@dawn-ai/core 0.8.7 → 0.8.9

package/README.md

@@ -6,7 +6,155 @@
 
 Filesystem-based route discovery, app config loading, state-field resolution, and typegen primitives that the Dawn CLI builds on.
 
-This is an internal Dawn workspace package, part of [Dawn — the TypeScript meta-framework for LangGraph](https://github.com/cacheplane/dawnai). For documentation, see [dawnai.org/docs](https://dawnai.org/docs/getting-started).
+This is part of [Dawn - the TypeScript meta-framework for LangGraph](https://github.com/cacheplane/dawnai).
+Use this package for CLI/runtime integration points; application routes usually
+import author-facing helpers from `@dawn-ai/sdk`.
+
+Conceptual docs: [Routes](https://dawnai.org/docs/routes),
+[Configuration](https://dawnai.org/docs/configuration),
+[Workspace Filesystem](https://dawnai.org/docs/workspace),
+[Memory](https://dawnai.org/docs/memory), and
+[API Reference](https://dawnai.org/docs/api#dawn-aicore).
+
+## Install
+
+```bash
+pnpm add @dawn-ai/core
+```
+
+```ts
+import {
+  createCapabilityRegistry,
+  createWorkspaceFs,
+  discoverRoutes,
+  loadDawnConfig,
+  renderDawnTypes,
+  type DawnConfig,
+} from "@dawn-ai/core"
+```
+
+## Public Exports
+
+### Capability markers
+
+- `createAgentsMdMarker()`
+- `createMemoryMarker()`
+- `createMemoryMdMarker()`
+- `createPlanningMarker()`
+- `createSkillsMarker()`
+- `createSubagentsMarker()`
+- `createWorkspaceMarker()`
+- `BUILT_IN_TOOL_NAMES`
+
+These markers detect route/app files and contribute prompt fragments, tools, or
+stream transformers. `createMemoryMarker()` activates only when route memory
+context is supplied; `createWorkspaceMarker()` activates when a `workspace/`
+directory exists or a runtime `workspaceRoot` is supplied.
+
+### Capability registry and permission gating
+
+- `createCapabilityRegistry(markers)` and `applyCapabilities()` collect marker
+  contributions for a route.
+- `gateToolOp()` and `wrapToolWithApproval()` apply tool-level approval rules.
+- Types include `CapabilityMarker`, `CapabilityMarkerContext`,
+  `CapabilityContribution`, `DawnToolDefinition`, `PromptFragment`,
+  `StreamTransformer`, `MemoryContext`, `MemoryStoreLike`, and registry result
+  types.
+
+### Workspace filesystem
+
+- `createWorkspaceFs(options)` builds the `WorkspaceFs` handle used as `ctx.fs`.
+- `CreateWorkspaceFsOptions` accepts `workspaceRoot`, a `FilesystemBackend`,
+  permissions, an `AbortSignal`, and `interruptCapable`.
+
+The helper resolves paths relative to `workspaceRoot`, canonicalizes them with
+the backend's `realPath`, and applies the same permission gate used by
+agent-facing workspace tools.
+
+### Configuration and discovery
+
+- `loadDawnConfig({ appRoot })` loads and normalizes `dawn.config.ts`.
+- `config(value)` is the typed identity helper for config files.
