@open-everywhere/core 0.1.0

package/dist/agent/memory/connector-memory.d.ts

@@ -0,0 +1,54 @@
+import type { MemorySilo } from "./silo.js";
+import type { Domain } from "./domain.js";
+export type ConnectorMemoryMode = "materialise" | "read-write" | "skill";
+/** The grants a domain holds, projected down to what a memory capability can be checked against. A capability's own validator receives this, so core never learns a vendor's grant shape. */
+export interface DomainMemoryGrants {
+    /** Connector slugs this domain's bundles grant (access/bundle.ts `connectors` + `providers`). */
+    readonly connectors: readonly string[];
+    /** GitHub repos ("owner/name") this domain's bundles grant (access/bundle.ts `repos`). */
+    readonly repos: readonly string[];
+}
+/**
+ * A connector's optional MEMORY capability — declared by the provider package that owns the
+ * connector, registered at boot beside its `MemoryProvider`.
+ */
+export interface ConnectorMemoryCapability {
+    /** The `MemoryProvider` id a silo names in `silo.provider` (e.g. "github", "notion"). */
+    readonly provider: string;
+    /** The CONNECTOR slug a domain must be granted for this backing to be usable there. */
+    readonly connector: string;
+    readonly mode: ConnectorMemoryMode;
+    /**
+     * 🔴 THE ONLY PERMITTED VALUE. A shared domain brain materialised through one person's user-subject token would bake that person's personal access into a cache every session in the domain reads.
+     * Declared rather than assumed, so the refusal is a type error at the call site and a throw at registration, not a comment somebody has to remember.
+     */
+    readonly subject: "app-principal";
+    /** What `silo.container` means for this backing — quoted in config errors. */
+    readonly containerLabel: string;
+    /** For `mode: "skill"`: the skill that teaches how to reach this source. */
+    readonly skill?: string;
+    /**
+     * Return `null` when `silo.container` is inside what the domain has been granted READ access to, or a problem string when it is not.
+     * Omit it when the backing has no container-level grant plane; the connector-grant check is then the whole invariant.
+     */
+    readonly assertContainerGranted?: (silo: MemorySilo, grants: DomainMemoryGrants) => string | null;
+}
+/**
+ * Declare a connector's memory capability. Called from the provider package's `register()`,
+ * beside its `registerProvider(...)` — the two are wired together and neither is useful alone.
+ * Fails LOUD on a re-declaration under a different connector, and on any subject other than the
+ * app-principal arm.
+ */
+export declare function registerConnectorMemory(cap: ConnectorMemoryCapability): void;
+/** The capability declared for a `MemoryProvider` id, or undefined for a first-party backing. */
+export declare function connectorMemoryFor(providerId: string | undefined): ConnectorMemoryCapability | undefined;
+/** Every declared capability, sorted by provider id — the roster's contribution view (OPE-375). */
+export declare function connectorMemoryCapabilities(): readonly ConnectorMemoryCapability[];
+/** Test seam: forget every declaration (the registry is process-global, like every other). */
+export declare function resetConnectorMemoryForTest(): void;
+/**
+ * Fail loud at config load when a domain's connector-owned silo reaches past that domain's grants: the domain must hold the connector grant, and the container must satisfy the capability's own validator.
+ * Every problem is reported at once. A first-party backing declares no capability and is skipped.
+ */
+export declare function assertConnectorMemoryGrants(domains: readonly Domain[], silos: readonly MemorySilo[], grantsFor: (domain: Domain) => DomainMemoryGrants | null): void;
+//# sourceMappingURL=connector-memory.d.ts.map

package/dist/agent/memory/connector-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-memory.d.ts","sourceRoot":"","sources":["../../../agent/memory/connector-memory.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;AAEzE,6LAA6L;AAC7L,MAAM,WAAW,kBAAkB;IACjC,iGAAiG;IACjG,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,KAAK,MAAM,GAAG,IAAI,CAAC;CACnG;AAID;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,yBAAyB,GAAG,IAAI,CAe5E;AAED,iGAAiG;AACjG,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,yBAAyB,GAAG,SAAS,CAExG;AAED,mGAAmG;AACnG,wBAAgB,2BAA2B,IAAI,SAAS,yBAAyB,EAAE,CAElF;AAED,8FAA8F;AAC9F,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,SAAS,UAAU,EAAE,EAC5B,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,GACvD,IAAI,CA6CN"}

package/dist/agent/memory/connector-memory.js

@@ -0,0 +1,80 @@
+// Connector-owned memory backings (github, notion) declare a capability here, so a domain projects only what its own connector grants already reach.
+// First-party backings (postgres, sqlite) are not declared here — the deployment holds their credential.
+import { memoryRefs } from "./domain.js";
+const REGISTRY = new Map();
+/**
+ * Declare a connector's memory capability. Called from the provider package's `register()`,
+ * beside its `registerProvider(...)` — the two are wired together and neither is useful alone.
+ * Fails LOUD on a re-declaration under a different connector, and on any subject other than the
+ * app-principal arm.
