@gajae-code/coding-agent 0.12.11 → 0.12.12

package/dist/types/sdk/bus/chat-daemon-command-channel.d.ts

@@ -0,0 +1,244 @@
+/**
+ * Request/response control channel for chat-daemon commands that must be
+ * executed *by* the running owner instead of terminating it.
+ *
+ * `control.json` is the lifecycle channel: every request the owner recognizes
+ * there ends its serving loop (stop/reload). Adopting an existing Slack root
+ * must not stop a healthy daemon, so operator commands travel on this separate
+ * per-request channel and are answered in place.
+ *
+ * Invariants:
+ * - Every request is addressed to an exact owner (`ownerId`, `pid`,
+ *   `incarnation`, daemon `generation`). A daemon that is not that exact owner
+ *   answers `owner_changed` and performs no work, so a replaced or restarted
+ *   owner can never satisfy a request captured against its predecessor. The
+ *   same tuple is re-proven inside the commit fence and echoed in the answer,
+ *   so the submitter can verify who actually acted.
+ * - `<id>.response.json` is a single-winner arbitration object created with
+ *   `O_CREAT|O_EXCL`. The serving daemon must win it *before* it commits, and a
+ *   submitter that has given up must win it before reporting failure. Whoever
+ *   loses learns so definitively, which removes the commit-vs-timeout race
+ *   without any sleep: a definitive `cancelled` answer proves no dispatch can
+ *   follow within this submission's race, and a lost cancellation is reported
+ *   as `unknown` rather than as a failure the caller could act on. The
+ *   arbitration is scoped to that race under the trust boundary below; it is
+ *   not durable settlement across a crashed and resurrected daemon.
+ * - Documents live in an owner-only (`0700`) directory below the agent
+ *   directory, are bounded, and are rejected unless they are ordinary regular
+ *   files. This matches the product's existing same-UID local trust boundary;
+ *   it is not a defence against a hostile process running as the same user.
+ * - Only identifiers travel through the channel. Tokens, message bodies, and
+ *   control secrets are never written here.
+ *
+ * The channel proves *correlation*, never authorship: every field a response
+ * echoes is copied verbatim out of the plaintext request published beside it,
+ * so a definitive answer is only actionable once the caller corroborates the
+ * mutation against an authority outside this directory.
+ */
+import { type ChatDaemonKind } from "./chat-daemon-control";
+export declare const CHAT_DAEMON_COMMAND_VERSION = 1;
+export declare const DEFAULT_CHAT_DAEMON_COMMAND_TIMEOUT_MS = 15000;
+export type ChatDaemonCommandName = "bind-thread";
+export type ChatDaemonCommandStatus = "ok" | "rejected" | "owner_changed" | "expired" | "outcome_unknown";
+/** Exact owner authority a request is addressed to. */
+export interface ChatDaemonCommandOwner {
+    ownerId: string;
+    pid: number;
+    incarnation: string;
+    generation: number;
+}
+export interface ChatDaemonCommandRequest extends ChatDaemonCommandOwner {
+    version: typeof CHAT_DAEMON_COMMAND_VERSION;
+    requestId: string;
+    kind: ChatDaemonKind;
+    command: ChatDaemonCommandName;
+    sessionId: string;
+    rootTs: string;
+    createdAt: number;
+    expiresAt: number;
+}
+/**
+ * The answer to exactly one request.
+ *
+ * The owner tuple, session, and root are the *addressed* request's, echoed
+ * verbatim. A response therefore carries the complete request envelope, and a
+ * submitter can prove that the document in front of it is correlated with its
+ * own request rather than with a replayed or concurrent one.
+ *
+ * That is correlation, not authentication. Every echoed field is public: it is
+ * copied out of the plaintext request published in the same command directory,
+ * so a stale or planted document can satisfy the envelope without the addressed
+ * daemon ever running. A caller that needs a definitive outcome must corroborate
+ * it against an authority outside this directory (the durable mutation itself).
+ */
+export interface ChatDaemonCommandResponse extends ChatDaemonCommandOwner {
+    version: typeof CHAT_DAEMON_COMMAND_VERSION;
+    requestId: string;
+    kind: ChatDaemonKind;
+    command: ChatDaemonCommandName;
+    sessionId: string;
+    rootTs: string;
+    status: ChatDaemonCommandStatus;
+    /** Machine-readable rejection category; never a message body or credential. */
+    code?: string;
+    endpointGeneration?: number;
+    teamId?: string;
+    channelId?: string;
+    completedAt: number;
+}
+/**
+ * Result of one handler dispatch, carrying explicit commit certainty.
+ *
+ * A failure is never just a code. `rejected` asserts that no mapping changed, so
+ * the caller may be told the binding definitively failed. `unknown` asserts the
+ * opposite: commit authority was exercised and the mapping may already be
+ * applied, so no definitive rejection may be reported for it. Handlers state
+ * this directly instead of leaving the channel to infer it from error text.
+ */
+export type ChatDaemonCommandOutcome = {
+    ok: true;
+    sessionId: string;
+    endpointGeneration: number;
+    teamId: string;
+    channelId: string;
+    rootTs: string;
+} | {
+    ok: false;
+    certainty: "rejected";
+    code: string;
+} | {
+    ok: false;
+    certainty: "unknown";
+    code: string;
+};
+export interface ChatDaemonCommandBindInput {
+    sessionId: string;
+    rootTs: string;
