@open-everywhere/core 0.1.0

package/dist/agent/channels/unified-window.d.ts

@@ -0,0 +1,550 @@
+import type { VendorEventTime } from "./wake-timing.js";
+import type { SurfaceBinding } from "../identity/binding.js";
+import { isFrozenSurfaceBinding } from "../identity/frozen-surface-binding.internal.js";
+import { type RequesterVerdict } from "../access/requester-identity.js";
+/**
+ * Where a single-window wake CAME FROM — the reply target the map stores, one variant per surface wired into the single-window mode. A new surface adds a variant here and a post arm in the reply dispatch.
+ * Every field is host-extracted from the verified webhook payload, or its enrichment, at dispatch time, and never model-authored.
+ */
+export type UnifiedWakeOrigin = {
+    readonly platform: "slack";
+    readonly channelId: string;
+    /** Present ⇔ the triggering message was itself in a thread (reply threads there);
+     *  absent ⇔ a top-level channel message (reply posts top-level) — planSupervisorReply's
+     *  exact semantics. */
+    readonly threadTs?: string;
+    /**
+     * The trigger message's own ts, set for EVERY top-level channel trigger — an addressed @mention and an AMBIENT channel-watch wake alike. The reply leg threads the answer under the message that woke the seat, while `threadTs` keeps its LOAD-BEARING absence: it doubles as the thread-scoped predicate and the ownership thread key, and both must keep reading a top-level wake as top-level.
+     * A DM-family origin sets it NEVER, because threading a 1:1 answer shatters the conversation. An origin with no triggering message — a routine fire — sets it never either, and posts top-level.
+     */
+    readonly replyAnchorTs?: string;
+} | {
+    readonly platform: "github";
+    readonly owner: string;
+    readonly repo: string;
+    /** The issue (or PR timeline) number the comment landed on — /issues/{n}/comments covers both. */
+    readonly issueNumber: number;
+    /** The webhook delivery's installation id — lets the reply mint a token for the RIGHT
+     *  installation without an owner→installation config lookup. */
+    readonly installationId?: number;
+} | {
+    readonly platform: "linear";
+    /**
+     * MENTION origin — the OPEN Linear Agent Session the reply COMPLETES. The reply is a `response` Agent Activity and NOT a comment create: the app-actor OAuth token is scoped to agent SESSIONS, not raw issue mutation, so a comment create on the issue fails outright. The @mention divert keeps this session OPEN with a non-terminal thought, so the async unified answer can land in it.
+     * REQUIRED and non-empty for a MENTION origin, ABSENT for an AMBIENT origin, which has no agent session — {@link isUnifiedWakeOrigin} enforces exactly one of the two shapes.
+     */
+    readonly agentSessionId?: string;
+    /**
+     * AMBIENT origin, set exactly when `agentSessionId` is absent: a non-@mention Linear comment on a cross-surface team joins the shared window like every other surface's ambient wake, but it has NO agent session.
+     * Its reply route is therefore a WORKSPACE-token comment create into the issue thread, the same mechanism the native per-team supervisor uses, and never an agent activity. The validator requires a non-empty `issueId` for this variant, because that is the create target.
+     */
+    readonly ambient?: true;
+    /** The Linear issue the wake fired on — a globally-unique id. On a MENTION origin: audit/context
+     *  (the agent session is the reply target). On an AMBIENT origin: THE `commentCreate` target.
+     *  Frozen from the enriched trigger comment. */
+    readonly issueId: string;
+    /**
+     * The thread-root comment the trigger nested under — the trigger's parent when it was itself a threaded reply, else the trigger comment.
+     * On a MENTION origin it is context only, because a response lands in the session and not in a threaded comment; on an AMBIENT origin it is the create `parentId`, so the reply threads under the trigger. Absent ⇒ a top-level issue comment.
+     */
+    readonly parentId?: string;
+    /**
+     * The Linear WORKSPACE the wake came from. A Linear access token is workspace-scoped, so the reply resolves the credential registered for THIS organization.
+     * Absent — every row stored before this field existed, and every single-workspace deployment — ⇒ the unchanged primary chain.
+     */
+    readonly organizationId?: string;
+} | {
+    readonly platform: "notion";
+    /**
+     * The inline discussion thread the trigger comment lives in — the reply's `discussion_id` target. A reply into an EXISTING discussion targets the discussion id, while a block parent would mint a NEW discussion.
+     * Frozen host-side from the RETRIEVED trigger comment at dispatch time.
+     */
+    readonly discussionId: string;
+    /** The page the discussion is anchored on — audit/context, never the post target. */
+    readonly pageId?: string;
+    /** The Notion workspace the page lives in — audit/context, never the post target. */
+    readonly workspaceId?: string;
+    /**
+     * The Notion integration the DELIVERY that minted this origin was VERIFIED under, frozen host-side so the unified reply posts under the credential that fetched the trigger.
+     * Absent on a row minted before the stamp ⇒ the arm falls back to the page's domain binding. The codec tolerates it as an extra field, so stored rows on either side of the change re-validate.
+     */
+    readonly credentialId?: string;
+} | {
+    readonly platform: "discord";
+    /**
+     * The conversation the trigger arrived in — the reply's channel-post target. A Discord thread IS its own channel id, so a threaded trigger's reply lands in its thread with no extra field: Slack's `threadTs` semantics collapse into this one id.
+     * Frozen host-side from the verified relay payload at dispatch time.
+     */
+    readonly channelId: string;
+    /**
+     * The guild the channel lives in — REQUIRED, deliberately. The Discord privacy floor never admits a guildless DM or group-DM surface into a shared window, and this validator enforces the SAME invariant on the reply path.
+     * A guildless origin fails {@link isUnifiedWakeOrigin}, so it resolves null and posts NOTHING — defence in depth against a mis-minted origin.
+     */
+    readonly guildId: string;
+    /** The triggering message id — the reply's message_reference anchor so the answer visibly
+     *  attaches to the mention in a busy channel. Best-effort (fail_if_not_exists=false
+     *  degrades to a plain channel post when the trigger was deleted). */
+    readonly messageId?: string;
+    /**
+     * Set ONLY for an ADDRESSED mention in a base, auto-threadable channel: the thread name the reply leg uses to open a thread off `messageId` and answer there, restoring the native path's auto-thread UX that the window divert otherwise skips.
+     * Fail-open — a failed thread create degrades to today's in-channel reply. An ambient or thread-borne wake never sets it.
+     */
+    readonly autoThreadName?: string;
+    /**
+     * THE POSITIVE THREAD SIGNAL (OPE-1719). Literal `true`, set at mint ONLY when the relay payload's channel type IS a thread type, and never set otherwise — so {@link isThreadScopedWakeOrigin} can answer Discord the way it answers Slack's `threadTs`.
+     * A Discord thread is its OWN channel id, so `channelId` alone cannot tell a thread from a plain channel. Without this field the owned-thread ingress router had to read every Discord wake as top-level, which is why the flag existed as a declared gap rather than a routing bug.
+     * ABSENT on every row already on disk, which reads as "not thread-scoped" — the fail-closed direction, and byte-identical to the behaviour before this field existed.
+     */
+    readonly thread?: true;
+} | {
+    /**
+     * DISCORD DM and GROUP-DM — a SECOND, positively-discriminated discord variant, and deliberately NOT a relaxation of the guild variant's `guildId` requirement. Relaxation-by-omission would be a real hole: the divert builder mints an EMPTY `guildId` and relies on the upstream privacy floor having refused a guildless surface before it ever gets there, so if "no guildId" became a VALID shape that empty value would start validating, and one regression in the floor would silently promote a DM into the shared-window reply path. A variant keyed on a positive `dm: true` — a flag the divert builder never sets, on either path — cannot be reached that way.