+ */
+export function registerConnectorMemory(cap) {
+    if (cap.subject !== "app-principal") {
+        throw new Error(`connector-owned memory "${cap.provider}": subject must be "app-principal" (got ${JSON.stringify(cap.subject)}) — ` +
+            `a shared domain brain is never materialised through a user-subject token (memory/connector-memory.ts).`);
+    }
+    const existing = REGISTRY.get(cap.provider);
+    if (existing && existing.connector !== cap.connector) {
+        throw new Error(`connector-owned memory "${cap.provider}" is already declared against connector "${existing.connector}" ` +
+            `and is being re-declared against "${cap.connector}" — two provider packages cannot own one backing id.`);
+    }
+    REGISTRY.set(cap.provider, cap);
+}
+/** The capability declared for a `MemoryProvider` id, or undefined for a first-party backing. */
+export function connectorMemoryFor(providerId) {
+    return providerId ? REGISTRY.get(providerId) : undefined;
+}
+/** Every declared capability, sorted by provider id — the roster's contribution view (OPE-375). */
+export function connectorMemoryCapabilities() {
+    return [...REGISTRY.values()].sort((a, b) => (a.provider < b.provider ? -1 : a.provider > b.provider ? 1 : 0));
+}
+/** Test seam: forget every declaration (the registry is process-global, like every other). */
+export function resetConnectorMemoryForTest() {
+    REGISTRY.clear();
+}
+/**
+ * Fail loud at config load when a domain's connector-owned silo reaches past that domain's grants: the domain must hold the connector grant, and the container must satisfy the capability's own validator.
+ * Every problem is reported at once. A first-party backing declares no capability and is skipped.
+ */
+export function assertConnectorMemoryGrants(domains, silos, grantsFor) {
+    const byName = new Map(silos.map((s) => [s.name, s]));
+    const problems = [];
+    for (const domain of domains) {
+        let grants = null;
+        let resolved = false;
+        for (const ref of memoryRefs(domain)) {
+            const silo = byName.get(ref);
+            if (!silo)
+                continue; // an unknown silo name is a DIFFERENT config error, owned by the resolver
+            const cap = connectorMemoryFor(silo.provider);
+            if (!cap)
+                continue; // first-party backing — the deployment is the credential holder
+            if (!resolved) {
+                grants = grantsFor(domain);
+                resolved = true;
+            }
+            if (!grants) {
+                problems.push(`  domain "${domain.name}" references silo "${silo.name}" (${cap.provider}-backed) but the domain has NO ` +
+                    `resolvable access grants — memory rides the same route as connector access, so bind a bundle granting ` +
+                    `the "${cap.connector}" connector to this domain (access/bundles.ts).`);
+                continue;
+            }
+            if (!grants.connectors.includes(cap.connector)) {
+                problems.push(`  domain "${domain.name}" references silo "${silo.name}" (${cap.provider}-backed) but does not hold the ` +
+                    `"${cap.connector}" connector grant — a memory projection IS read access, so it must be DECLARED on the ` +
+                    `connector plane rather than smuggled in through silo config. Grant "${cap.connector}" to this domain ` +
+                    `(bundle.connectors / bundle.providers) or drop the silo from the domain's memory list.`);
+                continue;
+            }
+            const containerProblem = cap.assertContainerGranted?.(silo, grants);
+            if (containerProblem)
+                problems.push(`  domain "${domain.name}" / silo "${silo.name}": ${containerProblem}`);
+        }
+    }
+    if (problems.length > 0) {
+        throw new Error("open-everywhere: connector-owned memory silo(s) reach past their domain's grants:\n" +
+            problems.join("\n") +
+            "\n(memory/connector-memory.ts / docs/capabilities/memory.md — the prefetch invariant)");
+    }
+}
+//# sourceMappingURL=connector-memory.js.map

package/dist/agent/memory/connector-memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-memory.js","sourceRoot":"","sources":["../../../agent/memory/connector-memory.ts"],"names":[],"mappings":"AAAA,qJAAqJ;AACrJ,yGAAyG;AAIzG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAsCzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqC,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAA8B;IACpE,IAAI,GAAG,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,CAAC,QAAQ,2CAA2C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;YACjH,wGAAwG,CAC3G,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,CAAC,QAAQ,4CAA4C,QAAQ,CAAC,SAAS,IAAI;YACvG,qCAAqC,GAAG,CAAC,SAAS,sDAAsD,CAC3G,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,kBAAkB,CAAC,UAA8B;IAC/D,OAAO,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,2BAA2B;IACzC,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,2BAA2B;IACzC,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAA0B,EAC1B,KAA4B,EAC5B,SAAwD;IAExD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,GAA8B,IAAI,CAAC;QAC7C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,SAAS,CAAC,0EAA0E;YAC/F,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG;gBAAE,SAAS,CAAC,gEAAgE;YACpF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;gBAC3B,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CACX,aAAa,MAAM,CAAC,IAAI,sBAAsB,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,QAAQ,iCAAiC;oBACxG,wGAAwG;oBACxG,QAAQ,GAAG,CAAC,SAAS,iDAAiD,CACzE,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CACX,aAAa,MAAM,CAAC,IAAI,sBAAsB,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,QAAQ,iCAAiC;oBACxG,IAAI,GAAG,CAAC,SAAS,wFAAwF;oBACzG,uEAAuE,GAAG,CAAC,SAAS,mBAAmB;oBACvG,wFAAwF,CAC3F,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,gBAAgB,GAAG,GAAG,CAAC,sBAAsB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpE,IAAI,gBAAgB;gBAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,IAAI,aAAa,IAAI,CAAC,IAAI,MAAM,gBAAgB,EAAE,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YACnB,uFAAuF,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/agent/memory/domain.d.ts

@@ -0,0 +1,384 @@
+import { type DomainCredentialOverride } from "../access/domain-credentials.js";
+import type { SessionMode } from "../access/resolver.js";
+import type { Trust } from "../identity/binding.js";
+import type { ApprovalModeConfig } from "../access/approver-chain.js";
+import type { ExternalPolicyOverride, ExternalRoomGrain } from "../access/external-policy.js";
+export type DomainMatch = "org" | "public" | "dm";
+/**
+ * Consulted ONLY when the code capability windowTopologyEnabled() holds; with the gate off every domain runs the native per-container path.