+    /**
+     * Terminal authority for this exact request. It must be awaited inside the
+     * store fence, immediately before the commit, and the commit must be
+     * abandoned when it answers `false`. It re-proves the exact daemon owner
+     * tuple, that the request is still published and unexpired, and takes the
+     * single-winner response claim, after which no cancellation can succeed.
+     */
+    commitAuthority?: () => Promise<boolean>;
+}
+/** Daemon-side executor. Implemented by the runtime that owns the live transports. */
+export interface ChatDaemonCommandHandler {
+    bindExistingRoot(input: ChatDaemonCommandBindInput): Promise<ChatDaemonCommandOutcome>;
+}
+export declare function isChatDaemonCommandRequest(value: unknown): value is ChatDaemonCommandRequest;
+export declare function isChatDaemonCommandResponse(value: unknown): value is ChatDaemonCommandResponse;
+/**
+ * The owner-only directory the channel exchanges its documents in.
+ *
+ * `directory` is a plain pathname: this codebase already trusts same-UID local
+ * processes, and every document below it is bounded and validated, so the
+ * channel does not attempt hostile-filesystem hardening it cannot honestly
+ * provide from TypeScript.
+ */
+export interface ChatDaemonCommandScope {
+    readonly directory: string;
+}
+export interface OpenChatDaemonCommandScopeInput {
+    agentDir: string;
+    kind: ChatDaemonKind;
+    /** Creates the daemon and command directories owner-only when absent. */
+    create?: boolean;
+}
+/** Capture the command directory, or report the channel unusable. */
+export declare function openChatDaemonCommandScope(input: OpenChatDaemonCommandScopeInput): Promise<ChatDaemonCommandScope | undefined>;
+/** Build a request addressed to one exact owner. */
+export declare function buildChatDaemonCommandRequest(input: {
+    kind: ChatDaemonKind;
+    command: ChatDaemonCommandName;
+    owner: ChatDaemonCommandOwner;
+    sessionId: string;
+    rootTs: string;
+    now?: number;
+    ttlMs?: number;
+    requestId?: string;
+}): ChatDaemonCommandRequest;
+export interface SubmitChatDaemonCommandInput {
+    agentDir: string;
+    kind: ChatDaemonKind;
+    owner: ChatDaemonCommandOwner;
+    command: ChatDaemonCommandName;
+    sessionId: string;
+    rootTs: string;
+    timeoutMs?: number;
+    pollIntervalMs?: number;
+    /** Bounded wait after a lost cancellation, before the outcome is reported unknown. */
+    settleGraceMs?: number;
+    ttlMs?: number;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+    requestId?: string;
+}
+/**
+ * Terminal result of one submission.
+ *
+ * `cancelled` is the only definitive failure: the submitter won the response
+ * claim, so the addressed owner cannot dispatch this request from here on within
+ * this submission's race. `unknown` means the daemon won that claim first and its
+ * answer was not observed; the caller must not report a definitive failure,
+ * because a commit may already be applied.
+ *
+ * `untrusted` means the response object under this identifier is a complete,
+ * well-formed document that does not carry this request's envelope. It is
+ * channel corruption — stale or planted — so it may not be read as an answer of
+ * any status, and because the identifier is now occupied the real outcome is
+ * unknowable from here; the caller must treat it exactly like `unknown`.
+ */
+export type ChatDaemonCommandSubmission = {
+    outcome: "answered";
+    response: ChatDaemonCommandResponse;
+} | {
+    outcome: "cancelled";
+} | {
+    outcome: "unknown";
+} | {
+    outcome: "untrusted";
+    code: "response_envelope_mismatch";
+} | {
+    outcome: "unavailable";
+    code: "command_channel_unavailable" | "request_id_unavailable";
+};
+/**
+ * Publish a command for the addressed owner and wait for its answer.
+ *
+ * The wait ends in exactly one of four states, and the commit-vs-timeout race is
+ * arbitrated by the exclusive creation of the response object rather than by any
+ * timing assumption.
+ */
+export declare function submitChatDaemonCommand(input: SubmitChatDaemonCommandInput): Promise<ChatDaemonCommandSubmission>;
+export interface ServeChatDaemonCommandsInput {
+    agentDir: string;
+    kind: ChatDaemonKind;
+    /** The serving daemon's own proven authority. */
+    ownerId: string;
+    pid: number;
+    incarnation: string;
+    generation: number;
+    handler: ChatDaemonCommandHandler;
+    /**
+     * Re-proves that this process still holds the persisted owner record. It is
+     * checked before any work is dispatched *and again* inside the commit fence,
+     * so a daemon that lost ownership after dispatch mutates nothing.
+     */
+    verifyOwnership?: () => Promise<boolean>;
+    now?: () => number;
+}
+/**
+ * Answer every pending request addressed to this exact owner. Requests aimed at
+ * any other owner identity are answered `owner_changed` without doing work, and
+ * expired requests are answered `expired`; neither performs a mutation.
+ */
+export declare function serveChatDaemonCommandsOnce(input: ServeChatDaemonCommandsInput): Promise<number>;
+/**
+ * Answer every pending request against an already-captured command scope.
+ *
+ * Exposed so a caller that already holds the directory authority drives exactly
+ * the production path.
+ */
+export declare function serveChatDaemonCommandsAgainstScope(scope: ChatDaemonCommandScope, input: ServeChatDaemonCommandsInput): Promise<number>;

