@open-everywhere/core 0.1.0

package/dist/agent/channels/reply-freshness.d.ts

@@ -0,0 +1,69 @@
+import { type PendingUnifiedWake, type UnifiedWakeOrigin, type UnifiedWakeRecord } from "./unified-window.js";
+/** The wake-map slice this gate reads. Two methods, both read-only — the gate never writes a row.
+ *  Its own interface (rather than the whole `OperationalStore`) so a test can drive it with a small
+ *  fake and so the dependency direction stays one-way. */
+export interface ReplyFreshnessStore {
+    getUnifiedWakeRecord(org: string, wakeId: string): Promise<UnifiedWakeRecord | null>;
+    listPendingUnifiedWakes(org: string, windowToken: string, afterIso: string, limit: number): Promise<readonly PendingUnifiedWake[]>;
+}
+/** How many newer wakes the gate loads. The refusal only ever reports a COUNT, so the cap costs
+ *  nothing but an exact number past it — and it stops a pathological burst from pulling an unbounded
+ *  row set onto the reply path. Past the cap the count is reported as "at least" (see the copy). */
+export declare const MAX_NEWER_WAKES = 20;
+/** The audit reason a reply refused by this gate carries, so a staleness refusal is countable apart
+ *  from every other refusal shape (the `reply.refused` row family, channels/reply-post.ts). */
+export declare const REPLY_STALE_REFUSAL_REASON = "stale-conversation";
+/** The audit reason a FORCED send carries on its own `reply.forced` row. A force is a post, not a
+ *  refusal, and it is the one place the model overrides a host verdict on the reply path — so it is
+ *  countable on its own rather than folded into the ordinary `reply.post` row. */
+export declare const REPLY_FORCED_AUDIT_REASON = "stale-conversation-forced";
+/** The gate's verdict. `fresh` ⇒ post. `stale` ⇒ refuse this once and report `newer`. */
+export type ReplyFreshness = {
+    readonly stale: false;
+} | {
+    readonly stale: true;
+    readonly newer: number;
+    readonly capped: boolean;
+};
+/**
+ * Has this conversation moved past what the model has seen?
+ *
+ * `target` is the origin the reply is about to post into — already resolved by the authority fence,
+ * so this function never decides WHERE a reply goes, only WHETHER it is still current. Every pending
+ * wake is matched against it with {@link sameUnifiedConversation}: a sibling conversation in the same
+ * cross-surface window is a different room and must never delay an answer in this one.
+ *
+ * The three exclusions that keep the count honest:
+ *   • the anchor bound itself — a row at or before the anchor is one the model was shown;
+ *   • `inputWake` and `turnWake` by id — a row stamped in the same millisecond as the anchor would
+ *     otherwise count itself;
+ *   • the read-time TTL — the store prunes only opportunistically on write, so on a quiet org a row
+ *     hours past its TTL is still readable, and counting one would refuse a reply over a message the
+ *     room has long since forgotten. Same bound, same reason, as the answerable-reply fence.
+ */
+export declare function replyFreshness(store: ReplyFreshnessStore, org: string, input: {
+    /** The conversation the reply is about to post into (the fence's resolved origin). */
+    readonly target: UnifiedWakeOrigin;
+    /** The caller's own bare window token. Absent ⇒ the gate is OFF (honest degrade). */
+    readonly windowToken: string | undefined;
+    /** The wake-id the model echoed — already past the authority fence. */
+    readonly inputWake: string;
+    /** eve's own auth stamp for this turn — the NEWEST wake the model was shown, when present. */
+    readonly turnWake: string | undefined;
+}, nowMs?: number): Promise<ReplyFreshness>;
+/**
+ * What the model reads when the gate refuses. It states the fact, names the ONE thing the model
+ * cannot do (see the messages — the host does not hold them), and gives both ways forward. The
+ * `no_reply` steer is FIRST because it is the outcome the burst problem wants: the queued wake drives
+ * the next turn, and the model answers everything at once. The wake stays unanswered either way, so
+ * ending the turn never costs the conversation its answer.
+ */
+export declare function staleReplyRefusalMessage(freshness: Extract<ReplyFreshness, {
+    stale: true;
+}>): string;
+/** Record that the freshness gate refused `wake` in THIS turn. No-op without a turn id. */
+export declare function markStaleRefusedThisTurn(turnId: string | undefined, wake: string): void;
+/** Did the freshness gate ALREADY refuse `wake` in this turn? False whenever the answer is unknown,
+ *  which leaves the gate armed — the fail-open direction here is "refuse once", not "never refuse". */
+export declare function wasStaleRefusedThisTurn(turnId: string | undefined, wake: string): boolean;
+//# sourceMappingURL=reply-freshness.d.ts.map

package/dist/agent/channels/reply-freshness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reply-freshness.d.ts","sourceRoot":"","sources":["../../../agent/channels/reply-freshness.ts"],"names":[],"mappings":"AAgEA,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAE7B;;0DAE0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACrF,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;CACpI;AAED;;oGAEoG;AACpG,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC;+FAC+F;AAC/F,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D;;kFAEkF;AAClF,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,yFAAyF;AACzF,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAmB/E;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE;IACL,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC,EACD,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,CAAC,CAkCzB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,cAAc,EAAE;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,CAAC,GAAG,MAAM,CAUpG;AA2BD,2FAA2F;AAC3F,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAYvF;AAED;uGACuG;AACvG,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQzF"}

package/dist/agent/channels/reply-freshness.js

@@ -0,0 +1,208 @@
+// reply-freshness — THE SEND IS THE CONSISTENCY POINT (Claude Tag steal, OPE-767).
