dddy#1swYyxYwrT)r"rUWEATHER_MEMO_TTL_Sr"r_WEATHER_LAST_GOOD)r)rs r1_weather_memo_putr"sI 9"iik,>>H c$-;"83 999s 8AAcdt5tj|cdddS#1swYyxYwrT)r"r"rrs r1_weather_last_goodr"s( +!%%c*+++s&/c 8|jdxsi}|jd}t|\}}|jdxsi}|jdxsg}|jdxsg}|jdxsg} |jdxsg} g} t|D]w\} } t| t|kr|| nd\}}| j | | t|kr|| nd||| t| kr| | nd| t| kr| | nddy|jd |jd |jd |jd t |jd d|||d| r| dnd| |rdnd|rddSddS)uOpen-Meteo response → a render-ready shape the SPA/kiosk renderers walk. Always carries up to 7 forecast days; the tile slices to its configured forecast_days at render time (so the memo is location-complete).rC weather_coderrUtemperature_2m_maxtemperature_2m_minN)rr3rrWrrKtemperature_2mapparent_temperaturerelative_humidity_2mwind_speed_10mis_dayr^)r feels_liker windr"r3rrWru°Fu°Cmphzkm/h)rCr r temp_unit speed_unit)rr"rrCrir)rrTrr3rrWrtimescodeshighslowsrrrnr dis r1_weather_normalizer"ƶs '')  "C 77> "D$T*KE4 GGG  "E IIf  #E IIn % +E II* + 1rE 99) * 0bD D%  1#CJE!HDIB  !CJE!HD !CJE!HD#d)m47    GG,-''"89 67GG,-3778Q/05$  !ad Ue!e  (.  r3c t|dk7}||dd|rdnd|rdnddd d } tjt|t }|j d k7rd d|j zfS |j}t||d fS#tj$r}d t |tfcYd }~Sd }~wwxYw#t$rYywxYw)zGFetch current + 7-day forecast from Open-Meteo. Returns (payload, err).rUz[temperature_2m,relative_humidity_2m,apparent_temperature,is_day,weather_code,wind_speed_10mz2weather_code,temperature_2m_max,temperature_2m_min fahrenheitcelsiusr"kmhrr)rNrPrCrtemperature_unitwind_speed_unitrrYr!NrKzOpen-Meteo returned HTTP %s.)Nz+Open-Meteo returned an unreadable response.) rr_OPEN_METEO_FORECAST_URLWEATHER_FETCH_TIMEOUT_Sr?r"rgrrr")r*rrRrTrrrlrs r1_weather_fetch_openmeteor"s 8 Bc9E,.LI$&5E FK!!":6*AC 33d6F6FFFFCiik c2 & ,,  * *K+C1IJJJK CBCs/ A9B+9B( B#B(#B(+ B76B7c N|xsdj}|sgdfS|ddtdtdt|xsdddd } t j t |t }|jd k7rgd |jzfS |j}g}|j dxsgD]}t|ts|j d|j d} } | | ;|j d|j d|j dxs|j dg} djd| D} |j!| | | d|dfS#tj$r}gt|t fcYd}~Sd}~wwxYw#t$rgd fcYSwxYw)uResolve a place name → candidate locations (Open-Meteo geocoding, no key). Returns (results, err); each result is {label, latitude, longitude}.r7Nrr^rrenr)r9rlanguager r!rKzPlace search returned HTTP %s.z-Place search returned an unreadable response.rrNrPr9admin1 country_codecountryrc38K|]}|st|ywrT)r*rps r1r/z#_weather_geocode.."s5Q1#a&5sr|)rrCrLrrr_OPEN_METEO_GEOCODE_URLr"r?r"rgrrrrrri) r#rr rrrlrrrr*rr0 rs r1rrs "A 4xgAs2s5:A/G(H&2FH!!"9&*AC 33d6F6FFFFCiik Cggi &BH!T" 55$aeeK&8S ;#+ vh~1F1Z!%%PYJZ[ 5%55 U#FGH 9%  * *H)#/FGGGH CBBBCs0 E"F"F5F F F F$#F$c |jdxsd}|dvrd}|jdxsdj}dx}}|dk(r5t|xsijddxsd}|rw|d |d |d }}}ng|d k(rtd}|rU|d |d |d }}}nE|jd }|jd }||t}|r|d |d }}|xs|d }||d dddS t t |d}t t |d}|jddk(rdnd} |jd} | dvrd} tdtdt|jdxsd} ||| f} d\} }}t| }| t|}nVt||| \}}|t| |t|}n,t| }|rt|dd |d}} }n d dd|zdS|j!d d |xsd ||fz| | | | || r|ndd! |S#t tf$r d dddcYSwxYw#t tf$rd} YwxYw)"uRWeather tile provider (DVI-1277). Resolves the tile's stored lat/lon (or the org default), fetches current + forecast from Open-Meteo through the memo/last-good layer, and returns a render-ready payload. No role gate. Location source (DVI-1364 P3): - ``manual`` (default): the tile's stored lat/lon; if none, the org default. - ``my_location``: the viewer's resolved regional location (system → org → their own override). On signage (no email) this lands on the org location. - ``org_default``: the org regional location (system → org, no per-user).r r)rr r rMr7Nr rrNrPrr TFzLNo location set for this weather tile. Edit the tile and search for a place.rrz(This weather tile's location is invalid.rRrUrTrO)rCrWrXrCr^rrYr)FNNrzWeather is unavailable: z %.3f, %.3f) rrrrOrRrYr rr)rrr"r"rjr rrrCrLrr"rr"r"r"r)rJr'r rr*rrnlatflonfrRrOr1r)r rrrrrr!s r1rZrZ'sWW& ' 38F == WW% & ," 3 3 5EC#  & '7'7'D'J K  mQ{^QwZeC = &r *  mQ{^QwZeCggj!ggk" ;#+)+AZ=!K.S+7 {ckU;= =GU3Z#U3Z#(H4H$E 776?D 55As1c#''/":"?a@AB u C*FE3 S !D Dz/dEB  ; c7 +=D$S)C&*3q6lD#a&ef"&U#=#CEE KKT:ldD\9uu5D  KK z "GUEG GG z "s$/*H 2H:H76H7:I Iz/idencia/configc  t}t|d}t|jdd}t d|||j dd|d|dt tjtj S) zConfig for the Admin -> Services -> Idencia pane. The org password is redacted to has_password (write-only, ThingPark convention).r^rsr7TrOr>!r?!r)rUr^rtrOr?!rsynccache) rF!rrrrrrK"rk! cache_keysrm!)rJr^rts r1idencia_config_getr"wsz  C s5z C B/0L d,. -J,.&11-2I2IJ  LLr3c @tjdxsi}t}t|j dt r|d}dD]>}t|j |t s#||jdd|d|<@t|j dt r,|djr|dj|dd<|j dd vr|d|d<t|j d t rd D]P}|d j |}t|t s(t||\}}|rt| d fcS||d |<Rt|d j dt r,t|d d\}}|rt| d fS||d d<t|j dt rr|dj d}t|ttfr*|dkDr%tdtdt||dd<d|dvrt|dd|dd< t!|t$5t&j)t*j,ddddt/t*j,t |d}t|j)dd} td|| |j dd|d |dS#t"$r}td| dfcYd}~Sd}~wwxYw#1swYxYw)zSave org account / endpoints / sync settings (partial merge). A blank/omitted org.password keeps the stored one so the redacted GET can round-trip without wiping the secret.Trr^)rFr=!NrKrsrOr@!r?!r6!rr`rrr9!rrr:!r-!rr7r>!)rUr^rtrOr?!r)rrrF!rrrr*rrP!rrS!rr rLrCrrH!rr!r!rrk!rm!r!) rrJr^rrQrJr!rE!rlrts r1idencia_config_postr"s   4 ( .BD  C$((5/4(5k' 5A#''!*c* #A t 4E 1  5 cggj)3 /C O4I4I4K%(_%:%:%)6lF $((;'.- *A{#''*C#s#7Q? T".33'*K # * d;'++I6 <24 3DY3OPICT*C//*-C Y '$((:&- *  ! !"9 : b3, 'BF7:4QB7QC O3 4 T*- -.24 3CN3S.TC ON +CS! ;M33T:;}667 s5z C B/0L d,. -J II C6se<=sBBC;;s* K-%L- L6L L LLz /idencia/testc tjdxsi}t}|jdxsdj xs|dd}|jdxsdj xs|dd}|r|st dd fS|jd d vr|jd n|jd d }|d k(ryt |jdxsd\}}|rt |d fSt|||xs|djddd\}}|rt d|dfSt ddd d|St|jdxsdd\} }|rt |d fSt||| xs|dd\} }|rt d|dfSt dd t| dt| dt| dS)zTest the org connection: login, then one minimal GraphQL round trip. Body may carry {username, password, login_url} to test values before saving; blanks fall back to the stored org config. Persists nothing.TrrFr7r^rsz1Set the organization username and password first.rr`rOr@!r>!rrr?!rFrsrFrrU rUrOr7!r!rrrX)rUrOhas_access_token has_id_tokenhas_refresh_tokenrX) rrrF!rrrrS!r!rP!r}!r) rrJrFrsrOrr!rlrr7!rs r1 idencia_testr"s   4 ( .BD  C$*113Ms5z*7MH$*113Ms5z*7MH 8PQSVVV#xx/>A488F  WWVU #  u}2488I3F3L"M  &+ +&!xF3{#3#7#7 2#F HI c e3/4 43$U3d331 #[2OIt T"C'' (KFC %s+S00 d$()9$: $VD\ 2%)&*;%< >>r3z /idencia/syncctdjdd}tstddfSt5t drtdd fcd d d St j d |tjjd  d d d tjt|fd jtd S#1swY@xYw)z8Kick off an org-scope sync in the background (Sync now).r'rr7z1Configure the organization Idencia account first.rr`r8A sync is already running.r9NTrrrA"r(rg)rrrf!rr1"r2"rrrrrrr4"rqrgs r1idencia_sync_startr"s FO   ,E  PQSVVV K y )!=>CKK ""%))+445HI # KK 0x ""'%' 4  KKC9CCz/idencia/sync-statuscptdttjtjSz1Poll target for the Admin pane's Sync now button.T)rUr"r")rrK"rk!r"rm!rXr3r1idencia_sync_statusr#/ d!5!7&11-2I2IJ LLr3z/idencia/user-connectionctdjdd}t|}t|jdtr|jdni}t|jdtr|jdni}t }t t|}tdt |jdxr|jd|jddt |jd|jd d|jd d|jd d|jd d vr|jd nd|jdd|jd d| S)zBThe current user's personal Idencia connection, password redacted.r'rr7rrrTrFrsrW"r7!r8!rOr@!rr>!) rUrrFrtrW"r7!r8!rOrorg_mode org_available) rrrrrrF!rrf!r)rrrvrh!rJr#s r1idencia_user_connection_getr#s5 FO   ,E"5)H&0j1I4&P(,,z "VXC *3779+=t D#'') "C  C+C01M d"377:#6#N377:;NOGGJ3 $SWWZ%8 9#&77+xx>1"6lF % dhhy)3 /24 ?CICT*C//!$I 4(wwz" GGJ %!#HZ<E8, CM44U;TBC}77>? d"377:#6$B377:;N$B+/88L+A'AC DD </u56;;<CCs* L/*M/ M8MMMMz/idencia/user-testc vtdjdd}tjdxsi}t |xsi}|jdxsdj xs|jdd}|jdxsdj xs|jdd}|r|st d d fS|jd d vr|jd n,|jd xstjd d }|dk(rt|jdxsd\}}|rt | d fSt|||xs0|jdxstdjddd\}} | rt d| dfSt dddd|St|jdxsdd\} }|rt | d fSt||| xs|jd\} } | rt d| dfSt dd t| dt| dS)zTest the current user's personal Idencia login. Body may carry {username, password, login_url} to test before saving; blanks fall back to the stored personal connection (then the org endpoint settings). Persists nothing.r'rr7TrrFrsz/Enter your Idencia username and password first.rr`rOr@!r>!rrr?!r"FrrU r"r7!r!rr)rUrOr"r"rX) rrrrri!rrrF!rS!r!rP!r}!r) rrr4rFrsrOrr!rlrr7!rs r1idencia_user_testr #]s7 FO   ,E   4 ( .BD %e , 2F$*113Qvzz*b7QH$*113Qvzz*b7QH 8NOQTTT#xx/>A488F jj M$8$:$>$>vu$M  u}2488I3F3L"M  &+ +&!x SFJJy$9S02;?CCIrR UV c e3/4 43$U3d331 #[2OIt T"C'' (6vzz+68KFC %s+S00 d$()9$: $VD\ 2 44r3z/idencia/vocabcDtjtjd}|r$t|j dt r|dni}t d|j dxsg|j dxsg|j dxsg|r |d Sd S) u Picker vocabulary for the Idencia tile editor (D3 guided pickers): project / item-type / status names from the org sync's cached vocab. Empty lists until the first successful sync — the pickers degrade to free text, so this is never a hard dependency.r%"rTrr!rr"N)rUrr!rr)rk!r"rm!rrrrr!r%"s r1 idencia_vocabr#s  ! !-"9"97 CC!j1CT&JC NPRE d!IIj17R#ii 5;!IIj17R.1\*  ==8<  ==r3)rzAll timerrrrrr))r zPer day)rzPer week)rz Per monthcVt|jdxsd}|tvr|SdS)Nrr)r*rrd")rrs r1_idencia_report_ranger#s- fjj!*U +C,,37%7r3cF|t|d|d|dr|ddSddS)zEReport meta block from a live-first fetch result (cached badge data).r rrNr r rr)r)r rKs r1_idencia_report_metar#sCWX->(?W%)0):WW% FF@D FFr3ct|\}}}}|rdddd|fSt|||}|ddddd|dxsdfS|dDcgc]}t|ts|}}|||t ||dfScc}w)uViewer-scope live-first rows for one dataset. Returns (rows, scope, creds, meta, error) — error is a user-facing message when Idencia is unconfigured or both live and cache are unavailable.Nrrrr")ro!r^"rrr#) r'rr r!r rrKrrns r1_idencia_report_fetchr#s!!*Q*=A >D > 3FGDd JJ ?s A.A.c t|d\}}}}}|rd|fSt|jdxsd}|jdrK|Dcgc]@}tt |dddxsdj j |dvr|B}}t|} | jd d } | D cgc]"} | d| d | d | d| | d | d g$} } | rStd| D} td| D}td| D}| jd| ||| || gdddd ddd ddddddddg}|| |ddfScc}wcc} w)zPer-project required / produced / remaining / % complete, plus a trailing totals row (also wanted in the CSV, so it lives in the data).rNrr7r r9r"rec(|djSr rsrs r1r z4_idencia_report_production_summary..Ըs&  1r3rc4|sytd|xsdz|z dS)NY@rr^rj)r!rs r1pctz/_idencia_report_production_summary..pctָs#Uhm!,x7;;r3rr!rc3.K|] }|dxsdywr"rXrps r1r/z5_idencia_report_production_summary..޸s91AjM&Q&9r"c3.K|] }|dxsdywr"rXrps r1r/z5_idencia_report_production_summary..߸s:AQz]'a':r"c3.K|] }|dxsdywr"rXrps r1r/z5_idencia_report_production_summary..s:AAkN'a':r"zAll projects (total)rrRequiredProduced Remaining pct_completez % Completerrnr) r#rU"rr*r"rrEr!"rrri)rr'rnr r!rrrrrr#rrt_reqt_prodt_remrs r1"_idencia_report_production_summaryr+#ȸs%:$ $K!D%c Sy$VZZ %:%@bAG{{9Ea}Q wG#egeeg1CDEE).H MM1M2< 9A B34 fIq}a mQ{^ * q} - / BC B 999:::::: *E65&( ) 95!J7!J7"[9% = ?G T :D @@1E Bs AE8'Ec t|d\}}}}}|rd|fSt|jdxsdt|iicjdr-t t ||dxsijdxsgjdr-t t ||d xsijdxsgfd }t |Dcgc] }||s |c}} t| j} t| jd D cgc]\} } | | | rtd | z| z dndg } } } | r| jd| | rd ndgdddddddddg}|| |ddfScc}wcc} } w)zItem counts by status, filterable by project / item type / date range. Name maps are fetched only when a filter needs them and fail soft to raw ids (same tolerance as the dashboard tile provider).rNrr7r rrrTr!cHjdrOt|dd}jt|| t|ndxsd}|jdvryjdrPt|dd d }jt|| t|ndxsd}|jdvryjd rCtt|d d d xsdj xsd}|jd vryt |dS)Nr r!rt"r7rFrTr!ry"rz"rdr"rr")rr"r*rErrf")rrKr9rdrrv"rr{"s r1rI z)_idencia_report_item_status..keeps ;;y !; =C<<Cco#c(2N[R[Dzz|79#55 ;;v <JC<<Cco#c(2N[R[Dzz|76?2 ;;x q(L(K&%'',uw<2; ||~WX%66"1c+EFFr3c4|d |djfSri"rsrs r1r z-_idencia_report_item_status..sr!ufbekkm-Dr3rr#r^zAll statuses (total)rdrrrrr# % of Totalr'#) r#rU"rr#r`"r^"r"rrrrrjri)rr'rnr r!rrrI rr$r@ rrrrrrv"rr{"s @@@@r1_idencia_report_item_statusr0#s%:$$H!D%c Sy$VZZ %:%@bAG  'CRHh{{9$ z : @b E Ef M SQSU{{6$ | < B G G O USUWG$$$@1QQ$@ AF   Eflln"DF Gq! q% E)1-D A GC G  *EE5tLM(31|46GT :D @@%A Gs E?&E?)#Fc(t|d\}}}}}|rd|fSt|}t|jdxsddvrd|Dcgc]}t ||dr|}}fd} i} |D]Y}| |} | j | ddd } | dxxd z cc<t |d d d d} t| } | K| d xsd| z| d <[td| D}d| vr|jd|Dcgc]}|| |d| |d g}}|rG|Dcgc]}| |d | |d }}|jdt||r t|ndgddddddd ddg}|||ddfScc}w#ttf$rd} YwxYwcc}wcc}w)aShipments grouped per period (day / ISO week / month) from each row's ship date, with summed item counts where the schema provides one. Rows with no parseable date land in an explicit "Unknown" bucket rather than being dropped (schema-tolerant, matching _idencia_range_keep).rNperiodr)r rrr"ct|dd}|ydk(rd|zSdk(r d|d|d fzSt|j}d |d|d fzS) Nr!r!rr z%04d-%02d-%02drz %04d-%02drr^z %04d-W%02d)rb"r isocalendar)rrnrr2#s r1bucketz)_idencia_report_shipments..bucket*su a[ 9 9 U?#a' ' W !A$!- -a ,,.s1vs1v...r3r)rrr^ itemCountrrr c3,K|] }|dk7s |yw)rNrXrs r1r/z,_idencia_report_shipments..As7Y!7s rzAll periods (total)Periodrrrr'#)r#r#r*rrf"r}r"rrrrrirCr)rr'rnr r!rrrrr5#rsr)rrr,rr known_itemsrr2#s @r1_idencia_report_shipmentsr:#s %:$ $L!D%c Sy  'C H%/ 0F -- G!"1c+DE  GD G /G  3Qi   s!d$C D +!alGZP JE  G*/U2AgJ 3 7W7 7DG IFJ KAwqz+& 7(; < KC K 48;q!!*W-9qz'*; ; )3t9(3C $? @(3"[913GT :D @@M G,:& E  L;s$ E.+ E35F F3FF))r=r)r:r) source_sheetTeam)r;zForm IDc t|jdxsd}|tjvrd}tj||jdxsd}|dfd}|dDcgc]}|d |d ||d g}}|r|j d rd nd gd tj|dd dddddg}||ddidd fScc}w)zInventory breakdown: asset counts grouped by Type / Area / Team / Form ID with % of total, plus a trailing totals row (kept in the data so the CSV carries it). An optional text filter scopes it like the list search.r|r=r r7r) r@ c0rtd|zz dSdSNr#r^r#rr@ s r1r#z%_assets_report_breakdown..pcta 27uUU]U*A.ATAr3rrrzAll assets (total)r#NrAssetsr#r/#r rr'#)r*rr GROUP_FIELDS group_countsri) rr'r rr#rrnrr@ s @r1_assets_report_breakdownrE#Ws  :&6, 7E L---  $ $Ufjjo.C DD MEB@DH~ N!QwZ7S7_ 5 ND N  )55%dKL)B)B5)IJ2|46Gx6J KT QQ Os/Cc  tj|jdxsd}|d |d} fd}d}|Dcgc]\}}||||||g}}}dd d d d d d dd g} | |d dddfScc}}w)uData completeness / exceptions: how many assets are missing key fields (Type / Area / Serial # / photo). Flag, not fix — one row per gap.r r7r) r@ missingc0rtd|zz dSdSr?