package/dist/types/sdk/bus/chat-daemon-control.d.ts

@@ -32,7 +32,11 @@ export type ChatDaemonAction = "stop" | "reload";
  * Discord generation 24 / slack generation 23 apply provider-completeness and
  * effective-enable admission to chat daemon lifecycle controls. Discord
  * generation 25 / slack generation 24 apply identity-bound exact replacement
- * cleanup shared by managed-session and daemon filesystem authority.
+ * cleanup shared by managed-session and daemon filesystem authority. Discord
+ * generation 26 / slack generation 25 add the in-place operator command channel:
+ * an owner serves per-request commands inside its own serving loop and answers
+ * them against an exact owner tuple, so an owner at an earlier generation may
+ * not serve or answer a request captured against this contract.
  */
 export declare const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>>;
 export declare function chatDaemonGeneration(kind: ChatDaemonKind): number;
@@ -93,6 +97,12 @@ export declare function chatDaemonPaths(agentDir: string, kind: ChatDaemonKind):
     state: string;
     control: string;
 };
+/**
+ * Configuration fingerprint that identifies which settings a daemon owner was
+ * started for. `undefined` means the current settings cannot configure that
+ * transport at all, so no owner can be authorized against them.
+ */
+export declare function chatDaemonIdentity(settings: Settings, kind: ChatDaemonKind): string | undefined;
 export declare function readChatDaemonState(agentDir: string, kind: ChatDaemonKind): Promise<ChatDaemonState | undefined>;
 export declare function readChatDaemonControlRequest(agentDir: string, kind: ChatDaemonKind): Promise<ChatDaemonControlRequest | undefined>;
 export declare function writeChatDaemonControlRequest(agentDir: string, kind: ChatDaemonKind, request: ChatDaemonControlRequest): Promise<void>;

package/dist/types/sdk/bus/chat-daemon-runtime.d.ts

@@ -1,5 +1,6 @@
 import { SessionIndex } from "../broker/session-index";
 import { type SdkSessionEndpoint } from "../client/discovery";
+import type { ChatDaemonCommandBindInput, ChatDaemonCommandOutcome } from "./chat-daemon-command-channel";
 import type { ChatDaemonKind } from "./chat-daemon-control";
 import type { DiscordProvider } from "./discord-provider";
 import { type SlackProviderClient } from "./slack-provider";
@@ -69,6 +70,12 @@ export declare class ChatDaemonRuntime {
     private reconcile;
     private attach;
     private resolveEndpoint;
+    /**
+     * Adopt an operator-supplied Slack root for one attached session. Returns a
+     * machine-readable rejection instead of throwing so the daemon control plane
+     * can answer without exposing internal failure detail.
+     */
+    bindExistingRoot(request: ChatDaemonCommandBindInput): Promise<ChatDaemonCommandOutcome>;
     private schedule;
     private enqueueFrame;
     private handleFrame;