+//
+// THE PROBLEM. A burst of messages in one conversation does not arrive as one turn. The first
+// message wakes the seat; the next ones land while that turn runs. eve queues them, so the running
+// turn never sees them, and the model answers a question the room has already moved past. Widening
+// the ingress linger only shrinks the window — it never closes it, and it costs latency on every
+// happy path. Tag solves this at the SEND instead: its reply carries the last message the model saw,
+// and the send is REFUSED when a newer message has arrived, with the newer messages delivered so the
+// model can re-decide. Zero cost when nothing raced; teeth exactly when something did.
+//
+// 🔴 WHAT THE HOST CAN AND CANNOT KNOW, because a previous attempt got this wrong. OPE-47 built the
+// same guard over the TURN WAKE and OPE-162 deleted it as dead code: eve writes a turn's auth bag
+// once, from the FIRST step's delivery, so `currentWakeId` is TURN-CONSTANT and the guard could
+// never fire. The signal that actually moves is the PENDING-WAKE STORE. A wake row is registered by
+// `unified.ts`'s `receive` BEFORE the delivery is sent (unified-window.ts registerUnifiedWakeTarget),
+// so a message that arrives mid-turn has a durable, unanswered row of its own WHILE the turn that
+// cannot see it is still running. That row is the moving signal, and this module reads it.
+//
+// 🔴 ONLY INBOUND WAKES COUNT, and this is not a refinement — it is what makes the gate correct at
+// all. A delegating turn mints wakes of its OWN against the SAME conversation: a task-window opening
+// wake, a completion wake, the auto-redrive. Those are not news the room is waiting on. A gate that
+// counted them would refuse the hand-off note of every turn that delegates — measured immediately,
+// as a red in `reply-delegation-pending-test.ts` §1. So the wake row carries an `inbound` flag,
+// stamped only where the host knows an arrival is ATTENDED (channels/unified.ts
+// `divertToUnifiedWindow`), and the listing returns nothing else.
+//
+// THE ANCHOR — what counts as "what the model has seen". Two wake ids are host-stamped and provable:
+// the wake the model is answering (`inputWake`, already past the authority fence) and the wake THIS
+// turn was delivered under (`turnWake`, eve's own auth stamp). A turn that merged queued deliveries
+// carries only the LAST delivery's auth, so on such a turn `turnWake` names the NEWEST wake the model
+// was shown. The anchor is therefore the LATER of the two registration stamps, and only a pending
+// wake registered after it can be one the model has not seen. A merged sibling is always at or
+// before the anchor, so a legitimate multi-wake turn never draws a refusal.
+// 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THE ANCHOR RULE IS STILL LIVE (OPE-2042). eve
+// batches adjacent queued deliveries only when their full auth contexts match, and OE stamps a fresh
+// per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying deliveries on one
+// unified window never compare equal; only the caller-less task COMPLETION COHORT still folds, and
+// it carries no `auth` at all. A turn still holds more than one wake without any merge — the reply
+// fence's same-conversation and pending arms admit a sibling — so `inputWake` and `turnWake` still
+// disagree and the anchor still has work to do.
+// `scripts/coalesced-delivery-merge-assumption-test.ts` pins the MERGE road alone.
+//
+// WHAT THE REFUSAL SAYS, AND WHAT IT DOES NOT. The wake map stores each wake's ORIGIN, never its
+// text — the host does not hold the newer messages and cannot inline them. So the refusal reports
+// HOW MANY newer messages exist and that they are already queued for delivery, which is exactly what
+// Tag's own copy says ("they are being delivered to you"). It deliberately does NOT name their
+// wake-ids: the OPE-182 refusal copy withholds the same thing for the same reason — the model was
+// never shown those wakes, and handing it addresses it never saw widens reach, not legibility.
+//
+// TWO VALVES, BOTH BOUNDED. `force: true` is the model's explicit "posting now matters more", and it
+// is audited as such. The loop guard is the second: the gate refuses at most ONCE per turn per wake.
+// A model that re-sends without `force` therefore posts, so refuse → redeliver → refuse can never
+// cycle. The recorded refusal is what makes the gate a speed bump rather than a wall.
