@open-everywhere/core 0.1.0

package/dist/agent/channels/question-bridge.js

@@ -0,0 +1,412 @@
+// question-bridge — what makes `ask_question` a real affordance on the unified channel instead of a hole the turn falls into. It owns BOTH halves: the outbound post that shows the room a question, through the same route the `reply` tool uses, and the durable row, keyed by WINDOW TOKEN, that lets the room's next message come back as a real answer routed to the session that asked. ONE row per window token and CONSUME-ONCE, and the row is written ONLY when the question was actually POSTED — a dropped question must never eat the room's next message.
+// TWO OUTCOMES, BOTH AUDITED — bridged or dropped, never neither — because the defect's signature was an absence of rows. THE QUESTION TEXT IS NEVER AUDITED: it is model-authored on a turn whose whole purpose is often to relay attacker-derived content back to a human, so the rows carry ids, enums and counts only and the text goes to the ROOM and nowhere else. No `reply.post` row is written either: a question is not an answer, and the eval scorers join on that action name to decide whether a wake was answered.
+import { appendAudit } from "../audit/audit.js";
+import { isSessionLimitContinuationRequest } from "./session-park.js";
+import { WAKE_TARGET_TTL_MS, unifiedThreadRef } from "./unified-window.js";
+import { dmAnchorSurfaceForToken } from "./window-key.js";
+/** A non-park input request was shown to the room. */
+export const QUESTION_BRIDGED_AUDIT_ACTION = "turn.question_bridged";
+/** A non-park input request could NOT be shown to the room. */
+export const QUESTION_DROPPED_AUDIT_ACTION = "turn.question_dropped";
+/** Posted when a request carries no usable prompt text. HOST-authored: a question with nothing to
+ *  read is still a parked turn, and a human seeing this can unpark it with any message — which is
+ *  strictly better than the room hearing nothing at all. */
+export const EMPTY_QUESTION_FALLBACK = "I asked a question but supplied no text — reply with anything and I'll carry on.";
+/**
+ * eve's framework-owned kind for a TOOL APPROVAL (`shared/input.js` `inputRequestKindSchema`, whose
+ * three values are `question` / `session-limit` / `tool-approval`).
+ *
+ * 🔴 WHY THIS KIND NEEDS ITS OWN HANDLING, AND WHY IT IS A DEFECT THAT IT DID NOT HAVE ANY
+ * (OPE-1056). This bridge was built for `ask_question`, where eve's implicit rule is "the next
+ * message is the answer" and a bare string is a complete response. An APPROVAL is not answered that
+ * way. eve resolves one in `harness/input-request-resolution.js` `resolveApprovalOutcome`, which
+ * reads `response.optionId` and NOTHING else: `approve` approves, `cancel`/`deny` denies, and every
+ * other value — INCLUDING AN ABSENT ONE — answers `{approved: false, status: "invalid"}`. The
+ * answer leg sent `{requestId, text}` with no `optionId` (channels/unified.ts), so a human replying
+ * "Approve" to a bridged connector-write approval denied the write and could never approve it. That
+ * is the measured half of why `S-EVE-CARD` finds no settled approval on the live drive.
+ */
+export const APPROVAL_REQUEST_KIND = "tool-approval";
+/**
+ * The FIRST non-park request in an `input.requested` batch, or `undefined` when the batch is eve's session-limit park, which another module owns, or carries nothing recognisable.
+ * FIRST, not all: eve parks the whole batch on one prompt and resumes it with one answer, so posting every request would ask the room several questions it can only answer once. A request with an EMPTY prompt is still returned — it is still a parked turn, and the renderer substitutes a host-authored fallback; dropping it here would recreate the exact silence this module exists to remove.
+ */
+export function detectBridgeableInputRequest(requests) {
+    if (!Array.isArray(requests))
+        return undefined;
+    for (const r of requests) {
+        if (r === null || typeof r !== "object")
+            continue;
+        if (isSessionLimitContinuationRequest(r))
+            continue;
+        const req = r;
+        const options = [];
+        if (Array.isArray(req.options)) {
+            for (const o of req.options) {
+                const opt = o;
+                const label = opt?.label;
+                // The LABEL is what admits an option — a labelled option is showable, and that is what this
+                // loop has always decided. The id rides along because an APPROVAL cannot be answered without
+                // it (see {@link APPROVAL_REQUEST_KIND}); an option with no id degrades to `""`, which
+                // {@link approvalOptionIds} then drops rather than storing an unusable key.
+                if (typeof label === "string" && label.length > 0)
+                    options.push({ id: typeof opt?.id === "string" ? opt.id : "", label });
+            }
+        }
+        return {
+            requestId: typeof req.requestId === "string" ? req.requestId : "",
+            toolName: typeof req.action?.toolName === "string" ? req.action.toolName : "unknown",
+            kind: typeof req.kind === "string" ? req.kind : "unknown",
+            prompt: typeof req.prompt === "string" ? req.prompt : "",
+            options,
+        };
+    }
+    return undefined;
+}
+/**
+ * The message the room sees: the question, then its options as a plain list — a surface-agnostic rendering, because the post arms take one string and nothing here may assume a vendor's block format ({@link PostArm} carries no blocks member, so this bridge cannot post an interactive card on any surface).
+ * ON AN `ask_question` the human answers by replying normally and eve consumes that next message as the answer, so no option id travels back. 🔴 ON AN APPROVAL IT DOES, and the line above used to say it never did: eve settles an approval on `optionId` alone, so the reply has to be MATCHED to an option before it is delivered ({@link resolveApprovalOptionId}), and a reply that matches none leaves the turn parked.
+ */
+export function renderQuestionForSurface(question, opts) {
+    const head = question.prompt.trim().length > 0 ? question.prompt.trim() : EMPTY_QUESTION_FALLBACK;
+    if (question.options.length === 0)
+        return head;
+    const list = question.options.map((o) => `• ${o.label}`).join("\n");
+    // AN APPROVAL SAYS HOW TO ANSWER IT; A QUESTION DOES NOT NEED TO. For an `ask_question` every
+    // reply is an answer, so the options are a suggestion and a hint would be noise. For an approval
+    // only a reply that NAMES an option resolves it — anything else leaves the turn parked (see
+    // {@link resolveApprovalOptionId}) — so a room shown the bare list would not know that.