#r#r@#s r1r#z(_assets_report_completeness..pcttrA#r3))zMissing Asset Typer=)z Missing Arear:)zMissing Serial # serial_no)zNo photo attachedrrzData gaprrrB#r#r/#r)r r@ r'#N)r completenessr) rr'rrG#r#checksrr)rnrr@ s @r1_assets_report_completenessrL#ms  $ $vzz#'<" =D ME9oGB.FHN NUGCL#gcl"3 4 ND N42|46G  (59 ;<@ BB OsA8c t|jdxsd}t dt |d}t } |jd|fj}|j|Dcgc]}|d|d|dxsd g}}d d d d dd ddd g}||ddiddfS#ttf$rd}YwxYw#|jwxYwcc}w)zMost-viewed assets (D3-A usage angle) from the asset_viewed history events, most views first. Empty until usage logging has accrued.r\rxr^rKzSELECT ref, COUNT(*) AS n, MAX(created_at) AS last FROM tool_history WHERE action = 'asset_viewed' AND COALESCE(ref,'') != '' GROUP BY ref ORDER BY n DESC, last DESC LIMIT ?rrrr7r z Asset Tag #rviewsViewszLast viewed (UTC)r rr'#N) rrrrrCrLrrLrr[)rr'r\rOhitsr} rnrs r1_assets_report_most_viewedrQ#s&**U#)r* aS# C =D|| 2586 ;AQuXqvqyB / >D >}51(;<>Gx6J KT QQ! z " >s#B)!C6C)B=<B=C)r#r#r#)mtdz Month to date)ytdz Year to dater#cvtjj}|jd}|dk(r|t dz }n_|dk(r|t dz }nJ|dk(r|t dz }n5|d k(r|j d }n|d k(r|j d d }nd|fS|jd|fS)zl(start, end) YYYY-MM-DD for a QC report range key; start None = open (all captured batches up to today).rrrrrr( rYrR#r^rcrS#)rr N)rrrrrr)rr rrqs r1_qc_report_windowrV#s    % % 'E .. $C iQ// R00 R00  ! $  A1 -Sy >>* %s **r3c t|jdxsd}|tvrd}t|jdxsdjxsd}|rt j |sd}t |\}}t j|||}t j|t j}dddd d dd d dd ddddddddddddddg}d||d|d|d|dd}|t||ddfS)aQC material consumption totals over a date range, in each material's consumption (ordering) unit with its administered rounding decimals, split per plant when no plant is chosen. Reuses the same range_totals + row flattening as the /qc/report/range.csv export (one shape).rrrHr7Nplantrrrrcapturedrrr consumptionrrrrrrrrrrrr)r rrrrrr'#) r*r_QC_REPORT_RANGE_KEYSrrrzrV#rrrr) rr'rrHrqrrrrs r1_qc_report_consumption_totalsr\#s= fjj!/Z 0C ''&**Y'-2.446>$Gx**73"3'JE3   sG 4C  & &sH,G,G,I JC1!J7!,<=%?$/BC)4FG +=>%?AGSL8IJM8J}- /D(=c(B   r3))last_1dr^)rr)rr)last_60dr)rr incddlm}ddlm}t |j dxsdj } |jdddDcgc] }t|c}\}}d|cxkrdkrnJd|cxkrd ksJJ t |j d xsd j xstd j d xsd} ||} ttj t |j dxsdd} d} | |j d} | |j d} | s#tj| j} | s| t!| dz z } | | kDr| | } } | | z j"dzt$kDr| t!t$dz z } t |j dxsd j j'}|r>|jdDchc]#}|j s|j %c}nd}t)t+dDcgc]}|j ddk(r|}}|9|Dcgc].}|dj'|vs|dj'|vr|0}}|j-ddd d!g}||Dcgc]}d"|dz|dd!c}z }g}t/} t1|| }|| k\rt|j2|j4|j6||| #}|j9|j:j=d$}|j=d%g}|D]'}t?||d|}|jA|d n|)|jA||t!dz }|| k\r|jCd&|d'||fz| j=d%| j=d%tE|d(}|||d)dfScc}w#t$r d \}}YwxYw#t$rd}||} Y\wxYwcc}wcc}wcc}wcc}w#|jCwxYw)*Nr)rr time_of_day19:00rSrrr)rrr7rr|rrrc tjt|jdj S#t $rYywxYwr")rrr*rrryrs r1_pdz)_dash_manual_snapshot_report.._pds? !**3q6<<>:FKKM M  s:= A A r2rX r^rrrrTrrr9c(|djSr rsrs r1r z._dash_manual_snapshot_report..saioo/r3rrr rrr rrr %02d:%02d)r rr`#rrrr'#)#rrrrr*rrrrryrr_DATASOURCE_SNAPSHOT_RANGESrrrrr_DATASOURCE_SNAPSHOT_MAX_DAYSrErrrrrrrr rrrrrir[rC)rr'r8rtodrrrrrrng_daysrd#rqrrGrsel_setrrrrnrOr local_dtinstantrrrs r1_dash_manual_snapshot_reportrn#sJ(! fjj'27 3 9 9 ;C"%))C.!"45Q#a&5BB||,,R " ,, ,, &**T"(b)//1L"2&**:6L:K  f  /044 FJJw  -:.4H  6" #E fjj C   $))+ o8a<88 s{%s e A ==o+H1+LMM fjj#)r * 0 0 2 8 8 :CBE#))C.>QAGGIqwwy>4G/!),.LA12v(1JLFL#3tW]]_/vY__&'133 KK/K0/0G vN!4(1V9=NNG D  D$T*Ul%chh 377&("R9H))#''2;;dd?d d@dAddBd dCdDddEd dFdGddHdIdJdKdLddMd gtddN}dOdPdQgt d|dR<t#t%dSD]G}dT|dUzdPdQ|j'dVxsgDcgc]}|dW|d/ddXc}|fdYd|dZ|d.z<I|Scc}wcc}wcc}wcc}wcc}wcc}w)[a Auditor -> Reporting registry (same shape philosophy as _dashboard_tile_types() / the SCADA report-type registry). Adding a report = one entry here + its run() builder; a new source also adds a reporting.* leaf in _AUDITOR_RESOURCE_TREE for access granting.rz Date ranger9rrFiltersr&z(project:"Bridge A" type:Beam status:Cast)r)rrT placeholderu)Idencia — Production summary by projectrrzproject:"Bridge A", "Plant B")rq#)rr resourcerr:u!Idencia — Item status breakdownuIdencia — Shipments over timer2#Groupr)r)rrTr r.uAssets — Inventory breakdownrrr|rr=r z Search filteru#tag / description / manufacturer…u)Assets — Data completeness / exceptionsuAssets — Most viewedr\zTop N20u0Batch Production — Material consumption totalsrrrrHrr7rTrrru-Data sources — Manual values at time of dayrrLookbackr]#rrrrr^#z Last 60 daysrrr`#z Time of day (HH:MM, plant-local)ra#r2zFrom (YYYY-MM-DD, optional)zoverrides lookbackrX zTo (YYYY-MM-DD, optional)zdefaults to todayrz Sources (names/ids, blank = all)zblank = every manual sourcemanual_sources)r)rrTrq#pickerrz Timezone (blank = plant default)r|)idencia_production_summaryidencia_item_statusidencia_shipmentsassets_inventory_breakdownassets_data_completenessassets_most_viewedqc_consumption_totalsmanual_source_snapshotu#Power BI — Dataset refresh statuspowerbirpowerbi_refresh_statusqueriesu Power BI — r9rr)rct|||SrT)_powerbi_report_query_run)rr'rs r1r z'_auditor_report_types..s-b&$?r3 powerbi_q_)_IDENCIA_REPORT_RANGESrrr+#r0#_IDENCIA_REPORT_PERIODSr:#_ASSETS_GROUP_FIELDSrE#rL#rQ#_QC_REPORT_RANGESrrr\#rn#_powerbi_report_refresh_status_powerbi_sanitize_queries_load_powerbi_configr)r" range_param filters_paramrrVr rs r1rr2ss "L(0FG1tAwGIK% 6$NPMA-@M(GIJ5 ' 9-@$k2.  7-@''85L#MDG#M#)+,79-  6,>"Z.BCT!WC(*ov EG H , ' A,>"_f'LNO. % .,>$w'+-.-  H,.?@T!W@&("GX!<01'/'='=t'TV"# !w' 3VV  !1 " $E#1H*h'9'7(.9(.9(.9 ; ' (&0R9)F0DF'B0CE!,N0M+-'I0AC#D&0-# K] EF7)<- 'E "# '';'=i'H I $qy0-@ !h 527 !x!G*fM7,-@ ) lQtW$%  LiH*$ND6AV^7s#G) G. G3G8G= H ct}|jdr t|St|jdd}|j Dchc]\}}|d|vs|c}}Scc}}w)z>Report ids the user may list/run (admins hold every resource).rrr7rr#)rrrrr)r'rVheldrKrs r1r2r2s^ ! #E xx 5z txx4 5D#kkm EFCq}/DC EE Es A-%A-c|dDcic]=}|dtjj|dxsdjdd?c}Scc}w)zCQuery-arg values for a report's declared params (strings, trimmed).rr)r7Nr)rrhrr)rrs r1_auditor_report_paramsr#sZ ) + eHw||''%17R>>@#F F ++ +sAA z/auditor/reportsrc ttd}tjDcgc]\}}||vr||d|d|dd}}}|j dt d| Scc}}w) uGReport types the caller may run (id/label/source/params — no run fn).r'rr rrc(|djSrrsr*s r1r z&auditor_reports_list..ƺs1W:++-r3rTr)r2rrrrr)rrKrrs r1auditor_reports_listr#s)9G/0668 LsAC7N' akk # LC LHH-H. dC ((  LsA/z/auditor/reports/ctj|}|stddfS|ttdvr t S|dt |td\}}|r td|Std||d | S) zRun one report. Source-side failures return ok=False + message (soft, like tile providers) so the UI shows the reason instead of a broken pane.Unknown report.rrr'r:FrTr)rUrrr6)rrrr2rrr#)rKrr6rs r1auditor_report_runr#ʺs '(,,S1J ./44 ,WV_==  #*U#$::$F$+FO5KFC %s++ ds*W*=f MMr3z!/auditor/reports//export.csvctj|}|stddfS|ttdvr t S|dt |td\}}|rt|dfSdt|dtjjd d }t||d Dcgc]}|d  c}|d Scc}w)z9CSV of one report run (same params as the on-screen run).r#rrr'r:rU togen_report_r z %Y%m%d_%H%Mrrrrn) rrrr2rrr#rtrrrrq)rKrr6rr9rs r1auditor_report_export_csvr#ۺs'(,,S1J ./44 ,WV_==  #*U#$::$F$+FO5KFC S!3&&  3++-66}E GD 4fY6G!H!G*!H!&> ++!Hs7 C ))last_24hr)last_dayzLast day)rr) last_monthz Last month)rYz Custom rangecf|sy|jdry|t|jddvS)zTrue if the user may use a reporting feature leaf (admins hold every resource; otherwise the specific reporting.* leaf must be granted).FrTrr7r)r'r)s r1_reporting_feature_allowedr# s5  xx  &txx'<= ==r3ct|dS)Nrr#r-s r1_reporting_can_buildr#s %d,? @@r3c:t|tsi}|jd}|tvrd}d|i}|dk(rdt |jdxsdj dd|d<t |jdxsdj dd|d<|S) zkCoerce the report-level date-range param. Custom carries ISO date strings; presets carry only the mode.rOrrYrqr7Nr$!r)rrr_REPORT_RANGE_MODE_KEYSr*r)rrOrs r1_report_sanitize_date_ranger#s c4  776?D ** 4.C x3777+1r288:3B?G -2.446s;E Jr3c t|tsgSt}g}t|ddD]Q\}}t|ts|j dxsdj }||vr@|j dxsdj }|tvrd}|j drt|j dddn#d tjjdd z|||t||j d xsit|j d d }|dk(rt|j d|d<t|j d}|dk7r||d<|j!|T|S)zNormalize a template's tile list to the same shape the dashboard store uses (reuse of the P1 tile registry + sanitizers). Unknown tile types are dropped so a hand-edited definition can't smuggle an unrenderable tile.NrrTr7rdrrrSr9rrcr:r;rYr<rPrdr=) rrrrrrrdrr8s r1_report_sanitize_tilesr#,sc c4  ! #E E#cr(#1!T" v$"++-   f )002 , ,D,-EE$K3quuT{#CR($**,"2"23B"77+E155?3HbI/j0AB  8 .quuV}=DL!!%%-0 #:DL T/0 Lr3>rrmonthlyc 6t|tsi}|jd}|tvrd}d\}}t |jdxsdj }d|vrT|j dd\}} tdtd t|}tdtd t|} tdtd t|jd } tdtd t|jd}t|jd|d||fz||t|jddS#ttf$rd\}}YwxYw#ttf$rd}YwxYw#ttf$rd}YwxYw)uCoerce a template's delivery schedule (DVI-1258, P5). Never trusts a client-supplied `identity` — that is stamped server-side from the live session in the create/update route (see _report_apply_schedule_identity).rrrrrUr7rSr^rrrrrr' day_of_monthr~rf#r)r~rrUrr#r) rrr_REPORT_SCHEDULE_FREQSr*rrrCrLrrrr) rrrrrrrrdoms r1_report_sanitize_scheduler#Rs c4  77; D )) FB CGGFO !r"((*A axwwsA1 QBA(BQBA(BaQCGGI$6 789!SS!89:; *+r2h&cggg&'  :& FB  z " z "s69>E8.E-'.FE*)E*-FFFFc |xsijdxsi}|jds|jdd|S|jdxsdj|jdxsdt|jdt|jd t|jd d |d<|S) uStamp the authorizing identity onto an enabled schedule from the live session (never from the client). A scheduled run in the togen-worker has no web session, so it renders the report AS this captured identity — the builder who saved the schedule — keeping every tile's per-source D8 gate. Azure role flags aren't resolvable offline, hence the snapshot; the builder re-authorizes on each definition save. Cleared when scheduling is off. Mutates + returns `definition`.r r~identityNrr7r9rrrrr9rrr)rrrEr) definitionr'rs r1_report_apply_schedule_identityr#xs 2 " ": . 4"E 99Y  *d#((7#)r002 &BDHH]34$((;/0DHH]34 E* r3cpt|xsdjdd}tjdd|S)uScrub a linked-dashboard id (DVI-1388). Dashboard ids are `dash_` / `dash_system_oversight`, so limit to that charset and cap length. Blank/garbage → '' (an unlinked report).r7NrXrl)r*rrFr\)rrs r1$_report_sanitize_source_dashboard_idr#s5 CI2s#A 66#R ++r3c:t|tsi}t|jdt |jdt |jdt |jdd}t|jd}|r||d<|S)zAFull defence-in-depth sanitize of a template's authoring payload.rr` rr )rr` rr source_dashboard_id)rrr#rr#rSr#r#)rrr$s r1_report_sanitize_definitionr#s c4 '(891#'',2GH-SWW\-BC-cggj.AB C /sww7L/M NC %( !" Jr3c `|d|d|d|d|d|d|jdxsidS) z4API view of a template record (definition included).rr9rLr rrr#)rr9rLr rrr#rr s r1_report_template_publicr#sH$iVs7|y>\1B,'ggl+1r  r3z/reporting/templatesc td}t|}|xst|dxs t|d}|s tSt j }t d||t|tDcgc] }t|c}Scc}w)zList report templates (metadata) + whether the caller may author them + the range-mode vocabulary the Builder UI needs. Visible to anyone who can view OR build reporting; empty list is fine for a viewer with no templates yet.r'rrT)rUr can_buildcan_use_viewer range_modes) rr#r#rr[ list_templatesrro _REPORT_RANGE_MODESr)r'r#can_viewrrs r1reporting_templates_listr#s 6?D$T*I@6t=MN@ %d,> ?   ,,.I di9";D"A1DEAQE GGEs-Bz/reporting/templates/ctd}t|s"t|dst|ds tSt j |}|t ddfSt dt|S) z&Reopen one template (full definition).r'rrr!rrTrUr )rr#r#rr[ rp rr#rr'r~s r1reporting_template_getr#ɻsm 6?D  &)$0@A)$0BC   $ $S )C {23S88 d%.@* MC=";9CKG4y-T)CE d% >DSzJt0,1G1M2N ' D9  ' '$:.>.@ BC {23S88=";&k3y>38;D *-d)IOQ d%w#>@4y*-d)29),Z-@)AC D d%/resyncc td}t|s tStj|}|t ddfSt |jdxsi}|jdxsdj}|st dd fSt|\}}|t d dfSt||d <||d<t|}t||tj||t }|t ddfStd dd|dd|jdxs|d|dd||||dt!|d dt dt#|S)uRe-pull the linked dashboard's CURRENT tiles into this template (reporting.builder). Replaces only the tiles — name/date-range/recipients/ schedule are preserved. Bumps the template version.r'r!rrr#r#r7z)This report is not linked to a dashboard.r`z8Source dashboard not found or no longer shared with you.r)r#r r report_template_resyncedzRe-synced report template 'r9r#r#r r7)rr#r r7rn Tr#)rr#rr[ rp rrrrrNr#r#r#r#rr rCr#)rr'r~r#rrrMrYrs r1reporting_template_resyncr#Ys 6?D  %   $ $S )C {23S88cggl+1r2J~~34:AACG HI3NN&w/LFD |LNORS S6t>*uc:SUVuuS a A _!, , 7 7 9E55??$a 11 D s.A$F11 F?>F?ct|}|d}|dvry|dk(ry|dk(r'|jd}|y|d kry|d kry|d kry yy) uMap the report-level date range onto the {all,last_7d,last_30d,last_90d} vocabulary the date-filterable Auditor report sources (Idencia time reports) understand. Lossy by necessity — there is no per-day source option, so last_day/last_week both map to last_7d; a custom window maps by span. Sources with no `range` param ignore this (the value is dropped by _dash_report_source_run, which only passes a report's declared params).rO)r#r#rrr#rrYrrrr r)r#r)r#rrOrs r1_report_range_to_source_ranger#sp$B 'F &>D 44 | xzz&! < 19 2: 2: r3c|jdxsdj}t}|j|}|dddSt|jdxsi}|dk(r t |||S|dvr|rt |jd }t j|}|r^|jd d k7rJtd |jd gDr(t|jd xsi} || d<| |d <|dk(r?|jds.|jdxsgD cgc] } | tvr| c} |d<|jd} | siStj| } t| sdddS | ||Scc} w#t$r(tjjd| dddcYSwxYw)uxDispatch one report tile through its registered provider (mirrors dashboards_tile_data) under `user`, injecting the report-level date filter into date-filterable report sources. Returns the provider payload verbatim — including its {access:false}/{available:false} soft states, so the D8 per-source gate is preserved. Never raises (a bad tile soft-degrades).rTr7FzUnknown tile type.rrcrbrrr6r rc3DK|]}|jddk(yw)r)rNrrps r1r/z#_report_run_tile..sQAe /Qs rrrrr[r6zProvider not available.z&reporting run: tile provider %s failedzThis tile failed to run.)rrrfrrBrrr2rrrryrmrnr) rr'rArrrrJrKrdescrrwrrs r1r@r@ͼs XXf  # * * ,E$&H << D |"/CDD txx!'R (C "3l;; ))lcggh/0%'++C0 eii)]:Q8R9PQQ#''(+1r2F*F7O"CM CGGN$;%(WWX%6%<"?q%==?H HHZ(M  )-- .K K "/HIIK3%%? K E}U"/IJJKs<FF .GGc 0|jdxsi}t||n|jd}t|}t|}t |jdxsgd}g}|D]} | jd| jd| jdxsd | jd xsd | jd xsit | ||d } | jddk(r%| jdr| jd| d<| jdr(| jddk7r| jd| d<|j | d|jd|jd|jd||dS)zRun a template into a resolved view-model: the ordered tiles (layout + config) each with its provider payload, plus the resolved date window and template identity. This is exactly what the Viewer renders and what a run snapshots to history.r#r` rc&|jddSrrr*s r1r z*_report_build_view_model.. sw!2r3rrrTrdrr:r7rc)rrTrdr:rcrrYr<rPrdr^r9r )r rrtemplate_versionr` r)rr#r#r#rr@ri) r r'r` r#r#rrArrrrs r1rq rq ss l+1rJ $ , *..2N PB #B 'F04L JNN7+1r2 4EI   %%+EE&MEE&M-Xj)/ReeHo+'4>   55=H $vEE&ME&M 55=QUU6]c1EE&ME&M  ||D)!f-$LL3  r3c|jdxsg}t}|D]=}|j|}||jd}t|s4||r=yy)uTrue only if the viewer can access every layer the oversight tile references (re-runs the layer registry's access() role checks — cheap).r[rFT)rrr)rJr'rr[rrrs r1_report_oversight_layers_okr#'sf 778  "D  Fzz# < hhx  C=T  r3c|jdry|jd}|jdxsi}|dvry|dk(ry|dvr6t|jd}|r |tvry|t|vS|d k(r7t |jd xst |jd d S|d k(r t |S|dk(rt |jdS|dk(r t|S|dk(rl|jdxsd}|dk(r t|St |xr:|jd d jt|jk(S|dk(r t||S|dvryy)aIRe-gate one stored tile against the CURRENT viewer for historical-run reopen (D8). Correct-or-stricter: returns True only when the viewer clearly holds the tile's source gate; unknown/identity-scoped cases redact. Mirrors each live provider's own gate so a snapshot can never leak data the viewer lacks access to.rTrTrc)r&rUrr[r~ rbr#r6rprrr7r0 rrrrr r+r)rrrrKF) rrrr2rrvr$rrrEr*r#)rr' run_authorrrJrKr$s r1_report_tile_access_okr#6s  xx  IIf E ))H  #C 99   ))cggh/0c!6!880666 !!DHH[)G/"0EFH H D!! DHH]+,, ""T"" ggh'4 $;&t, ,JQ"-335Z9N9N9PPR R *355 HH  r3c ddd}|jdxsgD]}t|||st||d<|jddk(s4|jdxsijd xsg}|jdxsi}|jd }t|ts|D]Y}|jd } | |vst|jd|jdxsid ||rLt||| <[|S) z|Redact any tile in a stored view-model the current viewer can't access (D8 on reopen). Mutates + returns the view-model.FrrdrrrTrbrcrrr)rr#rr) rJr'r#r?rrrkidsr rs r1_report_regate_view_modelr#lsGIF&&/'R1%eT:>#F|E)   99V  '8,277 CJHii *0bG;;z*D$%%1E))D/Cd{+A%*YYv%6',yy':'@bB *,.