+ * "solo" (the default) gives each channel its own standing window; "unified" merges the whole domain into one context window.
+ */
+export type WindowMode = "solo" | "unified";
+/**
+ * A group slices the CONTEXT WINDOW only: the silo, the trust plane, the access bundle and the audit scope all stay at the DOMAIN grain.
+ * The group name is a GLOBAL window id, so assertWindowGroupExclusivity refuses a name another domain uses and a name equal to any domain name.
+ */
+export interface WindowGroup {
+    readonly name: string;
+    /** Every entry must narrow WITHIN the enclosing domain: an exact key must already be a member of it, and a container must intersect one of the domain's own containers. */
+    readonly reach?: readonly string[];
+    /** Exclusions from this group's {@link reach} — exclude always wins, as at the domain grain. */
+    readonly exclude?: readonly string[];
+}
+/**
+ * The name travels as a windowId through the session registry key and the supervisor token, where "/" and ":" are structure.
+ * Bounded at 64 characters so a name can never crowd out the token's other segments.
+ */
+export declare const WINDOW_GROUP_NAME_RE: RegExp;
+/**
+ * The operator-facing calibration dial for how eagerly a standing seat engages: `reserved` raises the engagement bar, `aggressive` lowers it, `neutral` leaves it unchanged.
+ * It calibrates a judged wake only. It never bypasses the judge.
+ */
+export type EngagementTier = "aggressive" | "neutral" | "reserved";
+/** Reasoning effort (AI SDK provider-agnostic; an upstream that can't map it ignores it). */
+export type ModelReasoning = "provider-default" | "none" | "minimal" | "low" | "medium" | "high" | "xhigh";
+/** The org's model-policy allow-list (model/policy.ts) tags each allowed model with a tier, so a role or domain names a tier instead of a model and stays portable across orgs. */
+export type ModelTier = "high" | "medium" | "low";
+/** Every field is optional and absent fields INHERIT: explicit domain, then the `org` pseudo-domain, then the agent.ts static defaults (see modelRouteFor). */
+export interface ModelRoute {
+    /** Model id in the configured backend's namespace — `creator/model` on a gateway, for example "anthropic/claude-sonnet-5". */
+    readonly id?: string;
+    /** A HINT the backend maps. Deliberately NOT inherited across a model change: a route that sets `id` but no `providers` DROPS the inherited pin, because a pin belongs to the id it was set with. */
+    readonly providers?: readonly string[];
+    /** Self-serve up to the org's `reasoningCeiling` (model/policy.ts), not allow-list constrained; `xhigh` is a per-turn cost amplifier behind a deliberately raised ceiling. */
+    readonly reasoning?: ModelReasoning;
+    /**
+     * A concrete `id` on the SAME route wins over `tier`, and that id must be in the org allow-list (fail-loud at config load, assertRoutesWithinPolicy).
+     * ASYMMETRIC across layers: a layer that sets one of `id`/`tier` DROPS any inherited value of the other.
+     */
+    readonly tier?: ModelTier;
+}
+/**
+ * `primary` answers in the channel, `utility` is the shared cheap summarizer (compaction plus the dream judge), `supervisor` is the standing ambient session.
+ * `supervisor` FALLS BACK to `primary` when unset, so adding the role is inert until a domain routes it.
+ */
+export interface ModelRoutes {
+    readonly primary?: ModelRoute;
+    readonly utility?: ModelRoute;
+    readonly supervisor?: ModelRoute;
+}
+export type ModelRole = keyof ModelRoutes;
+/** Cosmetic tuning, so FAIL-OPEN end to end: any resolution or update error falls back to the backend's default size and never blocks a turn. */
+export interface SandboxPreset {
+    /** On Vercel the sandbox's memory scales with this vCPU count. */
+    readonly vcpus?: number;
+}
+export interface Domain {
+    /**
+     * IMMUTABLE ONCE REFERENCED. The name is persisted verbatim into rows and keys that outlive a deploy, and a rename migrates none of them — the old rows are orphaned silently.
+     * To change what humans see, set Domain.title instead. A real rename is a data migration.
+     */
+    readonly name: string;
+    /** Purely cosmetic: nothing resolves, matches, partitions or authorizes on it, and it is never persisted as a key. Absent means humans see `name`. */
+    readonly title?: string;
+    /**
+     * Three shapes: an exact `platform/<tenant>/<surface>` key, a whole-tenant `platform/<tenant>` container, or a same-level `platform/<tenant>/<prefix>*` glob. The NARROWEST matching entry wins, across domains and within one.
+     * The `*` is legal only as the last character of a three-segment entry, refused fail-loud at config load, because overlap between two entries must be decidable. Pair with `exclude`, which always wins.
+     */
+    readonly reach?: readonly string[];
+    /**
+     * A surface an exclusion matches is not in this domain, whatever `reach` says. An entry is a three-segment surface key or a same-level glob, never a whole tenant.
+     * Fail-loud at config load: an exclusion must intersect one of THIS domain's reach entries, and may not cancel a whole entry.
+     */
+    readonly exclude?: readonly string[];
+    /** At most one domain per match value, and a domain has `reach` XOR `match` — both enforced fail-loud at config load. */
+    readonly match?: DomainMatch;
+    /** A LIST composes several silos. Each silo materialises into its OWN sandbox dir; they co-exist and are never merged. Omitted means a grouping with no memory. */
+    readonly memory?: string | readonly string[];
+    /**
+     * `"readonly"` includes the `org` pseudo-domain's silos forced read-only here; `"inherit"` includes them with their native per-silo read/write.