+    //
+    // 🔴 THE HINT IS TRUE ONLY WHERE THE CALLER'S RETURN LEG MATCHES OPTIONS, which is why it is
+    // opt-in and not derived from the kind alone (cold review, 2026-09-11). This renderer is shared:
+    // `packages/providers/notion/agent/channels/notion.ts` posts it too, and that surface's return leg
+    // stores no option ids and responds with `text` only — so printing the line there would promise a
+    // protection the code does not provide, and a Notion reader who followed it would DENY the write
+    // and consume the row. A surface earns the line by carrying {@link approvalOptionIds} into its
+    // durable row and {@link resolveApprovalOptionId} into its answer route.
+    //
+    // A SECOND DEPENDENCY, stated rather than assumed: the line tells the room to reply with one of
+    // the LABELS it just printed, while {@link resolveApprovalOptionId} compares against the option
+    // IDS. That is only true because eve's approval labels lowercase to its ids
+    // (`harness/input-extraction.js` mints `Approve`/`approve` and `Cancel`/`cancel`). An eve that
+    // labelled the same option `Approve this write` would make the printed word unmatchable while this
+    // line still promised it worked — so whoever sees that drift fixes the matcher, not this comment.
+    const hint = opts?.answerByOption === true && question.kind === APPROVAL_REQUEST_KIND ? `\n\n${APPROVAL_ANSWER_HINT}` : "";
+    return `${head}\n\n${list}${hint}`;
+}
+/** HOST-authored coaching line under a bridged APPROVAL's option list. See
+ *  {@link renderQuestionForSurface} for the two conditions that make it true. */
+export const APPROVAL_ANSWER_HINT = "Reply with one of those words to answer — anything else leaves this waiting.";
+/**
+ * The option ids an APPROVAL can be answered with, or an empty list for every other kind.
+ *
+ * EMPTY FOR AN `ask_question`, DELIBERATELY: its option ids are model-authored, nothing downstream
+ * needs them (a question takes free text), and returning them would put model prose into the durable
+ * row that {@link OutstandingQuestion} promises holds ids only. An id-less option is dropped for the
+ * same reason the loop above keeps it as `""` — it cannot resolve anything.
+ */
+export function approvalOptionIds(question) {
+    if (question.kind !== APPROVAL_REQUEST_KIND)
+        return [];
+    return question.options.map((o) => o.id).filter((id) => id.length > 0);
+}
+/** Words a room may answer an approval with, beside the option ids themselves. HOST-authored and
+ *  deliberately SMALL: the fail direction of an unmatched reply is a question that waits (safe),
+ *  while a loose match on the approve side runs a governed op nobody meant to allow.
+ *  🔴 EVERY WORD HERE NAMES APPROVAL, and a bare conversational acknowledgement does NOT (cold
+ *  review, 2026-09-11). `ok` and `okay` were in this set and are the reason it is stated as a rule:
+ *  a seat parked in a group DM or a channel hears "ok" addressed to somebody else all day, and any
+ *  one of them would have executed the governed write. `yes` stays — it is an answer to a question,
+ *  not an ack — and it is the weakest member; do not add to this set without the same test. */
+const APPROVE_WORDS = new Set(["approve", "approved", "allow", "yes"]);
+/** The deny half of the vocabulary above. It may be broader than the approve half, because a wrong
+ *  deny costs a re-ask and a wrong approve costs an unintended write. */
+const DENY_WORDS = new Set(["cancel", "deny", "denied", "reject", "rejected", "no", "stop", "decline"]);
+/**
+ * The option id a room's reply names, or `undefined` when it names none.
+ *
+ * 🔴 THE WHOLE MESSAGE MUST BE THE ANSWER, never a word found inside one. "no, that is the wrong
+ * page — use the other one" is a correction, not a deny, and matching a substring there would settle
+ * a governed approval off prose that was steering it. So the reply is trimmed, lowercased and
+ * stripped of surrounding punctuation, and then compared WHOLE.
+ * The comparison is against `optionIds` FIRST — eve labels its approval options `Approve`/`Cancel`,
+ * which lowercase to the ids exactly, so the labels need no separate table and no model-authored text
+ * has to be stored to match them. The small synonym vocabulary above is the second arm, and it can
+ * only ever select an id the request ACTUALLY OFFERED: a request with no `cancel`/`deny` option
+ * cannot be denied by the word "no".
+ */
+export function resolveApprovalOptionId(text, optionIds) {
+    const word = text.trim().toLowerCase().replace(/^[^\p{L}\p{N}]+/u, "").replace(/[^\p{L}\p{N}]+$/u, "");
+    if (word.length === 0)
+        return undefined;
+    const offered = optionIds.filter((id) => id.length > 0);
+    const exact = offered.find((id) => id.toLowerCase() === word);
+    if (exact !== undefined)
+        return exact;
+    const family = APPROVE_WORDS.has(word) ? APPROVE_WORDS : DENY_WORDS.has(word) ? DENY_WORDS : undefined;
+    if (family === undefined)
+        return undefined;
+    return offered.find((id) => family.has(id.toLowerCase()));
+}
+/** Ceiling on a post-arm error string reaching the audit detail: enough of the arm's message to name
+ *  the failing surface and reason, never a response body. */
+const ERROR_MAX = 300;
+/**
+ * The platform-prefixed CONTAINER the question was posted into, or `undefined` when the origin has
+ * no derivable one.
+ *
+ * TOTAL BY CONSTRUCTION, because this feeds an AUDIT ROW and the row must be written whatever
+ * happens: `unifiedThreadRef` throws on a variant it cannot key, and a throw here would lose the
+ * whole row rather than one field. The caller in channels/unified.ts guards the identical call the
+ * same way for the routing key — same derivation, same posture, so the room recorded and the room
+ * allowed to answer cannot come from two different rules.