%)LS 11$ Ir3z/reporting/templates//runc td}t|s tStj|}|t ddfSt jdxsi}|jd}t|||}d}|jd r[tj|d |d t||jd }|d }td dd|dz|d |d |dt d||S)zRun a template live under the viewer's identity. Body: {date_range?, save?}. Returns the resolved view-model; when save is truthy the run is snapshotted to history (D4-A).r'Nr!rrTrr` rrr rk r rl zSaved a run of report '%s'r9)rrfrn )rUrIrf) rro rr[ rp rrrrrq rr rr )rr'r~rr#rJrfr:s r1reporting_template_runr#s 6?D $T *   $ $S )C {23S88   4 ( .BD , B !#tR 0B F xx&&s4y#i.'7'9224&&2FHT}&8;c&kIt9.1$i6J L dr& 99r3z/reporting/templates//runsctd}t|s tStj|t ddfSt dtj |S)z6Run history (metadata) for one template, newest first.r'r!rrTrUr)rro rr[ rp rrBrr's r1reporting_template_runsr#sX 6?D $T *  !!#&.23S88 d!8!8!= >>r3z/reporting/runs/c :td}t|s tStj|}|t ddfS|j dxsi}t|||j dt d|d |d |d |d |d|d |dS)uReopen a historical run from its stored snapshot, re-gated against the current viewer (D8) — the snapshot data is served (immune to later data changes) but a tile the viewer can't access is redacted.r'zRun not found.rrrIran_by)r#Trrr#r=rd)rrr#r=r#rdrI)rUr:)rro rr[ rRrrr#)rfr'r:rJs r1reporting_run_getr$s 6?D $T *     'C {-.33   $"Bb$37783DE d$iM(: 23s8}h-3x= ! r3z(/reporting/templates//schedule-runsctd}t|s tStj|t ddfSt dtj |S)z|Scheduled-run health log for one template (Report Builder). Shows when each fire ran, whether it emailed, and any error.r'r!rrTr#)rr#rr[ rp rlist_schedule_runsr#s r1reporting_schedule_runsr$ýsX 6?D  %  !!#&.23S88 d!A!A#!F GGr3c <|xsijdxsi}|jdxsdj|jdxsdt|jdt|jdt|jddS) uReconstruct the identity a scheduled run renders as. A worker run has no web session, so the builder's identity is snapshotted at schedule-save time (Azure role flags aren't resolvable offline) — the report renders exactly what its author could see, with per-source D8 gating intact. Offline grants (reporting.* leaves, approver depts, tool visibility) are still re-read live from JSON by the tile providers keyed on this identity's email.r#rr7r9rrrr#)rrEr)r rss r1_report_scheduled_userr$ݽs^  , 2E))G$*113 &!'REIIm45%))K01EIIm45  r3cN|jdsy|jdxsd} dt|jdxsdjdd D\}}|j |j f||fkry|d k(r1|jt|jd d xsd k7ry|dk(r-|jt|jdd xsd k7rytj||jd S#ttf$rd \}}YwxYw)a3True when an enabled schedule should fire at `now` and hasn't already fired this period. Cadence day gate + a time-of-day floor; per-period dedup via the run-log's run_date (one row per day; weekly/monthly only reach the day gate on their matching day, so the day-scoped guard covers all three).r~Frrc32K|]}t|ywrT)rrs r1r/z'_report_schedule_due..sUQ#a&UrrU08:00rSr^r#rrrr#r#r) rr*rrrrrrrr r[ schedule_ran_onr)r rrrrrs r1_report_schedule_duer $s << " << $ /DU#hll6&:&Eg"F"L"LSRS"TUB #**R( xCKKMSi1K1Pq-QQ ySWWHLL,K,Pq(QQ,,[#,,z:RS SS z "Bs8D D$#D$cddlm}|jdxsd}|jdxsi}|jdxs|jdxsd}|jd xsg}tjd z||z} d} |d d D]{} | jd xsi} | jdxs3| jdxsdj ddj } | dtj| zdzz } }dtj|zdz|rdtj|zdzndz| rd| zdzndzdztj| zdz}tj||d}|r d|d|d nd!|z} ttj|||S#t$r2tjjd"|jd#Yy$wxYw)%zEmail a scheduled report to a simple recipient list with a deep-link to the saved run. HTML-only for now (server-rendered PDF attachment = F2). Returns True on a Graph accept, False otherwise.rrr9r_ r` rrOr7rz/?open_report_run=NrSrcrerTr r\z7
  • rzV

    Your scheduled report z is ready.

    zE

    Date range: rz.

      rz)
      View report online

      Opens the saved run in Togen (sign-in required).

      zScheduled reportrzReport: r:r7z Report: %sz$Scheduled report email failed for %srF)r rrr=r;rrerrrrryrmrnr)r rJrfrrr9r#rrrrnrrJrerrrs r1_report_scheduled_emailr $s# <<  +8D   #B VVG_ 4v 4"F FF7O !rE  " " $'; ;eFm KD D 3BZ8eeHo# SQUU6]%8b$A$A#s$K$Q$Q$S J %%e,-/67 88  )+8+=+=d+C D # $5; S    ' (*0 1@B  D  %d+ 1 1 JJ !E!%$ 1 1sBAB8C C cddl} |jd tj5t ddd;#1swY xYw#t $r"tj jdY7wxYw)zBackground thread (togen-worker only): fire due report schedules. Checks each minute; cadence + time gate live in _report_schedule_due so Builder changes apply without a worker restart (mirrors the sync loops).rNrzReport scheduler loop error)rUrrmr0"r$ryrnrrB"s r1_report_scheduler_loopr$_sj  2 @" )&( )  ) ) @ JJ !> ? @'A AA A A (A87A8zpowerbi_config.jsonz"https://api.powerbi.com/v1.0/myorgz1https://analysis.windows.net/powerbi/api/.defaultz!https://login.microsoftonline.comuPower BI is not configured. An admin must set the Azure tenant ID, client (app) ID, and client secret in Togen Admin → Services → Power BI.cddddgttgd}tjr t j tj }t|jdtr;|dD]3}t|dj|ts&|d||d|<5t|jdtrI|dDcgc]4}t|jrt|j6c}dd|d<t|jdtr)|dDcgc]}t|tr|c}dd|d<t|jd tr^|d jd }t|ttfr|d kDrt||d d <d |d vrt|d d |d d <|S|Scc}wcc}w#tjt f$rY|SwxYw) z/Return Power BI config with defaults filled in.r7 tenant_idr r )r^ workspacesrr#r^r$NrKr#rr9!rr:!)rPOWERBI_SETTINGS_DEFAULTSPOWERBI_CONFIG_FILErrrrrrr*rrrr rrr)rJrrrr rE!s r1r#r#s "bI56 C""$ JJ2<<>?E%))E*D1U8A!%,"2"21"5s;(-e QE 1 8%))L148=B<=P%8(+A &)V\\^%88<%>L!%))I.5-29-=":%/4%8#$"::>3"@I%))J/6:&**+BCb3,/BF?B2wC O$;<!U:%666:j).97;C ON3 J3J%8":$$g.   J s7A0G+ 6G+9G!/G+>G&BG+! G++HHctjtj|d tj t j t jzy#t$rYywxYwr) r$rrrrrrrrrNs r1_save_powerbi_configr$rI!rc gt}}|xsgddD]W}t|tst|j dxsdj dd}t jddt|j dxsdj dd}t jddt|j d xsdj dd}t|j d xsdj dd }|r|r|r|st jd dt|j d xsdjdd}|r||vr$dtjjddz}|j|g} |j dxsgddD]} t| tst jddt| j dxsdjdd} | s[| j| t| j dxs| j ddxs| d|j|||||| dZ|S)uValidated admin DAX query library (P3, D3-A). Each entry becomes a runnable Auditor -> Reporting report, so this is strict: entries missing a name/workspace/dataset/DAX are dropped, ids are minted when blank and de-duplicated, and id/GUID fields are charset-scrubbed (they land in REST URL paths / report ids). params (≤5) declare {{key}} placeholders the report UI collects as text inputs.NrKr9r7rdrrrSrrrz [^0-9a-z_-]rr rrrrRr)rr)rr9rrrr)rrrr*rrrFr\rErWrXrYrri) rrrr r9rK r(rqidrrr)s r1r#r#s>CECiR# E!T" 155=&B'--/5 VV$b#aeeN.C.Ir*J*P*P*R STWUW X VV$b#aeeL.A.GR*H*N*N*P QRUSU V!%%,$"%++-et4s ff^RQUU4[->B)?)E)E)GH"McTk (("--C  %%/'R!, ZAa&&&Ce 0B,C,I,I,KLSbQC c(+AEE'N,Ac(B(H(H(J4C(P(WTWYZ  Z #tR"$SFD E+E. Jr3c|xs t}|d}|jdr1|jdr |jdr|d|d|ddSy)z>Org service-principal creds dict, or None when not configured.r^r$r r r$N)r#rre!s r1_powerbi_org_credsr!$s_ '%'C e*C ww{ 49Q -C rr{!rr)rrr$$POWERBI_LOGIN_BASErrPOWERBI_TOKEN_SCOPEr?rdrrrgr*r&rrErr) r!r7r1r rrJrrlrr rs r1_powerbi_mint_tokenr.$sUii $* 1 1 3F;'-2446I YY ' -2F &000  &); d#A&,,T215ds; 88G  0 0//5h89 9   s "x6<<>'A** Et KK1  * *:7.sC89: :: " z " sB7!F/G G2/GGGG G/.G/2HHctj}t5tj|}|r|s|d|kDr|ddfcdddSdddt |\}}|r)t5tj |ddddd|fSt5|d|t d|ddz zdt|<ddd|ddfS#1swYzxYw#1swYd|fSxYw#1swY+xYwzZCached bearer token for a scope, minting when missing/expired. Returns (token, error).r.rDNrrrr!)rU_powerbi_token_lock_POWERBI_TOKENSrr.$rrCr!r!r rrrrs r1_powerbi_get_tokenr4$A ))+C &!!), u\!2S!8w<%&&&&e,KFC  1    4 0 1Sy DH%B|(rr7)NzPower BI did not return JSON.)Nz,Power BI authorization failed after re-mint.)rwPOWERBI_API_BASEr4$rrrr?rdrgrr&rrr) r!r!rbrarr7rJr!rDrrrls r1 _powerbi_apir<$Us //*-$3Cd3JC#9' 5W N s 9  >!))()e*;< ' 3W !D   z )gl    s ">   s "C   s "071CB1G1M0NbQQ Q   s "\   s "a '3D4D4D3ER!YYt_-/0 0 R&&(t8O 999;$ $C#9H @5.. >523<=> > >0 98 9s0#E8FE>!E91E>9E> F Fct5tj||f}|r(|dtjkDr|dcdddStj ||fddddy#1swYyxYwr!)_powerbi_memo_lock _POWERBI_MEMOrrUrr!s r1_powerbi_memo_getr@$r!r!ct5tjtz|ft||f<dddy#1swYyxYwrT)r>$rUPOWERBI_MEMO_TTL_Sr?$r!s r1_powerbi_memo_putrC$r"r"cPt||}||ddddS|\}}|,t||| tj||||ddddStj||}|r |dd|d|dSddd|dS#t$r"t j jdY]wxYw)a'Live-first data fetch for tiles/reports (D4). fetch_fn() returns (payload, error). Returns {data, cached, as_of, error}: - memo hit (<60 s old live result) -> live data, no badge - live success -> memoized + written through to the scope's cache; no badge - live failure w/ cached last-good -> cached payload, cached=True + as_of (renderers show the badge) - live failure, nothing cached -> data=None + the error NFr"z#Power BI cache write-through failedrTr") r@$rC$r#$r"ryrmrnrr"r"s r1_powerbi_fetchrE$s Y 2D tLL:LGS {)Y8 H  # #Iy' B 54$OO  ! !)Y 7C I$\*S: :ED3 GG H JJ !F G Hr "cP|syt|jdxsdj}t|jdxsdjj}|D]8}t|jj}|s-||k(s||k(s8yy)zTrue when a workspace passes the admin allowlist (GUID or exact name, case-insensitive). Empty allowlist = every visible workspace.Trr7r9F)r*rrEr) allowlistrK r1r9rrBs r1_powerbi_workspace_allowedrH$s  bffTl b ! ' ' )C rvvf~# $ * * , 2 2 4D J    $ $ & !s(a4i r3c  t}|sd}tjd||d|fSt}tj}t ||dt \}}|rtjd||d|fS|xsijdgDcgc]}t|ts|}}|Dcgc]P}t|d|r?|jd |jd t|jd d R}}ggd } } } |D]g} t ||d| d dt \} }t ||d| d dt \}}|s|r2| dz } tjjd| d | d |xs|t| xsijdgD]q}t|ts| j|jd |jd |jd|jd| d | d | dds|xsijdgD]Q}t|ts| j|jd |jd | d | d | ddSj|| | d}tj |d|tj |d| tj |d| tj |d|t#j$j'd}tj(dt+|t+| t+| d|t+|t+| t+| d}| r| |d<tjd ||!|dfScc}wcc}w)"uOne org-scope sync pass: pull the workspace/report/dataset inventory into the cache + picker vocabulary (so P2 tile editors offer names, not GUIDs) and append an inventory snapshot. A workspace whose reports or datasets can't be listed is skipped and counted — one bad workspace never kills the whole sync. Returns (counts, error); the outcome is always recorded via powerbi_store.record_sync so the Admin pane shows it.z-Power BI service principal is not configured.rr#"N/groups?$top=5000r!rr$rr9isOnDedicatedCapacity)rr9 on_capacityr/groups/z/reportsz /datasetsr^z-Power BI sync: skipping workspace %s (%s): %s datasetIdembedUrlrL$)rr9r embed_urlrworkspace_namerL$)rr9rrQ$rL$)r$rr,"rr,"r%"rr inventoryr&"workspaces_skippedrUr)")r!$r#$r*"r#rm!r<$POWERBI_SYNC_TIMEOUT_SrrrrH$rrmrnrorir"rrrr+"rC)r r!rrJr rrrr$rr,"rrK rrxrderrrrnr%"r'"r$s r1_powerbi_run_syncrV$Ŀs  E =!!'cBSy  C  # #EUE+>%;=ID# !!'cBSy*"))'26 NA*Q:Ma NF NM 5c,6GKquuT{EAEE&MUQUU#:;< >MJM "$RwXGD "T(8/L)?A T "T(9/M)?A T 4 qLG JJ  N!&z2d8T\T C )"- CA!T"aeeDk155=./eeK.@-.UU:->02424V*/1-/@  BC C)"- DA!T"quuT{AEE&M13D35f:02=0A!CD D%D2&'! #EE<<E9g6E:x8E7E2    ! * *+> ?FC OG "%h-19?A OG h-)F'.#$d%? 4<cOMsM;'M;1ANc  tj5t|\}}|r!tjj d|n tjj d|dddt5dtd <dddy#1swY"xYw#t $r:tjjdtjd|dYgwxYw#1swYyxYw#t5dtd <dddw#1swYwxYwxYw) zEThread body around _powerbi_run_sync: always clears the running flag.zPower BI sync failed: %szPower BI sync ok: %sNzPower BI sync worker crashedrr/"r#"Fr8) rmr0"rV$rnrorlryrr#$r*"_powerbi_sync_lock_powerbi_sync_stater3"s r1_powerbi_sync_workerrZ$s 3 __  @-e4MFE ""#=uE  6?  @  3-2  * 3 3 @ @ K ;<!!'(I KK  3 3  3-2  * 3 3 3r6"ch|ddr t|sytdt|dddz}tjdxsi}|j d}|sy t j|d }t j|z j|k\S#ttf$rYy wxYwr8") r!$rCrr#$r3rrrrrrrr:"s r1_powerbi_sync_duer\$!r="r>"cddl} |jd tts(t5t dr dddBt j ddtjjddddtd#1swYxYw#t$r"tjjd Y7wxYw) zBackground thread (togen-worker only): org-scope vocab sync on the configured cadence. Checks each minute; the interval gate lives in _powerbi_sync_due so config changes apply without a restart.rNTrr8r@"rrrA"zPower BI sync loop error)rUrr\$r#rX$rY$rrrrrZ$ryrmrnrrB"s r1_powerbi_sync_loopr^$2s  2 =$%9%;<# S&y1 S S$** -113<<=PQ+S S ! -   S S = JJ !; < =rE"ct5tt}dddtj}d|d|d|d|ddS#1swY4xYwrG")rX$rrY$r#$rI"rJ"s r1_powerbi_sync_publicr`$GrL"rM"z/powerbi/configc t}t|d}t|jdd}t d|||d|d|dt t jt jS) zConfig for the Admin -> Services -> Power BI pane. The client secret is redacted to has_secret (write-only, ThingPark convention).r^r r7Tr$rr#)rUr^r(!r$rr#r"r") r#rrrrr`$r#$r"rm!rJr^r(!s r1powerbi_config_getrc$Sss  C s5z Ccggor23J d !,/#j/y>,.&11-2I2IJ  LLr3c ztjdxsi}t}t|j dt r|d}dD]>}t|j |t s#||jdd|d|<@t|j dt r,|djr|dj|dd<t|j dtrL|dDcgc]7}t |jrt |jdd9c}dd|d<t|j d trt|d |d <t|j d t rr|d j d }t|ttfr*|d kDr%td tdt||d d <d|d vrt|d d|d d< t|t$5t&j)t*j,ddddt |d}t|j)dd}t#d|||d|d |d Scc}w#t $r}t#d|dfcYd}~Sd}~wwxYw#1swYxxYw)zSave service principal / workspace allowlist / sync settings (partial merge). A blank/omitted org.client_secret keeps the stored one so the redacted GET can round-trip without wiping the secret.Trr^)r$r NrKr r$r#rr9!rr"rr:!r-!rrr7)rUr^r(!r$rr#)rrr#rrrr*rrr#rr rLrCrr$rrr1$r2$rr#$rm!)rrJr^rrrE!rlr(!s r1powerbi_config_postre$bs   4 ( .BD  C$((5/4(5k+ 5A#''!*c* #A t 4E 1  5 cggo. 4_9M9S9S9U*-o*>*D*D*FCJ '$((<($/;? ;M0a #A !V\\^DS10046L$((9%t,24 ?CI$((:&- *  ! !"9 : b3, 'BF7:4QB7QC O3 4 T*- -.24 3CN3S.TC ON +CS! ;M33T:; s5z Ccggor23J d !,/#j/y> ++/0 C6se<=sBBC;;s0=Uhh{+1r88:Uc%j>U88O4:AAC9 Z8  ;E + 5#5%:PUVX[[[%e,KFC %s+S00 0 0C@!! /9vh7G+GH*,  3!