+- `discoverRoutes(options)` scans the Dawn app directory and returns a route
+  manifest.
+- `findDawnApp(options)` locates app roots, and
+  `assertDawnRoutesDir(appRoot, routesDir?)` validates that a routes directory
+  exists, returning `Promise<void>`.
+- `toRouteSegments()`, `isPrivateSegment()`, and `isRouteGroupSegment()` parse
+  file-system route segments.
+- Types include `DawnConfig`, `LoadedDawnConfig`, `DiscoverRoutesOptions`,
+  `DiscoveredDawnApp`, `RouteDefinition`, `RouteManifest`, `RouteSegment`,
+  `RouteKind`, and `NormalizedRouteModule`.
+
+### State and typegen
+
+- `resolveStateFields()` resolves route state reducers and defaults.
+- `extractToolSchemasForRoute()` and `extractToolTypesForRoute()` inspect route
+  tools for schemas and generated type definitions.
+- `renderDawnTypes()`, `renderRouteTypes()`, `renderStateTypes()`, and
+  `renderToolTypes()` render the generated `dawn:routes` declaration. Some docs
+  and audits refer to this group as `renderTypeDefinitions`; there is no single
+  exported function by that name.
+- Types include `ResolveStateFieldsOptions`, `RouteStateFields`,
+  `ExtractToolSchemasOptions`, `ExtractToolTypesOptions`,
+  `RouteToolSchemas`, `RouteToolTypes`, `ExtractedToolSchema`,
+  `ExtractedToolType`, `ResolvedStateField`, and `StateFieldReducer`.
+
+### Tool scope
+
+- `resolveToolScope()` and `toolOrigin()` decide whether a discovered tool is
+  visible to a route.
+- Types include `ScopeInput` and `ToolOrigin`.
+
+### Storage type re-export
+
+- `ThreadsStore` is re-exported from `@dawn-ai/sqlite-storage` for config typing.
+
+## Examples
+
+Discover routes and render generated route types:
+
+```ts
+import {
+  discoverRoutes,
+  extractToolTypesForRoute,
+  renderDawnTypes,
+} from "@dawn-ai/core"
+
+const manifest = await discoverRoutes({ appRoot: process.cwd() })
+const toolTypes = await Promise.all(
+  manifest.routes.map(async (route) => ({
+    pathname: route.pathname,
+    tools: await extractToolTypesForRoute({
+      routeDir: route.routeDir,
+      sharedToolsDir: `${process.cwd()}/src`,
+    }),
+  })),
+)
+
+const dts = renderDawnTypes(manifest, toolTypes)
+```
+
+Create a gated `WorkspaceFs` handle:
+
+```ts
+import { createWorkspaceFs } from "@dawn-ai/core"
+import { localFilesystem } from "@dawn-ai/workspace"
+
+const fs = createWorkspaceFs({
+  workspaceRoot: `${process.cwd()}/workspace`,
+  backend: localFilesystem(),
+  permissions: undefined,
+  signal: new AbortController().signal,
+  interruptCapable: false,
+})
+```
+
+## Notes
+
+`@dawn-ai/core` is intentionally lower level than `@dawn-ai/sdk`. Prefer the SDK
+for route code (`agent`, `defineMemory`, `DawnToolContext`, `RuntimeContext`),
+and use core when building CLIs, adapters, tests, or runtime integrations.
 