+ */
+function containerKeyOf(origin) {
+    try {
+        const key = unifiedThreadRef(origin).channelKey;
+        return key.length > 0 ? key : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Show ONE detected question to the room and record which way it went. BEST-EFFORT, in the house posture: this runs inside a channel event handler on a turn eve has ALREADY parked, so nothing here throws and a failure becomes a dropped row while the turn stays parked. What it must never do is return without a row.
+ * The wake is deliberately NOT marked answered: a question is not an answer, and the wake still owes the room a reply once the human unparks the turn.
+ */
+export async function bridgeQuestionToSurface(scope, question, deps) {
+    const audit = deps.audit ?? appendAudit;
+    // `answerByOption` is earned HERE, in this module, not asserted by a caller: the same file holds
+    // the durable row that carries {@link approvalOptionIds} and the {@link resolveInboundAnswerRouting}
+    // that matches a reply against them, and this bridge is the unified window's alone (the Notion
+    // surface calls {@link renderQuestionForSurface} directly and has no such return leg). Keeping the
+    // flag beside the two halves it depends on is what stops the hint outliving them.
+    const text = renderQuestionForSurface(question, { answerByOption: true });
+    // Ids/enums/counts only — never `prompt`, never an option LABEL (see the header's redaction rule).
+    const base = {
+        requestId: question.requestId,
+        toolName: question.toolName,
+        kind: question.kind,
+        chars: text.length,
+        options: question.options.length,
+        ...(scope.wakeId ? { wakeId: scope.wakeId } : {}),
+        ...(scope.sessionId ? { sessionId: scope.sessionId } : {}),
+    };
+    const row = (action, detail) => audit({ org: scope.org, platform: scope.platform, workspace: scope.workspace, surface: scope.surface, action, detail }).catch(() => undefined);
+    let origin = null;
+    try {
+        origin = await deps.resolveOrigin();
+    }
+    catch {
+        origin = null; // an origin lookup that threw is an origin we do not have — same outcome, one row.
+    }
+    if (!origin) {
+        await row(QUESTION_DROPPED_AUDIT_ACTION, { ...base, reason: "unresolved-origin" });
+        return { status: "dropped", reason: "unresolved-origin" };
+    }
+    try {
+        const id = await deps.post(origin, text);
+        // WHICH ROOM SAW IT (OPE-1231). The row named the platform and the message id but never the
+        // ROOM, so the audit trail could not answer "where was this shown?" — and for a request raised
+        // inside a DELEGATED WORKER that is the whole security question: `connectors.dmOnly` admits a
+        // worker spawned from a DM, and the containment argument for a connector card rests on the card
+        // being in one person's own room. The platform-prefixed CONTAINER key is the same grain
+        // {@link OutstandingQuestion.containerKey} routes an answer on, so the room that was SHOWN the
+        // question and the room allowed to ANSWER it are recorded at one grain and can be compared.
+        // Still ids only: a container id, never a member list and never the prompt.
+        const containerKey = containerKeyOf(origin);
+        await row(QUESTION_BRIDGED_AUDIT_ACTION, { ...base, platform: origin.platform, id, ...(containerKey ? { containerKey } : {}) });
+        return { status: "bridged", platform: origin.platform, id, origin };
+    }
+    catch (err) {
+        await row(QUESTION_DROPPED_AUDIT_ACTION, {
+            ...base,
+            reason: "post-failed",
+            platform: origin.platform,
+            error: (err instanceof Error ? err.message : String(err)).slice(0, ERROR_MAX),
+        });
+        return { status: "dropped", reason: "post-failed" };
+    }
+}
+/** A room message was delivered to the window as an ANSWER, not as an ordinary wake. */
+export const QUESTION_ANSWERED_AUDIT_ACTION = "input_response.routed";
+/** An answer that could not be delivered — eve refused the `respond`, so the message was delivered
+ *  as an ordinary wake instead and the question stays open. NEVER a silent fall-through. */
+export const QUESTION_ANSWER_DROPPED_AUDIT_ACTION = "input_response.dropped";
+/** Key prefix for the outstanding-question row. Its own namespace, so it can never collide with the
+ *  task-wake plane's `oe-task-wake:` rows or the taint plane's rows in the same slice. */
+const BRIDGED_QUESTION_PREFIX = "oe-question-bridge:";
+/** Same 6h bound as the wake-target map: the row and the wakeId→origin row are written by the same
+ *  handler and are meaningless apart, so one outliving the other buys nothing. */
+const BRIDGED_QUESTION_TTL_MS = WAKE_TARGET_TTL_MS;
+/** The store key for one window token's outstanding question. The token is unique within the org. */
+export function bridgedQuestionKey(bareToken) {
+    return `${BRIDGED_QUESTION_PREFIX}${bareToken}`;
+}
+/**
+ * The task that owns a parent-visible request id, or `undefined` when the id is not task-namespaced — a window's OWN question carries a bare tool-call id and yields `undefined`.
+ * DERIVED, NOT AUTHORITATIVE: nothing routes on this, and it exists so an operator reading the audit trail can join an answer to the worker it unblocked. If eve changes the namespacing it degrades to `undefined` and the leg still works.
+ */
+export function taskIdOfBridgedRequestId(requestId) {
+    const cut = requestId.indexOf(":");
+    if (cut <= 0)
+        return undefined;
+    const head = requestId.slice(0, cut);
+    return head.startsWith("task_") ? head : undefined;
+}
+/**
+ * Record that this window is now parked on a question the room can see.
+ * It never throws — the caller runs inside a channel event handler on an ALREADY-PARKED turn, and a store blip must not break the event dispatch on top of it. The return says whether the row was written, so the caller can log the difference between "the room can answer this" and "it cannot".