+     * Forbidden on the `org` and `public` pseudo-domains, refused at config load. A silo this domain lists in `memory` wins over the includeOrg copy.
+     */
+    readonly includeOrg?: "readonly" | "inherit";
+    /**
+     * `DANGEROUSLY_BYPASS` turns ask into allow: it kills approval CARDS only. It cannot lift a deny, and cannot lift the taint ask-floor. `APPROVE_ALL` floors every open verb to a card, except tool names on `allowlist`. `DENY_ALL` tightens every verdict to deny.
+     * Config-as-code only: there is deliberately no runtime toggle for a lowering mode.
+     */
+    readonly approvalMode?: ApprovalModeConfig;
+    /**
+     * Respond (judged) to a top-level message that says the agent's name without an @mention. OFF by default. An explicit domain wins for its channels; an unassigned channel reads the `org` pseudo-domain's flag.
+     * Externally-shared or unconfirmable channels never name-drop wake, whatever this flag says (fail-closed).
+     */
+    readonly nameDropWake?: boolean;
+    /**
+     * Does an UNADDRESSED message wake the standing seat? OFF by default, which makes the room ADDRESSED-ONLY; ambient talk then enters the seat's context on its NEXT wake.
+     * It does not decide whether a seat EXISTS — every channel has one. Single hop: an explicit domain wins for its channels, else the `org` pseudo-domain's flag.
+     */
+    readonly ambientSupervisor?: boolean;
+    /**
+     * Names an admission function (channels/seat-admission.ts); unset takes DEFAULT_ADMISSION, and an unknown name is refused fail-loud at config load.
+     * Admission decides what the seat READS on a wake it already takes. It never decides whether the seat wakes.
+     */
+    readonly admission?: string;
+    /**
+     * The DOMAIN OVERRIDE half of the `externalPolicy` settings block, resolved FIELD BY FIELD: a domain that declares only `roomGrain` keeps the org default's `authorGrain`.
+     * Single domain hop, as `ambientSupervisor` does it: an explicit domain's declaration wins for its channels, else the `org` pseudo-domain's.
+     */
+    readonly externalPolicy?: ExternalPolicyOverride;
+    /**
+     * `"solo"` (the default) is one window per CHANNEL; `"unified"` is ONE window for the whole domain. Consulted only when windowTopologyEnabled() holds, and inert with the gate off.
+     * FORBIDDEN on the `org`/`public`/`dm` pseudo-domains, enforced fail-loud by assertUnifiedDomainTrust — which is what makes every undeclared channel's seat solo.
+     */
+    readonly mode?: WindowMode;
+    /**
+     * A channel takes the most specific group that admits it (windowGroupFor); a channel no group admits falls through to the `mode` residue, so `windows` is purely additive.
+     * Same gate and chain as `mode`: only when windowTopologyEnabled() holds, never on a pseudo-domain (assertUnifiedDomainTrust); names and overlap are proved by assertWindowGroupExclusivity.
+     */
+    readonly windows?: readonly WindowGroup[];
+    /**
+     * INHERITS like `models`: explicit domain, then the `org` pseudo-domain, then the per-platform default (GitHub `reserved`, everything else `neutral`).
+     * Only meaningful where `ambientSupervisor` is on; inert otherwise.
+     */
+    readonly engagementTier?: EngagementTier;
+    /** INHERITS field by field: an explicit domain's route overlays the `org` pseudo-domain's, which overlays the agent.ts static model config. */
+    readonly models?: ModelRoutes;
+    /**
+     * The maximum reasoning effort a route in this domain may resolve to. INHERITS like `models`: org policy default, `org` domain, dm/public criteria, explicit domain.
+     * A domain may RAISE or LOWER it. Only meaningful when a model policy is configured; with none there is no clamp at all.
+     */
+    readonly reasoningCeiling?: ModelReasoning;
+    /** INHERITS like `models`: framework defaults, the `org` pseudo-domain's list, then the explicit domain's. Each layer EXTENDS what it inherited or REPLACES it wholesale (see `statusVerbsMode`). */
+    readonly statusVerbs?: readonly string[];
+    /** How this domain's `statusVerbs` combine with the inherited list. Default "extend". */
+    readonly statusVerbsMode?: "extend" | "replace";
+    /**
+     * Anything the domain sets explicitly WINS over the role's value, field by field. An unknown role name throws at config load (roles/role.ts applyRoleDefaults).
+     * The layered knobs take the role as its own rung: framework, org, role, domain.
+     */
+    readonly role?: string;
+    /** A role can preset it; the domain's own value wins. */
+    readonly sandbox?: SandboxPreset;
+    /**
+     * QUALIFIED principal keys — `platform/<principal-id>`, plus the WORKSPACE rung on a tenant-scoped platform ("slack/T0AB1CD2E/U0EXUSER002"). A bare id is refused fail-loud at config load, and a `linkSet:<id>` reference is deliberately refused: admin standing must be static and diff-auditable, with no runtime link-set read on the highest-privilege gate.
+     * This does NOT inherit — an explicit domain's admins come only from its own list — but an org admin is also a domain admin everywhere (access/roles.ts roleForBinding).
+     */
+    readonly admins?: readonly string[];
+    /**
+     * Marks this explicit domain's channels as the org's admin/governance venue. A WIDENING flag, so it lives in config-as-code behind a PR, never a runtime toggle.
+     * Fail-loud at config load (assertGovernanceDomains): a `reach` domain, a non-empty `admins` roster, at most GOVERNANCE_CHANNEL_MAX channels, and every channel operator-vouched-internal.