package/dist/types/sdk/bus/control-plane-frames.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Typed control-plane discriminants that must never reach chat presentation.
+ *
+ * A chat daemon observes one session socket for user-visible events, but that
+ * socket also carries the SDK's own request/response traffic: `SdkClient`
+ * settles a pending request from an inbound frame and still forwards the very
+ * same frame to every `onFrame` observer. A runtime that projects unknown frame
+ * types into a generic notification therefore renders protocol answers — most
+ * visibly `GJC event replay result` — as chat content, and a chat transport
+ * with no mapping for that session publishes it as a brand-new root.
+ *
+ * Membership is exact, typed, and closed. It is never inferred from a `_result`
+ * or `_response` suffix: ordinary public frames are free to be named anything,
+ * and a fuzzy rule would silently swallow real user content. Every entry below
+ * names the source authority that emits it and the code path that proves it can
+ * be delivered to a chat daemon's frame observer.
+ *
+ * In scope (proven reachable at the chat-daemon session-client seam):
+ * - `event_replay_result` — `SessionSdkHost` (`sdk/host/host.ts`) answers the
+ *   `event_replay` request that `ChatDaemonRuntime.attach()` issues on every
+ *   attachment, so every attached session receives exactly this frame.
+ * - `control_response` — the same host's answer to the `control_request` that
+ *   `ChatDaemonRuntime` sends for an authorized `/sdk control …` command, and
+ *   the endpoint-stale refusal the session runtime writes for a fenced
+ *   connection.
+ * - `query_response` — the host's answer to the matching `query_request`, and
+ *   the same endpoint-stale refusal path.
+ * - `hello` — `ServerMessage::Hello` from the native session server
+ *   (`crates/gjc-sdk/src/protocol.rs`), sent to every connection at accept time
+ *   and re-observed by frame handlers whenever the client reconnects and
+ *   adopts a new connection id.
+ *
+ * Deliberately out of scope — typed server→client frames that exist but are
+ * unicast only to a connection that issued a request a chat daemon never
+ * sends, so no source path delivers them here: `session_activate_result`,
+ * `register_provider_result`, `lease_state`, `reverse_response`,
+ * `reverse_request`, `reverse_cancel`, `global_response`, `pong`, and
+ * `transport_error`. Add one only together with the source path that proves it
+ * reaches this seam.
+ */
+export declare const CONTROL_PLANE_FRAME_TYPES: ReadonlySet<string>;
+/** Whether an exact frame/event discriminant is protocol-only control plane. */
+export declare function isControlPlaneFrameType(name: string | undefined): boolean;

package/dist/types/sdk/bus/conversation-store.d.ts

@@ -70,4 +70,22 @@ export declare class ConversationStore<T extends ConversationRecord> {
     delete(key: string, expectedGeneration: number): Promise<boolean>;
     /** Apply a synchronous update under the mapping lock, retrying no stale state. */
     transact(key: string, update: (current: T | undefined) => T | undefined): Promise<T | undefined>;
+    /**
+     * Apply one key update while atomically observing every mapping in the same
+     * store snapshot. The observation and the write share the cross-process file
+     * lock, so a caller can enforce uniqueness constraints that span keys.
+     *
+     * The update may be asynchronous so a caller can re-prove local authority
+     * (process, endpoint, or session state) inside the lock, immediately before
+     * its commit; returning `current` unchanged aborts without any mutation. It
+     * must never perform a remote/network call while holding the lock: the lock
+     * is a short fence, not a place to wait on a provider.
+     *
+     * Authority proven by the update is the last proof before the atomic
+     * replacement. Authority that rolls after it is an ordinary lifecycle event:
+     * the mapping records the endpoint generation it was proven under, so a newer
+     * generation fences it through the same monotonic compare-and-swap every
+     * other writer uses.
+     */
+    transactWithSnapshot(key: string, update: (current: T | undefined, conversations: Readonly<Record<string, T>>) => T | undefined | Promise<T | undefined>): Promise<T | undefined>;
 }