+ */
+export async function rememberBridgedQuestion(store, org, bareToken, input) {
+    try {
+        if (bareToken.length === 0 || input.requestId.length === 0)
+            return false;
+        const at = input.at ?? new Date().toISOString();
+        const taskId = taskIdOfBridgedRequestId(input.requestId);
+        const optionIds = (input.optionIds ?? []).filter((id) => id.length > 0);
+        const row = {
+            requestId: input.requestId,
+            ...(input.containerKey !== undefined && input.containerKey.length > 0 ? { containerKey: input.containerKey } : {}),
+            ...(input.wakeId !== undefined && input.wakeId.length > 0 ? { wakeId: input.wakeId } : {}),
+            ...(taskId !== undefined ? { taskId } : {}),
+            ...(optionIds.length > 0 ? { optionIds } : {}),
+            at,
+        };
+        await store.putTaskResult(org, bridgedQuestionKey(bareToken), JSON.stringify(row), at, BRIDGED_QUESTION_TTL_MS);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Read one window's outstanding question back, or `undefined` for an absent, malformed or
+ *  unreadable row. FAIL-SOFT TO "NO QUESTION": the fallback is an ordinary wake, which is what every
+ *  message did before this leg existed. */
+export async function readBridgedQuestion(store, org, bareToken) {
+    try {
+        if (bareToken.length === 0)
+            return undefined;
+        const raw = await store.getTaskResult(org, bridgedQuestionKey(bareToken));
+        if (raw === null)
+            return undefined;
+        const parsed = JSON.parse(raw);
+        const requestId = parsed?.requestId;
+        if (typeof requestId !== "string" || requestId.length === 0)
+            return undefined;
+        // A row written before this field existed, or by a build that stored a malformed one, reads back
+        // with NO option ids — which routes exactly as it did then (free text, no optionId). The read is
+        // element-wise for the same reason every other field here is typed on the way out: the row is
+        // JSON off a store, not a value this process just built.
+        const optionIds = Array.isArray(parsed?.optionIds)
+            ? parsed.optionIds.filter((id) => typeof id === "string" && id.length > 0)
+            : [];
+        return {
+            requestId,
+            ...(typeof parsed?.containerKey === "string" && parsed.containerKey.length > 0 ? { containerKey: parsed.containerKey } : {}),
+            ...(typeof parsed?.wakeId === "string" && parsed.wakeId.length > 0 ? { wakeId: parsed.wakeId } : {}),
+            ...(typeof parsed?.taskId === "string" && parsed.taskId.length > 0 ? { taskId: parsed.taskId } : {}),
+            ...(optionIds.length > 0 ? { optionIds } : {}),
+            at: typeof parsed?.at === "string" ? parsed.at : "",
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Drop one window's outstanding question. It is called on an ANSWER — consume-once, so the message AFTER the answer is an ordinary wake — and on a CANCELLED parent turn, where eve wipes the whole proxy map, so the request id can no longer route and a later `respond` would swallow the room's message instead of waking the seat.
+ * An expired or unreadable row is handled by TTL, not here. It never throws, and returns whether a row was actually removed.
+ */
+export async function forgetBridgedQuestion(store, org, bareToken) {
+    try {
+        if (bareToken.length === 0)
+            return false;
+        return await store.deleteTaskResult(org, bridgedQuestionKey(bareToken));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * THE ANSWER LEG SETTLES ITS OWN WAKE (OPE-2116). `receive` registers every inbound wake as PENDING before it
+ * decides where the wake goes. When the wake is delivered to a worker as an answer, the seat never gets it,
+ * so the row must not stay pending: the reply freshness gate (reply-freshness.ts) counts a pending inbound
+ * row as "already queued for you" and refuses the seat's reply with that false promise.
+ * This reuses the ordinary answered mark. No turn id rides it, because no seat turn answered the wake, so
+ * the answerable-reply fence also refuses a seat reply addressed to it. Never throws: the answer is
+ * already delivered, and a store failure here must not make the caller re-send it as a wake.
+ */
+export async function settleAnsweredWake(store, org, wakeId, at = new Date().toISOString()) {
+    try {
+        if (wakeId.length === 0)
+            return false;
+        await store.markUnifiedWakeAnswered(org, wakeId, at);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Does this inbound wake ADDRESS THE SEAT by an @-mention (OPE-2116, Tommy's ruling 2026-09-24)? True when the surface stamped the wake `direct-mention`, the wake is not a follow-up, and the window is NOT a DM.
+ * 🔴 TWO WAKES CARRY THE STAMP WITHOUT AN @-MENTION, and both are addressed by construction, so the stamp says nothing there about whether the person is answering. A DM: every DM surface stamps `direct-mention` on every DM wake. The DM test is the window token's DM pseudo-domain ({@link dmAnchorSurfaceForToken}), the same seam the dispatch gates use; a group DM rides the same seat. A FOLLOW-UP (`UnifiedWindowWake.followUp`): a Linear `prompted` reply in the app's agent session that names no app mention. Without these exclusions neither could answer its own worker's question.
+ */
+export function isAddressedMentionWake(window, bareToken) {
+    return window.addressing === "direct-mention" && window.followUp !== true && dmAnchorSurfaceForToken(bareToken) === undefined;
+}
+/**
+ * Decide whether one inbound room message answers the window's outstanding question. THE FLOOR IS THE SAME ONE THE WIDGET PATH RUNS: a room message resolving a worker's question is the same act as a click on that question's widget over a different transport, and anything else would make the transport the control. A REFUSAL IS NOT A DROP — the message still reaches the seat as an ordinary wake and the row is LEFT IN PLACE, so the question stays open for someone who may answer. An INTERNAL DISPATCH is never an answer: it is host-authored with no human behind it.
+ * AN @-MENTION NEVER ANSWERS: it is the seat's wake, and only an unaddressed reply answers (see {@link isAddressedMentionWake}).
+ * ONLY THE ROOM THE QUESTION IS SHOWING IN MAY ANSWER IT. The row is keyed by window token, which cannot say WHERE, so this compares the inbound wake's CONTAINER against the container the question was posted into. FAIL-SOFT in the one safe direction: a mismatch, an absent stored container and an unreadable inbound container all answer `foreign-room`, an ordinary wake with the row left in place — the cost is a question that waits longer, never a silently swallowed message.