+     */
+    readonly governance?: boolean;
+    /**
+     * Where a routine created anywhere in this domain posts when the creating surface cannot post proactively. It must be one of THIS domain's own exact `reach` entries, and only a domain with a `reach` may set it (assertReportChannels).
+     * Whether the named surface can actually be posted into is checked at routine-creation time, not here.
+     */
+    readonly reportChannel?: string;
+    /**
+     * ORG-LEVEL ONLY: set it on the `org` pseudo-domain — assertComplianceDomains fails loud anywhere else. DEFAULT OFF.
+     * On, access/connector-disclosure.ts requires the VERIFIED REQUESTOR of a direct-addressed turn to be entitled to the connector's resource before the credential resolves, and FAILS CLOSED when no entitlement signal is available.
+     */
+    readonly requestorEntitlementChecks?: boolean;
+    /**
+     * Set it on the `org` pseudo-domain ONLY; the lint rejects it anywhere else. Absent means `"channel"`: the gate engages only once a `governance: true` domain exists.
+     * `"dm-fallback"` engages the gate with NO governance domain configured, and delivers an org-grain read to the verified role-holder's DM instead of the room.
+     */
+    readonly governanceDelivery?: GovernanceDeliveryMode;
+    /**
+     * FALLBACK, NOT FAIL-CLOSED: a domain that declares nothing here uses the org default credential. An override is an addition, never a precondition.
+     * A DECLARED override naming a credential the provider does not carry is a config error refused at boot (access/domain-credentials.ts), never a fall back to the org credential.
+     */
+    readonly credentials?: readonly DomainCredentialOverride[];
+    /**
+     * Connector ids this domain's rooms may raise credential-grant asks for; each must name a CREDENTIAL_GRANT_ROLES entry (access/credential-grant.ts).
+     * FAIL-CLOSED: absent or empty admits no grant at all, and there is no org-wide default to fall back to. A connector this tree admits no grant role for is refused at boot.
+     */
+    readonly credentialGrants?: readonly string[];
+}
+export type GovernanceDeliveryMode = "channel" | "dm-fallback";
+export declare function memoryRefs(domain: Domain): string[];
+export declare function defineDomain(domain: Domain): Domain;
+/** How a surface reached its domain: `"roster"` when the winning `reach` entry is an EXACT key, `container:<entry>` when it is a container (the entry verbatim), `excluded:<domain>:<entry>` when an exclusion vetoed a domain that would have matched, and `"none"` when no domain reaches it. */
+export type DomainVia = "roster" | `container:${string}` | `excluded:${string}` | "none";
+export interface DomainRouting {
+    readonly domain: Domain | undefined;
+    readonly via: DomainVia;
+}
+/**
+ * The EXACT keys of a `reach` list — the enumerable half. Container entries are deliberately absent: a container still admits surfaces created tomorrow, so no list can stand for it.
+ * Declaration order is preserved, because several callers take the FIRST entry as the domain's anchor surface.
+ */
+export declare function domainRoster(domain: {
+    readonly reach?: readonly string[];
+}): string[];
+export declare function domainContainers(domain: {
+    readonly reach?: readonly string[];
+}): string[];
+/**
+ * One domain's verdict on one key: the MOST SPECIFIC matching `reach` entry, or the `exclude` entry that carved it back out — exclude ALWAYS wins.
+ * Exported so a vendor fence that re-walks the decision asks this same question; two implementations are how a fence and the router come to disagree about who owns a surface.
+ */
+export declare function domainReachVerdict(domain: Domain, channelKey: string): {
+    readonly kind: "admits" | "excluded";
+    readonly entry: string;
+} | undefined;
+/**
+ * MOST SPECIFIC WINS: among the domains that admit the key, the one whose winning entry denotes the NARROWEST set takes it. Only explicit domains — the `match` pseudo-domains are selected from trust/mode, never by channel key.
+ * PURE and SYNCHRONOUS, and it stays that way: resolveAccess and EventScopeGrant.grantsRead sit downstream, so a fetch here would make EffectiveAccess time-varying.
+ */
+export declare function resolveDomainForChannel(channelKey: string, domains: readonly Domain[]): DomainRouting;
+export declare function domainForChannel(channelKey: string, domains: readonly Domain[]): Domain | undefined;
+export declare function criteriaDomain(match: DomainMatch, domains: readonly Domain[]): Domain | undefined;
+/** Mirrors the memory resolver's own classification (memory/resolve.ts's dm branch plus the trust gate). Never returns "org" — that layer is unconditional, and knobLayersFor adds it itself. */
+export declare function domainMatchFor(mode: SessionMode, trust: Trust): DomainMatch | undefined;
+export declare function nameDropWakeEnabled(channelKey: string, domains: readonly Domain[]): boolean;
+/**
+ * `undefined` means NO DOMAIN OVERRIDE, which the caller resolves to the org default field by field. It is not a value.
+ * An ABSENT `channelKey` is a room the caller could not name, not a reason to skip the question: it returns the `org` pseudo-domain's declaration, and only an explicit domain needs the key.
+ */
+export declare function externalPolicyOverrideFor(channelKey: string | undefined, domains: readonly Domain[]): ExternalPolicyOverride | undefined;
+/** An injectable sink, so a test captures the warning text instead of scraping stdout. */
+export interface SilentRoomGrainValidationDeps {
+    readonly warn?: (message: string) => void;
+}
+/**
+ * WARN ONLY, NEVER REFUSES BOOT: two of the three external-room legs (vendor-external, guest-present) are runtime facts, so a channel armed by one carries no `public` declaration and a refusal would be a false positive.