#?@P@P?QQRS   z )1C%s+S00"-!DQ,S->BDGD ds6{&)'l=DRa[I3uquuV}23I KK#  * *@%'B/S9(:;Kick off an org-scope vocab sync in the background (Sync now).r'rr7z/Configure the Power BI service principal first.rr`r8r"r9NTrrrA"r(r")rrr!$rrX$rY$rrrrrrrZ$rqrgs r1powerbi_sync_startrk$s FO   ,E  NOQTTT K y )!=>CKK ""%))+445HI # KK 0x ""'%' 4  KKr"z/powerbi/sync-statuscptdttjtjSr#)rr`$r#$r"rm!rXr3r1powerbi_sync_statusrm$r#r3z/powerbi/user-connectioncBtddttdS)uStatus for the User Settings -> Services -> Power BI pane. D1-A: org service principal only — the pane is read-only status; personal connections arrive with the D1-B follow-up.Tr^F)rUrOr#personal_supported)rrr!$rXr3r1powerbi_user_connection_getrp$s$ d!%&8&:!;&+ --r3z/powerbi/vocabcDtjtjd}|r$t|j dt r|dni}t d|j dxsg|j dxsg|j dxsg|r |d Sd S) uPicker vocabulary for the P2 tile editors / P3 query library UI: workspace / report / dataset names from the org sync's cached vocab. Empty lists until the first successful sync — pickers degrade to typing GUIDs, so this is never a hard dependency.r%"rTr$rr,"r"N)rUr$rr,"r)r#$r"rm!rrrrr #s r1 powerbi_vocabrr$s  ! !-"9"97 CC!j1CT&JC NPRE d#ii 5; 99Y/52!IIj17R.1\*  ==8<  ==r3i zThis report's workspace is not on a Microsoft Fabric capacity, which the embedded-report tile requires. Assign the workspace to a capacity (F2 is the entry SKU) in the Fabric admin portal, or use the Power BI Data tile instead (no capacity needed).cNt|xsdjjd}tjdd|}dD]H} t j ||}|jtjjcSy#ttf$rY]wxYw)uEpoch seconds from a Power BI expiration stamp, or None. GenerateToken returns ISO-8601 UTC, with or without fractional seconds (.NET stamps can carry 7 fractional digits — more than %f accepts, so truncate to 6).r7rz (\.\d{6})\d+$z\1)z%Y-%m-%dT%H:%M:%S.%frr N) r*rr8rFr\rrrr rrv rr)r&rr;rs r1_powerbi_parse_expirationrt$s djb/   ! ( ( -C &&!5# .C< ((c2B::\%5%5:6@@B B I&   s ABB$#B$c tj}|||f}t5tj|}|r|dtz |kDr |dfcdddSdddt ||d|d|ddddi \}}|rd|fS|xsijd } | sy t |jd xs |tz} | |jd | d } t5| t|<ddd| dfS#1swYxYw#1swY| dfSxYw)a"Cached app-owns-data embed token for one report (POST GenerateToken, accessLevel View). Returns (info, error); info = {token, expiration, expires_epoch}. Cache hits serve until POWERBI_EMBED_MARGIN_S before expiry, so a wall of tiles mints roughly one token per report per hour. expires_epochNrM$ /reports/z/GenerateTokenr accessLevelViewrarrD)Nz'Power BI did not return an embed token. expiration)rDr{$rv$)rU_powerbi_embed_lock_POWERBI_EMBED_TOKENSrPOWERBI_EMBED_MARGIN_Sr<$rt$POWERBI_EMBED_FALLBACK_TTL_S) r!r!ws_idrrr)r!rrrDrv$rls r1_powerbi_embed_tokenr$s1 ))+C eY 'C #'', 3'*@@3F95 5'9+^< v68ID# Sy ZR  W %E >.txx /EF;::$((<*@* ,D *%)c"* :'"* :s*C, C8,C58Dctjtjd}|r$t|j dt r|dni}|j dxsgD]d}t|t st |j dt |k(s;t |j dt |k(sb|cSy)uThe synced vocab row for one report, or None (no sync yet / not found). Carries name/embed_url/on_capacity — the P2 embed gate's capacity signal.r%"rrrrN)r#$r"rm!rrrr*)r$rr!r%"rs r1_powerbi_vocab_reportr$4s  ! !-"9"97 CC!j1CT&JC NPRE YYy ! 'R q$ Cd $4I$Fn-.#e*<H r3cHt}|r;|jdxsd|jdxsd|jddSfd}tdd|}t|jd tr|d ni}|j dd |S) uReport display metadata: the synced vocab row when available (fast, and it knows on_capacity), else a live-first fetch of the single report. Never fatal — the embed URL has a well-known fallback shape, so this returns {} on total failure and the tile still tries to embed.r9r7rP$rL$)r9rP$rL$ctdd\}}|rd|fS|xsijdxsd|xsijdxsdddfS)NrM$rw$r9r7rO$)r9rP$r<$r)rrr!rr!r$s r1fetchz#_powerbi_report_meta..fetchJsv E#+E7)I;!GI c 9 ((06B"jb--j9?RABFG Gr3r^ rSrN)r$rrE$rrr})r!r!r$rrr$fetchedrs```` r1_powerbi_report_metar$@s y 1C -2CGGK 'Total'; measure keys like '[Total]' also shed their brackets).z ^.*\[(.*)\]$r7r^)rFrGr*rb)r9rs r1_powerbi_strip_colr$s9 #djb/2A1771:/DJB/r3c>t|tr t|dS|S)zCJSON-friendly cell value; floats rounded to 2 decimals for display.r)rr rjrs r1 _powerbi_cellr$s!UQ{ Hr3c t||d|d|ddd|igddid \}}|rd |fS|xsijd xsg}|rt|d tsy |d jd}|rd dt |d dzfS|d jdxsg} | r| d jdngxsgD cgc]} t| tr| } } g} | D]-} | j D]} | | vs| j | /| D cgc]*} | D cgc]} t| j| c} ,}} } | D cgc] } t| c} |dd fScc} wcc} wcc} } wcc} w)zOne executeQueries call. Returns ({'columns': [...], 'rows': [[...]]}, error). Column order = first-seen key order across rows (executeQueries emits rows as objects); names are stripped to bare column labels.rM$ /datasets/z/executeQueriesrr# includeNullsT)r#serializerSettingsrz$Nrr)Nz*Power BI returned no result for the query.rzDAX query error: rtablesrnrq) r<$rrrr*r,rir$r$)r!r!r$rrrrrres_errr$rrr,rrns r1_powerbi_run_daxr$s5 5'J<?%s^,(6'=? @ID#  Syzry)/RG *WQZ6AajnnW%G(3w<+==== QZ^^H % +F6F Fd 3]1558 $ 3 FD F7;.s5'#1sEl3OJq$.s/Iq' /Irl"rm") r$rCrrr rr*rir$r) rrnrlabel_ivalue_iro"rrQrr.r&s r1_powerbi_data_slicesr$s+7D9GW F E#c!f,aj$#U|, 30E &2wQ7G' d#:5E 9  c0BCD Ec&kJ.KZ(&*=d g+C/ID/I,IJ Y( ) Mr3c ddl}t|\ }}|rdd|dS|jdxsd|jdxsd|jd xsdjrrsddd dSd d d |j j d j dd}t | fd}|d}t|ts dd|dxsddS|jdxsg}|jdxsg} t|jdxsdxsd} dd||jdxsdt|d|d|dr|dnd|| d| t| t|| t|jdxsdd } t| dk(rQtt|D cgc]-} || xsd| dz| t| dkr| d| ndd/c} dd | d!<| Scc} w)"uPower BI data tile (DVI-1243 P2, D2-B half of D2-C): the server runs the tile's DAX via executeQueries and returns render-ready shapes (table rows + chart slices + single-row KPIs) for Togen's dependency-free renderers — no capacity licensing needed. Live-first with cached fallback (D4); soft-degrades with a message, never a broken tile. D1-A: org scope for every viewer, signage-safe by construction.rNTFrrr7rrzHPick a workspace and dataset and enter a DAX query in the tile settings.dax:rSrr$ c"tSrTr$)r!rdsidr rK sr1r z-_dash_provider_powerbi_data..s%5eUBc%Rr3rrPower BI data is unavailable.rrnrr r{ rr rr) rrr r{ r rrrrnr@ ro"r^zColumn rrkpis)rr&$rrr2rrrE$rrrrrCr$r)rJr'rr rr!r$r>rrnrow_caprrr!rr$r rK s @@@@@r1rrsF ;D AE5&# UsCC  &BB 77< &BD 775> R & & (C TU9: :"% D',,szz'23==?DFIUE9RTG V_F fd #U"7+N/NP Pjj#)rG ::f  #D#''*%*+1rGTV779%0wx()GG4D%,X%6!DXgT&w'*377<+@+EA'FH G 4yA~ 3w<(*aj5ga!eW$5$%DG $4d1gaj$ @*+-1. N *s 2Hclt|xsd}t|dk\r|dddk(r|dddz|ddzS|S)z@Readable 'YYYY-MM-DD HH:MM' from a Power BI ISO timestamp (UTC).r7r$ rrrPNr\)r*rC)r&rs r1_powerbi_fmt_tsr$sG djb/C 3x2~#b*+3Bx#~Br ** Jr3c|d}|jdxsgD]N}t|j|dxsdjdddd}|jd |dz|}P|S) aThe library query's DAX with {{key}} placeholders substituted from the report run's params. Values are length-capped and have double quotes flipped to single so a value can never break out of a DAX string literal; a missing param substitutes as empty.rrr)r7rrd NrKz{{%s}})rr*r)r#rrrrQs r1_powerbi_query_daxr$sz ,C YYx &B4&**QuX&,"-55c3?Ekk(QuX-s34 Jr3c @ ddl}t|\ }}|rd|fSt|ddddd|jj dj dd}t  | fd }|d }t|ts d|d xsd fSt|jd xsgD cgc]\} } d| z| xsd| dzzd} } } |t|d|d|dr|d ndd} | |jdxsg| ddfScc} } w)zRun one admin-defined library query as an Auditor report. Same fetch path (and cache keys) as the powerbi_data tile, so a report and a tile on the same query share the live-first memo + cached fallback.rNr$rrSrrr$ c.tddS)Nrrr$)r!rr#r sr1r z+_powerbi_report_query_run..0s" u^/D!&|!4c;r3rrr$rrYrXr^rr rr#rnr'#) rr&$r$r2rrrE$rrrrr)r#rr'rr rr!r$r>rrrrr!rr s` @@@r1r#r#"s` ;D AE5&# Sy UF +C nu\2 SZZ()335cr:(?W%)0):WW% FD 6(:(@b   CsDc t|\}}|rd|fStjtjd}|xsij dxsgDcgc]6}t |t r$|j dr|j dr|8}}|sytdt|tz }|dt}gdd} } }|D]Z}|d|d} } | | ffd } td | d | | }|j d xs| |j d xs| g}|d/|j|dddt|dxsdddzdgz|drd} | |dxsd| kr|d} |d}|s|j|gdzt |dt r|dni}|j|t|j dt|j dt|j dxsdt|j dxsdgz]|r |jd|tfzdddddgdddd d!dd"d#dd$d%ddd&dd'd(dg}|| | dd)}|||d*dfScc}w)+u|Built-in ops report: last refresh per dataset (the plan's D3 'genuinely useful' baseline). Dataset inventory comes from the synced vocab — without a completed sync there is nothing to probe, so the report says to run one. Each dataset costs one /refreshes call (live-first + cached fallback); a failing dataset degrades to an inline note, never kills the report.Nr,"rrr)NuvNo dataset inventory is cached yet — run a Power BI sync first (Togen Admin → Services → Power BI → Sync now).rFc ttd|d|d\}}|rd|fS|xsijdxsgdfS)NrM$r$z/refreshes?$top=1rr$)r$ds_idrr]r!r s r1r$z-_powerbi_report_refresh_status..fetchTsX%u5'E72CDFJD$Tz!JB##G,2D8 8r3zrefresh:rSrQ$r9rz unavailable: rr7rr Tr)NNznever refreshedN startTimeendTimerdr refreshTypeu0(+%d more datasets not probed — report cap %d) workspace WorkspacerrDatasetrqzLast refresh startrzLast refresh endrrTrr#r'#)r&$r#$r"rm!rrrrCrCPOWERBI_REFRESH_REPORT_CAPrE$rir*r$)rr'r rr!rnr,"rrn any_cached cached_as_ofr$r$r$r$r refreshesr\rrr!r s @@r1r#r#>s !B,'N&w/ FO  KKDD E (1t? 1 >Y? 6 <"=?? @; @B G!#=>?4tT3 4#[9 95)=>'9:(3/ 1G  \ Dd ;T AAmRs;I.znetsuite_config.jsonuNetSuite is not configured. An admin must set the account ID, client (consumer) ID, certificate ID, and private key in Togen Admin → Services → NetSuite.r")PS256RS256c@dddddddttd}tjrO t j tj }t|jdtrQ|dD]3}t|dj|ts&|d||d|<5|ddtvrd|dd<t|jdtr|djdd |d<t|jd tr^|d jd }t|ttfr|d kDrt||d d <d |d vrt|d d |d d <|S|S#tjt f$rY|SwxYw)z/Return NetSuite config with defaults filled in.r7r$ account_idr certificate_id algorithm private_key)r^ item_filterrr^r$r$Nrrr9!rr:!)rNETSUITE_SETTINGS_DEFAULTSNETSUITE_CONFIG_FILErrrrrrr*NETSUITE_JWT_ALGSrrr rrr)rJrrrE!s r1_load_netsuite_configr$s!#" '<67  9C ##% JJ3==?@E%))E*D1U8A!%,"2"21"5s;(-e QE 1 8u:k*2CC.5CJ{+%))M2C8%*=%9%?%?%A%4%HM"%))J/6:&**+BCb3,/BF?B2wC O$;<!U:%666:j).97;C ON3 J3J$$g.   J sA0F!CFFFctjtj|d tj t j t jzy#t$rYywxYwr) r$rrrrrrrrrNs r1_save_netsuite_configr$sM##DJJs1$=> ""4<<$,,#>?    rc|xs t}|d}|jdrZ|jdrI|jdr8|jdr'|d|d|d|jdxsd|ddSy ) zOrg service-account creds dict, or None when not fully configured (all of account_id, client_id, certificate_id, private_key are required).r^r$r r$r$r$r$r$N)r$rre!s r1_netsuite_org_credsr$s  (&(C e*C  #''+"6()cggm.D!,/c+>N"%&6"7 WW[1,/"B )U#$$W- d?/ @@@$ N4475CHTcN;KMN NNs/B"%B1" B.-B.1 C:CCCc,|jdr3|jdr"|jdr|jdsdtfSt|\}}|rd|fSt|} t j |dd|dd d i| } |j}|jd zdk7s|jdsXt||}|jddk(rdd|dfS|jddk(rdd|dfSdd|jd|fS t|jd} |d| ddfS#tj $r}dd t||zfcYd}~Sd}~wwxYw#t$ri}YwxYw#ttf$rd} Y_wxYw)zMint an app-only SuiteTalk REST token via the OAuth 2.0 client-credentials grant with a JWT client assertion. Returns (tokens, error) where tokens = {access, expires_in}.r$r r$r$Nr0!z6urn:ietf:params:oauth:client-assertion-type:jwt-bearer)r2!client_assertion_typeclient_assertionr!application/x-www-form-urlencodedrrxr7zNetSuite token request failed: rdrrrr*$z;NetSuite rejected the client credentials (invalid_client): zx. Check the client ID, certificate ID, and that the certificate mapping is active for a role with SuiteQL + item access. invalid_grantz5NetSuite rejected the JWT assertion (invalid_grant): z:. Check the certificate ID/key pairing and the account ID.z%NetSuite token request returned HTTP r>rrr+$)rr$r$r$rrr?r$rrrgr$rr) r!r7r$rrJrrlrr rs r1_netsuite_mint_tokenr$5s IIl # +(> *+ -0H111.u5NIs Sy e $C ;""  4N&/1$%HIyy{ 3!#488N+C'd3 88G  0 0//5h7JJK K 88G  /Q#H%,,- -=))*"VH67 7,/0 >** Et KK1  * *;7/S9:; ;; " z " sB-D= E.E?=E+E& E+&E+. E<;E<?FFctj}t5tj|}|r|s|d|kDr|ddfcdddSdddt |\}}|r)t5tj |ddddd|fSt5|d|t d|ddz zdt|<ddd|ddfS#1swYzxYw#1swYd|fSxYw#1swY+xYwr0$)rU_netsuite_token_lock_NETSUITE_TOKENSrr$rrCr3$s r1_netsuite_get_tokenr$ls ))+C &""9- u\!2S!8w<%&&&'u-KFC ! 2  D 1 2Sy DH%B|()Nz,NetSuite authorization failed after re-mint.)rCrLrNETSUITE_PAGE_LIMITr$r$rrrr?r$rgrrr$rr) r!r!rr rr7rJr!rDrrrlrs r1_netsuite_suiteqlr$s 3s57$78:MN OE C !$ %F "5 ) *'% IC%<(EgO s 9  ?!&&*3e*;);$/ 0 3Z!D   z )gl  99;D   s "N   s ".   s ",   s "a '3D4D4D3ERH24>?@ @!$-t2t;;K%? ? ? D s0"E7E:E7E2*E72E7: FFcdd}t|xsdj}|r |d|dz }|dz }|S)aXDefault SuiteQL item query. A conservative, widely-available column set on the `item` table (id, itemid/name, display name, type, description, weight); an optional admin WHERE fragment scopes the set further. On-hand qty / dimensions are read tolerantly from the row when the account exposes them (see _netsuite_normalize_item).z^SELECT id, itemid, displayname, itemtype, description, weight FROM item WHERE isinactive = 'F'r7z AND (r7z ORDER BY idr)r$rfilts r1_netsuite_item_sqlr$sF  .C { b ! ' ' )D  vQ>C Jr3c t|tsy|jDcic]\}}t|j |!}}}d}dD]}|j |dvs||}ni}dD]}|j |dvs||||< t|j dxsdt|j dxsdt|j dxs|j dxsdt|j d xsdt|j d xsd||d Scc}}w) a Normalize a SuiteQL item row (lowercased keys) to a stable catalog shape. Tolerant: on-hand qty / dimensions flow through only when the account's query exposes them, so a customized item_filter/query that adds columns lights them up with no code change.N)quantityonhandtotalquantityonhandquantityavailabler)r cubicvolumelengthrErFrr7itemid displaynameitemtyper)rr%r9rTrr dims)rrrr*rEr)rrrrr r %s r1_netsuite_normalize_itemr %s0 c4 '*yy{3tq!Q 3A3G K 558: %dG  D C 558: %dDGaeeDk'R(!%%//R0m,EhE2Fj)/R0quu]39r:   4s$D=ct5tj||f}|r(|dtjkDr|dcdddStj ||fddddy#1swYyxYwr!)