+     * 🔴 THE INVARIANTS THIS VARIANT MUST NEVER WEAKEN, mirrored in the codec's validator. A guildless origin is never admitted BY OMISSION, only by an explicit `dm: true`. The shared-window divert path cannot mint one. The check is an XOR in BOTH directions, so `dm:true` beside a non-empty `guildId` is INVALID rather than "one wins" — that is the impersonation direction, where a DM-shaped row acquiring guild authority would reach guild-keyed thread refs, engagement marks and vouch keys. No `autoThreadName` here, in the TYPE and in the validator, because its reply-leg branch is guild-keyed and a DM carrying it would write engagement rows under an undefined guild. The privacy floor does not move: it still refuses every guildless surface unconditionally, and a DM origin exists only on a DM-anchored TASK window admitted by byte-equality against the anchor surface. Approval decision wakes stay guild-only.
+     */
+    readonly platform: "discord";
+    /** The DM / group-DM channel — the whole address. `POST /channels/{id}/messages` under the
+     *  bot token is all a Discord DM reply needs, and there are no threads in a DM. Host-derived
+     *  from the binding's own post-back target (the verified relay payload's channel id). */
+    readonly channelId: string;
+    /** THE DISCRIMINANT. Literal `true`, required, and the only thing that admits this shape. */
+    readonly dm: true;
+    /**
+     * The triggering message id — the same best-effort reply anchor the guild variant carries. Allowed here because it has no guild-keyed consequence: it is cosmetic and degrades to a plain post.
+     * That is the line for this variant — exactly the fields with guild-keyed effects are forbidden, and nothing else.
+     */
+    readonly messageId?: string;
+} | {
+    readonly platform: "teams";
+    /**
+     * Bot Connector base URL captured off the JWT-VERIFIED inbound activity — the host the reply posts through. Teams cannot be cold-addressed, so a captured reference is the only route, and this is the same field eve's own Teams send path trusts from channel state.
+     * Validated as https at both write and post time.
+     */
+    readonly serviceUrl: string;
+    /** The Bot Framework conversation id — for a channel message it carries the reply-chain
+     *  anchor (`…;messageid=<root>`), so a plain send already lands in the chain. */
+    readonly conversationId: string;
+    /** The reply-chain ROOT activity id — the trigger's `replyToId` when it was itself a reply, else the trigger activity. Absent ⇒ a plain conversation send. */
+    readonly replyToActivityId?: string;
+    /** The tenant the conversation lives in — audit/context, never the post target. */
+    readonly tenantId?: string;
+};
+/** How long a wake's reply target stays resolvable. Generous vs a turn's real lifetime (minutes)
+ *  so a slow judged turn can still answer; short enough that the map stays bounded. */
+export declare const WAKE_TARGET_TTL_MS: number;
+/** Mint one host-side wake id. UUID — unguessable and collision-free across instances; the id is
+ *  a routing key the model echoes back, never a secret. */
+export declare function mintWakeId(): string;
+/** The two-method slice of OperationalStore this module needs (injected for deterministic tests;
+ *  live callers pass getOperationalStore()). */
+export interface UnifiedWakeTargetStore {
+    putUnifiedWakeTarget(org: string, wakeId: string, targetJson: string, at: string, ttlMs: number, windowToken?: string, inbound?: boolean): Promise<void>;
+    getUnifiedWakeTarget(org: string, wakeId: string): Promise<string | null>;
+}
+/**
+ * The FULL stored row for one wake — the wake map's own shape, which the operational store type-imports and both adapters return.
+ * `getUnifiedWakeTarget` returns only `targetJson`, because its callers do not need the lifecycle flags; the answerable-reply fence does, and reads THIS instead.
+ */
+export interface UnifiedWakeRecord {
+    /** The serialized {@link UnifiedWakeOrigin} — opaque to the store, re-validated on read. */
+    readonly targetJson: string;
+    /** ISO-8601 registration stamp — the READ-TIME TTL key (see {@link resolveAnswerableReplyTarget}). */
+    readonly createdAt: string;
+    /** The BARE window token this wake was dispatched to. Absent on a legacy (pre-migration) row ⇒
+     *  the row NEVER qualifies for the pending arm (fail-closed), only for the this-turn arms. */
+    readonly windowToken?: string;
+    /** ISO-8601 when a reply marked this wake answered; absent ⇒ still pending. */
+    readonly answeredAt?: string;
+    /** The turn that answered it — the SAME-TURN re-accept key (a turn may keep replying to a wake
+     *  it already marked). Absent ⇒ unknown turn ⇒ compares unequal ⇒ fail-closed. */
+    readonly answeredTurnId?: string;
+    /**
+     * ISO-8601 when the turn-end wake-accounting AUDIT considered this wake; absent ⇒ no turn has audited it yet.
+     * This is the ACCOUNTING horizon and nothing else: no gate reads it, and the pending-wake query neither filters nor projects it, so the horizon cannot change what the reply-freshness gate or the answerable-reply fence sees.
+     */
+    readonly auditedAt?: string;
+    /**
+     * Did this wake carry a message FROM A ROOM — an ATTENDED arrival — rather than one the deployment minted for itself (a task spawn, a completion wake, an approval-decision wake, the auto-redrive, a routine fire)? Host-decided at the divert from the same `internalDispatch` fact the spend gate turns on, and STICKY-TRUE on upsert, so a re-drive cannot clear a flag a person's message set.
+     * PROJECTED SINCE OPE-2051, which is the first reader outside the two pending-wake queries that already FILTER on it: `hooks/turn-anchor.ts` asks it at turn end to decide whether this turn may retire a cancel reconstruction. ABSENT means unknown — a legacy row, or a per-surface delivery that registers no row at all — and every reader must read absent as ATTENDED, which is the behaviour those deployments already have.
+     */
+    readonly inbound?: boolean;
+}
+/** Exact per-wake authority captured before Eve may coalesce another delivery into the same turn.
+ * Every field comes from this wake's own verified ingress; consumers must read the snapshot as one
+ * unit so binding A can never be paired with requester or membership facts from later wake B. */
+export interface UnifiedWakeAuthority {
+    readonly binding: SurfaceBinding;
+    readonly requester: RequesterVerdict;
+    readonly nonMemberWake: boolean;
+}
+/** Authority plus the routing facts validated from the same durable wake row. */
+export interface ResolvedUnifiedWakeAuthority extends UnifiedWakeAuthority {
+    readonly origin: UnifiedWakeOrigin;
+    readonly surfaceKey: string;
+}
+/** Strict codec for authority crossing the host dispatch and durable-store seams. Relational
+ * checks against origin/surface/org happen at those seams, where those values are available. */
+export declare function isUnifiedWakeAuthority(value: unknown): value is UnifiedWakeAuthority;
+/**
+ * One UNANSWERED wake row, as the reply FRESHNESS gate reads it — a narrow projection of {@link UnifiedWakeRecord}.
+ * The gate needs the id, to exclude the wakes this turn has seen, the origin, to decide which rows name the conversation it is about to post into, and the stamp, its read-time TTL bound. It never needs the answered columns, because the query already excludes an answered row.