+//
+// IT APPLIES TO `done: false` TOO, deliberately. A progress note or a hand-off line is written
+// against the same room the answer is, so a stale one is stale in the same way. The alternative —
+// exempting an unfinished answer — buys one step on a path that already has the `force` valve and
+// the refuse-once guard, and it costs the ONE rule a reader can hold: every send is checked.
+//
+// FAIL-OPEN, EVERYWHERE. No window token, an unreadable store, an unparseable stamp, a missing row,
+// no eve context: every one of those turns the gate OFF and the reply posts. A freshness check is a
+// courtesy to the reader; a lost answer is a product failure. The direction never inverts.
+import { defineState } from "eve/context";
+import { isUnifiedWakeOrigin, sameUnifiedConversation, WAKE_TARGET_TTL_MS, } from "./unified-window.js";
+/** How many newer wakes the gate loads. The refusal only ever reports a COUNT, so the cap costs
+ *  nothing but an exact number past it — and it stops a pathological burst from pulling an unbounded
+ *  row set onto the reply path. Past the cap the count is reported as "at least" (see the copy). */
+export const MAX_NEWER_WAKES = 20;
+/** The audit reason a reply refused by this gate carries, so a staleness refusal is countable apart
+ *  from every other refusal shape (the `reply.refused` row family, channels/reply-post.ts). */
+export const REPLY_STALE_REFUSAL_REASON = "stale-conversation";
+/** The audit reason a FORCED send carries on its own `reply.forced` row. A force is a post, not a
+ *  refusal, and it is the one place the model overrides a host verdict on the reply path — so it is
+ *  countable on its own rather than folded into the ordinary `reply.post` row. */
+export const REPLY_FORCED_AUDIT_REASON = "stale-conversation-forced";
+/**
+ * Read the registration stamp of one wake, or `undefined` when the row is missing or its stamp does
+ * not parse. Never throws — an unreadable store reads as "no anchor", which turns the gate off.
+ */
+async function stampOf(store, org, wakeId) {
+    if (typeof wakeId !== "string" || wakeId.length === 0 || wakeId.length > 200)
+        return undefined;
+    let row;
+    try {
+        row = await store.getUnifiedWakeRecord(org, wakeId);
+    }
+    catch {
+        return undefined;
+    }
+    if (!row)
+        return undefined;
+    const at = Date.parse(row.createdAt);
+    return Number.isFinite(at) ? at : undefined;
+}
+/**
+ * Has this conversation moved past what the model has seen?
+ *
+ * `target` is the origin the reply is about to post into — already resolved by the authority fence,
+ * so this function never decides WHERE a reply goes, only WHETHER it is still current. Every pending
+ * wake is matched against it with {@link sameUnifiedConversation}: a sibling conversation in the same
+ * cross-surface window is a different room and must never delay an answer in this one.
+ *
+ * The three exclusions that keep the count honest:
+ *   • the anchor bound itself — a row at or before the anchor is one the model was shown;
+ *   • `inputWake` and `turnWake` by id — a row stamped in the same millisecond as the anchor would
+ *     otherwise count itself;
+ *   • the read-time TTL — the store prunes only opportunistically on write, so on a quiet org a row
+ *     hours past its TTL is still readable, and counting one would refuse a reply over a message the
+ *     room has long since forgotten. Same bound, same reason, as the answerable-reply fence.
+ */
+export async function replyFreshness(store, org, input, nowMs) {
+    const fresh = { stale: false };
+    if (!input.windowToken)
+        return fresh;
+    const [inputAt, turnAt] = await Promise.all([stampOf(store, org, input.inputWake), stampOf(store, org, input.turnWake)]);
+    // NO ANCHOR, NO GATE. Without a provable stamp for at least one wake the model was shown, every
+    // pending row would look newer and every reply would refuse — the exact false-refusal shape the
+    // fail-open direction exists to prevent.
+    if (inputAt === undefined && turnAt === undefined)
+        return fresh;
+    const anchorMs = Math.max(inputAt ?? Number.NEGATIVE_INFINITY, turnAt ?? Number.NEGATIVE_INFINITY);
+    let rows;
+    try {
+        rows = await store.listPendingUnifiedWakes(org, input.windowToken, new Date(anchorMs).toISOString(), MAX_NEWER_WAKES + 1);
+    }
+    catch {
+        return fresh; // store unavailable → the gate is off, the answer still lands
+    }
+    const now = nowMs ?? Date.now();
+    let newer = 0;
+    for (const row of rows) {
+        if (row.wakeId === input.inputWake || row.wakeId === input.turnWake)
+            continue;
+        const at = Date.parse(row.createdAt);
+        if (!Number.isFinite(at) || at <= anchorMs)
+            continue;
+        if (now - at > WAKE_TARGET_TTL_MS)
+            continue; // read-time TTL — see the doc above
+        let parsed;
+        try {
+            parsed = JSON.parse(row.targetJson);
+        }
+        catch {
+            continue; // an unreadable origin cannot be proven to name THIS conversation → never counts
+        }
+        if (!isUnifiedWakeOrigin(parsed))
+            continue;
+        if (!sameUnifiedConversation(parsed, input.target))
+            continue;
+        newer += 1;
+    }
+    if (newer === 0)
+        return fresh;
+    return { stale: true, newer: Math.min(newer, MAX_NEWER_WAKES), capped: newer > MAX_NEWER_WAKES };
+}
+/**
+ * What the model reads when the gate refuses. It states the fact, names the ONE thing the model
+ * cannot do (see the messages — the host does not hold them), and gives both ways forward. The
+ * `no_reply` steer is FIRST because it is the outcome the burst problem wants: the queued wake drives
+ * the next turn, and the model answers everything at once. The wake stays unanswered either way, so
+ * ending the turn never costs the conversation its answer.