 ## License
 

package/dist/capabilities/built-in/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/capabilities/built-in/memory.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,aAAa,CAAA;AAanE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,gBAAgB,CAgLrD"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/capabilities/built-in/memory.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,aAAa,CAAA;AAanE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,gBAAgB,CAsPrD"}

package/dist/capabilities/built-in/memory.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
+import { gateMemorySupersede } from "../permission-gate.js";
 const DEFAULT_SEMANTIC_IDENTITY = ["subject", "predicate"];
 // A route's defineMemory() schema arrives as `unknown` (loaded via dynamic
 // import, validated structurally). Module-scoped (no closure deps) so it isn't
@@ -23,6 +24,7 @@ export function createMemoryMarker() {
             const mem = context.memory;
             if (!mem)
                 return {};
+            const permissions = context.permissions;
             const indexEntries = await mem.store.search({
                 namespace: mem.namespace,
                 status: "active",
@@ -56,6 +58,25 @@ export function createMemoryMarker() {
                 schema: recallSchema,
                 run: async (input) => {
                     const q = (input ?? {});
+                    // Embed the query for the hybrid keyword+vector path when an embedder
+                    // is configured. Embed FAILURE degrades to keyword-only — never throw,
+                    // so a flaky/offline embedder can't break recall.
+                    let queryVec;
+                    if (mem.embedder && q.query) {
+                        try {
+                            ;
+                            [queryVec] = await mem.embedder.embed([q.query]);
+                        }
+                        catch (err) {
+                            // Gated: silent embed failures are an ops footgun (user thinks
+                            // vector recall works while every embed errors). Mirrors the
+                            // summarization hook's DAWN_DEBUG_SUMMARIZATION convention.
+                            if (process.env.DAWN_DEBUG_MEMORY === "1") {
+                                console.warn(`[dawn:memory] recall embed failed, falling back to keyword-only: ${String(err)}`);
+                            }
+                            queryVec = undefined;
+                        }
+                    }
                     const rows = await mem.store.search({
                         namespace: mem.namespace,
                         ...(q.query ? { query: q.query } : {}),
@@ -65,10 +86,16 @@ export function createMemoryMarker() {
                         // Recency reference for ranked recall — the per-request timestamp,
                         // NOT Date.now() (determinism rule; see module docblock).
                         now: mem.now,
+                        ...(queryVec && mem.embedder
+                            ? { queryEmbedding: queryVec, embedderId: mem.embedder.id, vector: mem.vector }
+                            : {}),
                     });
+                    // Wrap in {result} so the langchain bridge uses the string verbatim as
+                    // the ToolMessage content; a bare string hits unwrapToolResult's
+                    // JSON.stringify path, quoting it and escaping the newlines below.
                     if (rows.length === 0)
-                        return "(no memories found)";
-                    return rows.map((r) => `${r.id}: ${r.content}`).join("\n");
+                        return { result: "(no memories found)" };
+                    return { result: rows.map((r) => `${r.id}: ${r.content}`).join("\n") };
                 },
             };
             const remember = {
@@ -78,8 +105,9 @@ export function createMemoryMarker() {
                 run: async (input) => {
                     const inp = (input ?? {});
                     const validated = mem.validate(inp.data);
+                    // All returns below wrap in {result} — see the recall tool's note.
                     if (!validated.ok)
-                        return `Rejected: ${validated.errors}`;
+                        return { result: `Rejected: ${validated.errors}` };
                     const data = validated.value;
                     const identityKeys = mem.defined.identity ?? DEFAULT_SEMANTIC_IDENTITY;
                     // id is DATA-derived so contradicting values (same identity, different
@@ -88,7 +116,9 @@ export function createMemoryMarker() {
                         .update(`${mem.namespace}|${JSON.stringify(data)}`)
                         .digest("hex")
                         .slice(0, 16)}`;
-                    const status = mem.writes === "auto" ? "active" : "candidate";
+                    // "ask" shares auto's write semantics; only its SUPERSEDE branch gates.
+                    const autoLike = mem.writes === "auto" || mem.writes === "ask";
+                    const status = autoLike ? "active" : "candidate";