+ */
+export interface PendingUnifiedWake {
+    readonly wakeId: string;
+    /** The serialized {@link UnifiedWakeOrigin} — opaque to the store, re-validated on read. */
+    readonly targetJson: string;
+    /** ISO-8601 registration stamp. */
+    readonly createdAt: string;
+}
+/** The wake-map slice the ANSWERABLE-reply fence needs on top of {@link UnifiedWakeTargetStore} — its own extension, so the two-method slice stays the much wider contract every register and resolve caller, and every test fake, satisfies. */
+export interface AnswerableWakeStore extends UnifiedWakeTargetStore {
+    getUnifiedWakeRecord(org: string, wakeId: string): Promise<UnifiedWakeRecord | null>;
+    markUnifiedWakeAnswered(org: string, wakeId: string, at: string, turnId?: string): Promise<void>;
+}
+/**
+ * Record one wake's origin in the durable map — called by the unified channel's `receive` hook BEFORE the send, so the mapping exists before the model could possibly reply to the wake. `windowToken` is the BARE token the wake is dispatched to, host-known at the call site and never model-authored: it is the cross-domain fence the pending arm of {@link resolveAnswerableReplyTarget} checks, and omitting it stores NULL, so the row can only ever be answered as this turn's own wake — the honest degrade. `addressing` rides as a TOLERATED EXTRA FIELD on the stored origin JSON rather than as a new column: the blob is already opaque and re-validated structurally on read, so an extra key round-trips untouched and every existing reader is unaffected.
+ * `inbound` says this wake carries a real message FROM THE ROOM, as opposed to one the deployment minted for itself — a task-window opening wake, a completion wake, an approval decision, the auto-redrive. ONLY the reply FRESHNESS gate reads it, and it is why that gate is correct rather than coincidentally correct: an internal wake is not news the room is waiting on, so counting one would refuse the hand-off note of every delegating turn. The divert is the single site that knows an arrival is ATTENDED, so it is the only caller that ever passes `true`; everything else omits it and is excluded by default, the fail-safe direction, where a mis-classified wake costs a missed refusal and never a false one. 🔴 IT IS STICKY-TRUE: the redrive re-registers an EXISTING wake id as an internal dispatch, so a plain overwrite would clear the flag on a row that really did carry a human's message — both adapters OR the new value onto the stored one, and nothing ever turns an inbound row internal.
+ */
+export declare function registerUnifiedWakeTarget(store: UnifiedWakeTargetStore, org: string, wakeId: string, origin: UnifiedWakeOrigin, atIso: string, windowToken?: string, inbound?: boolean, addressing?: string, surfaceKey?: string, binding?: SurfaceBinding, authority?: UnifiedWakeAuthority): Promise<void>;
+/** Pair the provider's post-back target with the provider origin stored beside it. Platform and
+ * surface-key equality alone do not stop a same-provider channel A origin carrying channel B's
+ * authority. Only fields both shapes define are compared; every comparison is host-derived. */
+export declare function wakeBindingMatchesOrigin(binding: SurfaceBinding, origin: UnifiedWakeOrigin): boolean;
+/** Strictly admit the sanitized binding snapshot stored beside a wake's origin. */
+export declare const isWakeSurfaceBinding: typeof isFrozenSurfaceBinding;
+/**
+ * Pair a wake's configured window grain with the binding frozen at ingress. Most providers use the
+ * conversational surface for both. Discord threads and Teams reply chains deliberately split them:
+ * `surface` remains the exact reply target while `domainSurface` names the parent channel that owns
+ * standing-window membership. Admit only those two host-captured values under the binding's exact
+ * platform/workspace prefix; never infer membership from an arbitrary sibling in the same domain.
+ */
+export declare function wakeBindingMatchesSurfaceKey(binding: SurfaceBinding, surfaceKey: unknown): surfaceKey is string;
+/** Resolve the host-captured authority for a wake as one validated snapshot. Legacy rows have none
+ * and fail soft; no consumer may independently join turn-global identity to this per-wake row. */
+export declare function resolveUnifiedWakeAuthority(store: UnifiedWakeTargetStore, org: string, wakeId: string): Promise<ResolvedUnifiedWakeAuthority | undefined>;
+/** Compatibility projection for readers that need only placement. */
+export declare function resolveUnifiedWakeBinding(store: UnifiedWakeTargetStore, org: string, wakeId: string): Promise<SurfaceBinding | undefined>;
+/** Resolve the exact surface key frozen beside a wake, or `undefined` for a malformed/legacy row. */
+export declare function resolveUnifiedWakeSurfaceKey(store: UnifiedWakeTargetStore, org: string, wakeId: string): Promise<string | undefined>;
+/**
+ * Read the `surfaceKey` extra field back off a stored wake row's `targetJson` — the fully-qualified
+ * `platform/workspace/surface` the DIVERT dispatched this wake from, frozen host-side at mint.
+ *
+ * 🔴 WHY THE ROW CARRIES IT AT ALL (OPE-1756). A propose site derives its scope with
+ * `resolvePartition(ctx)`, and on a MERGED turn that ctx is the LAST delivery the merge kept — not
+ * the wake that carried the ask. The origin alone cannot repair that: a `UnifiedWakeOrigin` names a
+ * container and a thread, and no surface's origin carries the tenant segment a surfaceKey needs
+ * (`unifiedThreadRef` answers `slack/<channel>`, never `slack/<team>/<channel>`). So the one honest
+ * source is the divert's OWN `input.surfaceKey`, written beside the origin the same way `addressing`
+ * is — a tolerated extra field on an already-opaque blob, invisible to `isUnifiedWakeOrigin`.
+ * The auth-carrying merge is unreachable on eve 0.54.3 — see this module's header — so the frozen
+ * key is still LOAD-BEARING: the fence admits sibling wakes with no merge at all (OPE-2042).
+ *
+ * Pure, total and never throws: a malformed row, or any row minted before this field existed,
+ * answers `undefined`, and the caller then keeps `resolvePartition(ctx)` — today's behaviour exactly.
+ */
+export declare function wakeSurfaceKeyFromTargetJson(targetJson: string): string | undefined;
+/**
+ * Read the `addressing` extra field back off a stored wake row's `targetJson`, without touching the strict {@link isUnifiedWakeOrigin} origin validator.
+ * Pure, total and never throws: a malformed or pre-this-field row answers `undefined`, which the accounting audit reads as ambient — the under-count direction for a measurement pass, never a false "addressed".
+ */
+export declare function wakeAddressingFromTargetJson(targetJson: string): string | undefined;
+/**
+ * Resolve a wakeId back to its origin, FAIL-CLOSED: an unknown id, an expired row, malformed JSON, or a shape that is not a known origin variant all yield null.
+ * The caller then posts NOTHING rather than guessing — the same "no valid target ⇒ no post" property the per-surface reply planner has.
+ */
+export declare function resolveUnifiedWakeTarget(store: UnifiedWakeTargetStore, org: string, wakeId: string): Promise<UnifiedWakeOrigin | null>;
+/**
+ * Do two wake origins name the SAME conversation, the same container and the same thread? The canonical identity is {@link unifiedThreadRef}, so two different threads, channels or platforms never collide, and two wakes that landed in the SAME thread always match. A top-level wake's thread key falls back to its container id, and UX-only fields like a Slack reply anchor or a Discord message id are deliberately NOT part of the identity.
+ * The reply authority fence uses it: a delegated-completion turn is driven by an INTERNAL completion wake whose id the model does not echo, so it answers the ORIGINAL user message whose wake-id it still sees in context. Both wakes were registered against the same conversation, so this equality lets the legitimate delegated reply through WITHOUT loosening the fence — a wake naming a DIFFERENT conversation still fails, so you can still only post where THIS turn's wake points.