+ */
+export function staleReplyRefusalMessage(freshness) {
+    const count = freshness.capped ? `at least ${freshness.newer}` : `${freshness.newer}`;
+    const plural = freshness.newer === 1 && !freshness.capped ? "message" : "messages";
+    return (`reply: this conversation has moved on — ${count} newer ${plural} arrived after the ones you have seen. ` +
+        "NOTHING was posted. Those messages are already queued and reach you as your next wake, so the best move is " +
+        "to end this turn now (`no_reply`) and answer them together with this one — the wake stays open and unanswered. " +
+        "Posting now is DISCOURAGED, not blocked: send this same call again, or pass `force: true`, and it posts. " +
+        "It costs the room an answer that ignores the newest messages, and the override is recorded.");
+}
+const refusedSlot = defineState("open-everywhere.reply-stale-refused", () => null);
+/** Cap on the recorded set — the same bound, for the same reason, as reply-signal.ts's sets: it stops
+ *  a looping turn from growing the serialized container without bound. Past the cap the gate stops
+ *  RECORDING, so it keeps refusing rather than silently going quiet. */
+const MAX_REFUSED_WAKES = 32;
+/** Record that the freshness gate refused `wake` in THIS turn. No-op without a turn id. */
+export function markStaleRefusedThisTurn(turnId, wake) {
+    if (turnId === undefined || turnId.length === 0)
+        return;
+    if (typeof wake !== "string" || wake.length === 0)
+        return;
+    try {
+        refusedSlot.update((prev) => {
+            const wakes = prev !== null && prev.turnId === turnId ? prev.wakes : [];
+            if (wakes.includes(wake) || wakes.length >= MAX_REFUSED_WAKES)
+                return { turnId, wakes };
+            return { turnId, wakes: [...wakes, wake] };
+        });
+    }
+    catch {
+        /* no session context — the guard degrades to OFF, exactly as the header says */
+    }
+}
+/** Did the freshness gate ALREADY refuse `wake` in this turn? False whenever the answer is unknown,
+ *  which leaves the gate armed — the fail-open direction here is "refuse once", not "never refuse". */
+export function wasStaleRefusedThisTurn(turnId, wake) {
+    if (turnId === undefined || turnId.length === 0)
+        return false;
+    try {
+        const cur = refusedSlot.get();
+        return cur !== null && cur.turnId === turnId && cur.wakes.includes(wake);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=reply-freshness.js.map

package/dist/agent/channels/reply-freshness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reply-freshness.js","sourceRoot":"","sources":["../../../agent/channels/reply-freshness.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,8FAA8F;AAC9F,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,qGAAqG;AACrG,qGAAqG;AACrG,uFAAuF;AACvF,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,gGAAgG;AAChG,oGAAoG;AACpG,sGAAsG;AACtG,kGAAkG;AAClG,2FAA2F;AAC3F,EAAE;AACF,mGAAmG;AACnG,qGAAqG;AACrG,oGAAoG;AACpG,mGAAmG;AACnG,gGAAgG;AAChG,gFAAgF;AAChF,kEAAkE;AAClE,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,oGAAoG;AACpG,sGAAsG;AACtG,kGAAkG;AAClG,+FAA+F;AAC/F,4EAA4E;AAC5E,gGAAgG;AAChG,qGAAqG;AACrG,+FAA+F;AAC/F,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,gDAAgD;AAChD,mFAAmF;AACnF,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,qGAAqG;AACrG,+FAA+F;AAC/F,kGAAkG;AAClG,+FAA+F;AAC/F,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,kGAAkG;AAClG,sFAAsF;AACtF,EAAE;AACF,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,6FAA6F;AAC7F,EAAE;AACF,oGAAoG;AACpG,oGAAoG;AACpG,2FAA2F;AAE3F,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,GAInB,MAAM,qBAAqB,CAAC;AAU7B;;oGAEoG;AACpG,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC;+FAC+F;AAC/F,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;kFAEkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAOrE;;;GAGG;AACH,KAAK,UAAU,OAAO,CAAC,KAA0B,EAAE,GAAW,EAAE,MAA0B;IACxF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAC/F,IAAI,GAA6B,CAAC;IAClC,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA0B,EAC1B,GAAW,EACX,KASC,EACD,KAAc;IAEd,MAAM,KAAK,GAAmB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzH,gGAAgG;IAChG,gGAAgG;IAChG,yCAAyC;IACzC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,iBAAiB,EAAE,MAAM,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACnG,IAAI,IAAmC,CAAC;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC;IAC5H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,8DAA8D;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ;YAAE,SAAS;QAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,QAAQ;YAAE,SAAS;QACrD,IAAI,GAAG,GAAG,EAAE,GAAG,kBAAkB;YAAE,SAAS,CAAC,oCAAoC;QACjF,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,iFAAiF;QAC7F,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;YAAE,SAAS;QAC7D,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,GAAG,eAAe,EAAE,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAmD;IAC1F,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;IACtF,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACnF,OAAO,CACL,2CAA2C,KAAK,UAAU,MAAM,yCAAyC;QACzG,6GAA6G;QAC7G,iHAAiH;QACjH,2GAA2G;QAC3G,6FAA6F,CAC9F,CAAC;AACJ,CAAC;AAoBD,MAAM,WAAW,GAAG,WAAW,CAA2B,qCAAqC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAE7G;;wEAEwE;AACxE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,2FAA2F;AAC3F,MAAM,UAAU,wBAAwB,CAAC,MAA0B,EAAE,IAAY;IAC/E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC1D,IAAI,CAAC;QACH,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAC1B,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,iBAAiB;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACxF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;AACH,CAAC;AAED;uGACuG;AACvG,MAAM,UAAU,uBAAuB,CAAC,MAA0B,EAAE,IAAY;IAC9E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC9B,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/agent/channels/reply-post.d.ts

@@ -0,0 +1,176 @@
+import { type BindableContext } from "../identity/binding.js";
+import { type ReplierLabel } from "./turn-delivery.js";
+import type { EditLocus } from "./reply-edit.js";
+export type { ReplierLabel };
+/**
+ * The resolved place a reply posts — a discriminated union over the surfaces with a wired mid-turn post primitive.
+ * Every field is resolved from the SESSION BINDING, never from model input.
+ */
+export type ReplyTarget = {
+    readonly platform: "slack";
+    readonly channelId: string;
+    readonly threadTs?: string;
+} | {
+    readonly platform: "discord";
+    readonly channelId: string;
+} | {
+    readonly platform: "notion";
+    readonly discussionId: string;
+    readonly pageId?: string;
+    readonly workspaceId?: string;
+    /** The Notion integration the DELIVERY that woke this turn was verified under (OPE-467),
+     *  carried on the binding target so the reply posts under the credential that fetched.
+     *  Absent ⇒ the arm falls back to the replied-to page's domain binding. */
+    readonly credentialId?: string;
+} | {
+    readonly platform: "teams";
+    readonly serviceUrl: string;
+    readonly conversationId: string;
+    readonly replyToActivityId?: string;
+} | {
+    readonly platform: "linear";
+    readonly agentSessionId: string;
+    readonly organizationId?: string;
+} | {
+    readonly platform: "linear";
+    readonly issueId: string;
+    readonly parentId?: string;
+    readonly organizationId?: string;
+} | {
+    readonly platform: "github";
+    readonly owner: string;
+    readonly repo: string;
+    readonly issueNumber: number;
+    readonly installationId?: number;
+};
+/**
+ * Resolve the reply target from a tool ctx, or null when this surface cannot host `reply`, or the post anchor cannot be resolved.
+ * The dynamic gate already hides the tool where the surface cannot post; this is the execute-time belt-and-braces, and what makes the decision unit-testable.
+ */
+export declare function resolveReplyTarget(ctx: BindableContext): ReplyTarget | null;
+/**
+ * The partition and provenance a reply CHOKE POINT stamps onto its canonical `reply.post` row. The caller supplies it and the choke point OWNS writing the row, so there is exactly ONE row per byte-leaving post no matter which route initiated it.
+ * Taint-clean: only ids, counts and routes reach the detail — never message text.
+ */
+export interface ReplyAudit {
+    readonly org: string;
+    /**
+     * The turn's PARTITION platform. {@link replyAuditFor} reads it from the turn's own binding, so a reply carries the REAL surface even on a windowed seat. NO product path stamps `"unified"` here: the one struct that did was the addressed-prose bridge's, and that route is deleted (OPE-1982).
+     * What it still files is this plane's HOST-VERDICT rows — `reply.refused`, `reply.forced`, `reply.edit.refused` — which are told no surface because nothing landed. The `"unified"` value stays LOAD-BEARING as a FLOOR rather than as a live case: `channels/reply-provenance.ts` reads that exact value as the sentinel for "these labels name the WINDOW, not a room", which is what would stop a surface-proved connector read being named in the footer of a reply posted under window labels. Never widen it to a surface name.
+     * 🔴 IT IS NOT THE `platform` COLUMN ON `reply.post`. That column names the SURFACE the reply landed on — see {@link auditReplyPost}.