package/dist/types/sdk/bus/existing-thread-readiness.d.ts

@@ -0,0 +1,71 @@
+/**
+ * The prepare → bind → activate lifecycle for adopting an existing chat root.
+ *
+ * Stock startup publishes a session's readiness immediately, so the running
+ * chat daemon surfaces the session and creates its own root before an operator
+ * could ever name an existing one. A session that opts in is *prepared*
+ * instead: its id, endpoint, and broker registration are discoverable authority
+ * while readiness stays withheld, which leaves exactly one root claim for
+ * `gjc notify bind-thread` to fill. Activation then publishes readiness once,
+ * and the daemon adopts the bound root instead of replacing it.
+ *
+ * Nothing here mutates a mapping. The gate only reads the daemon-owned store to
+ * prove a binding exists, and the activation client only asks the session's own
+ * host to publish the readiness it withheld.
+ */
+import type { SessionIndex } from "../broker/session-index";
+import type { SdkSessionEndpoint, SdkSessionEndpointScope } from "../client/discovery";
+import type { SessionActivationGate } from "../host";
+import { type ActivatedPreparedSession, type PreparedSessionActivationClient } from "../session-activation";
+import type { ConversationStore } from "./conversation-store";
+import type { SlackConversation } from "./slack-conversation";
+/** Explicit, session-scoped opt-in for withholding readiness until a root is bound. */
+export declare const EXISTING_THREAD_BIND_ENV = "GJC_NOTIFY_BIND_EXISTING_THREAD";
+/**
+ * Existing-thread binding is opt-in, and only the exact value `1` opts in.
+ *
+ * Every other value — absent, empty, `0`, or anything truthy-looking — keeps
+ * the stock immediate-readiness contract, so no session silently loses its
+ * root publication because of an ambiguous environment.
+ */
+export declare function isExistingThreadBindingRequested(env?: NodeJS.ProcessEnv): boolean;
+export interface SlackBindingActivationInput {
+    store: ConversationStore<SlackConversation>;
+    teamId: string;
+    channelId: string;
+}
+/**
+ * Authorize activation only against an applied binding for this exact session.
+ *
+ * The proof is the daemon-owned mapping itself: an active record for this
+ * session, in the configured workspace and channel, carrying a root and the
+ * exact endpoint generation being activated. A missing, foreign, or
+ * stale-generation mapping is a refusal, and an unreadable store raises so the
+ * caller reports unavailable authority instead of an authorization.
+ */
+export declare function createSlackBindingActivationGate(input: SlackBindingActivationInput): SessionActivationGate;
+export type { ActivatedPreparedSession, PreparedSessionActivationClient, SessionActivationErrorCode, } from "../session-activation";
+export { requestPreparedSessionActivation, SessionActivationError } from "../session-activation";
+export interface PreparedSessionActivationInput {
+    sessionIndex: SessionIndex;
+    sessionId: string;
+}
+export interface PreparedSessionActivationDeps {
+    readEndpoint?: (repo: string, sessionId: string, scope?: SdkSessionEndpointScope) => Promise<SdkSessionEndpoint | null>;
+    connect?: (endpoint: {
+        url: string;
+        token: string;
+    }) => Promise<PreparedSessionActivationClient>;
+}
+/**
+ * Ask a prepared session to publish the readiness it withheld.
+ *
+ * The same discovery authority the binding requires is resolved first, so an
+ * unindexed, terminated, or endpoint-rolled session is refused before any
+ * connection is opened. The request names the exact session and endpoint
+ * generation, and the answer is accepted only when it proves both, so a
+ * replacement session can never be activated in place of the requested one.
+ * Activation is idempotent: an exact retry answers `already` without a second
+ * readiness signal.
+ */
+export declare function activatePreparedSession(input: PreparedSessionActivationInput, deps?: PreparedSessionActivationDeps): Promise<ActivatedPreparedSession>;

package/dist/types/sdk/bus/notification-service.d.ts

@@ -51,6 +51,16 @@ export interface NotificationExactUnlinkResult {
 export declare function readNotificationEndpointFile(file: string): Promise<NotificationEndpointFile>;
 /** Bump when the native exact-deletion identity contract changes. */
 export declare const NATIVE_PATH_IDENTITY_CONTRACT_VERSION = 1;
+/**
+ * Remove exactly the inspected regular file.
+ *
+ * Intermediate directory symlinks (e.g. multi-account layouts that share
+ * `notifications/` via a directory symlink) are resolved before the native
+ * no-follow unlink. Only the parent path is canonicalized; the final basename
+ * is rejoined so native exact_unlink still applies AT_SYMLINK_NOFOLLOW to the
+ * final path component at mutation time. A final-component file symlink stays
+ * `reparse_point` (including TOCTOU replacement after JS preflight).
+ */
 export declare function exactUnlinkNotificationFile(file: string, identity: NotificationEndpointFileIdentity, quarantineName: string): NotificationExactUnlinkResult;
 /** Minimal filesystem surface the service needs; injectable for tests. */
 export interface NotificationServiceFs {