_netsuite_memo_lock_NETSUITE_MEMOrrUrr!s r1_netsuite_memo_getr%sp 9  )Y!78 3q6DIIK'q699 Iy148 9  9 r!ct5tjtz|ft||f<dddy#1swYyxYwrT)r %rUNETSUITE_MEMO_TTL_Sr %r!s r1_netsuite_memo_putr%s< 8 IIK- -w28 9-.888r"cPt||}||ddddS|\}}|,t||| tj||||ddddStj||}|r |dd|d|dSddd|dS#t$r"t j jdY]wxYw)uLive-first fetch: memo hit → live success (memoized + cache write-through) → cached last-good ('Cached — as of') → error. Same shape as _powerbi_fetch/_idencia_fetch.NFr"z#NetSuite cache write-through failedrTr") r%r%r$r"ryrmrnrr"r"s r1_netsuite_fetchr%s i 3D tLL:LGS {9i9 H  $ $Y 7 C 54$OO  " "9i 8C I$\*S: :ED3 GG H JJ !F G Hr "c.t}|sd}tjd||d|fSt}tj}t |d}gddddf\}}}} } t |||t|t \} }|rtjd||d|fSd | jd xsgDD cgc]} | r| } } |j| |d z }t| jd tr| d } | jdr| snD|tk\r1d} tjj!dtt#|n |tz }tj$|d|tj$|dt#|| | dt'j(j+d}tj,dt#|| d|t#||d}| rd|d<| | |d<tjd|||dfScc} w)aOne org-scope sync pass: page the SuiteQL item query into the local product catalog (cache) + an inventory snapshot, so the LTL picker never blocks on a live query. Returns (counts, error); the outcome is always recorded via netsuite_store.record_sync for the Admin pane.z+NetSuite service account is not configured.rr#"Nr$rFTr rr7c32K|]}t|ywrT)r %rs r1r/z%_netsuite_run_sync..s@ !5Q7@rrr^ totalResultshasMoreu\NetSuite sync hit the %d-page cap (%d items) — catalog truncated; tighten the item filter.r catalog_meta)rrr@ rr)rrr&")rrrr@ rUr)")r$r$r*"r$rm!r$r$r$NETSUITE_SYNC_TIMEOUT_SrrrrNETSUITE_PAGE_CAPrmrnrorCr"rrrr+")r r!rrJr rrrrrr@ rrrOr'"r$s r1_netsuite_run_syncr%s3 !E ;""7%sCSy  !C  $ $E S/ 0C-/Aud-B*E65)U %eUC?R-3=TV c   & &we3 G9 @&*hhw&7&=2@FaCDFF T   dhh~. 4(Exx "$  % %I JJ  67HE   %%+ .UIu5UN'*5z ',./   ! * *+> ?F SZ9B,D'-/5zE 2F"{ wt5@ 4<?Fs9 Hc  tj5t|\}}|r!tjj d|n tjj d|dddt5dtd <dddy#1swY"xYw#t $r:tjjdtjd|dYgwxYw#1swYyxYw#t5dtd <dddw#1swYwxYwxYw) zFThread body around _netsuite_run_sync: always clears the running flag.zNetSuite sync failed: %szNetSuite sync ok: %sNzNetSuite sync worker crashedrr/"r#"Fr8) rmr0"r%rnrorlryrr$r*"_netsuite_sync_lock_netsuite_sync_stater3"s r1_netsuite_sync_workerr %As 4 __  @.u5MFE ""#=uE  6?  @! 4.3  + 4 4 @ @ L ;<""7%)J LL  4 4  4.3  + 4 4 4r6"ch|ddr t|sytdt|dddz}tjdxsi}|j d}|sy t j|d }t j|z j|k\S#ttf$rYy wxYwr8") r$rCrr$r3rrrrrrrr:"s r1_netsuite_sync_duer"%Ss z?> *2Ec2JQC O,CDEFKJ  " "; / 52D $B &&r+>?    4 ' 6 6 8J FF  "r>"cddl} |jd tts(t5t dr dddBt j ddtjjddddtd#1swYxYw#t$r"tjjd Y7wxYw) zBackground thread (togen-worker only): org-scope catalog sync on the configured cadence. Checks each minute; the interval gate lives in _netsuite_sync_due so config changes apply without a restart.rNTrr8r@"rrrA"zNetSuite sync loop error)rUrr"%r$r%r%rrrrr %ryrmrnrrB"s r1_netsuite_sync_loopr$%ds  2 =%&;&=>$ S' 2 S S%++ -113<<=PQ,S S "+ .   S S = JJ !; < =rE"ct5tt}dddtj}d|d|d|d|ddS#1swY4xYwrG")r%rr%r$rI"rJ"s r1_netsuite_sync_publicr&%ysa +)*+  ' ' )FY'u\7J7^VF^i( **++rM"z/netsuite/configc t}t|d}t|jdd}t d|||d|dt t jt jS)uConfig for the Admin → Services → NetSuite pane. The private key is redacted to has_key (write-only, ThingPark/Power BI convention).r^r$r7Tr$r)rUr^rr$rr"r") r$rrrrr&%r$r"rm!)rJr^rs r1netsuite_config_getr(%sl !C s5z C377="-.G dW"=1C O-/'22>3K3KL NNr3c Ftjdxsi}t}t|j dt r|d}dD]>}t|j |t s#||jdd|d|<@t|j dt r3|djj}|tvr|nd|dd<t|j d t r,|d jr|d j|dd <t|j d t r|d jdd |d <t|j d t rr|d j d }t|ttfr*|dkDr%tdtdt||d d <d|d vrt|d d|d d< t|t$5t&j)t*j,ddddt |d}t|j)d d}t#d|||d |d S#t $r}t#d|dfcYd}~Sd}~wwxYw#1swYoxYw)zSave service account / item filter / sync settings (partial merge). A blank/omitted org.private_key keeps the stored one so the redacted GET can round-trip without wiping the key.Trr^)r$r r$NrKr$r$r$r$rrr9!r`'rr:!r-!rrr7)rUr^rr$r)rrr$rrrr*rrBr$rr rLrCrr$rrr$r$rr$rm!)rrJr^rr$rE!rlrs r1netsuite_config_postr+%sl   4 ( .BD  !C$((5/4(5k> 5A#''!*c* #A t 4E 1  5 cggk*C 0k"((*002C-04E-Ec7CJ{ # cggm,c 2s=7I7O7O7Q(+M(:(@(@(BCJ} %$((=)3/!-0668$?M$((:&- *  ! !"9 : b3, 'BF7:5#aR/7RC O3 4 T*- -.24 3CN3S.TC ON +Cc" =^55t<= s5z C377="-.G dW"=1C O MM C6se<=sBBC==s*3 I0%J0 J9J JJJ z/netsuite/testc6tjdxsi}t}t|j dt r|j dni}|j dxsdj xs|dd|j dxsdj xs|dd|j dxsdj xs|dd|j dxsdj jxs|dj dxsd |j d xsdj xs|dd d }|dtvrd |d<|dr|dr |dr|d std dfSt|\}}|rtd|dfSd|dz}t5|dtjdzdt|<ddd t|d}t|||ddt \}} t5tj#|dddd| rtddd| zdfS|j dxsgD cgc] } t%| } } | D cgc]} | s| ds | dc} dd} |j d}tddt|t&r|| Sd| S#1swYxYw#1swYxYw#t5tj#|ddddw#1swYwxYwxYwcc} wcc} w)!zTest the service account: mint a token, then run a tiny SuiteQL item probe. Body may carry unsaved creds to test values before saving; blanks fall back to the stored org config. Persists nothing (bypasses caches).Trr^r$r7r r$r$r$r$r$zDSet the account ID, client ID, certificate ID and private key first.rr`FrrU test:rrr!Nr$rrr%z&Signed in, but the item query failed: rUtoken_okrrr9r%)rUr/% items_totalr)rrr$rrrrrBr$rr$r$rUr$r$r$NETSUITE_LIVE_TIMEOUT_Srr %r)rrJr^r!rrr rrqerrrrrrr@ s r1 netsuite_testr3%s.   4 ( .BD  !C'>$((5/BCww|,299;Ws5z,?Wggk*0b779TSZ =T77#34:AACcs5zRbGcww{+1r88:@@B@U 4@8?/52<<>5u:m4 7E [!22$k , E+$6&'E-,@01256 6&u-KFC %s+S00 eL) )E C,28,<15r1A#CC. ]!34&ueS!/FH d" .   - . %$ 4t ;>?BC C3788G3D3J LQ %a ( LE L!& :A!& ai :2A >F HH^ $E dT(25#(>u  ""DH  ""!CC . . ! .   - . . . M :sT3%K!&K KL0L8L>LK KL"L9 LL Lz/netsuite/syncctdjdd}tstddfSt5t drtdd fcd d d St j d |tjjd  d d d tjt|fd jtd S#1swY@xYw)z=Kick off an org-scope product-catalog sync in the background.r'rr7z-Configure the NetSuite service account first.rr`r8r"r9NTrrrA"r(r")rrr$rr%r%rrrrrrr %rqrgs r1netsuite_sync_startr5%s FO   ,E  LMsRR K  *!=>CKK ##%))+445HI $ KK 1 ""'%' 4  KKr"z/netsuite/sync-statuscptdttjtjSr#)rr&%r$r"rm!rXr3r1netsuite_sync_statusr7%s/ d!6!8'22>3K3KL NNr3z/netsuite/user-connectionctjtjd}d}|r3t|j dt r|dj d}t ddttd|S) uStatus for the User Settings → Services → NetSuite pane. D1-A: org service account only — read-only status; no personal connections.r%NrrTr^F)rUrOr#ro$ catalog_count) r$r"rm!rrrrrr$)rr9%s r1netsuite_user_connection_getr:% sm  # #N$<$#;#;Y GC!j1CT&JC NPRE d#e*SYBOOL4Qu ''r3zpaychex_config.jsonuPaychex is not configured. An admin must set the API client ID, client secret, and company ID in Togen Admin → Services → PayChex.zhttps://api.paychex.comz/auth/oauth/v2/tokenz/companies/{cid}/workersz /companies/{cid}/timeoffrequestsz/companies/{cid}/checkinsicddddittd}tjr t j tj }t|jdtr;|dD]3}t|dj|ts&|d||d|<5t|jdtr`|djDcic]>\}}t|tr)t|tr|r|rt|t|@c}}|d<t|jdtr^|djd}t|ttfr|dkDrt||dd<d |dvrt|dd |dd <|S|Scc}}w#tjtf$rY|SwxYw) uReturn Paychex config with defaults filled in. driver_overrides maps a Paychex workerId → a Togen Personnel `per_*` id (D5-A manual linkage).r7r r company_id)r^driver_overridesrr^r@%rr9!rr:!)rPAYCHEX_SETTINGS_DEFAULTSPAYCHEX_CONFIG_FILErrrrrrr*rrr rrr)rJrrrrrE!s r1_load_paychex_configrC%Js!#RrJ!56 8C""$ JJ2<<>?E%))E*D1U8A!%,"2"21"5s;(-e QE 1 8%))$67>/45G/H/N/N/P+N'+q!!!S)jC.@Q1FCFN+N&'%))J/6:&**+BCb3,/BF?B2wC O$;<!U:%666:j).97;C ON3 J3J+N$$g.   J s-A0F5AF5$AF/'BF5/F55GGctjtj|d tj t j t jzy#t$rYywxYwr) rB%rrrrrrrrrNs r1_save_paychex_configrE%grI!rc|xs t}|d}|jdr1|jdr |jdr|d|d|ddSy)z}Org service-app creds dict, or None when not fully configured (all of client_id, client_secret, company_id are required).r^r r r?%r>%N)rC%rre!s r1_paychex_org_credsrG%osd  '%'C e*C ww{ 8SWW\=R -!$_!5!,/1 1 r3cVt}|rtj|ddfSdddtfS)uResolve which Paychex connection a request runs under. D1-A: the org service account is the ONLY scope — no per-user creds. Returns (scope_key, creds, source, error).r^Nr7)rG% paychex_storerm!_PAYCHEX_NOT_CONFIGURED_MSGr%$s r1_paychex_resolve_connectionrK%{s4  C &&UD88 r6 66r3cJddlm}||xsdjxs|xsd}t|}|j }d|vs d|vsd|vsd|vrd |d St |t jsd |vrd |d St |t jr d|d|dddS|ddS)uCondense a requests exception into an actionable one-liner (matches the NetSuite/Idencia/Power BI lesson — the raw text buries DNS/timeout causes).rrr7zthe Paychex servicerU!rV!rW!rX!rY!r($rZ!r[!rr\!r:Nr]!rrr"ra!s r1_paychex_request_errorrM%s& CI2  % % G#*F1FD s8DjjlGG#}'?*g5&'1*4&1## $#~--.+2H&tfA..#~556&tfBtDSzl"== :r3ct|tr|jd}t|trb|r`t|dtr|dni}t |jdxs|jdxsdj }|r|ddSdD]8}|j|st ||j d dddcSt t|d dxsdddS) zPull a readable message out of a Paychex REST error body. Paychex returns {errors:[{code,message,field}]} on failures and OAuth {error, error_description} on token failures.r? rrr3r7Nr)r4rrrer0r&r$)rrerrse0rrs r1_paychex_error_detailrQ%s$xx! dD !d&tAw5a2BbffY'?266&>?R@FFHC4Cy C 9Axx{47|))$/24C88 9 wtVR(.B / 55r3c|jdr|jdsdtfS tjtd|d|ddddi|} |j}|jd zd k7s|jd sMt||}|jd dvrdd|jd d|dfSdd|jd|fS t|jd}|d |ddfS#tj $r}dd t |tzfcYd}~Sd}~wwxYw#t$ri}YwxYw#ttf$rd}YcwxYw)zMint an app-only Paychex API token via the OAuth 2.0 client-credentials grant. Returns (tokens, error) where tokens = {access, expires_in}.r r Nr0!r1!rr$r$zPaychex token request failed: rdrrr)r*$unauthorized_clientz)Paychex rejected the client credentials (rzR. Check the API client ID and secret, and that the app is approved for the tenant.z$Paychex token request returned HTTP r>rrr+$) rrJ%rrPAYCHEX_TOKEN_URLr?rM%rrrgrQ%rr)r!r7rrlrr rs r1_paychex_mint_tokenrU%s IIk "uyy'A000 H""  4$[1#(#9;$%HI yy{ 3!#488N+C&tT2 88G  I I"hhw/0F8<,,- -<))*"VH67 7,/0 >** Et KK)  * *H6.s4EFGH HH  z " sA)C;D0E;D-D("D-(D-0 D>=D>EEctj}t5tj|}|r|s|d|kDr|ddfcdddSdddt |\}}|r)t5tj |ddddd|fSt5|d|t d|ddz zdt|<ddd|ddfS#1swYzxYw#1swYd|fSxYw#1swY+xYwr0$)rU_paychex_token_lock_PAYCHEX_TOKENSrrU%rrCr3$s r1_paychex_get_tokenrY%r5$r6$c t|jdr|nt|z}dD]}t||t |\}}|rdd|fcS t j |d|zdd|xsd|} | jd vr|d k(r_ | j} | jd k(ry | jdk(ry| jdk(ry| jdk(ry| jdzdk7r,d| jd| jdt| | zfcSt| tr| ni| jdfcSy#t j$r} ddd t| |zfcYd} ~ cSd} ~ wwxYw#t$ri} YwxYw)zGET one Paychex API resource. path may be a full URL (a pagination `next` link) or an app-relative path. Returns (data, status, error); one re-mint retry on an auth failure (expired/revoked token).rAr!rNrrrrzPaychex request failed: rrr)NrzNPaychex rejected the service app (HTTP 401). Check the API client credentials.r)NrzPaychex refused access (HTTP 403). The API app needs scope for this data, and clock/time data requires the Time & Attendance product.r)Nrz&Paychex returned HTTP 404 (not found).r:$)Nr:$u@Paychex is throttling requests (HTTP 429) — try again shortly.rdrzPaychex returned HTTP r>)NNz+Paychex authorization failed after re-mint.)r*rw PAYCHEX_BASErY%rrrr?rM%rgrrrQ%rr) r!r!rbrr7rJr!rDrrrlrs r1_paychex_api_getr\%s d)&&v.$\D5HC$P' 5W N s s? " D!%%*3e*;#57~ !D   z )gl  99;D   s "D   s "J   s "F   s "1   s "a '))()9)9(:"='d345 5#4.B9I9I4OOI$PJ E5.. D :"8c"B!CD D D D s0#D?E3?E0E+#E0+E03 FFc|xsijd}t|trE|D]@}t|ts|jddk(s)|jds;|dcSy)zsReturn the pagination `next` href from a Paychex response, or None. HAL style: {links:[{rel:'next',href:...}]}.rrrrCN)rrrr)rrrws r1_paychex_next_linkr^%scZR  W %E% !A!T"quuU|v'=!%%-y  ! r3cFgdd}}}t|xsi} | jdt|} | } | rkt||| | |\} } }|r||||fS| j d}t |t r|j||dz }||k\rd}nt| } d} | rk|||dfS) ziFollow Paychex pagination, accumulating the `content` array. Returns (rows, pages, truncated, error).rFr r!rr^TN) rr}PAYCHEX_PAGE_LIMITr\%rrrrr^%)r!r!rbrr7rxrnrrrrN use_paramsr_statusrrs r1_paychex_get_allrc%$s E%D V\rALL,-HJ -i5?Rgs  3. .((9% gt $ KK    C<I %d+    4 ''r3ct|tsy|jd}t|tr.|j r|j j S|jd}t|t r|D]}t|tst|jdxsdjdvsC|jdxs$|jdxs|jd}t|ts|j s|j j cSy)zxPull a worker's email from the common Paychex shapes (direct `email`, or a communications list with an EMAIL entry).r7rcommunicationsrT)EMAIL WORK_EMAILPERSONAL_EMAILurir)rrrr*rrErrB)rdirectcommsrrs r1_paychex_worker_emailrl%>s c4  WWW F&#6<<>||~##%% GG$ %E% -Aa&155=&B'--/4FFEE'NDaeeElDaeeGna%!'')779??,, - r3c t|tsyt|jdxs(|jdxs|jdxsd}t|jdtr|jdni}t|jdxs|jdxsdj }t|jdxs|jdxsdj }d j d ||fDxs?t|jd xs|jd xsdj }|s|sy||xs|||t |t|jd xsdj tt|jdtr7|jdxs9|jdxsijdn|jdxsdj t|jdxsdj dS)zNormalize a Paychex worker row to a stable roster shape. Tolerant of the tenant's field variants (name object vs legalName, worker_id vs id).NworkerIdr workerUidr7r9 givenName familyNamer\c3&K|] }|s| ywrTrXrs r1r/z,_paychex_normalize_worker..\s511Q5r' legalNamer workerTypeemploymentStatus currentStatus statusTypejobTitle) worker_idr9rrr worker_typerd job_title)rrr*rrrrl%)rr1name_objgivenfamilyr9s r1_paychex_normalize_workerr%Ss c4  cggj!PSWWT]Pcggk6JPb QC",SWWV_d"CswwvH  [)GSWW[-AGR H N N PE l+Jsww|/DJ K Q Q SF HH55 5 "377;'8<< +F%'  tKC!*3/sww|4:;AAC'0B(CTJ''/2S!gg&89?RDD\R"ww7=2?@EuwSWWZ06B7==? A Ar3ct5tj||f}|r(|dtjkDr|dcdddStj ||fddddy#1swYyxYwr!)_paychex_memo_lock _PAYCHEX_MEMOrrUrr!s r1_paychex_memo_getr%tr!r!ct5tjtz|ft||f<dddy#1swYyxYwrT)r%rUPAYCHEX_MEMO_TTL_Sr%r!s r1_paychex_memo_putr%}r"r"cPt||}||ddddS|\}}|,t||| tj||||ddddStj||}|r |dd|d|dSddd|dS#t$r"t j jdY]wxYw)uLive-first fetch: memo hit → live success (memoized + cache write-through) → cached last-good ('Cached — as of') → error. Same shape as _netsuite_fetch/_powerbi_fetch/_idencia_fetch.NFr"z"Paychex cache write-through failedrTr") r%r%rI%r"ryrmrnrr"r"s r1_paychex_fetchr%s Y 2D tLL:LGS {)Y8 G  # #Iy' B 54$OO  ! !)Y 7C I$\*S: :ED3 GG G JJ !E F Gr "cxt}|sd}tjd||d|fS|d}tj}t ||t j |t\}}}}|rtjd||d|fSd|DDcgc]}|s| } }|r.tjjd tt| tj|d | tj|d t| |d t| |d } |rd| d<t ||tj |t\} } } }|&tj|d| t| | d<nd| d<t ||tj |t\}} } }|&tj|d|t|| d<nd| d<t!j"j%d}tj&d t| |d|tjd|| | dfScc}w)uOne org-scope sync pass: page the workers roster into the local cache + a snapshot so the driver-availability overlay never blocks on a live query. Time-off + clock status are best-effort augmentation reads (they need the tenant's Time & Attendance product) — a 403/404 there is counted+skipped, never fatal. Returns (counts, error); the outcome is always recorded via paychex_store.record_sync for the Admin pane.z*Paychex service account is not configured.rr#"Nr?%rr!c32K|]}t|ywrT)r%r,rs r1r/z$_paychex_run_sync..sFA4Q7FruCPaychex sync hit the %d-page cap (%d workers) — roster truncated.rt roster_meta)rr)workersrTrtimeoff unavailablecheckinrr)r%rr&"rUr)")rG%rI%r*"rm!rc%PAYCHEX_WORKERS_PATHr PAYCHEX_SYNC_TIMEOUT_SrmrnroPAYCHEX_PAGE_CAPrCr"PAYCHEX_TIMEOFF_PATHPAYCHEX_CHECKIN_PATHrrrr+")r r!rrr rnrrrr%r$to_rowsr r to_errci_rowsci_errr'"s r1_paychex_run_syncr%s<  E :!!'cBSy  C  # #E#3 u*11c1:&#(D%C !!'cBSyFFLQ!qLGL  Q c'l ,E8W5E=&)'lKMW 6F"{/ u*11c1:&(GRV~y':Ly)y/ u*11c1:&(GRV~y':Ly)y    ! * *+> ?FxS\7@*B&,.d%? 