+     */
+    readonly platform: string;
+    readonly workspace: string;
+    readonly surface?: string;
+    /**
+     * WHO this reply answers — the acting principal of the DELIVERY that drove the turn. Every route fills it, each from the one place its own lifecycle still holds that delivery.
+     * ABSENT means the delivery authenticated nobody: never a guess, and never another turn's principal.
+     */
+    readonly principalId?: string;
+    /**
+     * The ATTESTED CREATOR of a routine or webhook fire, when this reply answers one and the fire names a creator — NEVER the reply's author, which stays {@link principalId}.
+     * It is carried so the audit trail names the human who owns the automation without a join to the routine row. Absent on an ordinary human turn or a creator-less row: genuinely nobody to name, never a guess. The `reply`/`edit_reply` tools fill it through {@link replyAuditFor}, which is now the ONLY door that writes this row (OPE-2006) — so a fire that owes an answer names its creator exactly when it answers through the tool, and a fire that ends in closing prose posts nothing to name it on.
+     */
+    readonly creatorId?: string;
+    readonly sessionId?: string;
+    readonly wakeId?: string;
+    /**
+     * THIS turn's id. It is written to no row: it is what lets {@link auditReplyRefused} record the refusal on the TURN as well as in the log, so the unified window's dropped-prose branch can see at turn end that the host already refused this wake — which is what names the withholding on the drop row and suppresses the one corrective redrive.
+     * Carrying it here, rather than at each refusal site, keeps ONE choke point, so a future refusal that writes the row cannot forget to record the decision. Absent on a sessionless context, where the record degrades to empty and the drop reads as an ordinary one.
+     */
+    readonly turnId?: string;
+    /**
+     * WHICH DOOR CARRIED THIS ROW. ONE value since OPE-2006: the `reply`/`edit_reply` TOOL is the only way a seat's words leave a session, on every surface and every seat shape.
+     * 🔴 IT STAYS A FIELD RATHER THAN A CONSTANT, and the reason is the row and not this type. `detail.route` is written on `reply.post`, `reply.post.failed`, `reply.refused` and `reply.forced`, and an operator reading a row from before the terminal route was deleted sees `"terminal"` there. A field keeps the column meaning the same thing across that boundary; folding it away would make the old rows read as a column that no longer exists.
+     * The former second value was `"terminal"` — a chat surface's `message.completed` handler posting the model's ending text through `postTerminalProse`. That plane is deleted: a turn's closing prose is now DROPPED and audited (`channels/closing-prose-drop.ts`).
+     */
+    readonly route: "tool";
+}
+/**
+ * Build the reply plane's audit struct from a live tool ctx — the who and where a tool call holds. The choke point then OWNS writing the row, so there is exactly one row per event whichever verb initiated it.
+ * Shared by `reply` and `edit_reply`, so the two cannot drift into different attribution: an edit is audited with the same partition, principal, session and wake as the reply it corrects.
+ *
+ * 🔴 IT STAMPS THE FIRE'S ATTESTED CREATOR (OPE-1982). This route did not, and did not need to while the single-window prose bridge stamped it for a windowed routine fire. That bridge is deleted, so a fire on a unified window now answers through THIS door or through none — and leaving the field off here would have deleted the creator from every such row, making the human who owns the automation reachable only by a join to the routine row. It is read off the SAME ctx the principal is, it is `undefined` on an ordinary human turn, on a webhook fire and on a creator-less routine, and it never becomes the reply's author, which stays {@link principalId}.
+ */
+export declare function replyAuditFor(ctx: BindableContext, route: ReplyAudit["route"], wakeId?: string): ReplyAudit;
+/**
+ * Does this reply body carry an ANSWER at all, or is it a stub a reader gets nothing out of? PURE, and the ONE test the unified window's DROP ROW (`channels/unified.ts`) and the e2e content gates share, so a turn the log calls answer-less and a turn a gate grades as answer-less are the same turn.
+ *
+ * 🔴 IT GATES NO DELIVERY, AND THAT IS WORTH SAYING OUT LOUD. It once decided whether the addressed-prose bridge would post; that route is deleted (OPE-1982), so the one in-product reader left LABELS the drop row — `reason: "no-substance"` — and the e2e gates ask the same question from the other side. It is not on the `reply` TOOL route either: a model that calls `reply("...")` still posts it and still spends the wake, because there the model chose to post and is still choosing what to say, so a host refusal reaches it and can steer it. A floor at the choke point would be refusing a call the model could have made honestly, which is a different ticket's argument to make. It lives HERE, beside the choke point, because it is a reply-plane rule and the next route to need it should find it without re-deriving it.
+ *
+ * 🔴 IT IS NOT A LENGTH TEST, AND IT MUST NEVER BECOME ONE. A correct answer here is routinely three characters — `144`, `81`, `no` — so a floor on `chars` strikes the shortest RIGHT answers this deployment gives. S11's own note records the same finding from the gate side: the interim it had to step past ran 194 characters, and a bar wide enough to catch it swallows real short answers too.