+ */
+export declare function sameUnifiedConversation(a: UnifiedWakeOrigin, b: UnifiedWakeOrigin): boolean;
+/**
+ * WHERE INSIDE its conversation a post for `origin` hangs — the platform's own
+ * {@link WakeOriginCodec.placementRef}, or `undefined` for an unregistered platform, a codec that
+ * declares no placement axis, or an arm that answered empty.
+ *
+ * PURE AND TOTAL: a throwing arm answers `undefined`, which reads as "no placement" — the same
+ * direction an absent arm reads, so a broken provider degrades to today's behaviour and never to a
+ * guess.
+ */
+export declare function unifiedPlacementRef(origin: UnifiedWakeOrigin): string | undefined;
+/**
+ * Do two origins agree about WHERE INSIDE the conversation their post hangs?
+ *
+ * 🔴 A CONVERSATION IS NOT A PLACEMENT, and this is the predicate whose absence let that confusion
+ * ship (OPE-1827). {@link sameUnifiedConversation} compares {@link unifiedThreadRef} alone, and on
+ * Slack a TOP-LEVEL wake's thread key IS its channel id — so two top-level wakes in one channel, each
+ * carrying a different `replyAnchorTs`, compare EQUAL as conversations while naming two different
+ * messages to hang under. A caller that reads that equality as "nothing to do" keeps whichever anchor
+ * it already had, which is how a coalesced retarget left a task pointing at the wrong message inside
+ * the right room.
+ *
+ * Two origins on DIFFERENT platforms are never asked: a cross-platform pair is not one conversation,
+ * so its placements are not comparable, and this answers `false` rather than comparing two surfaces'
+ * unrelated id spaces.
+ */
+export declare function sameUnifiedPlacement(a: UnifiedWakeOrigin, b: UnifiedWakeOrigin): boolean;
+/**
+ * `target`, carrying `source`'s POST PLACEMENT where `target` holds none of its own — the fix for a
+ * reply that answers a SIBLING wake and lands in the wrong place inside the right conversation.
+ *
+ * 🔴 WHY A CONVERSATION IS NOT A PLACEMENT. {@link sameUnifiedConversation} compares
+ * {@link unifiedThreadRef} alone, and on Slack a TOP-LEVEL origin's thread key is its CHANNEL id: a
+ * top-level wake is top-level for identity even though its answer opens a thread on the message that
+ * woke it, and that placement rides `replyAnchorTs`, deliberately outside the identity (OPE-759,
+ * slack-events.ts). So EVERY top-level wake in one Slack channel is one conversation, carrying a
+ * different anchor each — and an origin minted for a message that answers nothing (a routine fire, a
+ * webhook post-back) carries no anchor at all while passing the same test. Handing such an origin
+ * straight to the post arm puts the answer FLAT on the channel, under no message, while this turn's
+ * own wake names the message the room is waiting under.
+ *
+ * PURE AND TOTAL. A cross-platform pair, an unregistered platform, a codec with no arm, and a
+ * throwing arm all answer `target` unchanged.
+ *
+ * 🔴 THIS CAN NEVER MOVE A POST, AND THE GUARANTEE IS ENFORCED HERE RATHER THAN ASSUMED OF THE ARM.
+ * A codec arm is PROVIDER code, so the narrowing contract stated on {@link WakeOriginCodec} —
+ * fill a placement the target lacks, never overwrite one — is a requirement this module cannot see a
+ * platform break: `validate` accepts a whole different `channelId` or an invented `threadTs`, because
+ * its job is tolerating rows already on disk. So the carried origin is re-validated AND re-tested for
+ * the conversation the caller already proved: a changed container moves `channelKey`, an invented
+ * thread scope moves `threadKey`, and either answers `target` instead. The legitimate carry moves
+ * neither. Without this line the property would rest on an arm's good behaviour, which is the one
+ * thing a comment cannot prove.
+ */
+export declare function withCarriedPlacement(target: UnifiedWakeOrigin, source: UnifiedWakeOrigin): UnifiedWakeOrigin;
+/**
+ * The origin of the conversation THIS TURN IS BOUND TO — the origin `turnWake` was registered
+ * against — or `undefined` when the turn holds no wake, the row is gone, or the store could not
+ * answer (OPE-1524).
+ *
+ * 🔴 IT ANSWERS AN ORIGIN, NOT A KEY, and that is the whole design. The question a caller really has
+ * is "does the origin I resolved name the conversation this turn is bound to?", and the honest way
+ * to ask it is {@link sameUnifiedConversation} over two origins. Re-deriving a platform's registry
+ * key at a second site to compare keys is the shape OPE-1520 refused: two sites deriving one key
+ * drift, and a drifted key reads a stop that is not there or misses one that is.
+ *
+ * FAIL-SOFT: every unknown answers `undefined`, so a caller gating a guard on this gets the guard
+ * OFF rather than a guess. Callers that must not lose the narrow case keep their own `inputWake ===
+ * turnWake` arm as a floor — this predicate is a widening, never a replacement.
+ */
+export declare function boundConversationOrigin(store: UnifiedWakeTargetStore, org: string, turnWake: string | undefined): Promise<UnifiedWakeOrigin | undefined>;
+/**
+ * Is a delivery to `origin` under `deliveredWake` the settlement report owed to `owedWake`?
+ *
+ * 🔴 THE OWED WAKE IS ALMOST NEVER THE WAKE THE MODEL ANSWERS UNDER, which is why this compares
+ * CONVERSATIONS and not ids. The duty is armed with the wake the SETTLEMENT installed — the task's
+ * own reply address (`hooks/spawn-taint.ts`) — while the model replies under the wake of the
+ * conversation that asked. The two name one room through two ids, so an id comparison answers false
+ * on the ordinary case and the caller silently gets the wrong verdict.
+ *
+ * 🔴 AND THE CONVERSATION IS CHECKED, NOT THE TURN (OPE-1655). A standing seat holds several
+ * conversations in one turn: A, where it said "I've started …", and B, a queued question. A's worker
+ * settles and the duty arms; the model then answers B. Treating any delivery as the report would
+ * discharge the duty and write a row naming B — a row asserting room A was told, while room A heard
+ * nothing.
+ *
+ * SAME-WAKE FIRST, so the case that needs no store read pays for none. BEST-EFFORT: an unresolvable
+ * owed wake answers false, which leaves the duty ARMED and the fold policy ON — for both callers the
+ * conservative direction, and never a false link.
+ */
+export declare function deliveryReachedOwedConversation(store: UnifiedWakeTargetStore, org: string, owedWake: string, deliveredWake: string, origin: UnifiedWakeOrigin): Promise<boolean>;
+/**
+ * Do two wake origins name the same CONTAINER — the room a member reads, one rung wider than {@link sameUnifiedConversation}'s thread? The container is the thread ref's channel key alone: a Slack channel, a Discord channel, a GitHub issue, a Linear issue.
+ * 🔴 THE CONTAINER IS THE UNIT A CONTRADICTION IS VISIBLE IN, which is why this exists beside the thread comparator rather than replacing it. Linear renders every agent activity on ONE issue feed, so an answer posted for one wake and a "no response needed" posted for a sibling wake sit side by side even when their thread keys differ. The close gate therefore asks the CONTAINER question, and the authority fence keeps asking the thread question — a wider container must never widen where a reply is allowed to land.