+ * `orgDefaultRoomGrain` and `declaredPublic` are PURE INPUTS, not the runtime singletons: the trust register is populated by a separate boot import, so reading it here would race boot order.
+ */
+export declare function warnSilentRoomGrainWithoutPublicSignal(domains: readonly Domain[], orgDefaultRoomGrain: ExternalRoomGrain, declaredPublic: (workspaceKey: string, surfaceKey: string) => boolean, deps?: SilentRoomGrainValidationDeps): void;
+/**
+ * Default everywhere is OFF, which is ADDRESSED-ONLY, never seatless.
+ * This is NOT the seat gate — the seat stands either way (windowedSupervisorEnabled). A refused ambient message enters the seat's context on its next wake.
+ */
+export declare function ambientSupervisorEnabled(channelKey: string, domains: readonly Domain[]): boolean;
+/**
+ * `"no-domain"` is a deployer CONFIG GAP: the surface is in no domain and the `org` pseudo-domain does not opt in either. The fix is to add the surface to a domain's `reach`.
+ * `"domain-refused"` is deliberate: the surface is in a domain whose `ambientSupervisor` flag is off.
+ */
+export type AmbientSkip = "no-domain" | "domain-refused";
+/** Decides nothing and changes nothing about whether the supervisor runs. It only names the outcome so an ingress can record it (channels/ambient-skip.ts); `undefined` means the supervisor DID engage. */
+export declare function ambientSkipFor(channelKey: string, domains: readonly Domain[]): {
+    readonly reason: AmbientSkip;
+    readonly domain?: string;
+    readonly via: DomainVia;
+} | undefined;
+/** Returns the NAME, not the function: the resolver stays free of the registry, which is what lets the config-load validation and the wake path read the same answer. */
+export declare function admissionNameFor(channelKey: string, domains: readonly Domain[]): string;
+/**
+ * True only when the code capability windowTopologyEnabled() holds (the one gate, default OFF, fail-closed) AND the channel resolves to a seat domain. Every channel the bot is in gets a seat.
+ * Gate off means false for every channel, so the caller keeps the native per-container `(org, surfaceKey)` grain unchanged.
+ */
+export declare function windowedSupervisorEnabled(channelKey: string, domains: readonly Domain[]): boolean;
+/**
+ * Undefined only when the deployment declares NO `org` pseudo-domain and the channel is in no explicit domain; the channel then keeps the native per-container path. That is the one fail-closed arm.
+ * Ignores the capability gate on purpose, so a config-load check can ask which domain WOULD seat a channel.
+ */
+export declare function standingSeatDomainFor(channelKey: string, domains: readonly Domain[]): Domain | undefined;
+/** When defined, its `name` is the grain the seat's session, registry row and token are anchored by. Memory, access and trust stay DOMAIN-anchored under every topology. */
+export declare function windowedDomainFor(channelKey: string, domains: readonly Domain[]): Domain | undefined;
+/**
+ * A channel with no explicit domain resolves `"solo"`, which gives that channel its OWN window, so an undeclared room never shares context with another.
+ * The SOLE reader of `mode`, consulted only after windowedSupervisorEnabled has confirmed the channel windows.
+ */
+export declare function windowModeFor(channelKey: string, domains: readonly Domain[]): WindowMode;
+/**
+ * MOST SPECIFIC WINS, the same rule one grain up: the group whose winning entry denotes the narrowest set takes the key, whatever order the groups are declared in.
+ * A group that reaches the key but then excludes it does NOT capture it — the sweep continues, so another group can still take it.
+ */
+export declare function windowGroupFor(channelKey: string, domain: Domain): WindowGroup | undefined;
+/**
+ * Undefined is the ordinary answer and means no group spoke: the caller keeps the `mode` residue untouched.
+ * Like windowModeFor it does NOT re-check windowedSupervisorEnabled; it is consulted only after the caller has confirmed the channel windows.
+ */
+export declare function windowIdFor(channelKey: string, domains: readonly Domain[]): string | undefined;
+/**
+ * Refuses a `match` (org/public/dm) pseudo-domain that sets `mode` or `windows`, listing every problem at once — which is why a pseudo-domain seats every channel SOLO.
+ * Call it at the config-load seam beside assertDomainsValid, assertChannelExclusivity and assertWindowGroupExclusivity.
+ */
+export declare function assertUnifiedDomainTrust(domains: readonly Domain[]): void;
+/**
+ * Platforms whose binding TRUST VERDICT is authoritative: the mapper re-derives it from a live per-wake check (Slack's externally-shared test; local is internal by construction).
+ * On every OTHER platform `trust: "external"` means NOT DETERMINED, not "guests present" — so a guard that refuses on it alone refuses those platforms entirely on a deployment that has not vouched them.
+ */
+export declare const BINDING_TRUSTED_PLATFORMS: ReadonlySet<string>;
+/**
+ * A PURE INPUT, injected by the caller: these assertions run at config load and the trust register is populated by a separate boot import, so reading the singleton here would race boot order.
+ * A predicate, not a key list, because the registry's most-specific-wins resolver honours a `public` carve-out under an internal tenant. The `readonly string[]` form still means a flat either-grain match with no carve-outs.
+ */
+export type VouchedInternalFor = (workspaceKey: string, surfaceKey: string) => boolean;
+/**
+ * A standing WINDOW holding MORE THAN ONE member requires every register-gated member to be operator-vouched-internal, throwing at config load. A one-member window cannot bleed cross-context and is exempt.
+ * A source passes on an operator vouch, on `OE_TRUST=internal`, or on a BINDING_TRUSTED_PLATFORMS platform; everything else fails closed. Membership is read from EXACT `reach` entries only.