                     const content = typeof inp.content === "string" && inp.content.length > 0
                         ? inp.content
                         : JSON.stringify(data);
@@ -107,7 +137,26 @@ export function createMemoryMarker() {
                         createdAt: mem.now,
                         updatedAt: mem.now,
                     };
-                    if (mem.writes === "auto") {
+                    // Embed the content for vector recall when an embedder is configured.
+                    // Embed FAILURE degrades to keyword-only (putOpts stays undefined) —
+                    // NEVER lose the write. Forwarded to EVERY put site below.
+                    let putOpts;
+                    if (mem.embedder) {
+                        try {
+                            const [ev] = await mem.embedder.embed([content]);
+                            if (ev)
+                                putOpts = { embedding: ev, embeddingModel: mem.embedder.id };
+                        }
+                        catch (err) {
+                            // Gated warn — see the recall catch above. The write still lands
+                            // keyword-only (putOpts undefined); we never lose the memory.
+                            if (process.env.DAWN_DEBUG_MEMORY === "1") {
+                                console.warn(`[dawn:memory] remember embed failed, storing keyword-only: ${String(err)}`);
+                            }
+                            putOpts = undefined;
+                        }
+                    }
+                    if (autoLike) {
                         // Inline identity key helper — avoids importing from @dawn-ai/memory
                         const identityKey = (d) => identityKeys.map((k) => JSON.stringify(d[k] ?? null)).join(" ");
                         const existing = await mem.store.search({
@@ -125,21 +174,41 @@ export function createMemoryMarker() {
                                     confidence,
                                     tags,
                                 });
-                                return `Updated memory ${target.id}.`;
+                                return { result: `Updated memory ${target.id}.` };
+                            }
+                            // Same identity but different value — supersede. In "ask" mode this
+                            // is the one write that gates: the agent is contradicting a prior
+                            // belief. ADDs/idempotent UPDATEs above never reach the gate.
+                            if (mem.writes === "ask") {
+                                const gate = await gateMemorySupersede(permissions, {
+                                    namespace: mem.namespace,
+                                    // Human-readable display form for the prompt — deliberately NOT
+                                    // the `identityKey` match key above (which JSON.stringifies to
+                                    // stay unambiguous); do not merge the two.
+                                    identity: identityKeys.map((k) => String(data[k] ?? "")).join(" / "),
+                                    oldId: target.id,
+                                    oldContent: target.content,
+                                    newContent: content,
+                                });
+                                if (!gate.allowed) {
+                                    return {
+                                        result: `Kept existing memory ${target.id} ("${target.content}"); ` +
+                                            `your contradicting value was not stored (${gate.reason}).`,
+                                    };
+                                }
                             }
-                            // Same identity but different value — write new active row then supersede old
-                            await mem.store.put(record);
+                            await mem.store.put(record, putOpts);
                             await mem.store.supersede(target.id, id);
-                            return `Superseded ${target.id} with ${id}.`;
+                            return { result: `Superseded ${target.id} with ${id}.` };
                         }
                         // No existing record with same identity — add new active row
-                        await mem.store.put(record);
-                        return `Stored memory ${id}.`;
+                        await mem.store.put(record, putOpts);
+                        return { result: `Stored memory ${id}.` };
                     }
                     // Candidate mode (and "off" never reaches here — remember tool absent):
                     // write a candidate; reconciliation happens later at CLI approval.
-                    await mem.store.put(record);
-                    return `Stored memory candidate ${id} (pending approval).`;
+                    await mem.store.put(record, putOpts);
+                    return { result: `Stored memory candidate ${id} (pending approval).` };
                 },
             };
             // Fingerprint the snapshot the render closure froze at load time. `id`