+ */
+export declare function sameUnifiedContainer(a: UnifiedWakeOrigin, b: UnifiedWakeOrigin): boolean;
+/**
+ * The reply authority fence's verdict — either the origin to post to, plus WHICH arm admitted it for audit and diagnosis, or a fail-closed reason.
+ * The reply tool maps each reason to its instructive error: mismatch to the authority-fence message, expired to "no longer on record", answered to the "you already replied to this wake" steer.
+ */
+export type AnswerableReplyResolution = {
+    readonly ok: true;
+    readonly origin: UnifiedWakeOrigin;
+    readonly via: "turn" | "same-conversation" | "pending";
+} | {
+    readonly ok: false;
+    readonly reason: "mismatch" | "expired" | "answered";
+};
+/**
+ * THE SAME-TURN REFUSAL COPY — what the model reads when it replies again, in ONE turn, to a wake it
+ * already answered with `done: true` (channels/reply-signal.ts §DONE-VALVE, applied in
+ * tools/reply.ts).
+ *
+ * 🔴 IT IS A VALVE (OPE-1452, and Tommy's ruling of 2026-09-03: "we should never be hard-blocking
+ * this, it's okay for the model to double-post, just discouraged"). This arm fires on a wake the
+ * fence already ADMITTED — arm 2 takes this turn's own wake unconditionally — so the host CAN post
+ * this message and is choosing not to. That choice is the model's to overturn, and the sentence that
+ * opens the valve states its cost.
+ *
+ * It is therefore NOT the copy for the one route where the second post is impossible rather than
+ * unwanted. There the reply tool throws {@link replyRefusalMessage}'s `answered` arm instead, which
+ * is the same body with no valve on the end — see `terminalPostClosesConversation`
+ * (channels/unified-reply.ts).
+ *
+ * The body is {@link answeredBody}, shared with the fence's own `answered` refusal, and the valve is
+ * {@link secondMessageValve}, shared with the should-be-edit policy. This function adds no words of
+ * its own: one word, one meaning, in both directions.
+ *
+ * The valve always names `force`, with no parameter to say otherwise, because this guard exists on
+ * ONE variant: `isWakeDoneThisTurn` is read only by the unified `reply`, and that variant holds a
+ * `force` input. A `canForce` switch here would be a branch no caller can select.
+ */
+export declare function answeredThisTurnRefusalMessage(inputWake: string): string;
+/**
+ * THE REFUSAL COPY — the prose the model reads back when the fence says no, and a security-relevant string rather than error decoration. A diverted fire is given a TRUSTED block naming its own wake-id, because a model with no id invents one, is refused, and gives up, which was a total outage of the triggered plane. That disclosure made the wake-id a string with a KNOWN NAME, a KNOWN FORMAT and a KNOWN CONSEQUENCE for getting it wrong — exactly what a decoy needs, since untrusted payload content can carry reminder-shaped markup naming some OTHER id, and the untrusted wrapper defangs its own delimiters but does not, and should not, rewrite arbitrary markup inside the payload. The blast radius of believing a decoy is therefore AVAILABILITY, never authority: the id names no wake this session holds, so the fence refuses it exactly as it refuses a hallucinated one, and the worst case is a fire that goes quiet. That bound is real, and it is the outage shape itself, which is why "bounded" was never the same as "harmless". So on `mismatch` the copy RE-DISCLOSES the id THIS turn was actually delivered under, costing a decoyed or hallucinated attempt a retry instead of the turn — which discloses NOTHING NEW, because that is the host-set stamp for this very delivery, already accepted unconditionally by the fast-path arm and already named by the envelope. It is deliberately NOT a list of every answerable wake: the pending arm would admit those, but the model was never SHOWN them, and handing it addresses it never saw would widen reach, not legibility. It also names the decoy vector explicitly, because the one thing that reliably distinguishes the trusted id from a decoy is POSITION — inside the untrusted fence or outside it.
+ * 🔴 `silent` IS THE CARVE-OUT, AND IT IS LOAD-BEARING. A silent routine's fire is delivered WITHOUT the mandate precisely so the disclosure cannot become the way a silent routine starts talking — but the wake row is still registered and the stamp is still set, so re-disclosing it here would hand a silent fire the one thing that carve-out withholds, through the back door of an error message. The caller passes the same per-turn signal, off the same host-set unforgeable stamp, that drops the terminal prose, so silence has ONE reader. It fail-softs to false, which is not a weakening: a turn where that signal is unavailable is a turn where the terminal-prose drop is unavailable too, so silence is already off either way.
+ */
+export declare function replyRefusalMessage(reason: "mismatch" | "expired" | "answered", inputWake: string, opts?: {
+    readonly turnWake?: string;
+    readonly silent?: boolean;
+}): string;
+/**
+ * Resolve the reply target for a unified-session `reply`, enforcing the authority fence. THE ARMS, IN ORDER. (1) No `turnWake` ⇒ `mismatch`: a session with no wake stamp can never reply. (2) `inputWake === turnWake` ⇒ resolve it, `via:"turn"`, and NEVER consult the answered mark, because the current turn may keep replying to its own wake — the one same-turn repeat the product refuses, the same wake after `done:true`, is caught BELOW this fence, in the reply tool, on the origin this fence hands back — it reads that origin to tell a second post the room can still take from one it cannot (OPE-1452) — and a multi-part answer passing `done:false` still lands here repeatedly. (3) A DIFFERENT id where BOTH resolve and {@link sameUnifiedConversation} holds ⇒ `via:"same-conversation"`, the delegated-completion arm. (4) The PENDING arm: the echoed id names a live wake on THIS window that nobody has answered yet. Arm 4 exists because a turn that MERGED deliveries keeps only the LAST one's auth, so the older predicate let a turn answer exactly ONE of the N conversations it was woken by; what is given up is only the narrower CLAIM that a turn may answer one conversation, an artefact of the merge rather than a security property. (The auth-carrying MERGE is unreachable on eve 0.54.3 — see this module's header — but arm 4 is LIVE regardless: it admits a pending, unanswered wake registered on this window by an EARLIER turn, which no merge rule touches. OPE-2042.) Its refusals are all fail-closed: no window token at all, where the arm is silently unavailable and the fence degrades to the older one; no row; a malformed stored origin; a legacy row with no window token to prove which session it belongs to; a row naming a DIFFERENT window, the cross-domain fence; a past-TTL row; or one already answered by a DIFFERENT turn, where an undefined turn id compares unequal. THE MODEL STILL NEVER AUTHORS AN ADDRESS: a wake id is a host-minted UUID that appears only inside this session's own envelopes and audit rows, and arm 4 additionally requires the row to name this session's own host-stamped WINDOW TOKEN. The EDIT path uses {@link resolveEditableWakeTarget} instead, which shares every arm here except the `answered` refusal.
+ * ⚠️ THE READ-TIME TTL IS LOAD-BEARING, NOT BELT-AND-BRACES. Neither store read applies a TTL: rows die on disk only through the OPPORTUNISTIC prune on a later write in the same org, so on a quiet org an expired row stays readable for days. The old fence made that harmless, because you could only answer this turn's wake anyway; arm 4 widens authority and must not inherit it. `nowMs` is injectable purely so the bound is deterministically testable. KNOWN, ACCEPTED WIDENING: content in channel A that says "reply to wake-id U", where U is a pending wake from channel B in the same window, now succeeds where it used to be refused. The boundary is that every surface in a shared window passed the operator-VOUCH floor — admission to the window IS the operator's "these are one internal room" assertion — that a reply is non-consequential tier, and that the choke point audits every post with its wake and session ids. The narrower alternative, scoping arm 4 to the same platform or channel key, re-breaks the exact multi-conversation requirement this exists for.