+ */
+export declare function assertWindowSourcesVouched(domains: readonly Domain[], vouched: readonly string[] | VouchedInternalFor): void;
+/** Chosen below the design's stated smell threshold, which calls a 40-channel governance domain clearly wrong: the venue's safety story is a SMALL, uniformly-privileged audience. */
+export declare const GOVERNANCE_CHANNEL_MAX = 20;
+export declare function governanceDomains(domains: readonly Domain[]): Domain[];
+/** Config designation only — arming is the separate runtime floor check (access/audience-floor.ts). */
+export declare function isGovernanceChannel(channelKey: string, domains: readonly Domain[]): boolean;
+/**
+ * The FIRST channel of the FIRST governance domain, else `fallback` — the legacy `OE_ACCESS_ADMIN_CHANNEL` alias, which has no roster, so nothing unlocks there.
+ * Undefined means no governance channel is configured at all: a read redirects to the requester's DM, and a write refuses.
+ */
+export declare function governanceChannelFor(domains: readonly Domain[], fallback?: string): string | undefined;
+/** Defaults to `"channel"` when absent or set anywhere the lint would have rejected. Fail-safe either way: the default never DM-delivers, and the opt-in only narrows what a room may hear. */
+export declare function governanceDeliveryMode(domains: readonly Domain[]): GovernanceDeliveryMode;
+/**
+ * Config-load fail-loud lint: a governance domain must have an explicit `reach`, a non-empty `admins` roster, at most GOVERNANCE_CHANNEL_MAX channels, and every channel operator-vouched-internal.
+ * `vouched` is a PURE INPUT, never the runtime trust singleton, because the register is populated by a separate boot import.
+ */
+export declare function assertGovernanceDomains(domains: readonly Domain[], vouched: readonly string[] | VouchedInternalFor): void;
+/**
+ * The channel's OWN explicit domain's reportChannel, and nothing else. Deliberately not inherited and not org-wide: only the audience already sharing this domain's brain can be said to have agreed to the redirect.
+ * A channel in no explicit domain gets no redirect at all.
+ */
+export declare function reportChannelFor(channelKey: string, domains: readonly Domain[]): string | undefined;
+/**
+ * Two rules: reportChannel may only be set on a domain with a `reach`, and it must name one of THAT domain's own channels — a redirect out of the domain posts to an audience the domain never agreed to.
+ * Whether the surface can actually be posted into is NOT checked here (the dispatch registry's boot order is not guaranteed); it is checked at routine-creation time.
+ */
+export declare function assertReportChannels(domains: readonly Domain[]): void;
+export declare function requestorEntitlementChecksEnabled(domains: readonly Domain[]): boolean;
+/** A doctrine guard, not a typo guard: `requestorEntitlementChecks` may appear ONLY on the `org` pseudo-domain. A per-room pre-check is the "different members of one room get different answers" shape the design rejected, so a misplacement is refused loudly instead of silently ignored. */
+export declare function assertComplianceDomains(domains: readonly Domain[]): void;
+/** UNLIKE the behaviour opt-ins, this is a TUNING knob and INHERITS: explicit domain, `org` pseudo-domain, then the per-platform default. Total — it always yields a tier, so callers carry no unset case. */
+export declare function engagementTierFor(channelKey: string, domains: readonly Domain[]): EngagementTier;
+/**
+ * Each domain expands to [its role, itself], so the order is framework, org, role, domain, and the domain's own fields win.
+ * Structural rather than the Role type itself, to keep this module role-agnostic at runtime.
+ */
+interface KnobLayer {
+    readonly statusVerbs?: readonly string[];
+    readonly statusVerbsMode?: "extend" | "replace";
+    readonly models?: ModelRoutes;
+    readonly reasoningCeiling?: ModelReasoning;
+}
+export interface NamedKnobLayer extends KnobLayer {
+    readonly name: string;
+}
+/**
+ * Merges FIELD BY FIELD over framework, org, role and domain, so a domain that sets only `reasoning` keeps the inherited model id.
+ * Returns {} when nothing routes: the caller falls through to the agent.ts static model and then to the model-policy envelope for tier resolution and clamping.
+ */
+export declare function modelRouteFor(role: ModelRole, channelKey: string, domains: readonly Domain[], roles?: readonly NamedKnobLayer[], surfaceMatch?: DomainMatch): ModelRoute;
+export declare const DEFAULT_STATUS_VERBS: readonly string[];
+/** An empty result (for example `replace` with an empty list) falls back to the defaults — the status line must never go verb-less. Blank entries are dropped. */
+export declare function statusVerbsFor(channelKey: string, domains: readonly Domain[], roles?: readonly NamedKnobLayer[], surfaceMatch?: DomainMatch): readonly string[];
+/** `base` is the org policy default the caller passes. Each domain layer overrides it in order: `org`, dm/public criteria, explicit domain. A domain may raise or lower it. */
+export declare function reasoningCeilingFor(channelKey: string, domains: readonly Domain[], roles: readonly NamedKnobLayer[] | undefined, surfaceMatch: DomainMatch | undefined, base: ModelReasoning): ModelReasoning;
+/**
+ * The WRITE-TIME twin of reasoningCeilingFor, keyed by domain name because a set has no live channel to resolve from.
+ * The envelope re-clamps at call time regardless, so this is the friendlier refusal message, not the enforcement. An unknown name contributes no rung beyond `org`.