4<KMs H7H7c  tj5t|\}}|r!tjj d|n tjj d|dddt5dtd <dddy#1swY"xYw#t $r:tjjdtjd|dYgwxYw#1swYyxYw#t5dtd <dddw#1swYwxYwxYw) zEThread body around _paychex_run_sync: always clears the running flag.zPaychex sync failed: %szPaychex sync ok: %sNzPaychex sync worker crashedrr/"r#"Fr8) rmr0"r%rnrorlryrrI%r*"_paychex_sync_lock_paychex_sync_stater3"s r1_paychex_sync_workerr%r5"r6"ch|ddr t|sytdt|dddz}tjdxsi}|j d}|sy t j|d }t j|z j|k\S#ttf$rYy wxYwr8") rG%rCrrI%r3rrrrrrrr:"s r1_paychex_sync_duer%r="r>"cddl} |jd tts(t5t dr dddBt j ddtjjddddtd#1swYxYw#t$r"tjjd Y7wxYw) zBackground thread (togen-worker only): org-scope roster sync on the configured cadence. Checks each minute; the interval gate lives in _paychex_sync_due so config changes apply without a restart.rNTrr8r@"rrrA"zPaychex sync loop error)rUrr%rC%r%r%rrrrr%ryrmrnrrB"s r1_paychex_sync_loopr%rD"rE"ct5tt}dddtj}d|d|d|d|ddS#1swY4xYwrG")r%rr%rI%rI"rJ"s r1_paychex_sync_publicr%rL"rM"c|xs t}|jdxsi}tjtjd}|r$t |jdt r|dng}t}|Dcic]&}|jds|jd|(}}i}|D]H}|jdxsdjj}|s7|j||Jd} gg} } |D]} t | ts| jdxsd} d \}}|j| }|r ||vr||d }}n"| jdr| d|vr || dd}}| | ||d }| j||| j| | | t|t| t| z |xsijd d Scc}w)uIMatch the synced Paychex roster to Togen Personnel/driver records (D5-A). Precedence per worker: a manual override (driver_overrides) → an exact email match against a Personnel record → unmatched. Never a fuzzy match, never silently dropped. Returns {links:[{worker, person, match}], unmatched:[worker], ...}.r@%rtrrrr7c |sy|jdt||jdxsdjjdt |jdvdS)Nrrr7rrArn)rr rrEr=rs r1_person_publicz-_paychex_driver_links.._person_public3sbeeDk?1+=%%..B557==?%)?EE.)*++, ,r3ry%rr)workerrPrGr")rr worker_countrr)rC%rrI%r"rm!rrr rrEr}rrirC)rJrr!r%rcrrby_emailr!r%rrrr1rPrGrrs r1_paychex_driver_linksr%!s  '%'C*+1rI  ! !-"9"98 DC # 37793Et(Lc)nRTG  F%+ ;quuT{QUU4[!^ ;E ;H 'eeGn" ) ) + 1 1 3   A &' ,29E   !T" eeK &B"  ]]3  "+!"IxEF UU7^' h 6$QwZ0'EFv(>O U >   Q   LSZ#i.5PiR__\2 44= GGz/paychex/configc t}t|d}t|jdd}t d|||dt t jt jS)uConfig for the Admin → Services → PayChex pane. The client secret is redacted to has_secret (write-only, ThingPark/Power BI/NetSuite convention).r^r r7Tr)rUr^r(!rr"r") rC%rrrrr%rI%r"rm!rb$s r1paychex_config_getr%Qse  C s5z Ccggor23J d  O2F2H&11-2I2IJ LLr3c *tjdxsi}t}t|j dt r|d}dD]>}t|j |t s#||jdd|d|<@t|j dt r,|djr|dj|dd<t|j dt rr|dj d }t|ttfr*|d kDr%td td t||dd <d |dvrt|dd |dd < t|t 5t"j%t&j(ddddt |d}t|j%dd}td|||dS#t$r}td|dfcYd}~Sd}~wwxYw#1swYkxYw)zSave service app / sync settings (partial merge). A blank/omitted org.client_secret keeps the stored one so the redacted GET can round-trip without wiping the secret.Trr^)r r?%NrKr rr9!rr*%rr:!r-!rrr7)rUr^r(!r)rrrC%rrrr*rrr rLrCrrE%rrrW%rX%rrI%rm!)rrJr^rrE!rlr(!s r1paychex_config_postr%^s   4 ( .BD  C$((5/4(5k, 5A#''!*c* #A t 4E 1  5 cggo. 4_9M9S9S9U*-o*>*D*D*FCJ '$((:&- *  ! !"9 : b3, 'BF7:5#aR/7RC O3 4 T*- -.24 3CN3S.TC ON +CS! ;M33T:; s5z Ccggor23J d  O -- C6se<=sBBC;;s*) G":%H " H+H;HH Hz /paychex/testctjdxsi}t}t|j dt r|j dni}|j dxsdj xs|dd|j dxsdj xs|dd|j dxsdj xs|ddd}|dr |dr|dstd d fSt|\}}|rtd | dfSd|dz}t5|dtjdzdt|<ddd t||tj|dddit\}}} t5tj!|dddd| rtd dd| zdfS|xsij dxsgD cgc] } t#| } } | D cgc]} | s| ds | dc} dd} tdd| S#1swYxYw#1swYxYw#t5tj!|ddddw#1swYwxYwxYwcc} wcc} w)zTest the service app: mint a token, then read a tiny workers probe. Body may carry unsaved creds to test values before saving; blanks fall back to the stored org config. Persists nothing (bypasses caches).Trr^r r7r r?%r>%z;Set the API client ID, client secret, and company ID first.rr`FrrU r-%rrr!Nr%r rr!z)Signed in, but the workers query failed: r.%rr9)rUr/%r)rrrC%rrrrrrU%rW%rUrX%r\%r%r PAYCHEX_LIVE_TIMEOUT_Srr%)rrJr^r!rrr rrb%r2%rrnrrs r1 paychex_testr%s   4 ( .BD  C'>$((5/BCggk*0b779TSZ =T77?39r@@B9 Z8ww|,299;Ws5z,?W  YE + 5#9eL>Q#$%() )%e,KFC %s+S00 eL) )E B+1(+;04 b0@"BB-. 5.55% :M5NQ<)?Agt! -   t , - %$ 7$ >ABEF F48JB3C3CI3N3TRT VQ %a ( VD V!% 9Aqyai 9"1 =F dT& 99BB - -  -   t , - - - W 9sT(%H1H5 H)I+4I0<I0I0H&)H25I(<I I(I% !I(z /paychex/syncctdjdd}tstddfSt5t drtdd fcd d d St j d |tjjd  d d d tjt|fd jtd S#1swY@xYw)z4Kick off an org-scope roster sync in the background.r'rr7z,Configure the Paychex service account first.rr`r8r"r9NTrrrA"r(r")rrrG%rr%r%rrrrrrr%rqrgs r1paychex_sync_startr%s FO   ,E  KLcQQ K y )!=>CKK ""%))+445HI # KK 0x ""'%' 4  KKr"z/paychex/sync-statuscptdttjtjSr#)rr%rI%r"rm!rXr3r1paychex_sync_statusr%r#r3z/paychex/driver-linksc Xt}tDcgc]{}|jdrh|jdt||jdxsdj j dt |jdvd}}}td d|d|Scc}w) uMatched/unmatched Paychex worker → Personnel driver view (D5-A). Also returns the Personnel roster so the admin can pick a manual override.rrr7rrArnT)rUrrX)r%r rr rrEr=r)rrrcs r1paychex_driver_links_getr%s " #E '( 9AEE$K UU4[/!*<w-2446<<>$(>55()**+9F9  6df 6 66 9sBB'z/paychex/driver-linkc\tjdxsi}|jdxsdj}|jdxsdj|st ddfSr*t fd t Dst d d fSt}t|jd xsi}r||<n|j|d ||d < t|t dddit|S#t$r}t d|dfcYd }~Sd }~wwxYw)zSet or clear a manual per-worker driver override (D5-A). Body: {worker_id, person_id}. A blank/omitted person_id clears the override (falls back to the email auto-match).Trry%r7razworker_id is required.rr`c3FK|]}|jdk(ywr rr s r1r/z+paychex_driver_link_post..sEaquuT{c)ErIzUnknown person_id.rr@%Nr; rrUrX) rrrrrr2r rC%rrrE%rr%)rr1rJrrlr s @r1paychex_driver_link_postr%s"   4 ( .BD 88K &B - - /C 88K &B - - /C 56;; 3E?3DEE12C77  CSWW/06B7I  # c4 'C<S!  9d 93C8 99 </u56;; ++r3)rr#rYc0tjr\ tjtj }t |t r!|Dcgc]}t |ts|c}S gSgScc}w#tjtf$rYgSwxYw)z?Return the list of saved report schedules (empty list if none).) SCADA_REPORT_SCHEDULES_FILErrrrrrrrr)rrs r1_load_scada_report_schedulesr%s"**, JJ:DDFGE%&#(@aJq$,?@@' I2IA$$g.   I rcXtjtj|dy)z*Persist the report schedules list to disk.rrN)r%rrrrs r1_save_scada_report_schedulesr%#s**4::i+JKr3c |jdxsdj}|syt|dkDry|jdxsdj}|tvrdd d j td fSd}|d k(r! t |jd }|dkry|jd}|g}t|tsy|Dcgc]4}t|ts|js%|j6}}tjj}|xsijdxsttj||||t!|jdt!|jd|xsijdxs||d }|dfS#t tf$rYywxYwcc}w)zBuild/validate a schedule dict from a request body. Returns (schedule, error). ``existing`` supplies id/created_at when updating.r9r7rrrrrNrrrrYr)Nz4custom_days must be an integer for a custom cadence.r^)Nzcustom_days must be at least 1.r$)Nzsensors must be a list.rrexternalr) rr9rrr$rr%rr)rrrCSCADA_REPORT_CADENCESrrrrrrr*rrrrWrXr) rrr9rrr$rrr s r1_scada_schedule_from_bodyr%(s HHV  " ) ) +D 1 4y3Fxx "1k88:G++8CX9Y8ZZ[\\\K( Pdhh}56K ?:hhy!G gt $.")NQZ3-?AGGIqwwyNGN     ( ( *C~2""4(=C ,="txx)**-.~2**<8?C H T>1:& PO POs$F4G $G 5G 4GGz/scada/report-schedulesc*ttS)z"Return all saved report schedules.r)rr%rXr3r1scada_report_schedules_listr%Ts 9; <c&tjdxsi}t}tfdt |Dd}|t ddfSt |||\}}|rt |d fS|||<t|t | S) z)Update an existing report schedule by id.Trc3RK|]\}}|jdk(s| ywr rrs r1r/z0scada_report_schedules_update..orr Nrrrrr`r )rrr%rrrr%r%rs` r1scada_report_schedules_updater%is   4 ( .BD,.I Ni 2NPT UC {23S88-dYs^LMHc S!3&&IcN + H %%r3ct}|Dcgc]}|jd|k7s|}}t|t|k(rtddfSt |tdScc}w)zDelete a report schedule by id.rrrrTrY )r%rrCrr%rs r1scada_report_schedules_deleter%zsh-.I%Aqt)@AIA 9~Y'23S88 + d  Brctjd} tj|t j j d|dd}|jddrtj||jdd}|jd s|d vrrt5d |jd |jd ddjxsdt j jdt|<dddyt5d|jd |jdd|jddt j jdt|<dddy#1swYyxYw#1swYyxYw#t $r}|j#d|jdt5d |jd t%|xs|j&j(t j jdt|<dddn#1swYnxYwYd}~yYd}~yd}~wwxYw)zBackground body of a Test / run-now: generate + persist + record a report with no email, then stash the outcome for the UI to poll.rFr)rErnr send_emailr Trr7error:)persist_failedrrrSr^rzReport failed.)rdrrrrNrrrr)rdrrrrrzrun-now failed for schedule %rr9)rrr run_schedulerrrr_append_run_logrrw_scada_run_now_lockrrr_scada_run_now_jobsryrr* __class__r)r r^rnrrdrls r1_scada_run_now_workerr%s    8 9FA'44 n((*//15(u> ::j$ ' " 2 26 :NB/   X &&4G*G$ E%hll46H#\\#q1"5;;=QAQ#1#5#5#7#A#A#C/E#F+ E   A d1C%zz-<#ZZ Q7-113==? +A  ' A A  E  A A A98<<;OP  A!(,,t2DS;S]]%;%;-113==?+A  ' A A A A AAsuBF&A#F FFAF 7FF F F FFF I !'IAH0' I0H9 5II z*/scada/report-schedules//run-nowct}tfd|Dd}|tddfStj|tddfSt j j}t5dd t|<dddtjt||fd jtd | d fS#1swYDxYw)zFTest a schedule: generate + persist + record its report now, no email.c3LK|]}|jdk(s|ywr r)r,rrs r1r/z0scada_report_schedule_run_now..s B!%%+*A!BrNrrrz Schedule has an invalid cadence.r`r8)rdrTr()rUr^r)r%rrr_interval_daysrWrXrYr%r%rrr%rq)rrrr^s` r1scada_report_schedule_run_nowr%s-.I BYBD IE }23S88,,U3;?@#EE ZZ\  F @1:6>'@F#@1 ""'%' d6 *C // @@s 8 CCz(/scada/report-schedules/run-now/ct5tj|}dddtddfSt|S#1swY%xYw)z5Poll a Test / run-now job started by the route above.NzUnknown or expired job.rr)rb)r%r%rr)r^rbs r1$scada_report_schedule_run_now_statusr%sM .!%%f-. {67<< s  ..s AA z/scada/report-runsctjjddj}t j }|r$|Dcgc]}|jd|k(s|}}t |dd}t|Scc}w)zReturn report run-log records, newest first. Optional ``schedule_id`` filter powers the per-schedule History surface in the Schedules tab; the Auditor SCADA Reporting sub-tab reads the same log via /history.rr7c&|jddSrrrx s r1r z#scada_report_runs..rr3Tr r)rrhrrrrrr)rrkrs r1scada_report_runsr%sv ,,  =" - 3 3 5C - - /C =Q}!5!s B#B)enforcedr%c|jr tj|j}t |tr|jdg}t |tr2|Dcgc]&}t |ts|js%|(c}SgS#tjt f$rd}YwxYwcc}w)zHReturn the email list from a recipient file (flat list or {recipients}).Nr) rrrrrrrrrrr*r)rbrrBs r1_load_scada_recipientsr%s ||~ ::dnn./D dD !88L"-D dD !#H!z!S'9aggiAH H I $$g. D  Is##B+B<B<B<B98B9c,tg}}|D][}t|ts|jj }|s5||vs:|j ||j |]|jtjd|idy)z7Persist a recipient list, de-duplicated and lowercased.rrrN) rrr*rrErrirrr)rbrArrGrBrHs r1_save_scada_recipientsr%szE2'D !!S! wwy  D$ HHTN NN4 ! OODJJ g6qABr3z$/scada/report-recipients/cvtj|}|tddfStt|S)z/Return the enforced or external recipient list.Unknown recipient list.rr)r)SCADA_RECIPIENT_FILESrrr%) list_namerbs r1scada_report_recipients_getr%s; ! $ $Y /D |67<< 4T: ;;r3ctj|}|tddfStjdxsi}|jdd}|jd xsdj }|d vrtd d fS|j }|d k(r(d|vsd|jddvrtdd fSt|}|d k(r2||Dcgc]}|j c}vr5|j|n#|Dcgc]}|j |k7s|}} t||tdt|Scc}wcc}w#t$r}td|dfcYd}~Sd}~wwxYw)zBAdd or remove an email in the enforced or external recipient list.Nr%rrTrrr7rrrr`rrrrrr; r)rUr) r%rrrrrrErr%rir%r) r%rbrrrrHrArBrls r1scada_report_recipients_postr%sp ! $ $Y /D |67<<   4 ( .BD XXh #F XXg  $" + + -E &&./44 ;;=D CtOs$**S/":M/MABCGG #D )F  62a 2 2 MM$ #9qwwyD'8!99<tV, d'=d'C DD3: </u56;;F X4CCEFG&..0 U!%gfo&9&9-&H'L)0)<)<])K"M NNr3z,/scada/report-approvals//approvectdjdd}tj||}|ds!|ddk(rdnd}t |d|d  |fSt d |d  S) ueApprove a pending request → email the persisted XLSX to its external recipients + log the send.r'rr2rUrApproval request not found.rr`rrapprovalTrUr%)rrr rr) request_idr r>r3s r1scada_report_approvals_approver&fss FO   3E # + +J >F $<Wo)FFsCVG_vh7GH$NN dVH%5 66r3z+/scada/report-approvals//rejectc tjdxsi}tdjdd}t j |||jd}|ds!|dd k(rd nd }t |d|d  |fSt d|d S)zJReject a pending request. The report is never sent to external recipients.Trr'rr2rmrUrr%rr`rr%r&)rrrrr rz r)r&rr r>r3s r1scada_report_approvals_rejectr&ss   4 ( .BD FO   3E # * *:udhhx>P QF $<Wo)FFsCVG_vh7GH$NN dVH%5 66r3zscada_alert_state.jsonc tjttt}|j dg}|j d}|sg|j ddfStj dtdt|d d |d d d }|jdk7rgd|jdt|fS|jj dgdfS#t$r}gt|fcYd}~Sd}~wwxYw)zFetch up to ``top`` recent SCADA mailbox messages. Returns (messages, error). Background-thread safe (returns plain data, not Flask responses). ``error`` is None on success or a short string describing the failure. rrrrr4zno access_tokenrz/messages?$top=zQ&$orderby=receivedDateTime desc&$select=subject,receivedDateTime,bodyPreview,bodyrrrrr;rKz Graph API r>rN)rrrrrrrrrrrgrrryr*)r\rrrDrrls r1_scada_fetch_messagesr&s" 77 %7:W !:::;;=   0|''(;=NOO O!!5m_EXJA A)0w&7%79     s "D$4$4#5R8QRV8W7XYY Yyy{w+T11 3s8|s+AC AC >!C D) C;5D;Dcd|vxsd|vS)z@Mirror the UI's _scadaIsSensorLabel: Temp/RH labels are sensors.r RHrX)rs r1r r s U? +dem+r3cR|jdxsi}|j|duS)z.s 1Q4r3rrrr^)minutes)rrryrmrnrrr&rir rrrr)rwindow_minutesr` rptsrrr s r1_scada_store_recent_pointsr&s ))5'CP C ZZ  $" "155= 1 :   JJE!%%.12 3   HHH WQZ/6A:2OP PF -!adfnA --!  KUS :&    .s/C +C;5 DD +C87C8;D  D ct|tsy t|}|j d}|j d}|dvr|t|kry|dvr|t|kDryy#ttf$rYywxYw)zJTrue if numeric ``value`` falls outside the configured ``rng`` (low/high).FrKrrT)rrr rrr)rrrrKrs r1rrs c4 El ''%.C 776?D *uSz!1 :#d "3  z "s A''A98A9cdiid}tjr tjtj }t |t rt|jd|d<t |jdt r3|djDcic]\}}|t|c}}|d<t |jdt r3|djDcic]\}}|t|c}}|d<|S|Scc}}wcc}}w#tjtf$rY|SwxYw)zReturn {stale: bool, oor: {label: bool}, roc: {label:rule_id: bool}} persisted alert state (roc = rate-of-change transition guard, DVI-1148).F)rrrocrrr&) SCADA_ALERT_STATE_FILErrrrrrrrrrr)rorrrs r1_load_scada_alert_stater&sBr 2E%%' JJ5??ABE%&!%eii&8!9geii.5;@<;M;M;O#P41aAtAwJ#PE%Leii.5;@<;M;M;O#P41aAtAwJ#PE%L L5L $Q#P$$g.   L s0B D$%D;24 5 %L   $$e S%%r3c 2 t}|jdxstt}t |jdtd}t d\}}|r.rrrPrNrrrrKr)rrrrKr)-r4rrrTrr&rmrnrorrecord_collector_runryrrrCrrrrr&r,rr rrrr=r-&EVENT_SCADA_STALErr &rrrr r &r &r&r&r2&rrrr.&ri)rcrrrfrr r received_raw received_dtror0&rr/&r4&is_staler last_label trigger_msgrv rrPrN seen_labelsrrrr s r1_run_scada_collectorr?&=s !F ;'I40H+IIimm$9$<=R$SUVK,B/OHe  =uE M  , ,U C  M  , ,a! L=))HL*84((S]X ? 1+C77-r2LK (66|7K7KCQY7Z[K $ %EBrx HE36::>O3PQ3|R(&UU8_&J& KH  !1!123,;;=CD +-gCN[))*>?TX ""  + +$/'", . / gE'NRHR K& +,? ,LMIx ZZ ! 'RFjj#)rG%K "g259 #FE26OPVX]6^ $VU3  5feD #FE7Ju Ujj#t$ 'QUU7^<U|u- t  & &66";;u-6%%. * + %L   &!e U9"<E" LE M JJ !K L M  M JJ !K L=)) M L JKL K &sNO1P"=,Q%R'R1(PP"(QQ(Q?