+ */
+export declare function resolveAnswerableReplyTarget(store: AnswerableWakeStore, org: string, 
+/** {@link currentWakeId} — the LAST coalesced delivery's host-set `oe_wake_id` stamp. */
+turnWake: string | undefined, 
+/** `resolveOwnWindowToken` — the caller's own bare window token (continuationToken, else the
+ *  host-stamped `oe_window_token`). Absent ⇒ arm 4 is unavailable (honest degrade). */
+windowToken: string | undefined, 
+/** `currentTurnId` — the eve turn id, the same-turn re-accept key. Absent ⇒ fails closed. */
+turnId: string | undefined, 
+/** The wake-id the model echoed. */
+inputWake: string, 
+/** Injectable clock for the read-time TTL (tests); defaults to now. */
+nowMs?: number): Promise<AnswerableReplyResolution>;
+/**
+ * The EDIT path's wake resolution — every arm of {@link resolveAnswerableReplyTarget} EXCEPT the answered check. WHY THAT CHECK DOES NOT BELONG HERE: on `reply` the wake carries two meanings at once, WHERE the message goes and that the conversation is still open for an answer, while on `edit_reply` it carries the first meaning only. The verb puts no message in the room — it rewrites one this deployment already posted, and the id it rewrites passes the own-post ledger, ownership and an edit window, before any byte leaves.
+ * 🔴 THE DEFECT THIS FIXES, measured in a soak run. A member asked the agent to add a link to a status line it had posted in an EARLIER turn. The model called `edit_reply`, the right verb, and the host refused it with reason `answered`, because that earlier turn had marked the wake done. The model fell back to posting a corrected copy, and the room kept BOTH lines forever. WHAT STILL GUARDS AN EDIT: the own-post ledger, so the message must be ours, at this locus, inside the edit window; the host-resolved locus, so the model never names a conversation; the pending-work INSTRUCTION the edit tool appends while a worker this turn dispatched still owes the answer (OPE-1544 — there is no frame to re-apply, OPE-1516 deleted it); and both audit rows.
+ */
+export declare function resolveEditableWakeTarget(store: AnswerableWakeStore, org: string, turnWake: string | undefined, windowToken: string | undefined, turnId: string | undefined, inputWake: string, nowMs?: number): Promise<AnswerableReplyResolution>;
+/**
+ * Structural check that a stored value is one of the known origin variants, fail-closed on anything else — a map row is host-written, but the reply path re-validates regardless.
+ * Per-arm bodies live in the platform codecs, and an unregistered, unknown or prototype-chain `platform` misses the registry and fails CLOSED.
+ */
+export declare function isUnifiedWakeOrigin(v: unknown): v is UnifiedWakeOrigin;
+/**
+ * The (container, thread) identity of a wake's origin — the canonical, per-platform pair the async spawn primitive keys BOTH its task-window id AND its thread-ownership row on.
+ * ONE derivation, so a spawn and a later inbound message in the SAME thread resolve to the SAME keys.
+ */
+export interface UnifiedThreadRef {
+    /** The container the thread lives in — platform-prefixed so two platforms never collide. */
+    readonly channelKey: string;
+    /** The thread within the container. Falls back to the container id where a platform has no finer
+     *  thread grain (a GitHub issue / a Linear issue / a Discord thread-channel IS its own thread). */
+    readonly threadKey: string;
+}
+/**
+ * Derive the {@link UnifiedThreadRef} for a wake origin. Pure and total over the origin variants; the result feeds the task-window id (identity) and the ownership store (routing), so it must be stable for a given thread. Where a platform's thread and container collapse the two fields carry the same id, which is still a unique-per-thread key.
+ * Keys are COLON-FREE by construction, because a raw id's colons fold to an underscore for the window-id grammar. The cast covers the impossible unregistered-platform arm exactly as the old exhaustive switch's fall-through did.
+ */
+export declare function unifiedThreadRef(origin: UnifiedWakeOrigin): UnifiedThreadRef;
+/**
+ * Is this wake's origin genuinely THREAD-scoped — did the triggering message land INSIDE a thread, rather than at a container's top level? The ingress router consults ownership ONLY for a thread-scoped wake: thread sessions own THREADS, and top-level container traffic is the STANDING seat's domain unconditionally. Without this guard an ownership row keyed on the top-level fallback, legacy rows already on disk included, would CAPTURE the whole channel's top-level traffic away from the standing seat.
+ * FAIL-CLOSED per platform, so only a POSITIVE thread signal reads true. Slack: `threadTs` present, the same presence the thread ref keys on. Teams: `replyToActivityId` present, because the reply chain IS the thread. GitHub, Linear and Notion: the container and the thread coincide, so every wake is thread-scoped by construction. Discord: `thread: true` present — a Discord thread is its own channel id, so the id alone distinguishes nothing, and the gateway therefore STAMPS the signal at mint from the relay payload's channel type (OPE-1719). A Discord origin already on disk carries no `thread`, so it reads false and routes standing, exactly as before the field existed. A Discord DM never carries it, because a DM has no threads.
+ */
+export declare function isThreadScopedWakeOrigin(origin: UnifiedWakeOrigin): boolean;
+/** The COSMETIC primary container id for a wake origin's channel-locus line, which the completion-wake builder consumes. Reply targeting is by wake-id and the map, never this value — it never routes. */
+export declare function wakeOriginContainerId(origin: UnifiedWakeOrigin): string;
+/** Auth-attribute keys the single-window dispatch stamps (and binding.ts's unified hop reads). */
+export declare const OE_PLATFORM_ATTR = "oe_platform";
+export declare const OE_WAKE_ID_ATTR = "oe_wake_id";
+/** Auth-attribute key: the wake's ADDRESSING (only "direct-mention" is stamped). It marks the wake
+ *  as OWED a reply, which the envelope tells the seat; it is not a delivery path. Since OPE-1982 the
+ *  unified channel's completion handler drops a turn's closing prose on every addressing alike, so
+ *  it selects no route — but it is NOT audit-only: it classifies the drop row's `addressing` field,
+ *  `hooks/job-posture.ts` reads it as a human principal in the turn, and
+ *  `access/analytics-scope.ts` degrades analytics rows mode without it. */
+export declare const OE_ADDRESSING_ATTR = "oe_addressing";
+/**
+ * Auth-attribute key: the session's GRAIN — the PRIMARY, unforgeable signal the binding's grain resolver reads. A window divert stamps "standing" by default, while a TASK dispatch PRE-stamps "task" on the child's incoming auth and the fallback here preserves it.
+ * Host-set only and never model-authored, on the same channel as the platform stamp. A native session carries no stamp, so the token backstop classifies it native.
+ */
+export declare const OE_GRAIN_ATTR = "oe_grain";
+/**
+ * Auth-attribute key: a WORKER, task-grain session's short delegated-task label — the reply display-name and prefix TIER signal. Host-set ONCE at task dispatch from the spawn's own brief: no new tool field, and never model-authored on its own, because the model supplies the brief text and the host truncates and stamps it.
+ * NOT re-stamped on a LATER wake of the same worker thread, which re-derives the grain on every wake but has no brief to re-stamp this with. A worker reply on a resumed wake still brackets, because grain alone decides that, just with the generic fallback label.
+ */
+export declare const OE_TASK_LABEL_ATTR = "oe_task_label";
+/**
+ * Auth-attribute key: the window's SOURCES vector — the platforms whose wakes fan into this window, comma-joined. Host-set at divert time and never model-authored, the same unforgeable channel as the platform and grain stamps.