+ * The test is instead the weakest one that still separates the two: a body carries substance when at least one LETTER OR DIGIT survives once emoji shortcodes are stripped. `144` passes; `...`, `…`, `👍` and `:+1:` do not.
+ *
+ * WHY THE DISTINCTION EARNS A FIELD (OPE-1911): a turn that trailed off on `...` and a turn that wrote a real answer nobody received are different failures, and the canonical rows carry `chars` rather than whether anything was said. Measured on ship #216, J-ENGAGED-slack: a three-character closing text reached the room and every reader downstream graded it as the answer.
+ *
+ * 🔴 DELIBERATELY NOT A POINTER TEST. "Answered in the comments." is a pointer rather than an answer, and this predicate calls it substantive, because the host cannot grade whether prose answers a question without reading the question — the same line {@link guardMemoryClaims} holds about a durability claim. What separates a pointer from the answer is the turn's own `done` intent, which only the `reply` tool carries.
+ */
+export declare function replyCarriesSubstance(body: string): boolean;
+/**
+ * Write the ONE canonical `reply.post` row at the choke point — best-effort, never throws, and never fails the post; a no-op when the caller passed no audit struct.
+ * The detail is taint-clean, and the `reply.post` action NAME is load-bearing — the eval scorers join on it — so it never changes.
+ *
+ * 🔴 THE `platform` COLUMN NAMES THE SURFACE THE REPLY LANDED ON, never the route that carried it (OPE-1745). It is the `platform` ARGUMENT — the surface the arm posted to — and NOT {@link ReplyAudit.platform}, which is the turn's partition.
+ * The two agree on the one route this plane carries, `tool`. The rule is stated rather than assumed because a struct whose labels name a WINDOW makes them disagree, and such a reply then drops out of every operator query and gate that filters `reply.post` by platform. Measured on deploy #201, when the deleted bridge route was one: a Linear reply rowed as `platform: "unified"` with `detail.platform: "linear"`, and the e2e driver's `actions=reply.post&platform=linear` gate saw nothing for 60 s while the row sat there.
+ * NOTHING IS LOST: `detail.route` still says how the reply was posted. The column answers "where did it land", the detail answers "which door did it take".
+ */
+export declare function auditReplyPost(audit: ReplyAudit | undefined, id: string, platform: string, chars: number): Promise<void>;
+/**
+ * What BOTH post choke points do with a thrown dispatch: classify it, write the one `reply.post.failed` row, and hand the class back. The caller re-throws the ORIGINAL error, so the model still reads the arm's own token-free copy.
+ * It is one function for the reason {@link recordLandedPost} is: the per-surface spine and the unified spine drifted before, and a third choke point must get this or nothing.
+ */
+export declare function notePostFailure(audit: ReplyAudit | undefined, err: unknown, platform: string): Promise<void>;
+/**
+ * Should a failed post give its dedupe claim back? THE DEFINITIVE CASE MUST RELEASE: the claim is mark-then-run, so a post that threw already holds its key, and the model's most likely retry is the SAME text — without a release that retry is answered with the dedupe sentinel, `reply` reports posted, and the wake is marked ANSWERED for a message nobody ever received.
+ * THE AMBIGUOUS CASE MUST NOT: the post may already be in the room, and the claim is the only thing stopping an identical retry from saying it twice. The turn stays OPEN either way, since no mark lands, so the class decides only whether an identical retry inside the window reaches the platform.
+ */
+export declare const releasePostKeyOnFailure: (err: unknown) => boolean;
+/**
+ * Write a `reply.refused` row — the DETECTIVE half of the wake-decoy bound, and a deliberate carve-out from the actions-only posture: the SYMPTOM of this failure is the ABSENCE of rows, so a refused reply is otherwise indistinguishable from a turn that judged silence warranted. It also turns "the blast radius is bounded to availability" from reasoning into evidence an operator can count.
+ * IT ALSO RECORDS THE DECISION ON THE TURN, not only in the log. A refusal leaves the reply tool having posted nothing, which is the exact state the unified window's dropped-prose branch reads, so without this mark the log cannot say the host withheld that answer and the corrective redrive would nudge the model back towards the call the host had just refused. This is the ONE choke point every refusal row goes through, so recording here is what makes a future refusal site unable to forget. It never throws, and runs BEFORE the row.
+ */
+export declare function auditReplyRefused(audit: ReplyAudit | undefined, reason: string): Promise<void>;
+/**
+ * Write a `reply.forced` row — the model OVERRODE a host verdict on the reply path and posted anyway.
+ * It has its own action rather than a flag on the post row next door, because an override is a different EVENT: it is the one place the reply path lets the model decide against the host, so an operator must be able to COUNT it without joining and filtering the whole post stream. It pairs with `reply.refused`, and the post still writes its own `reply.post` row beside it, never instead of it.
+ */
+export declare function auditReplyForced(audit: ReplyAudit | undefined, reason: string): Promise<void>;
+/**
+ * Sentinel `id` the choke points return when a byte-identical repost was suppressed within the dedupe window — never a real platform message id, so a caller must not treat it as one to query.