package/dist/capabilities/permission-gate.d.ts

@@ -1,4 +1,5 @@
 import type { PermissionsStore } from "@dawn-ai/permissions";
+import type { ConstraintPredicate } from "@dawn-ai/sdk";
 export type PathOperation = "readFile" | "writeFile" | "listDir";
 export type GateResult = {
     allowed: true;
@@ -19,6 +20,28 @@ export declare function gateBashOp(permissions: PermissionsStore | undefined, co
 export declare function gateToolOp(permissions: PermissionsStore | undefined, toolName: string, argsPreview: string, opts?: {
     readonly interruptCapable?: boolean;
 }): Promise<GateResult>;
+export interface MemorySupersedeDetail {
+    readonly namespace: string;
+    readonly identity: string;
+    readonly oldId: string;
+    readonly oldContent: string;
+    readonly newContent: string;
+}
+/**
+ * Memory supersede gate (memory.writes: "ask"). Prompts ONLY when the agent
+ * contradicts an existing active memory — ADDs and idempotent UPDATEs never
+ * reach this gate. Persisted decisions live under the reserved "memory" key
+ * as workspace+route namespace prefixes; candidates are matched with a "|"
+ * terminator so sibling routes cannot prefix-collide.
+ *
+ * DELIBERATE DIVERGENCE from gateToolOp: on "unknown" with no interactive
+ * human (non-interactive mode), this gate ALLOWS the supersede — ask is a
+ * supervision affordance, not a security boundary; headless it behaves
+ * exactly as writes:"auto". Explicit deny rules are still honored headless.
+ * Only called from inside the memory capability's remember tool, which only
+ * exists on agent routes (in-graph), so interrupt() is safe here.
+ */
+export declare function gateMemorySupersede(permissions: PermissionsStore | undefined, detail: MemorySupersedeDetail): Promise<GateResult>;
 /**
  * Wrap a tool so each call passes gateToolOp first (tools.approve). A blocked
  * call returns the denial reason AS THE TOOL RESULT — deliberately a different
@@ -43,4 +66,24 @@ export declare function wrapToolWithApproval<C, T extends {
 }>(tool: T, permissions: PermissionsStore, opts?: {
     readonly interruptCapable?: boolean;
 }): T;
+/**
+ * Wrap a tool so each call is first evaluated by an argument-constraint predicate
+ * (tools.constrain). The predicate returns `true` (allow), a string (deny — the
+ * string is returned as the tool result, matching wrapToolWithApproval's
+ * return-not-throw contract), or `{ approve: true }` (escalate to the HITL gate
+ * via gateToolOp). A predicate that throws OR returns any off-contract value
+ * (false, undefined, `{ approve: false }`, …) fails closed (deny) — a broken
+ * policy never silently allows. Per-call identity (signal/threadId/params) is read from
+ * the LIVE run context, never closed over, so the wrapper is safe inside the
+ * per-descriptor-cached agent. `routeId` and `predicate` are stable per descriptor
+ * and closed over.
+ */
+export declare function wrapToolWithConstraint<C extends {
+    readonly signal: AbortSignal;
+    readonly threadId?: string;
+    readonly params?: Readonly<Record<string, string>>;
+}, T extends {
+    readonly name: string;
+    readonly run: (input: unknown, context: C) => Promise<unknown> | unknown;
+}>(tool: T, predicate: ConstraintPredicate, permissions: PermissionsStore | undefined, routeId: string): T;
 //# sourceMappingURL=permission-gate.d.ts.map

package/dist/capabilities/permission-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-gate.d.ts","sourceRoot":"","sources":["../../src/capabilities/permission-gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAI5D,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAA;AAEhE,MAAM,MAAM,UAAU,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/E,wBAAsB,UAAU,CAC9B,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,UAAU,CAAC,CAwCrB;AAED,wBAAsB,UAAU,CAC9B,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,UAAU,CAAC,CA+BrB;AAYD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,CAAC,EACD,CAAC,SAAS;IACR,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CACzE,EACD,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,CAAC,CAS3F"}
+{"version":3,"file":"permission-gate.d.ts","sourceRoot":"","sources":["../../src/capabilities/permission-gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAM5D,OAAO,KAAK,EAAqB,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAG1E,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAA;AAEhE,MAAM,MAAM,UAAU,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/E,wBAAsB,UAAU,CAC9B,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,UAAU,CAAC,CAwCrB;AAED,wBAAsB,UAAU,CAC9B,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,UAAU,CAAC,CA+BrB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAYD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,CAAC,EACD,CAAC,SAAS;IACR,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CACzE,EACD,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,CAAC,CAS3F;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,CAAC,SAAS;IACR,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACnD,EACD,CAAC,SAAS;IACR,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CACzE,EAED,IAAI,EAAE,CAAC,EACP,SAAS,EAAE,mBAAmB,EAC9B,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,OAAO,EAAE,MAAM,GACd,CAAC,CAkCH"}