+ * A worker inherits it through the forwarded parent attributes, and the binding's window-sources reader is its consumer.
+ */
+export declare const OE_SOURCES_ATTR = "oe_sources";
+/**
+ * Auth-attribute key: the BARE window token of the session THIS delivery wakes, with no channel prefix. Host-set on every delivery and never model-authored. WHY it exists beside the continuation token: on a RESUMED standing seat, started days ago and resumed across deploys, the channel's continuation token can be ABSENT at tool-execute time, because session-static channel state degrades where per-wake auth attributes are FRESH on every delivery. The spawn guards fall back to this stamp when the token channel is blank, so a legitimate resumed seat can still delegate.
+ * 🔴 ANTI-SPOOF INVARIANT: the stamp always tells the truth about the session it wakes. An owner-divert or a task dispatch stamps the token actually being dispatched to, never the standing default, so a task worker's fallback still classifies TASK and the recursion guard holds through this channel.
+ */
+export declare const OE_WINDOW_TOKEN_ATTR = "oe_window_token";
+/**
+ * Auth-attribute key: a NONCE unique to ONE delivery, host-set by the divert and never model-authored, the same unforgeable channel as the platform and grain stamps.
+ * 🔴 IT EXISTS BECAUSE `oe_wake_id` IS NOT A PER-DELIVERY VALUE. eve writes a turn's auth only when a delivery brings one, so "this turn's stamp is byte-identical to the previous turn's" is the one structural proof that a turn brought NO delivery — the shape of a background-task settlement wake. The wake id nearly serves, because every ingress mints a fresh one, but the REDRIVE re-stamps the ORIGINAL id on purpose, so a corrective wake is a real delivery that would read as "no delivery" and lose its address. This nonce carries the "a delivery arrived" fact on its own, so the comparison never has to reason about which wake id a path chose. Its reader falls back to the wake id when this is absent, so an older deployment's auth bag degrades to the previous comparison rather than to none. NOTHING routes on it: it is compared for equality and never resolved to anything.
+ */
+export declare const OE_DELIVERY_ID_ATTR = "oe_delivery_id";
+/**
+ * The reply-anchor ts of a top-level Slack channel trigger, stamped per-delivery by the divert. Eve's NATIVE Slack adapter sets `thread_ts` to the triggering message's own ts when it is not a thread reply, and every binding consumer — approval cards, file posts, float notices — is designed against that semantic. The divert forwards the RAW event auth, where a top-level mention has no `thread_ts`, so those posts all landed at the channel root; the Slack binding falls back to this attribute, converging the divert path on the native semantic.
+ * Deliberately NOT stamped as `thread_ts` itself, and NOT set on the wake ORIGIN: the origin's `threadTs` absence is what keeps a top-level wake reading as top-level to the thread-scoped predicate and to ownership.
+ */
+export declare const OE_REPLY_ANCHOR_ATTR = "oe_reply_anchor";
+/**
+ * The grain attributes a DM-family ingress stamps — the SINGLE place the DM narrowing is expressed, so EVERY DM-family seam stamps identically: the per-surface auth builders AND the routine dispatcher, which builds a fired session's auth by hand and so bypasses the builders. A 1:1 DM and a group DM are both always-on STANDING conversational seats, closed multi-party conversations with no channel identity and the same class of seat, so their ingress positively stamps a standing grain — the PRIMARY, unforgeable signal the binding's grain resolver reads.
+ * 🔴 WITHOUT IT a real DM carries a native-shaped token that the token classifier would call "native", so the FULL wide-hands kit mounts on it and the gate reopens. The stamp is the whole fix: a positive standing claim narrows the seat, and the spoof-guard never fights a STANDING claim, because standing IS the narrow direction. A caller passes `isDm` for EITHER mode, each surface widening its own predicate, and a non-DM-family ingress gets an empty, spread-safe object, so a real channel or mention seat keeps its own grain and is never over-narrowed.
+ */
+export declare function rootDmGrainAttrs(isDm: boolean): Record<string, string>;
+/**
+ * Stamp the originating platform and wake id — plus the addressing, when the wake is an addressed mention — into an auth context's attributes. Pure: it returns a new object. The unified channel's sessions carry the ORIGINATING surface's own auth attributes verbatim, and these additions are what let the binding resolve the real platform per delivery, diagnostics tie a delivery back to its map entry, and the completion handler tell an addressed mention, owed a reply, from an ambient watch.
+ * NOT load-bearing for reply TARGETING — that is the map's job, because auth is per-turn-coalesced while the map is per-wake. `addressing` is only ever the addressed-mention value or absent, and absent ⇒ no attribute ⇒ ambient treatment, the safe default.
+ */
+export declare function stampUnifiedWindowAuth<A extends {
+    attributes?: Record<string, unknown>;
+}>(auth: A, platform: UnifiedWakeOrigin["platform"], wakeId: string, addressing?: "direct-mention", sources?: readonly string[], windowToken?: string, replyAnchor?: string, deliveryId?: string): A;
+/** The refusal reasons that mean the HOST decided this turn may not put this text in this room —
+ *  see {@link proseBlockingRefusal} below for what puts each one on this list, and what is
+ *  deliberately kept off it. */
+export declare const PROSE_BLOCKING_REFUSALS: readonly string[];
+/**
+ * WHICH host refusals WITHHELD a turn's dropped terminal prose. It takes the reasons this turn drew on the wake the prose was owed to and returns the FIRST blocking one, or `undefined` when none of them blocks. Pure and eve-free, so the whole decision is unit-testable. THE RULE: a refusal blocks when it is a decision about WHETHER this turn may put this text in this room. It does not block when it is a decision about the ADDRESS the model authored, because a dropped turn authored no address — the wake it was owed to is the host-resolved target of its own delivery, which is not the thing those refusals objected to.
+ * TWO READERS, both in `channels/unified.ts`'s drop branch. The DROP ROW reports a blocking reason as `refused:<reason>`, so an owed answer the host withheld stays countable apart from an ordinary ambient drop. The AUTO-REDRIVE is suppressed by one, because the corrective wake tells the model to deliver this answer through the `reply` tool, and on a turn the host just refused that is the host contradicting itself one turn later, when the refusal message it already read named the move it should make instead.
+ * BLOCKING: `stale-conversation`, where the room moved on and the host said do not post this yet; `should-be-edit`, fold this into our last message, because a second message is what the policy refused; `declined-this-turn`, where the turn already chose silence for this wake; `answered-this-turn`, where a further post is the duplicate that guard exists to stop; and `stopped` (OPE-1651), where a person asked the agent to leave this conversation and the stand-down valve had already been spent — the rule's first kind exactly, and the strongest one on the list, because the objection came from a person rather than from a policy. NOT BLOCKING, deliberately: `delegation-pending`, where the turn owes its own worker's report and a correction towards the tool is the right nudge rather than a contradiction; and the wake-fence reasons (`mismatch`, `expired`, `answered`, `task-wake-unread`), where the model named a wake it does not hold, an objection a drop never earned. The strings are literals here so this stays pure and import-free, and the test pins each one against its source constant, so a renamed reason fails a test rather than silently changing what the row reports.