>Q? RRcrtrtsy tjttt}|j dg}|j d}|s0tjjd|j d||S#t$r"tjjdYywxYw) zBAcquire an app-only Graph token scoped to the home (iCast) tenant.Nrrrrz"OneDrive: token request failed: %sr4z!OneDrive: token acquisition error) rrrrrrrrmrnrryr)rXr>rDs r1_onedrive_graph_tokenrA&s j   / / %7:W,,5[4\,] >* JJ  A6::NaciCj k  @AsA;B (B65B6user_upnrc |rtd|d|d}n td|d} tj|dd|id}|jd k7r;tj j d |j|||jd d y |jjd gS#t$r#tj jd|Yy wxYw)uFList OneDrive items — root if item_id is None, otherwise by item ID.r] /drive/items/z /children/drive/root/childrenrrrr;rKz,OneDrive list failed (%s) for %s item=%s: %sNrrzOneDrive: list error for %s) r^rrrgrmrnrr&rryr)rDrB&rrJrs r1_onedrive_list_itemsrF&s WXJmG9IN WXJ.BC !!#75'AR/S]_`   s " JJ  K!--x$))DS/ Syy{w++  :HEsA&B'B'')CCz /onedrive/lsc tjdxsi}|jdd}|stddfStjjdxsd}t }|std d fSt |||}|td d fSg}|D]_}d |v}|j|jdd|jdd|rd nd|jd|jddat|S)zList a OneDrive folder for the signed-in user using app-only Graph. Query params: item_id (optional) Drive item ID to list; defaults to root. Returns JSON {items: [{id, name, type, size, modified}]} or {error: ...}. r'rr7No user sessionrrrNu;OneDrive not available — Graph credentials not configuredrZzZCould not list OneDrive folder. Check that Files.ReadWrite.All is granted for this tenant.rU rrr9rrdr)rr9rTrdr"r)rrrrrhrA&rF&ri)r'rB&rrDrrr| rs r1 onedrive_lsrI&s  ;;v  $"Dxx$H ./44lly)1TG ! #E Z[]``` uh 8C {yz| E N  tR(vr*$-6v56      r3z/onedrive/downloadc tjdxsi}|jdd}|stddfStjjddj }|stdd fSt }|std d fS tjtd |d |dd|id}|jdk7rtddfS|j}|jd}|stdd fStjjdxs|jdd}|jdxsijdd} tj|dd ! jdk7rtd"dfS fd#} d$d%lm} m} d&|d'|d(} d) j$vr j$d)| d)<| | | | *S#t$r0tjjdtddfcYSwxYw#t$r0tjjd+td,dfcYSwxYw)-zProxy-download a OneDrive file by item ID for the signed-in user. Query params: item_id Drive item ID (required). name Suggested filename for Content-Disposition (optional). r'rr7rH&rrrzitem_id requiredr`zOneDrive not availablerZr]rD&rrrr;rKzItem not foundrz(OneDrive download: metadata fetch failedzOneDrive errorrU ru(No download URL — item may be a folderr9rdrmimeTyperrTrrc3DKjdD]}|yw)Nr rc)r)r file_resps r1generatez#onedrive_download..generate4s)"//5/A   rur)rstream_with_contextrnr)rrzContent-Length)rxz OneDrive download: stream failedzDownload error)rrrrrhrrA&rr^rgrryrmrnrr%rrO&rx)r'rB&rrDrrrrr5rN&rrO&rxrM&s @r1onedrive_downloadrP&s\ ;;v  $"Dxx$H ./44lly"-335G /0#55 ! #E 56;; 4"&&m78*M' C$w&78  C '!12C7 7~~ 88:;L GH#MM||'G488FJ+GHHHV$*// Shared DocumentsGeneral Documents driveTypedocumentLibraryr9zJ_sp_resolve_drive: no documentLibrary drive found for site %s (drives: %d))rUrQ&r monotonicrrr^rgrmrnrr&rryrrC_SP_DRIVE_CACHE_TTL)rDrR&rer re expire_tsr! site_respsite_id drives_respdrivespreferred_names default_driverns r1_sp_resolve_driverb&Qs   +F $) ?? y (OH"&&m78*HYKq A$w&78  C ' JJ  F%%y)..#2F .."&&tR0 JJ  OQZ [$((m77)7 3$w&78  " "c ) JJ  M''+2B2B4C2H !!#''4 COM " 55 !2 2uuV}/ ! $ ! "   X S[   r*H&.0ADW0W%X "  tW  I9U$  PRYZs2A2H*0AH*5A/I% I*)II)JJrcv tj|dd|idddd}|jdk7r:tjj d |j||j d d y |jjd gS#t$r#tjjd |Yy wxYw)zFetch a Graph /children URL and return the item list, or None on error. Selects only the fields needed by the browse response to reduce payload size. rrz(id,name,size,folder,lastModifiedDateTimer)rrfrrrKz,onedrive-browse: list failed (%s) for %s: %sNrrz"onedrive-browse: list error for %s) rrrgrmrnrr&rryr)rDrJrrs r1_onedrive_browse_listrd&s !! $w&78ISVW     s " JJ  >  %4C yy{w++  A5IsA)B ,B )B87B8z/documents/onedrive-browsec tjdxsi}tjjddj }|dvrt ddfStjjdd j j d }t }|st d d fSd d dg}|rM|jd }t|D].\}}|j|d j|d|dzd0|dk(rg|jdd }|st ddfS|rtd|d|d} n td|d} t|| d|d |xsd} | qt ddfSd} t|| } | t ddfS|rtd| d|d} n td| d } t|| d!| d |xsd} | t d"dfSg} g}| D]Z}|jd#d }||r|d |n||jd$d d%}d&|vr| j|J|j|\| jd'(|jd)(t |||| |*S)+uBrowse OneDrive/SharePoint folders for the quote-path picker (DVI-841). Query params: scope "personal" — signed-in user's OneDrive via /users/{upn}/drive "shared" — SharePoint site "InfrastructurePrecastInc" default library path Relative folder path from the drive root (default: root). Empty or "/" means root. Segments must not start/end with "/". Response JSON: { scope, path, breadcrumb:[{name,path}], folders:[{name,path,id}], files:[{name,path,id}] } Errors: 400 bad params, 502 Graph error, 503 credentials unavailable. Auth note (personal scope): uses app-only token reading /users/{upn}/drive, which requires Files.ReadWrite.All (application permission). If the tenant has not granted this, Graph returns 403. Delegated access (OBO flow) would be needed as an alternative — but that requires a separate OAuth redirect not currently wired up. r'r rn!)rn!re z$scope must be 'personal' or 'shared'rr`rbr7r6uMGraph credentials not configured — OneDrive/SharePoint browsing unavailablerZHomerFNr^rz$No authenticated user UPN in sessionrr]z /drive/root:/z :/childrenrE&z personal:r=zmCould not list personal OneDrive folder. Ensure Files.ReadWrite.All (application) is granted for this tenant.rU InfrastructurePrecastInczqCould not resolve SharePoint site or drive. Ensure Sites.Read.All (or Sites.Selected) is granted for this tenant.z/drives/z/root:/z/root/childrenzshared:zgCould not list SharePoint folder. Ensure Sites.Read.All (or Sites.Selected) is granted for this tenant.r9r)r9rbrrc(|djSr rsrs r1r z+documents_onedrive_browse..sqy0r3rc(|djSr rsrs r1r z+documents_onedrive_browse..sQvY__.r3)r rb breadcrumbrr)rrrrhrrrA&rrrirr^rd&rb&r)r'r raw_pathrDrj&r0 rrrB&rJr sp_site_namererrr| r9rs r1documents_onedrive_browserm&s* ;;v  $"D LL  Wj 1 7 7 9E **CDcII||+11399#>H ! #E a   "2./Js# ' PGAt   tSXXeGa!en5MN O P 88GR(!GH#M M  M -zTC M 2FGC%eSIhZqI[U[H\2]^ =[   2 $UL9  \     M(78*JOC M(>BC%eSGL>8K]W]J^2_` =\   G E  vvfb!,4xj$($FF4$  r> NN5 ! LL    LL0L1 JJ.J/ X*g]b ccr3)r!r!rrrrdcapture_enabledlast_capture_tsforeground_app idle_secondscpu_pct screen_countagent_uptime_sr_r> zvision_notification_log.jsonctjttd}tj|_|j d|jdt||S)zKOpen the Vision SQLite DB, creating tables on first use. Caller must close.FrDrFa  CREATE TABLE IF NOT EXISTS vision_enrollment_tokens ( token TEXT PRIMARY KEY, machine_id TEXT, issued_at REAL NOT NULL, expires_at REAL NOT NULL, consumed_at REAL ); CREATE TABLE IF NOT EXISTS vision_agents ( machine_id TEXT PRIMARY KEY, hostname TEXT, agent_token TEXT UNIQUE NOT NULL, enrolled_at REAL NOT NULL, last_seen_at REAL, revoked INTEGER NOT NULL DEFAULT 0, status TEXT NOT NULL DEFAULT 'active' ); CREATE TABLE IF NOT EXISTS vision_kv ( key TEXT PRIMARY KEY, value TEXT, updated_at REAL ); CREATE TABLE IF NOT EXISTS vision_checkins ( id INTEGER PRIMARY KEY AUTOINCREMENT, machine_id TEXT NOT NULL, received_at REAL NOT NULL, hostname TEXT, logged_in_user TEXT, os_version TEXT, agent_version TEXT, status TEXT, capture_enabled INTEGER, last_capture_ts REAL, foreground_app TEXT, idle_seconds REAL, cpu_pct REAL, screen_count INTEGER, agent_uptime_s REAL, ts REAL, local_ip TEXT, public_ip TEXT, FOREIGN KEY (machine_id) REFERENCES vision_agents (machine_id) ); CREATE TABLE IF NOT EXISTS vision_commands ( id TEXT PRIMARY KEY, machine_id TEXT NOT NULL, action TEXT NOT NULL, params_json TEXT, created_at REAL NOT NULL, delivered_at REAL, acked_at REAL, acked_status TEXT, error_message TEXT, FOREIGN KEY (machine_id) REFERENCES vision_agents (machine_id) ); CREATE TABLE IF NOT EXISTS vision_agent_logs ( machine_id TEXT NOT NULL, file TEXT NOT NULL, content TEXT, received_at REAL NOT NULL, PRIMARY KEY (machine_id, file) ); CREATE TABLE IF NOT EXISTS vision_agent_events ( id INTEGER PRIMARY KEY AUTOINCREMENT, machine_id TEXT NOT NULL, signature TEXT NOT NULL, detail TEXT, trace TEXT, ts REAL, received_at REAL NOT NULL, FOREIGN KEY (machine_id) REFERENCES vision_agents (machine_id) ); CREATE INDEX IF NOT EXISTS idx_vision_checkins_machine_time ON vision_checkins (machine_id, received_at); CREATE INDEX IF NOT EXISTS idx_vision_agent_events_machine_time ON vision_agent_events (machine_id, received_at); CREATE TABLE IF NOT EXISTS vision_recovery_audit ( id INTEGER PRIMARY KEY AUTOINCREMENT, ts REAL NOT NULL, machine_id TEXT NOT NULL, signature TEXT NOT NULL, event_id INTEGER NOT NULL, action TEXT NOT NULL, cmd_id TEXT, actor TEXT NOT NULL DEFAULT 'auto-recovery', outcome TEXT NOT NULL, detail TEXT ); CREATE INDEX IF NOT EXISTS idx_vision_recovery_audit_machine_time ON vision_recovery_audit (machine_id, ts); ) rGrHr*VISION_DB_PATHrJrKrLrM_vision_migraterNs r1r'r'?sU ??3~.% HD{{DLL*+ZZ vD Kr3c|jdDchc]}|d }}d|vr2|jd|jd|jt|jd}td|Dd}|)|d d k(r!|j d |jd |vr!|jd |jd|vr!|jd|j|jdj Dchc]}|d }}d|vr!|j d|jd|vr!|j d|j|jdDchc]}|d }}d|vr!|jd|jd|vr"|jd|jyycc}wcc}wcc}w)zCIdempotent schema upgrades for older Vision DBs (DVI-436, DVI-726).z PRAGMA table_info(vision_agents)r9rdzJALTER TABLE vision_agents ADD COLUMN status TEXT NOT NULL DEFAULT 'active'z=UPDATE vision_agents SET status = 'revoked' WHERE revoked = 1z+PRAGMA table_info(vision_enrollment_tokens)c32K|]}|ddk(s |yw)r9r!NrXr%s r1r/z"_vision_migrate..sAaqyL'@A Nnotnullr^a CREATE TABLE vision_enrollment_tokens_new ( token TEXT PRIMARY KEY, machine_id TEXT, issued_at REAL NOT NULL, expires_at REAL NOT NULL, consumed_at REAL ); INSERT INTO vision_enrollment_tokens_new (token, machine_id, issued_at, expires_at, consumed_at) SELECT token, machine_id, issued_at, expires_at, consumed_at FROM vision_enrollment_tokens; DROP TABLE vision_enrollment_tokens; ALTER TABLE vision_enrollment_tokens_new RENAME TO vision_enrollment_tokens; ssh_public_keyz8ALTER TABLE vision_agents ADD COLUMN ssh_public_key TEXTssh_key_writtenzOALTER TABLE vision_agents ADD COLUMN ssh_key_written INTEGER NOT NULL DEFAULT 0z1SELECT name FROM sqlite_master WHERE type='table'rvision_agent_eventsaX CREATE TABLE IF NOT EXISTS vision_agent_events ( id INTEGER PRIMARY KEY AUTOINCREMENT, machine_id TEXT NOT NULL, signature TEXT NOT NULL, detail TEXT, trace TEXT, ts REAL, received_at REAL NOT NULL, FOREIGN KEY (machine_id) REFERENCES vision_agents (machine_id) ); CREATE INDEX IF NOT EXISTS idx_vision_agent_events_machine_time ON vision_agent_events (machine_id, received_at); vision_recovery_audita CREATE TABLE IF NOT EXISTS vision_recovery_audit ( id INTEGER PRIMARY KEY AUTOINCREMENT, ts REAL NOT NULL, machine_id TEXT NOT NULL, signature TEXT NOT NULL, event_id INTEGER NOT NULL, action TEXT NOT NULL, cmd_id TEXT, actor TEXT NOT NULL DEFAULT 'auto-recovery', outcome TEXT NOT NULL, detail TEXT ); CREATE INDEX IF NOT EXISTS idx_vision_recovery_audit_machine_time ON vision_recovery_audit (machine_id, ts); z"PRAGMA table_info(vision_checkins)r3z4ALTER TABLE vision_checkins ADD COLUMN local_ip TEXTr4z5ALTER TABLE vision_checkins ADD COLUMN public_ip TEXT)rLrZrrrMr)rOr agent_colstok_infor2existing_tables checkin_colss r1rw&rw&s&*\\2T%UV!F)VJVz! X  TU DLL!NOPH A8A4 HC 3y>Q.   z) OP  * ]  &*\\;&hjqtOO3    o5   '+||4X'YZ!AfIZLZ% KL ,& LM 'gWPN[s G  G% G*c tsy|jjdd}d|d|d}ddd dd dd d ttd tt dt |g } tj|ddd}|jdk(ry|jxs|jxsdj}|xsd|jS#tj$rYyt$rYyt$r}t|cYd}~Sd}~wwxYw)aAppend public_key to authorized_keys on the rsync server (DVI-726). Uses ssh to run a one-liner on the remote that appends the key only if it is not already present (idempotent). Returns True on success or a string error message on failure. Requires _VISION_RSYNC_MGMT_KEY to be set to a private key file that is pre-authorized for _VISION_RSYNC_USER@_VISION_RSYNC_HOST. uGVISION_RSYNC_MGMT_KEY not configured — cannot push key automatically.rd z'\''z2mkdir -p ~/.ssh && chmod 700 ~/.ssh && grep -qxF 'z.' ~/.ssh/authorized_keys 2>/dev/null || echo 'z?' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keyssshz-ozStrictHostKeyChecking=noz BatchMode=yeszConnectTimeout=10z-pz-irTrxr5rr7z ssh exited zSSH connection timed out.zssh not found on server PATH.N)_VISION_RSYNC_MGMT_KEYrrr*_VISION_RSYNC_PORT_VISION_RSYNC_USER_VISION_RSYNC_HOSTr9r:r<rcrbTimeoutExpiredrry) public_key key_stripped remote_cmdrir>rrls r1_vision_write_ssh_key_to_rsyncr& s! "X##%--c7;L "^$] _  ( o ! c$% $  a 234 C DtRP    !}}3 3::<7 F$5$5#677  $ $+* /. 3xs0(C>CDD&D. C>8D>DcV|jd|fj}|r|dSdS)Nz)SELECT value FROM vision_kv WHERE key = ?rrrs r1_vision_kv_getr&5s/ ,,BSF K T T VC3w<(D(r3cR|jd||tjfy)NzINSERT INTO vision_kv (key, value, updated_at) VALUES (?, ?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_atrrs r1_vision_kv_setr&:rr3ct|t}|sA|r?tjj}t |t||j |Sr)r&_VISION_OPEN_ENROLL_KEYrWrXrYr&rZrs r1_vision_get_open_enroll_secretr&Cs@ D"9 :F f!!t4f= Mr3cftjtdzz }|jd|fy)zHDrop check-in rows older than the retention window. Cheap, index-backed.r z1DELETE FROM vision_checkins WHERE received_at < ?N)rU_VISION_CHECKIN_RETENTION_DAYSrL)rOr s r1_vision_prune_checkinsr&Ms) YY[9EA AFLLDviPr3z 192.168.250.4r iGz192.168.250.0/24) rsync_lan_iprsync_lan_port rsync_wan_iprsync_wan_port rsync_user lan_subnetcxddi}|jttjr t j tj }t|trt|jdtr|d|d<dD]H}|j|}t|ts%|js6|j||<JdD]%} |j|t||||<'|S#tjtf$rd}YwxYw#t t"f$rY\wxYw)zReturn Vision settings: {mock_data} + rsync server config (DVI-977). Mock defaults on until the first real check-in. rsync config defaults match the agent's built-in LAN/WAN endpoints so behaviour is unchanged until an admin edits them. mock_dataTNr&r&r&r&r&r&)r_VISION_RSYNC_DEFAULTSVISION_SETTINGS_FILErrrrrrrrrrr*rrrr)rrrrs r1_load_vision_settingsr&as%T"H OO*+##% JJ3==?@E eT "%))K0$7(-k(:%Q ,IIaLa%!'')"