+ */
+export async function resolveInboundAnswerRouting(input, deps) {
+    if (input.internalDispatch)
+        return { kind: "wake", reason: "internal-dispatch" };
+    const outstanding = await deps.read();
+    if (outstanding === undefined)
+        return { kind: "wake", reason: "no-question" };
+    // 🔴 AN @-MENTION IS THE SEAT'S WAKE, NEVER A WORKER'S ANSWER (OPE-2116). A person who names the
+    // agent is addressing the seat, and a new ask in the question's room was swallowed as the worker's
+    // answer while the seat never heard it. It runs BEFORE the room comparison and the admission: it
+    // spends no admission call and writes no refusal row. The row is LEFT IN PLACE, so a plain reply
+    // can still answer — for an ask_question and an approval alike.
+    if (input.addressedMention === true)
+        return { kind: "wake", reason: "addressed-mention" };
+    // The room comparison runs BEFORE the admission: a message from another room is not this
+    // question's business at all, so it must not spend an admission call or write a refusal row
+    // against a person who was never answering anything.
+    const asked = outstanding.containerKey;
+    const here = input.containerKey;
+    if (asked === undefined || asked.length === 0 || here === undefined || here.length === 0 || asked !== here) {
+        return { kind: "wake", reason: "foreign-room" };
+    }
+    // 🔴 AN APPROVAL IS ONLY ANSWERED BY A REPLY THAT NAMES AN OPTION, and this runs BEFORE the
+    // admission for the same reason the room comparison does: a message that settles nothing is not
+    // this question's business, so it must not spend an admission call or write a refusal row against
+    // a person who was not answering. An unmatched reply LEAVES THE ROW IN PLACE and falls through to
+    // an ordinary wake, so the room can try again — the module's standing "a refusal is not a drop"
+    // posture. The alternative is what shipped before: the reply went to eve as bare text, eve read no
+    // `optionId`, and `resolveApprovalOutcome` answered `invalid`, which DENIES the tool call and
+    // consumes the row. An off-topic message could therefore deny a governed connector write, and no
+    // reply at all could approve one.
+    const optionIds = outstanding.optionIds;
+    let optionId;
+    if (optionIds !== undefined && optionIds.length > 0) {
+        optionId = resolveApprovalOptionId(input.text ?? "", optionIds);
+        if (optionId === undefined)
+            return { kind: "wake", reason: "unmatched-option" };
+    }
+    const verdict = await deps.admit();
+    if (!verdict.ok)
+        return { kind: "wake", reason: "refused" };
+    return {
+        kind: "answer",
+        requestId: outstanding.requestId,
+        floor: verdict.floor,
+        ...(outstanding.wakeId !== undefined ? { wakeId: outstanding.wakeId } : {}),
+        ...(outstanding.taskId !== undefined ? { taskId: outstanding.taskId } : {}),
+        ...(optionId !== undefined ? { optionId } : {}),
+    };
+}
+//# sourceMappingURL=question-bridge.js.map

package/dist/agent/channels/question-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"question-bridge.js","sourceRoot":"","sources":["../../../agent/channels/question-bridge.ts"],"names":[],"mappings":"AAAA,wiBAAwiB;AACxiB,mgBAAmgB;AAEngB,OAAO,EAAE,WAAW,EAAmB,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAA0B,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,sDAAsD;AACtD,MAAM,CAAC,MAAM,6BAA6B,GAAG,uBAAuB,CAAC;AACrE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GAAG,uBAAuB,CAAC;AAErE;;4DAE4D;AAC5D,MAAM,CAAC,MAAM,uBAAuB,GAAG,kFAAkF,CAAC;AAE1H;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAwCrD;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAiB;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,QAA8B,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAClD,IAAI,iCAAiC,CAAC,CAAC,CAAC;YAAE,SAAS;QACnD,MAAM,GAAG,GAAG,CAAkH,CAAC;QAC/H,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAA6B,EAAE,CAAC;gBAClD,MAAM,GAAG,GAAG,CAA6C,CAAC;gBAC1D,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC;gBACzB,4FAA4F;gBAC5F,6FAA6F;gBAC7F,uFAAuF;gBACvF,4EAA4E;gBAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5H,CAAC;QACH,CAAC;QACD,OAAO;YACL,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;YACjE,QAAQ,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACpF,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACzD,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACxD,OAAO;SACR,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAA4B,EAAE,IAA4B;IACjG,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAClG,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,8FAA8F;IAC9F,iGAAiG;IACjG,4FAA4F;IAC5F,wFAAwF;IACxF,EAAE;IACF,6FAA6F;IAC7F,iGAAiG;IACjG,mGAAmG;IACnG,kGAAkG;IAClG,iGAAiG;IACjG,+FAA+F;IAC/F,yEAAyE;IACzE,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,4EAA4E;IAC5E,+FAA+F;IAC/F,mGAAmG;IACnG,kGAAkG;IAClG,MAAM,IAAI,GAAG,IAAI,EAAE,cAAc,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,OAAO,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3H,OAAO,GAAG,IAAI,OAAO,IAAI,GAAG,IAAI,EAAE,CAAC;AACrC,CAAC;AASD;iFACiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,8EAA8E,CAAC;AAEnH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA4B;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,qBAAqB;QAAE,OAAO,EAAE,CAAC;IACvD,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;+FAO+F;AAC/F,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5F;yEACyE;AACzE,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAE7H;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,SAA4B;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACvG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAsCD;6DAC6D;AAC7D,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,MAAyB;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC;QAChD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAA0B,EAC1B,QAA4B,EAC5B,IAAwB;IAExB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IACxC,iGAAiG;IACjG,qGAAqG;IACrG,+FAA+F;IAC/F,mGAAmG;IACnG,kFAAkF;IAClF,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,mGAAmG;IACnG,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;QAChC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,MAA+B,EAAiB,EAAE,CAC7E,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEjJ,IAAI,MAAM,GAA6B,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC,CAAC,mFAAmF;IACpG,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,CAAC,6BAA6B,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,mBAAgD,EAAE,