+ */
+export declare function proseBlockingRefusal(reasons: readonly string[]): string | undefined;
+/**
+ * The ONE single-window mention decision, shared by both of a surface's legs: `suppressNative`, should the surface's NATIVE per-conversation mention handler stand down, and `addressing`, the wake stamp the ambient unified leg carries instead — the addressed value, owed a reply and prose-bridgeable, when the unified window owns the mention, and undefined otherwise, which is ambient treatment. Both derive from the SAME predicate, which is what keeps the two legs perfectly complementary, never a double reply and never a gap: whenever the native handler is suppressed the ambient leg keeps the mention as an addressed wake, and on any un-vouched or non-single-window surface both fall back to the split where native owns mentions and ambient drops them. Pure and eve-free, so the gate is unit-testable without a live config.
+ * `privacyOk` is the surface's INTERNAL-TRUST floor: the OPERATOR VOUCH on the surface's own key, or the blanket internal-trust setting, fail-closed on un-vouched or unknown. It is the SAME per-surface allowlist that gates the shared cross-surface MEMORY, so admission to the shared WINDOW lines up exactly with the operator's standing "this surface is internal" assertion, and every surface uses it. Notion adds ONE MORE OPERATOR DECLARATION to that floor: a page under a declared TRUST ROOT passes on the verdict the webhook core already resolved for the delivery, which keeps the floor aligned with the memory plane that binds internal off the same verdict — still a declaration, still fail-closed, still no network. The surface's OWN private flag is DEMOTED to a logged defence-in-depth SIGNAL and is NOT the gate: a VOUCHED non-private surface ADMITS, so a workspace that can never mark a team private still reaches the window, and an UN-vouched surface never does whatever its private flag says. DOCTRINE: the operator vouches, the code enforces, and nothing is inferred from a surface field, which can be absent, stale, or actively misleading.
+ */
+export interface SingleWindowMentionPolicy {
+    readonly suppressNative: boolean;
+    readonly addressing: "direct-mention" | undefined;
+}
+export declare function singleWindowMentionPolicy(singleWindow: boolean, isMention: boolean, privacyOk: boolean): SingleWindowMentionPolicy;
+/**
+ * The wake-dispatch plumbing a surface passes to its supervisor wake dep when the grain says `singleWindow` — the wakeId minted for the envelope, plus the origin for the map.
+ * One typed object, so every surface core threads an identical shape through to its live wiring, which decides send-versus-receive on its presence.
+ */
+export interface UnifiedWindowWake {
+    readonly wakeId: string;
+    readonly origin: UnifiedWakeOrigin;
+    /**
+     * Present exactly when this wake is an ADDRESSED single-window mention: threaded to {@link stampUnifiedWindowAuth}, so the turn auth carries the addressing stamp and the unified channel's completion handler bridges its terminal prose to the reply target.
+     * Absent ⇒ no stamp ⇒ ambient or watch treatment, where terminal prose is hard-dropped — the safe default.
+     */
+    readonly addressing?: "direct-mention";
+    /**
+     * A FOLLOW-UP in the agent's own conversation that does NOT @-mention the agent — today a Linear `prompted` reply in the app's agent session. It is stamped `direct-mention` like a mention, but it is addressed by construction, the way a DM is.
+     * ONE READER: the question bridge's answer routing (question-bridge.ts `isAddressedMentionWake`), so a plain reply there can still answer a worker's open question (OPE-2116). Absent ⇒ the addressing stamp reads as a real @-mention.
+     */
+    readonly followUp?: true;
+    /**
+     * WHEN THE VENDOR SAYS THE EVENT HAPPENED (OPE-1716) — the first of the four latency anchors, read
+     * at the surface's own front door because that is the only place the vendor's clock is on the
+     * payload. `divertToUnifiedWindow` records it on the ingress row and never acts on it.
+     * Absent ⇒ the row carries no vendor time and the vendor→ingress segment is reported as unmeasured.
+     * 🔴 NEVER DERIVE IT CENTRALLY FROM THE ORIGIN. A Slack origin's `threadTs` is the thread ROOT's
+     * ts, not the trigger's, so a threaded follow-up would be measured from a message posted minutes
+     * earlier — a fabricated delay, on exactly the legs this measure exists to read.
+     */
+    readonly vendorTs?: VendorEventTime;
+}
+//# sourceMappingURL=unified-window.d.ts.map

package/dist/agent/channels/unified-window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unified-window.d.ts","sourceRoot":"","sources":["../../../agent/channels/unified-window.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAExF,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAE5F;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;2BAEuB;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;oEACgE;IAChE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACxB;;oDAEgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,qFAAqF;IACrF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;0EAEsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;CACxB,GACD;IACE;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B;;6FAEyF;IACzF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;qFACiF;IACjF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,8JAA8J;IAC9J,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEN;uFACuF;AACvF,eAAO,MAAM,kBAAkB,QAAqB,CAAC;AAErD;2DAC2D;AAC3D,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED;gDACgD;AAChD,MAAM,WAAW,sBAAsB;IACrC,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzJ,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3E;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sGAAsG;IACtG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;kGAC8F;IAC9F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;sFACkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;iGAEiG;AACjG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED,iFAAiF;AACjF,MAAM,WAAW,4BAA6B,SAAQ,oBAAoB;IACxE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;gGACgG;AAChG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CASpF;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,iPAAiP;AACjP,MAAM,WAAW,mBAAoB,SAAQ,sBAAsB;IACjE,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACrF,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClG;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,cAAc,EACxB,SAAS,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAoDD;;+FAE+F;AAC/F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAoDpG;AAED,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,+BAAyB,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,GAAG,UAAU,IAAI,MAAM,CAO/G;AAED;kGACkG;AAClG,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC,CAmBnD;AAED,qEAAqE;AACrE,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAgB/I;AAED,qGAAqG;AACrG,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWnF;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWnF;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,sBAAsB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAoB5I;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAI3F;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAOjF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAGxF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAU5G;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAGxC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAExF;AAED;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAAA;CAAE,GACjH;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,CAAA;CAAE,CAAC;AAYjF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,EAC3C,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACnE,MAAM,CAqBR;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,mBAAmB,EAC1B,GAAG,EAAE,MAAM;AACX,yFAAyF;AACzF,QAAQ,EAAE,MAAM,GAAG,SAAS;AAC5B;uFACuF;AACvF,WAAW,EAAE,MAAM,GAAG,SAAS;AAC/B,6FAA6F;AAC7F,MAAM,EAAE,MAAM,GAAG,SAAS;AAC1B,oCAAoC;AACpC,SAAS,EAAE,MAAM;AACjB,uEAAuE;AACvE,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,yBAAyB,CAAC,CAEpC;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,mBAAmB,EAC1B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,yBAAyB,CAAC,CAEpC;AAoED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,iBAAiB,CAKtE;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;uGACmG;IACnG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,gBAAgB,CAE5E;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAE3E;AAED,2MAA2M;AAC3M,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAEvE;AAKD,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAC9C,eAAO,MAAM,eAAe,eAAe,CAAC;AAC5C;;;;;2EAK2E;AAC3E,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAClD;;;GAGG;AACH,eAAO,MAAM,aAAa,aAAa,CAAC;AACxC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAClD;;;GAGG;AACH,eAAO,MAAM,eAAe,eAAe,CAAC;AAC5C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEtE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACvF,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,EACvC,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,gBAAgB,EAC7B,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,EAC3B,WAAW,CAAC,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,GAClB,CAAC,CAsBH;AAED;;gCAEgC;AAChC,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAoG,CAAC;AAE1J;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAEnF;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACnD;AACD,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,OAAO,EACrB,SAAS,EAAE,OAAO,EAClB,SAAS,EAAE,OAAO,GACjB,yBAAyB,CAG3B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;CACrC"}