package/dist/capabilities/permission-gate.js

@@ -1,5 +1,5 @@
 import { sep } from "node:path";
-import { suggestedCommandPattern, suggestedPathPattern } from "@dawn-ai/permissions";
+import { suggestedCommandPattern, suggestedMemoryPattern, suggestedPathPattern, } from "@dawn-ai/permissions";
 import { interrupt } from "@langchain/langgraph";
 export async function gatePathOp(permissions, operation, absPath, workspaceRoot, opts) {
     // If permissions store is absent, allow (legacy behavior — capability used without permissions context).
@@ -105,6 +105,44 @@ export async function gateToolOp(permissions, toolName, argsPreview, opts) {
     }
     return { allowed: true };
 }
+/**
+ * Memory supersede gate (memory.writes: "ask"). Prompts ONLY when the agent
+ * contradicts an existing active memory — ADDs and idempotent UPDATEs never
+ * reach this gate. Persisted decisions live under the reserved "memory" key
+ * as workspace+route namespace prefixes; candidates are matched with a "|"
+ * terminator so sibling routes cannot prefix-collide.
+ *
+ * DELIBERATE DIVERGENCE from gateToolOp: on "unknown" with no interactive
+ * human (non-interactive mode), this gate ALLOWS the supersede — ask is a
+ * supervision affordance, not a security boundary; headless it behaves
+ * exactly as writes:"auto". Explicit deny rules are still honored headless.
+ * Only called from inside the memory capability's remember tool, which only
+ * exists on agent routes (in-graph), so interrupt() is safe here.
+ */
+export async function gateMemorySupersede(permissions, detail) {
+    if (!permissions)
+        return { allowed: true };
+    if (permissions.mode === "bypass")
+        return { allowed: true };
+    const decision = permissions.match("memory", `${detail.namespace}|`);
+    if (decision === "allow")
+        return { allowed: true };
+    if (decision === "deny") {
+        return { allowed: false, reason: `approval denied for this route's memory overwrites` };
+    }
+    // unknown + headless → allow through (ask ≡ auto without a human).
+    if (permissions.mode === "non-interactive")
+        return { allowed: true };
+    const result = await emitPermissionInterrupt({
+        kind: "memory",
+        ...detail,
+        permissions,
+    });
+    if (result === "deny") {
+        return { allowed: false, reason: `approval denied` };
+    }
+    return { allowed: true };
+}
 /** Best-effort display preview of a tool call's args. Never matched or persisted. */
 function buildArgsPreview(input) {
     try {
@@ -144,13 +182,65 @@ export function wrapToolWithApproval(tool, permissions, opts) {
         },
     };
 }
+const CONSTRAINT_FAILED_REASON = "Blocked: the tool's argument constraint check failed (the policy predicate threw or returned an invalid verdict). Not run.";
+/**
+ * Wrap a tool so each call is first evaluated by an argument-constraint predicate
+ * (tools.constrain). The predicate returns `true` (allow), a string (deny — the
+ * string is returned as the tool result, matching wrapToolWithApproval's
+ * return-not-throw contract), or `{ approve: true }` (escalate to the HITL gate
+ * via gateToolOp). A predicate that throws OR returns any off-contract value
+ * (false, undefined, `{ approve: false }`, …) fails closed (deny) — a broken
+ * policy never silently allows. Per-call identity (signal/threadId/params) is read from
+ * the LIVE run context, never closed over, so the wrapper is safe inside the
+ * per-descriptor-cached agent. `routeId` and `predicate` are stable per descriptor
+ * and closed over.
+ */
+export function wrapToolWithConstraint(tool, predicate, permissions, routeId) {
+    return {
+        ...tool,
+        run: async (input, context) => {
+            const ctx = {
+                toolName: tool.name,
+                routeId,
+                signal: context.signal,
+                ...(context.threadId ? { threadId: context.threadId } : {}),
+                ...(context.params ? { params: context.params } : {}),
+            };
+            let verdict;
+            try {
+                verdict = await predicate(input, ctx);
+            }
+            catch {
+                return CONSTRAINT_FAILED_REASON;
+            }
+            if (verdict === true)
+                return tool.run(input, context);
+            if (typeof verdict === "string")
+                return verdict;
+            // Escalate to HITL ONLY on a genuine { approve: true } verdict.
+            if (typeof verdict === "object" &&
+                verdict !== null &&
+                verdict.approve === true) {
+                const gate = await gateToolOp(permissions, tool.name, buildArgsPreview(input));
+                if (!gate.allowed)
+                    return gate.reason;
+                return tool.run(input, context);
+            }
+            // Any other value (false, undefined, { approve: false }, a number, …) is
+            // off-contract — fail closed rather than silently escalate or allow.
+            return CONSTRAINT_FAILED_REASON;
+        },
+    };
+}
 async function emitPermissionInterrupt(args) {
     const interruptId = `perm-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const suggestedPattern = args.kind === "command"
         ? suggestedCommandPattern(args.command)
         : args.kind === "tool"
             ? args.toolName
-            : suggestedPathPattern(args.path);
+            : args.kind === "memory"
+                ? suggestedMemoryPattern(args.namespace)
+                : suggestedPathPattern(args.path);
     const payload = {
         interruptId,
         type: "permission-request",
@@ -159,17 +249,28 @@ async function emitPermissionInterrupt(args) {
             ? { command: args.command, suggestedPattern }
             : args.kind === "tool"
                 ? { toolName: args.toolName, argsPreview: args.argsPreview, suggestedPattern }
-                : {
-                    operation: args.operation,
-                    path: args.path,
-                    suggestedPattern,
-                },
+                : args.kind === "memory"
+                    ? {
+                        namespace: args.namespace,
+                        identity: args.identity,
+                        oldId: args.oldId,
+                        oldContent: args.oldContent,
+                        newContent: args.newContent,
+                        suggestedPattern,
+                    }
+                    : { operation: args.operation, path: args.path, suggestedPattern },
     };
     const decision = interrupt(payload);
     if (decision === "deny")
         return "deny";
     if (decision === "always") {
-        const tool = args.kind === "command" ? "bash" : args.kind === "tool" ? "tool" : args.operation;
+        const tool = args.kind === "command"
+            ? "bash"
+            : args.kind === "tool"
+                ? "tool"
+                : args.kind === "memory"
+                    ? "memory"
+                    : args.operation;
         await args.permissions.addAllow(tool, suggestedPattern);
     }
     return "allow";