CAAC,CAAC;QAChH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,4FAA4F;QAC5F,+FAA+F;QAC/F,8FAA8F;QAC9F,gGAAgG;QAChG,wFAAwF;QACxF,+FAA+F;QAC/F,4FAA4F;QAC5F,4EAA4E;QAC5E,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,GAAG,CAAC,6BAA6B,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChI,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,CAAC,6BAA6B,EAAE;YACvC,GAAG,IAAI;YACP,MAAM,EAAE,aAA0C;YAClD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;SAC9E,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE;4FAC4F;AAC5F,MAAM,CAAC,MAAM,oCAAoC,GAAG,wBAAwB,CAAC;AAE7E;0FAC0F;AAC1F,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAEtD;kFACkF;AAClF,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAEnD,qGAAqG;AACrG,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,GAAG,uBAAuB,GAAG,SAAS,EAAE,CAAC;AAClD,CAAC;AA0CD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAA2B,EAC3B,GAAW,EACX,SAAiB,EACjB,KAQC;IAED,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxE,MAAM,GAAG,GAAwB;YAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClH,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,EAAE;SACH,CAAC;QACF,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;2CAE2C;AAC3C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA2B,EAAE,GAAW,EAAE,SAAiB;IACnG,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;QACpC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9E,iGAAiG;QACjG,iGAAiG;QACjG,8FAA8F;QAC9F,yDAAyD;QACzD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;YAChD,CAAC,CAAE,MAAM,CAAC,SAAgC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YAChH,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,SAAS;YACT,GAAG,CAAC,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5H,GAAG,CAAC,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpG,GAAG,CAAC,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpG,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,EAAE,EAAE,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;SACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAA2B,EAAE,GAAW,EAAE,SAAiB;IACrG,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAwB,EAAE,GAAW,EAAE,MAAc,EAAE,EAAE,GAAW,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IACnI,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,KAAK,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAiBD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAkE,EAAE,SAAiB;IAC1H,OAAO,MAAM,CAAC,UAAU,KAAK,gBAAgB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,uBAAuB,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;AAChI,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAeC,EACD,IAAuB;IAEvB,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACjF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9E,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,iGAAiG;IACjG,gEAAgE;IAChE,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC1F,yFAAyF;IACzF,4FAA4F;IAC5F,qDAAqD;IACrD,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3G,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAClD,CAAC;IACD,4FAA4F;IAC5F,gGAAgG;IAChG,kGAAkG;IAClG,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,8FAA8F;IAC9F,iGAAiG;IACjG,kCAAkC;IAClC,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC;IACxC,IAAI,QAA4B,CAAC;IACjC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC"}

package/dist/agent/channels/rate-limit-retry.d.ts

@@ -0,0 +1,157 @@
+/** The HTTP status every vendor in this repo uses for a rate-limit refusal. */
+export declare const RATE_LIMITED_STATUS = 429;
+/**
+ * Does this 403 prove itself a RATE-LIMIT refusal rather than a permission refusal? A BARE 403 IS A REFUSAL, EVERYWHERE, ALWAYS — retrying a genuine permission denial is a hot loop against an API that already said no — so this answers true for exactly ONE shape: a 403 carrying a `Retry-After` the shared parser can read. The vendor's other documented marker resets up to an hour away, which no bounded budget can reach, so it stays a refusal.
+ * THE LIVE RESIDUAL, stated where the code is: the `Retry-After`-bearing 403 rests on an assumption this repo has NOT measured — that a genuine permission denial never carries one. An intermediary answering 403 with its own header would be retried, at a bounded cost of a few refused calls and then a named failure; the predicate can equally UNDER-fire, leaving the seam exactly as it was. Do not widen it from documentation alone.
+ */
+export declare function isRateLimitedForbidden(res: RetryableResponse, nowMs: number): boolean;
+/** Total attempts, the first call included. 4 attempts ⇒ at most 3 waits. */
+export declare const DEFAULT_MAX_ATTEMPTS = 4;
+/** The ceiling on ONE wait. A vendor may name a `Retry-After` of minutes; a write path that blocks
+ *  that long is worse for the caller than a named failure it can act on. */
+export declare const DEFAULT_CAP_MS = 30000;
+/**
+ * The ceiling on the TOTAL wait across one call's retries. READ THE ARITHMETIC BEFORE CHANGING A DEFAULT: attempts and the per-wait cap alone do not bound latency, and a caller that retries the whole call spends the budget again.
+ * A latency-critical caller must therefore pass its own tighter policy rather than trust these defaults — the identity probe that sits on a vendor's short event-ack path does exactly that.
+ */
+export declare const DEFAULT_TOTAL_BUDGET_MS = 60000;
+/** The wait used when a 429 carries no usable `Retry-After`. The header is mandatory on Slack and
+ *  usual elsewhere, so this is a floor for a malformed answer, not the normal path. */
+export declare const DEFAULT_FALLBACK_MS = 1000;
+/**
+ * The NAMED failure an exhausted retry produces. NAMING IT DOES NOT MAKE IT LOUD: a caller that catches everything still catches this, and it leaves no trace unless that caller logs it — so a fail-soft caller must log it by name, or the drop IS silent.
+ * Every field is safe to log: no token, no body, no personal data.
+ */
+export declare class RateLimitExhaustedError extends Error {
+    /** The refusal's HTTP status, so a failure classifier reads the same 429 a vendor error carried.
+     *  `channels/platform-failure.ts` treats 429 as AMBIGUOUS — an unanswered write may have applied. */
+    readonly status = 429;
+    /**
+     * The status the vendor ACTUALLY sent on the last refusal — 429, or 403 on a seam that opted in.
+     * `status` above stays 429 ON PURPOSE: it is what a failure classifier reads, and this error always MEANS "rate limited" whatever spelling the vendor used, so reporting 403 there would route a rate-limit exhaustion into the permission-denied arm.