+ * The genuine post's own `reply.post` row is the durable record; a suppressed repost writes NO second row, because no second post actually happened.
+ */
+export declare const REPLY_DEDUPE_SKIPPED_ID = "deduped:reply";
+/**
+ * WHAT EVERY LANDED REPLY OWES, in one place — called by BOTH choke points from inside their dedupe run, right after the platform returned the message id. It is ONE function because two call sites DRIFTED before: a standing seat on a cross-surface window replies through the other choke point, so every post it made was recorded nowhere and the next generation inherited a tail of questions with no answers. A third choke point can now only get both or neither.
+ * The two records answer different questions about the same post: the LEDGER says "this message is ours, and here is how to edit it", and the RING says "this is what was said here", which the next generation inherits. Both are best-effort and neither throws, and a `null` edit locus skips only the ledger write, because the two are independent facts.
+ */
+export declare function recordLandedPost(input: {
+    readonly org: string | undefined;
+    readonly editLocus: EditLocus | null;
+    readonly messageId: string;
+    readonly body: string;
+    readonly platform: string;
+    /** The wake this post ANSWERED, where the choke point holds one (OPE-905). Both callers read it
+     *  off the same `ReplyAudit` they already pass `org` from. */
+    readonly wake?: string | undefined;
+}): Promise<void>;
+/**
+ * Post a NEW message into the session's conversation and return its id — the audit and output anchor. This NOTIFIES: it is a real reply, and it throws an honest, token-free error if the post did not land, so the model reads the failure and can call again. There is NO fallback to the turn's closing text (OPE-2006): that text is dropped on every seat, so a post that did not land is an answer that did not leave.
+ * THE CHOKE POINT: the single canonical `reply.post` row is written HERE, immediately after the platform returns the id — audit where the bytes leave — and it lands even under the egress spoof, because the eval targets score from the row. It is also IDEMPOTENT across a step re-run or a genuine double call, keyed on the target and the text: two distinct tool invocations with the same wake and the same bytes are something nothing upstream of this seam could catch.
+ */
+/**
+ * `replier` marks THIS reply as a worker or delegated turn's, and is present only for a task-grain session. A surface that can vary its per-message display name passes it straight through to its arm, unchanged.
+ * Every other surface gets the shared bracket prefix baked into the posted BODY ONCE, here at the choke point, before dedupe-keying and dispatch — so the prefix is part of the idempotency key too, and a worker reply and a supervisor reply with the same underlying text are correctly different posts.
+ */
+export declare function postReply(target: ReplyTarget, text: string, audit?: ReplyAudit, replier?: ReplierLabel): Promise<string>;
+/**
+ * Post a HOST-AUTHORED notice — never a `reply.post` row, by construction. It is {@link postReply} with the audit parameter REMOVED FROM THE SIGNATURE, not merely omitted at the call site.
+ * Exporting the bare function to a provider bundle would hand every provider channel a way to post a MODEL's actual answer with no row, silently breaking the "one canonical `reply.post` per byte-leaving post" invariant and the eval scorers' join on that action. A caller that cannot pass an audit struct cannot make that mistake.
+ */
+export declare function postHostNotice(target: ReplyTarget, text: string): Promise<string>;
+/**
+ * The {@link EditLocus} for a resolved per-surface {@link ReplyTarget} — the host-resolved half of `edit_reply`'s address, and the key the own-post ledger records under.
+ * Deliberately NOT {@link replyDedupeLocus}, though both read the same union: that one builds a DEDUPE key, so it may composite fields freely, while an edit locus is an ADDRESS an arm dispatches on. PURE, and the ONE definition both the ledger write and the edit read use, so a message can only be edited at the address it was posted to. `null` for a surface with no editable address.
+ */
+export declare function replyEditLocus(target: ReplyTarget): EditLocus | null;
+//# sourceMappingURL=reply-post.d.ts.map

package/dist/agent/channels/reply-post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reply-post.d.ts","sourceRoot":"","sources":["../../../agent/channels/reply-post.ts"],"names":[],"mappings":"AAGA,OAAO,EAAmE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAM/H,OAAO,EAAkD,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AASjD,YAAY,EAAE,YAAY,EAAE,CAAC;AAE7B;;;GAGG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF;IAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAI5D;IACE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;+EAE2E;IAC3E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC,GACD;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,GAGjI;IAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAIvH;IAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnJ;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,GAAG,WAAW,GAAG,IAAI,CAgB3E;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,CAiC3G;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI3D;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB9H;AA6CD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElH;AAED;;;GAGG;AACH,eAAO,MAAM,uBAAuB,QAAS,OAAO,KAAG,OAAqD,CAAC;AAE7G;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBpG;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBnG;AA+BD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAEvD;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;kEAC8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;AAED;;;GAGG;AACH;;;GAGG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAoE9H;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,CAgCpE"}