#'')HQK ,: yy|/&)%(m   O$$g. E ":.s#'D "D'D$#D$'D98D9cXtjtj|dyr)r&rrrrfs r1_save_vision_settingsr&s##DJJx$BCr3cT|xs t}|d|d|d|d|d|ddS)zrsync endpoint config delivered to the agent in the check-in response (DVI-977). The agent uses it to pick its send endpoint in place of the hardcoded constants; env vars still take precedence agent-side.r&r&r&r&r&r&)lan_iplan_portwan_ipwan_portr'r&)r&)rrs r1_vision_rsync_configr&sL +)+A'()'() o o  r3c|sy|xs t}|jdxs td} tj|d}tj t |j|vrdSdS#t$rYywxYw)zReturn 'local' when local_ip falls inside the configured LAN subnet, else 'remote'. Returns None when local_ip is missing or unparseable (DVI-977).Nr&Fstrictr?r ) r&rr& ipaddress ip_network ip_addressr*rr)r3rrsubnetnets r1_vision_localityr&s +)+A UU< H$:<$HF""6%8#..s8}/B/B/DELwZRZZ sAA86A88 BBc\tjsiS tjtj }t |t r6|jDcic]\}}t|t|c}}SiScc}}w#tjtf$ricYSwxYw)zDReturn {machine_id: friendly_name} display-name overrides (DVI-682).) VISION_AGENT_NAMES_FILErrrrrrrr*rr)rrrs r1r&r&s " * * , zz1;;=>E%&eii 2D9O**+?i@P+QReii 3T:#(#4#:#:#<MR%b$/4H4LD,S1M K4K$$g.   K sB>C>'C>>DDc i}d|vrt|d|d<d|vr7t|djj}|tvr||d<d|vr7 t |d}|dkDr#t tdtd|d|d<dD]#}||vs tdt||||<%t|jd trG|d Dcgc]5}t|jst|j7c}|d <|jd }t|tri}t|jd trUt!|d Dchc]:}t|tt fr"dt|cxkrd krnn t|<c}|d <d D]\}|j|} t| ts%t#j$d| jsJ| j||<^||d <|S#ttf$rYwxYw#ttf$rYwxYwcc}wcc}w)zGCoerce a policy dict to known fields/types; drop anything unrecognized.rn&r&r&rrg?rP)r&r&rrr&r rr)rqrz^\d{1,2}:\d{2}$)rr*rrE_VISION_CAPTURE_MODESr rjrLrCrrrrrrrrrFrG) rrrOfpsrrrrFrnrs r1r&r&s/ CC!%c*;&?r3c|xs t}tt}|j|j dxsi|j dxsij |}t |tr|j||S)zHMerge default + per-machine override into the policy the agent receives.r.r&)rrrrrr)r!r7 rHrs r1_vision_effective_policyr&sn  ,*,F & 'CJJvzz)$*+ :&,"11*=H(D! 8 Jr3c|xstj}|tz tkry|atj syt }tj D]}|j st|j|jdxsd}|dkrC||dzz }|j D]1} |jrt||kr|j3y#t$rYBwxYw)uwDelete footage older than each machine's effective retention_days. Covers screenshot frames, video segments (.mp4), and their thumbnail/poster companions alike — anything in the machine's footage dir whose age exceeds its retention window. Throttled to one sweep/hour so the check-in path stays cheap. retention_days <= 0 disables purging for that machine.Nrrrr )rU_vision_footage_purge_at _VISION_FOOTAGE_PURGE_INTERVAL_Sr<rrrYr&r9rr_vision_frame_tsr/r)rr7 mdirrr rs r1_vision_purge_footager&s  C %%(HH"  $ $ & "F"**, {{} ' 6:>>?OPUTU 19 te|# A 99;#3A#6#?HHJ    s>.C11 C=<C=z^[A-Za-z0-9._-]+$)rrrr)rct|z SrT)r<)r!s r1_vision_footage_machine_dirr&8s  **r3ct} |jd|fj}|jt |xr|ddk(S#|jwxYw)zTrue only for an enrolled, approved (status='active') machine. Pending and revoked machines are quarantined from footage/recordings (DVI-436).5SELECT status FROM vision_agents WHERE machine_id = ?rdrv)r'rLrur[rrs r1_vision_machine_activer&<s_  frame image (a video item's poster keyframe for "full"), "segment" -> raw H.264 .mp4.r&)rr!r&r! s r1r.zFootageStore.read_bytesrs "!r3NNrrT)r __module__ __qualname____doc__r&r&r&r.rXr3r1r&r&Ws"" " "r3r&c2eZdZdZdZddZdZd dZdZy) LocalFootageStorezFootage served from the local mirror directory (VISION_FOOTAGE_DIR//...). This is the pre-DVI-743 behavior, moved behind the FootageStore seam with no functional change.ct|SrT)r&rr!s r1 _machine_dirzLocalFootageStore._machine_dirs *:66r3Nc ,|j|}|jsgSt}g}t|j D]}|j rd|j vr"|jj} | tvr/|j|j|j|dfs| tvs||j|dfg} |D]\}} | dk(r|j|vrt|} || |kr-|| |kDr5|jt| | d|d|jdd|d|jdd } | dk(rd |d|j| d <| j| | j!d d | d|S)uReal footage-store entries for a machine, newest first. Handles both screenshot frames (.jpg/.png/…) and video segments (.mp4 + poster), DVI-727. Thumbnails (.thumb.) are companions, not standalone entries. A poster image that shares a stem with a .mp4 segment is surfaced through the video entry (as its thumb/full poster), not as its own frame..thumb.r&r~ N/vision/frames/r6 ?size=thumb ?size=fullr&r_r! thumb_urlfull_url/vision/segments/ video_urlc |dSrArXrZ s r1r z/LocalFootageStore.list_frames..rBr3Tr )r&rrrrYrr9r!rE_VISION_VIDEO_EXTSrrri_VISION_FRAME_EXTSr&rr)rr!r&rX r rn video_stemsrrrrr! r_rs r1r&zLocalFootageStore.list_framess   j )xxzIe  $ +A99;)qvv"5((.."C((' a\*** a\* + GAtw166[#8!!$B28~"r'FF"g.zl!AFF8;O-j\166(*M Ew'8 AaffX%Nk" JJu % & &56E{r3c|j|}g}|dk(r |t|j|dzz }|t|j|dzDcgc]}d|jvs|c}z }|D]I}|j s|j j tvs5tt|cSycc}w)Nr4.thumb.*r1r&) r&rrr9rr!rEr&rr*)rr!r&rdrnrBrs r1r&zLocalFootageStore.frame_bytess   j ) 7? &:(=!>? ?J&4)@"A]QYVWV\V\E\q]]  )Ayy{qxx~~/3EE Q(( ) ^s C-Cc|j|}t|j|dzD]K}|js|jj t vs5tt|dcSy)Nr1T) conditional) r&rrrr!rEr&rr*)rr!r&rrnrs r1r&z LocalFootageStore.segment_streamse   j )x$/0 ;Ayy{qxx~~/3EE QT:: ;r3c|j|}|dk(rt|j|dzD]s}|js|jj t vs5|jtj|jj dfcSyg}|dk(r |t|j|dzz }|t|j|dzDcgc]}d|jvs|c}z }|D]s}|js|jj tvs5|jtj|jj dfcSycc}w)NrHr1 video/mp4r4r'r&r) r&rrrr!rEr&r._VISION_CONTENT_TYPESrr9r&)rr!r&r! rnrrBs r1r.zLocalFootageStore.read_bytessX   j ) 9 AFF8d?34 799;188>>#37I#I<<>+@+D+D(+,777 7 7? &:(=!>? ?J&4)@"A]QYVWV\V\E\q]]  BAyy{qxx~~/3EE||~'<'@'@HHNN$&@(BBB B ^s 2FFr&rT) rr&r&r&r&r&r&r&r.rXr3r1r&r&~s"E7*X r3r&r')rrrrrc4eZdZdZdZdZdZdZdZdZ y) _FootageLRUCacheuBounded on-disk LRU hot-cache for remotely-fetched footage (DVI-748, D3=ii). Holds recently-viewed thumbs/frames/segments only — never a full mirror. Entries are evicted oldest-first once the total cached size exceeds ``max_bytes`` or an entry is older than ``ttl_s``. Files are stored under ``root`` with their original extension so callers can serve them straight through send_file (correct Content-Type + native HTTP Range for video). cDt||_tt|d|_tt|d|_t j|_t|_ i|_ |jjddy#t$rYywxYw)NrTrM)r_rootrCr _max_bytes_ttlrLock_lock_OrderedDict_type_entries_mtimesrr)rr=rttl_ss r1__init__z_FootageLRUCache.__init__s~$Z c)na0E A& ^^% )+    JJ  TD  9   s5B BBc&|jddS)Nr6r r)rr)s r1 _safe_namez_FootageLRUCache._safe_names{{3%%r3ctj}|j5|jj|}| dddy|\}}|jrG||j j|dz |jkDr|j | dddy|js|j | dddy|jj||cdddS#1swYyxYwr) rUr 'r'rr 'r'_dropr move_to_end)rr)rrrb_sizes r1rz_FootageLRUCache.getsiik ZZ MM%%c*E}   KD%yyS4<<#3#3C#;;diiG 3  ;;= 3   MM % %c *   sC2 AC2!"C2 C22C;cJ|j|j|z } |j|jdz}|j ||j ||j5||jvr|j||t|f|j|<tj|j|<|j!ddd|S#t $r+}tjjd||Yd}~yd}~wwxYw#1swY|SxYw)Nz.partz%Footage cache write failed for %s: %s)r 'r'r r!r-rrrmrnror 'r'r'rCrUr' _evict_locked)rr)rrbrSrls r1putz_FootageLRUCache.put szzDOOC00 ""4;;#89C OOD ! KK ZZ !dmm# 3"&D !2DMM#  $ DLL      !    JJ  FS Q  !  s%AC!,A+D! D*!DDD"c|jj|d}|jj|d|r |djyy#t$rYywxYwr)r'rr'r/r)rr)rs r1r'z_FootageLRUCache._drops[ !!#t, d#  a!   sA AActd|jjD}||jkDrt |jdkDrt t |jj\}\}}|jj|d|jj|d |j||z}||jkDrt |jdkDryyyy#t$rY.&s<62rB> D  D N) rr&r&r&r'r'rr'r'r'rXr3r1r'r's% &  " r3r'c,eZdZdZdZdZedZy) _SFTPPoola Tiny thread-safe pool of paramiko SFTP connections (DVI-748). Avoids a per-request SSH handshake. Connections are validated cheaply on checkout; dead ones are discarded and replaced. paramiko is imported lazily so the local backend never pays for it. c|||c|_|_|_||_t t |d|_g|_tj|_ y)Nr^) _host_port_user _key_pathrCr _max_size_idlerr 'r ')rr$rr'key_pathmax_sizes r1r'z_SFTPPool.__init__:sF-14* DJ !S]A. ^^% r3c Rddl}|j}|j|j|j |j |j |j|jddddd |j}|jjd||fS)NrrF) r!rrF key_filenamer7banner_timeout auth_timeout look_for_keys allow_agentr) paramiko SSHClientset_missing_host_key_policy AutoAddPolicyrHr%'r&'r''r(' open_sftp get_channel settimeout)rr3'clientsftps r1r1z_SFTPPool._connectAs##%**8+A+A+CDZZdjj4::B5e  ! %%b)t|r3c#Kdx}}|j5|jr|jj\}}ddd| |jd||j \}} ||j5t|j|jkr'|jj||f dddy ddd |j y#1swYxYw#t$r( |j n#t$rYnwxYwdx}}YwxYw#1swY[xYw#t$rYywxYw#t$r" |j #t$rYwxYwwxYww)Nr) r 'r*'rrryr[r1rCr)'ri)rr:'r;'s r1 connectionz_SFTPPool.connectionNsk ZZ 0zz#zz~~/  0   % # <==?LFD J tzz?T^^3JJ%%vtn5  3   9 0 0  %LLN  $$  %"             sE-*C$ E-C0E-/D?3 E-?AD$ E- E-D0#E-$C-)E-0 D!:D  D! DD!DD!E- D!!E-$D-)E-0 D<9E-;D<<E-? E* EE* E&#E*%E&&E**E-N)rr&r&r&r'r1_contextmanager_typer='rXr3r1r#'r#'2s%&   r3r#'c\eZdZdZdZdZdZedZd dZ ddZ d Z d Z dd Z d Zy)RemoteSSHFootageStoreu Footage served on demand from the rsync storage server over SFTP (DVI-748 Phase 2). No full local copy — a bounded LRU caches only the hot set. Remote layout mirrors local: ``//`` (+ ``.thumb.`` companions, ``.mp4`` segments).c.tjd|_ttt t tt|_ tttt|_tt d|_i|_t'j(|_y)Nr6r)rBr8_baser#'r&r&r&r@rI_poolr'rDrFrG_cacherCrK _listing_ttl _listingsrr ' _listing_lock)rs r1r'zRemoteSSHFootageStore.__init__xsn/66s;   24F "$@  ' $&D $   :A>&^^-r3c$|jd|S)Nr6)rB'r&s r1 _remote_dirz!RemoteSSHFootageStore._remote_dirs**Qzl++r3c  tj}|j5|jj|}|r|d|kDr|dcdddSddd |jj 5}|j |j|}dddDcgc](}|jtt|ddxsdf*}}|j r5|j5||j z|f|j|<ddd|S|S#1swYxYw#1swYxYwcc}w#t$rg}Ymt$r-}tjjd||gcYd}~Sd}~wwxYw#1swY|SxYw)z}[(filename, mtime)] for a machine dir, briefly cached. [] on outage or a missing/empty dir (clean UI, never a crash).rr^Nrz(Remote footage listing failed for %s: %s)rUrG'rF'rrC'r=' listdir_attrrI'rr rerryrmrnrorE') rr!rr r;'attrsrrrls r1 _list_remotez"RemoteSSHFootageStore._list_remoteshiik    !^^'' 3F&)c/ay ! ! ! &&( HD))$*:*::*FG HRWXQajj%:q(A(FQ"GHXEX   ## N.1D4E4E.Eu-Mz* N u ! ! !  H HX  E  JJ  I:WZ [I  N s_*DD48!D# D4%-D/D4,E9D #D,( D44 E6E6 "E1+E61E69Fc|jddd}|jdr|dtd } t|}|dkDr|S |S#t$rY|SwxYw)Nrr^rz.thumbr&)rj r|rCr r)r9r rr_s r1_name_tszRemoteSSHFootageStore._name_tssv{{3"1% == "(3x=.)D tBM! "     sA AANc |j|}t}g}|D]\}} d|vr |jd} | dkr"|| dj} |d| } | tvr8|j | |j || | d|j|| fz| tvs|j || | d|j|| fg} |D]b\}} } }}|dk(r| |vr|||kr|||kDr#| t||d|d| dd|d| d d }|dk(r d |d| |d <| j |d| jd d| d|S)Nr&rrr&r~ r&r6r&r&r&r&r&c |dSrArXrZ s r1r z3RemoteSSHFootageStore.list_frames..rBr3Tr ) rM'rrfindrEr&rrirO'r&rr)rr!r&rX r rr&rr9r dotrrrr! r_rs r1r&z!RemoteSSHFootageStore.list_framess!!*-e  UKD%D **S/CQwst*""$C:D((% dCw dE8RST** dCw dE8RST U).  %D#tT2w4;#628~"r' "g.zl!D6M-j\4& K Ew'8 AdV%Lk" JJu ! " &56E{r3c|j|Dcgc]\}}| }}}g}|r|tfd|Dz }|tfd|Dz }|r|dSdScc}}w)z}|jdzr(||jddjvr|@ywr&rNrwrR'rEr,rrr&s r1r/z1RemoteSSHFootageStore._resolve..sJ!<<9 45!AGGCLM:J:P:P:RVZ:Z!sAAc3K|]B}d|vr<|jdzr(||jddjvr|DywrV'rW'rX's r1r/z1RemoteSSHFootageStore._resolve..sP !all8c>&B!''#,- &&(D0  sAA rN)rM'r) rr!r&r prefer_thumbr_mrrBs `` r1_resolvezRemoteSSHFootageStore._resolves $ 1 1* =>uq">>  &! ! J f    !+z!}44?s A#c"|d|}|jj|}||S|j|d|} |jj 5}|j |d5}|j |j}dddddd|jj|S#1swY-xYw#1swY1xYw#t$rYyt$r+} tjjd|| Yd} ~ yd} ~ wwxYw)znReturn a local cache path for a remote file, fetching via SFTP on a miss. None on outage/missing file.r6Nr z&Remote footage fetch failed for %s: %s)rD'rrI'rC'r='r?prefetchr rryrmrnror') rr!r9 cache_keyr! remote_pathr;'rrrls r1_fetchzRemoteSSHFootageStore._fetchs"l!D6* kkooi( ?J))*56av>  &&( %DYY{D1%RKKM779D% %{{y$//%% % %!   JJ  GVY Z sMCC+!B8 CC8C =CC  C DD#!D  Dc|j||t|dk(}|sy|j||}|ytj |j j }tt||S)Nr4rZ'r ) r\'r&ra'r'rr!rErr*)rr!r&rdr9rbrs r1r&z!RemoteSSHFootageStore.frame_bytesso}}Z3E,0GO>{{:t, <%))$++*;*;*=>TU33r3c|j||t}|sy|j||}|ytt |ddS)Nr'T)r!r')r\'r&ra'rr*)rr!r&rr9rbs r1r&z$RemoteSSHFootageStore.segment_streamsH}}Z3EF{{:t, <T[dKKr3c6|dk(r|j||t}n|j||t|dk(}|sy|j||}|y|dk(rdnd}tj |j j|}|j|fS)NrHr4rc'r'r) r\'r&r&ra'r'rr!rEr.)rr!r&r! r9rb default_ctrs r1r.z RemoteSSHFootageStore.read_bytess 9 ==X7IJD==X7I04!BD{{:t, <$(I$5[;U %))$++*;*;*=zJ %''r3r&FrT)rr&r&r&r'rI'rM' staticmethodrO'r&r\'ra'r&r&r.rXr3r1r@'r@'rsKE .,,  $L5 0( 4 L (r3r@'ctdk(r@ t}tjj dt t tt|Stdvr$tjjdttS#t$r4}tjjd|tcYd}~Sd}~wwxYw)a_Select the footage backend from VISION_FOOTAGE_BACKEND (DVI-743). "remote" (DVI-748) streams on demand over SFTP; anything else (incl. an unknown value) falls back to the local-disk mirror so a misconfigured env never takes footage offline. A failure constructing the remote backend also degrades to local rather than crashing startup.r z2Vision footage backend = remote SFTP (%s@%s:%s/%s)z?Remote footage backend unavailable (%s); falling back to local.N)r7r?zAVISION_FOOTAGE_BACKEND=%r is not recognized; using local backend.) r>r@'rmrnrlr&r&r&rBryrr&ro)r rls r1_make_footage_storerj's ) ')+E JJOOD"$68J*  L ]2  O "    ' JJ  QSV %& &  's>B B= )B82B=8B=c0tj|||S)utPhase-4 Assistant-ingestion resolver (DVI-751 — groundwork, NOT wired). The single server-side seam mapping a canonical Recordings item (machine_id, frame_id) to raw footage bytes for a future Assistant/Claude "analyze this capture" action. Returns ``(data: bytes, content_type: str)`` or None. Backed by the active FootageStore, so it behaves identically for the local-mirror and remote-SFTP backends. Ingestion mapping (the contract Vision Phase 4 will build on): - "full" -> full frame image. A screenshot item maps 1:1 to a Claude image block (base64). A video item yields its poster / keyframe image, the cheap representative still for a clip. - "thumb" -> small frame image (low-token preview / triage). - "segment"-> raw H.264 .mp4 bytes. The caller samples keyframes (or uploads via the Files API) — frame extraction is future Phase-4 work, deliberately out of scope here. Access: callers MUST enforce vision_access_required + _vision_machine_active before invoking; this resolver never re-checks access (same rule as the FootageStore serving methods). NOT YET WIRED: no Assistant tool registration, no Claude call, no UI, no endpoint. This locks the contract so the streaming refactor (DVI-743) is a clean base for Vision Phase 4.)_footage_storer.)r!r&r! s r1 footage_bytesrm'=s2  $ $Z4 @@r3c ttj}g}t|D]D}||dzz }|||kr|||kDrd|}|j||dd|d|dd|d|ddF|S) zKSynthetic frame list so Recordings/thumbnails are demonstrable pre-capture.rmock-r~ r&r6r&r&r&)rrUrri) r!r&rX rrrrr_r s r1_vision_mock_framesrp'Ys diik C C 5\   1s7] ?rCx  >b2g bTl *:,auKH)*Qse:F      Jr3c`|r t|dntj|d}|r|dSdS)Nr^)rr@r)rp'rl'r&)r!mockframess r1_vision_latest_framert'ns8:>!*A6!--j-B 6!9(D(r3VISION_THUMBS_CACHE_TTL)r_rc t} |jdj}|j|Dcgc]}|d }}|siSd}ddlm}t dttt|}i}||5}|j||D] \} } | || <  ddd|S#|jwxYwcc}w#1swY|SxYw) zAssemble {machine_id: {thumb_url, full_url, latest_kind}} for active agents, fetching each machine's latest frame in parallel (bounded by the SSH pool size so we never open more concurrent SFTP connections than the pool holds).z