+     */
+    readonly refusalStatus: number;
+    /** The provider surface, e.g. `slack`. */
+    readonly surface: string;
+    /** The vendor operation, e.g. `chat.postMessage`. */
+    readonly operation: string;
+    /** Attempts made, the first call included. */
+    readonly attempts: number;
+    /** The total time spent waiting across every honoured `Retry-After`. */
+    readonly waitedMs: number;
+    constructor(init: {
+        surface: string;
+        operation: string;
+        attempts: number;
+        waitedMs: number;
+        refusalStatus?: number;
+    });
+}
+/**
+ * Read a `Retry-After` header value as milliseconds. RFC 9110 allows two forms and a vendor uses either: delta-seconds, and an HTTP-date, which is a delay only relative to `nowMs`.
+ * It answers undefined when the header is absent, empty, or in neither form, so a caller uses its own fallback rather than guessing a delay from a value it could not read. A past HTTP-date clamps to 0, because the vendor says the wait is over.
+ */
+export declare function parseRetryAfterMs(value: string | null | undefined, nowMs: number): number | undefined;
+/**
+ * The subset of a response this primitive reads — a status, a header lookup, and an optionally-cancellable body. Every real `Response` satisfies it, as does a `{ok, status, text, json}` vendor fetch shape once that shape also carries a `headers` accessor.
+ * Generic over `T`, so a caller gets back the EXACT response type it sent in and `res.ok` and `res.json()` keep working unchanged downstream.
+ */
+export interface RetryableResponse {
+    readonly status: number;
+    readonly headers: {
+        get(name: string): string | null;
+    };
+    readonly body?: {
+        cancel(): Promise<unknown>;
+    } | null;
+}
+/**
+ * One refusal, reported to an observer so a caller can AUDIT its own retries. Every field is an id, a count or a duration — the same log-safe discipline {@link RateLimitExhaustedError} states for itself.
+ * It is the ONLY way a caller learns a retry happened at all: the primitive returns the first non-refused answer and says nothing about the attempts behind it, so a path whose retries must leave a trace reads them here.
+ */
+export interface RateLimitRefusal {
+    /** The provider surface, e.g. `slack`. */
+    readonly surface: string;
+    /** The vendor operation, e.g. `chat.postMessage`. */
+    readonly operation: string;
+    /** Which attempt was refused, the first call counted as 1. */
+    readonly attempt: number;
+    /** The status the vendor actually sent — 429, or 403 on a seam that opted in. */
+    readonly refusalStatus: number;
+    /** The wait about to be honoured. ZERO when `outcome` is `"exhausted"`: nothing is waited then. */
+    readonly delayMs: number;
+    /** The total already waited BEFORE this refusal, across the honoured delays. */
+    readonly waitedMs: number;
+    /** `"retrying"` ⇒ the wait below happens and the call is repeated. `"exhausted"` ⇒ the attempts
+     *  or the total budget are spent, and {@link RateLimitExhaustedError} is thrown instead. */
+    readonly outcome: "retrying" | "exhausted";
+}
+/** The seams a test drives instead of the clock and the network. */
+export interface RateLimitRetryOptions {
+    /** The provider surface, for the named failure. */
+    readonly surface: string;
+    /** The vendor operation, for the named failure. */
+    readonly operation: string;
+    /** Total attempts, the first call included. Defaults to {@link DEFAULT_MAX_ATTEMPTS}. */
+    readonly maxAttempts?: number;
+    /** The ceiling on ONE wait. Defaults to {@link DEFAULT_CAP_MS}. */
+    readonly capMs?: number;
+    /** The wait for a 429 with no usable `Retry-After`. Defaults to {@link DEFAULT_FALLBACK_MS}. */
+    readonly fallbackMs?: number;
+    /** The ceiling on the TOTAL wait for this call. Defaults to {@link DEFAULT_TOTAL_BUDGET_MS}. A
+     *  retry whose wait would exceed what is left gives up NOW rather than overrunning the budget. */
+    readonly totalBudgetMs?: number;
+    /** The sleep. A test injects one that records the delay instead of waiting it. */
+    readonly sleep?: (ms: number) => Promise<void>;
+    /** The clock, read only to turn an HTTP-date `Retry-After` into a delay. */
+    readonly now?: () => number;
+    /**
+     * An override that reads the honoured delay from somewhere OTHER than the `Retry-After` header — the response BODY, for a vendor that states its delay there. It runs ONLY for a response already judged a rate-limit refusal; a finite, non-negative answer WINS over the header; and it MUST NOT throw, because a body it cannot read answers `undefined` and falls back to the header.
+     * FUNNEL-FIXED, not a caller policy: a seam sets it once for its vendor, which is why it is deliberately absent from {@link RetryPolicy}. A reader that reads the body MUST read a CLONE — the primitive cancels the original body after this returns.
+     */
+    readonly retryAfterMs?: (res: RetryableResponse) => number | undefined | Promise<number | undefined>;
+    /**
+     * PER-SEAM OPT-IN: also honour a 403 that proves itself a rate-limit refusal. It is OFF BY DEFAULT AND MUST STAY THAT WAY, because a 403 is the ordinary spelling of a permission denial on every provider that uses this primitive, and widening it would change the contract for all of them.
+     * When true, a 403 is retried ONLY when {@link isRateLimitedForbidden} says so; a bare 403 comes back unchanged on EVERY seam, this one included. FUNNEL-FIXED and absent from {@link RetryPolicy}, so a caller tuning attempts or waits can never turn a permission refusal into a retry.
+     */
+    readonly retryForbiddenWithRetryAfter?: boolean;
+    /**
+     * Called once per refusal, BEFORE the wait it describes — so a row it writes survives a process that dies during the sleep, which is the incident an operator most needs the row for.