package/dist/capabilities/types.d.ts

@@ -19,8 +19,20 @@ export interface MemoryRecordLike {
     readonly updatedAt: string;
     readonly supersedes?: readonly string[];
 }
+/**
+ * Pluggable text embedder for opt-in vector/semantic recall. Structural — the
+ * concrete implementations (`openaiEmbedder`, `fakeEmbedder`) live outside core.
+ */
+export interface Embedder {
+    readonly id: string;
+    readonly dims: number;
+    embed(texts: readonly string[]): Promise<Float32Array[]>;
+}
 export interface MemoryStoreLike {
-    put(rec: MemoryRecordLike): Promise<void>;
+    put(rec: MemoryRecordLike, opts?: {
+        embedding?: Float32Array;
+        embeddingModel?: string;
+    }): Promise<void>;
     get(id: string): Promise<MemoryRecordLike | null>;
     search(q: {
         namespace: string;
@@ -31,14 +43,26 @@ export interface MemoryStoreLike {
         limit?: number;
         /** ISO recency reference for ranked searches; stores may ignore it. */
         now?: string;
+        /** When present, the store runs the hybrid keyword+vector path. */
+        queryEmbedding?: Float32Array;
+        /** Only rows whose stored embedding model equals this are vector-compared. */
+        embedderId?: string;
+        /** Hybrid ranking tuning; structural — the store validates. */
+        vector?: unknown;
     }): Promise<readonly MemoryRecordLike[]>;
     update(id: string, patch: Partial<MemoryRecordLike>): Promise<void>;
     supersede(id: string, bySupersedingId: string): Promise<void>;
 }
+/**
+ * Memory write-governance mode. "ask" = auto's exact write semantics, except
+ * SUPERSEDEs (same identity, different value) pass a HITL gate first — a
+ * supervision affordance, not a security boundary (headless ≡ auto).
+ */
+export type MemoryWritesMode = "off" | "candidate" | "auto" | "ask";
 export interface MemoryContext {
     readonly store: MemoryStoreLike;
     readonly namespace: string;
-    readonly writes: "off" | "candidate" | "auto";
+    readonly writes: MemoryWritesMode;
     readonly defined: {
         readonly kind: string;
         readonly scope: readonly string[];
@@ -55,6 +79,21 @@ export interface MemoryContext {
     };
     readonly now: string;
     readonly indexMaxEntries?: number;
+    /** The resolved embedder when vector recall is enabled; the capability embeds
+     *  writes + queries through it. Absent → keyword-only. */
+    readonly embedder?: Embedder;
+    /** Hybrid recall tuning threaded through to the store's search. All fields
+     *  optional/defaulted; absent → store defaults. */
+    readonly vector?: {
+        readonly weights?: {
+            readonly keyword?: number;
+            readonly vector?: number;
+        };
+        readonly rrfK?: number;
+        readonly vectorK?: number;
+        readonly recencyWeight?: number;
+        readonly confidenceWeight?: number;
+    };
 }
 export interface CapabilityMarkerContext {
     readonly routeManifest: RouteManifest;
@@ -82,6 +121,8 @@ export interface DawnToolDefinition {
         readonly middleware?: Readonly<Record<string, unknown>>;
         readonly signal: AbortSignal;
         readonly fs?: WorkspaceFs;
+        readonly threadId?: string;
+        readonly params?: Readonly<Record<string, string>>;
     }) => Promise<unknown> | unknown;
     readonly schema?: unknown;
 }