+ */
+export declare function reasoningCeilingForDomain(domainName: string, domains: readonly Domain[], roles: readonly NamedKnobLayer[] | undefined, base: ModelReasoning): ModelReasoning;
+/**
+ * Refuses only what specificity cannot order: two entries in DIFFERENT domains that denote the SAME set of keys, unless one of the two domains excludes the whole overlap.
+ * A strictly narrower entry beside a wider one is deliberately allowed; it is the ordinary way to hand a slice of a tenant to another domain.
+ */
+export declare function assertChannelExclusivity(domains: readonly Domain[]): void;
+/**
+ * A window id keys the `channel_session` registry row GLOBALLY and carries no domain segment, so a group name must be unique across domains and must never equal a domain name; otherwise two domains share one standing context window.
+ * Also refuses two groups in one domain whose entries denote the SAME set, and a group member that config routes to another domain.
+ */
+export declare function assertWindowGroupExclusivity(domains: readonly Domain[]): void;
+/**
+ * Config-load fail-loud validation of the structural rules: `reach` XOR `match`, the legal reach and exclude shapes, no reserved `oe-dm/` name, one domain per match value, includeOrg's requirements, and well-formed qualified admin keys.
+ * Each illegal shape is refused BY NAME rather than silently ignored, because dead config reads as a grant or a carve-out that does not exist.
+ */
+export declare function assertDomainsValid(domains: readonly Domain[]): void;
+/**
+ * THE RULE: a domain may reach at most ONE tenant of such a platform BY CONTAINER. With two, the same surface id can key under either, decided by an unauthenticated payload field.
+ * An EXACT entry carries its own tenant and is never ambiguous, so cross-workspace domains stay expressible. The rule is per domain, not per deployment.
+ */
+export declare function partitionTenantProblems(domains: readonly Domain[]): string[];
+export {};
+//# sourceMappingURL=domain.d.ts.map

package/dist/agent/memory/domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../../../agent/memory/domain.ts"],"names":[],"mappings":"AAmBA,OAAO,EAA4B,KAAK,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC1G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAE9F,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC;AAElD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAE5C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2KAA2K;IAC3K,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,gGAAgG;IAChG,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,QAA2C,CAAC;AAE7E;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC;AAEnE,6FAA6F;AAC7F,MAAM,MAAM,cAAc,GACtB,kBAAkB,GAClB,MAAM,GACN,SAAS,GACT,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ,mLAAmL;AACnL,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAElD,+JAA+J;AAC/J,MAAM,WAAW,UAAU;IACzB,8HAA8H;IAC9H,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,qMAAqM;IACrM,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,8KAA8K;IAC9K,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC;AAE1C,iJAAiJ;AACjJ,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,MAAM;IACrB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sJAAsJ;IACtJ,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,yHAAyH;IACzH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B,mKAAmK;IACnK,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,+IAA+I;IAC/I,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAC3C,qMAAqM;IACrM,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,yFAAyF;IACzF,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAE3D;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,aAAa,CAAC;AAE/D,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAGnD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,mSAAmS;AACnS,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,aAAa,MAAM,EAAE,GAAG,YAAY,MAAM,EAAE,GAAG,MAAM,CAAC;AAEzF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;CACzB;AA2CD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,EAAE,CAOrF;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,EAAE,CAOzF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAK9E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CAoBrG;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAEnG;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAEjG;AAED,iMAAiM;AACjM,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,WAAW,GAAG,SAAS,CAKvF;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAI3F;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,sBAAsB,GAAG,SAAS,CAIxI;AAED,0FAA0F;AAC1F,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AAED;;;GAGG;AACH,wBAAgB,sCAAsC,CACpD,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,mBAAmB,EAAE,iBAAiB,EACtC,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,EACrE,IAAI,GAAE,6BAAkC,GACvC,IAAI,CAuBN;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIhG;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,gBAAgB,CAAC;AAEzD,4MAA4M;AAC5M,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAAG,SAAS,CAQjG;AAED,yKAAyK;AACzK,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIvF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAGjG;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAExG;AAED,4KAA4K;AAC5K,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAGpG;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAExF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAW1F;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAI9F;AAiFD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAmBzE;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAC;AAE1F;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;AAuBvF;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,kBAAkB,GAAG,IAAI,CAsC5H;AAED,sLAAsL;AACtL,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAEtE;AAED,uGAAuG;AACvG,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE3F;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGtG;AAED,+LAA+L;AAC/L,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,sBAAsB,CAEzF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,kBAAkB,GAAG,IAAI,CAiDzH;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAEnG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAiBrE;AAED,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAErF;AAED,iSAAiS;AACjS,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAgBxE;AAOD,8MAA8M;AAC9M,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,CAOhG;AAED;;;GAGG;AACH,UAAU,SAAS;IACjB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC;CAC5C;AAED,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAoCD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,GAAE,SAAS,cAAc,EAAO,EACrC,YAAY,CAAC,EAAE,WAAW,GACzB,UAAU,CAgBZ;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAWjD,CAAC;AAEF,kKAAkK;AAClK,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,GAAE,SAAS,cAAc,EAAO,EACrC,YAAY,CAAC,EAAE,WAAW,GACzB,SAAS,MAAM,EAAE,CASnB;AAED,+KAA+K;AAC/K,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,SAAS,cAAc,EAAE,YAAK,EACrC,YAAY,EAAE,WAAW,GAAG,SAAS,EACrC,IAAI,EAAE,cAAc,GACnB,cAAc,CAMhB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,SAAS,cAAc,EAAE,YAAK,EACrC,IAAI,EAAE,cAAc,GACnB,cAAc,CAOhB;AAiBD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CA4CzE;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CA2D7E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CA2HnE;AAQD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAmB5E"}