+     * AWAITED. On a RETRYING refusal that costs the call nothing: the only thing it delays is a sleep that was about to happen anyway. On the EXHAUSTED refusal there is no sleep left, so it delays the THROW by one observer round trip — the price of a row that outlives the failure. It MUST NOT throw; a rejection is caught and dropped here, because an observer is never allowed to fail the call it observes.
+     * FUNNEL-FIXED like {@link retryAfterMs} and deliberately absent from {@link RetryPolicy}: a caller tuning attempts or waits must not be able to attach or remove a seam's audit trail.
+     */
+    readonly onRefusal?: (refusal: RateLimitRefusal) => void | Promise<void>;
+}
+/**
+ * The tunable half of {@link RateLimitRetryOptions} — everything except the NAMED `surface` and `operation`, which a funnel fixes per call site rather than leaving to its caller.
+ * This is the shape a write seam exposes as its own `retry?:` option, so a caller can tighten the policy, or a test inject a stub clock, without the funnel itself taking `surface`/`operation` as caller-settable.
+ */
+export type RetryPolicy = Pick<RateLimitRetryOptions, "maxAttempts" | "capMs" | "fallbackMs" | "totalBudgetMs" | "sleep" | "now">;
+/**
+ * Call `send`, honouring a rate-limit refusal's `Retry-After` up to a bounded number of attempts. It returns the FIRST response that is not a rate-limit refusal — whatever that response is.
+ * A refusal is a 429, and on a seam that sets `retryForbiddenWithRetryAfter` also a 403 carrying a readable `Retry-After`. It throws {@link RateLimitExhaustedError} when the last allowed attempt is still refused.
+ */
+export declare function withRetryAfter<T extends RetryableResponse>(send: () => Promise<T>, opts: RateLimitRetryOptions): Promise<T>;
+/**
+ * `withRetryAfter` for a `{ok, status, text, json}` vendor fetch shape whose OWN declared type carries no `headers`. At RUNTIME every one of those shapes' production value is the real `fetch`, whose `Response` already carries them, so this reads them when present and honours a refusal exactly as {@link withRetryAfter} does; a genuinely header-less response retries on the fallback wait, the same answer an unreadable header gives.
+ * It wraps the header-less response in a `Proxy` rather than spreading it, because a shallow copy takes only own enumerable properties and would silently drop `text`/`json` from a class instance. The shared fetch types are not widened instead: both are used far beyond these seams, and a required `headers` field would force every untouched test fake to grow one just to keep compiling.
+ */
+export declare function withRetryAfterLoose<T extends {
+    readonly status: number;
+}>(send: () => Promise<T>, opts: RateLimitRetryOptions): Promise<T>;
+/**
+ * Does this THROWN error prove itself a rate-limit refusal? Two SHAPES answer yes, never a word in the message: a numeric `status` of 429 (what an OE arm stamps, `channels/platform-failure.ts`), and the vendor client's own error-class `name`. A `cause` chain is walked, because a re-wrap keeps the class of the error it wraps only in that chain.
+ * Everything else — a transport throw, a 5xx, a permission refusal — answers false and is rethrown untouched by {@link withRetryAfterThrown}, exactly as a non-refusal response comes back unchanged above.
+ */
+export declare function isRateLimitThrow(err: unknown): boolean;
+/**
+ * {@link withRetryAfter} for a call that THROWS its rate-limit refusal instead of returning one. It returns whatever `run` resolves, on the first attempt that is not a refusal.
+ * A refusal is what {@link isRateLimitThrow} says it is; EVERY other rejection propagates unchanged, on the first attempt, so a permission denial and a transport throw keep their exact behaviour. An exhausted retry throws the same {@link RateLimitExhaustedError} a response-shaped one does, so a caller's failure classifier reads the same 429 either way.
+ * `retryAfterMs` is OWNED BY THIS ADAPTER — a thrown refusal states its delay on the error, not in a body — so a value a caller passes in `opts` is ignored. Nothing needs one today; the line is here so a seam that tries does not debug a silently dropped reader.
+ *
+ * 🔴 WHAT IS REPEATED IS THE WHOLE `run` CLOSURE, not a vendor call. Two things follow, and a caller owes both:
+ *  • THE VENDOR CALL is safe to repeat exactly because a refusal is an ANSWER: the primitive above never repeats a request the vendor left UNanswered — such a request may have applied — and a 429 is the vendor saying it did NOT take the call.
+ *  • EVERYTHING ELSE INSIDE THE CLOSURE RUNS AGAIN, so the closure must be RE-RUNNABLE. `divertToUnifiedWindow`'s closure is the live example and not a trivial one: `receive(channel, target).send(...)` re-enters the unified channel's own `receive` hook in-process, which re-registers the wake target (an idempotent upsert) and re-enters the answer leg — which is why that leg rethrows a rate-limit refusal instead of catching it (see its own note).
+ */
+export declare function withRetryAfterThrown<T>(run: () => Promise<T>, opts: RateLimitRetryOptions): Promise<T>;
+//# sourceMappingURL=rate-limit-retry.d.ts.map

package/dist/agent/channels/rate-limit-retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-retry.d.ts","sourceRoot":"","sources":["../../../agent/channels/rate-limit-retry.ts"],"names":[],"mappings":"AAGA,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAMvC;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAGrF;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC;4EAC4E;AAC5E,eAAO,MAAM,cAAc,QAAS,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C;uFACuF;AACvF,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AAEzC;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD;yGACqG;IACrG,QAAQ,CAAC,MAAM,OAAuB;IACtC;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,YAAY,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,EAWnH;CACF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAarG;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;gGAC4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,WAAW,CAAC;CAC5C;AAED,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yFAAyF;IACzF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,gGAAgG;IAChG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;sGACkG;IAClG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrG;;;OAGG;IACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,OAAO,GAAG,YAAY,GAAG,eAAe,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC;AAMlI;;;GAGG;AACH,wBAAsB,cAAc,CAAC,CAAC,SAAS,iBAAiB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,CAAC,CA2DjI;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACvE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,CAAC,CAAC,CAsBZ;AAmCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEtD;AAgBD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,CAAC,CAwB5G"}