package/dist/capabilities/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/capabilities/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEpE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IACjD,MAAM,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;QACxB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,uEAAuE;QACvE,GAAG,CAAC,EAAE,MAAM,CAAA;KACb,GAAG,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAA;IACxC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,WAAW,GAAG,MAAM,CAAA;IAC7C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;QACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KACtC,CAAA;IACD,6HAA6H;IAC7H,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,CACjB,IAAI,EAAE,OAAO,KAEX;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAC9D;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,QAAQ,CAAC,UAAU,EAAE,SAAS,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAA;QACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAA;KAC5B,CAAA;IACD,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;IACvC,4IAA4I;IAC5I,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,CACZ,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QACP,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QACvD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;QAI5B,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAA;KAC1B,KACE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,MAAM,CAAA;IACrE;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,CAClB,KAAK,EAAE,sBAAsB,KAC1B,QAAQ,CAAC,uBAAuB,CAAC,GAAG,aAAa,CAAC,uBAAuB,CAAC,CAAA;CAChF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;IACxD,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;IACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAA;CAC/D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACzF,QAAQ,CAAC,IAAI,EAAE,CACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uBAAuB,KAC7B,OAAO,CAAC,sBAAsB,CAAC,CAAA;CACrC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/capabilities/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEpE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;CACzD;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CACD,GAAG,EAAE,gBAAgB,EACrB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,YAAY,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3D,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IACjD,MAAM,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;QACxB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,uEAAuE;QACvE,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,mEAAmE;QACnE,cAAc,CAAC,EAAE,YAAY,CAAA;QAC7B,8EAA8E;QAC9E,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,+DAA+D;QAC/D,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,GAAG,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAA;IACxC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,WAAW,GAAG,MAAM,GAAG,KAAK,CAAA;AAEnE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;QACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KACtC,CAAA;IACD,6HAA6H;IAC7H,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,CACjB,IAAI,EAAE,OAAO,KAEX;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAC9D;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;8DAC0D;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAC5B;uDACmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;QAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KACnC,CAAA;CACF;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,QAAQ,CAAC,UAAU,EAAE,SAAS,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAA;QACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAA;KAC5B,CAAA;IACD,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;IACvC,4IAA4I;IAC5I,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,CACZ,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QACP,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QACvD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;QAI5B,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAA;QAIzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KACnD,KACE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,MAAM,CAAA;IACrE;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,CAClB,KAAK,EAAE,sBAAsB,KAC1B,QAAQ,CAAC,uBAAuB,CAAC,GAAG,aAAa,CAAC,uBAAuB,CAAC,CAAA;CAChF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;IACxD,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;IACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAA;CAC/D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACzF,QAAQ,CAAC,IAAI,EAAE,CACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uBAAuB,KAC7B,OAAO,CAAC,sBAAsB,CAAC,CAAA;CACrC"}