package/dist/types/sdk/bus/slack-daemon.d.ts

@@ -1,6 +1,8 @@
 import { type SdkSessionEndpoint } from "../client/discovery";
 import { ConversationStore } from "./conversation-store";
 import { type SlackConversation } from "./slack-conversation";
+export type { SlackThreadBindingErrorCode } from "./slack-thread-binding";
+export { SlackThreadBindingError } from "./slack-thread-binding";
 export declare class SlackEndpointBindingError extends Error {
     constructor(message?: string);
 }
@@ -11,6 +13,11 @@ export interface SlackEndpoint extends SdkSessionEndpoint {
 export interface SlackSdkClient {
     send(frame: Record<string, unknown>): void;
 }
+/** Proven right to bind one session at one endpoint generation. */
+export interface SlackBindingAuthority {
+    sessionId: string;
+    endpointGeneration: number;
+}
 export interface SlackNotificationDaemonOptions {
     agentDir: string;
     repo: string;
@@ -27,6 +34,12 @@ export interface SlackNotificationDaemonOptions {
     publicationOwnerId?: string;
     publicationLeaseMs?: number;
     resolveEndpoint?: (sessionId: string) => Promise<SlackEndpoint | null>;
+    /**
+     * Exact discovery/attachment authority for adopting an existing root. The
+     * runtime supplies index, endpoint, and attachment proof; without it only the
+     * resolvable endpoint generation can be proven.
+     */
+    resolveBindingAuthority?: (sessionId: string) => Promise<SlackBindingAuthority | undefined>;
     createClient: (endpoint: SlackEndpoint) => SlackSdkClient;
     onCommand?: (sessionId: string, content: string, endpoint: SlackEndpoint, idempotencyKey: string) => Promise<boolean>;
 }
@@ -46,6 +59,20 @@ export declare class SlackNotificationDaemon {
     /** Accepted inbound effects are durably claimed before their Socket Mode ACK. */
     handleEnvelope(envelope: SlackSocketEnvelope): Promise<boolean>;
     postRoot(sessionId: string, body: string, endpointGeneration?: number): Promise<SlackConversation>;
+    /**
+     * Adopt an operator-supplied root in the configured workspace and channel
+     * without publishing a replacement root.
+     *
+     * The root is verified against the provider before any lock is taken, and the
+     * claim re-proves session authority inside the store lock. When the caller is
+     * the daemon command channel it also supplies `commitAuthority`, which
+     * re-proves the exact daemon owner tuple and takes terminal request
+     * authority in the same fence, so an ownership change or a cancellation
+     * between dispatch and commit leaves the store untouched. The claim targets
+     * the same session key stock publication uses, so a concurrent first
+     * notification observes the adopted root instead of posting a second one.
+     */
+    bindExistingRoot(sessionId: string, rootTs: string, commitAuthority?: () => Promise<boolean>): Promise<SlackConversation>;
     /** Deliver a notification into the mapped root thread, creating that root once. */
     notify(sessionId: string, body: string, actionId?: string, endpointGeneration?: number): Promise<SlackConversation>;
     /** Posts a safe command outcome to the active mapped root thread. */

package/dist/types/sdk/bus/slack-live-provider.d.ts

@@ -63,4 +63,15 @@ export declare class SlackLiveProvider implements SlackProviderClient, SlackDiag
         clientMsgId: string;
         threadTs?: string;
     }): Promise<SlackMessageSearchResult | null>;
+    /**
+     * Confirm that `ts` addresses a real message in `channel`. Slack answers
+     * `conversations.replies` with the addressed message first; a timestamp that
+     * is unknown, deleted, or lives in another channel produces a Web API error
+     * instead, which surfaces as a `SlackProviderError` the caller treats as an
+     * unverified root.
+     */
+    findMessageByTimestamp(input: {
+        channel: string;
+        ts: string;
+    }): Promise<SlackMessageSearchResult | null>;
 }

package/dist/types/sdk/bus/slack-provider.d.ts

@@ -50,6 +50,15 @@ export interface SlackProviderClient {
         clientMsgId: string;
         threadTs?: string;
     }): Promise<SlackMessageSearchResult | null>;
+    /**
+     * Prove that an operator-supplied timestamp addresses a real message in the
+     * requested channel. Adoption of an existing root is refused when a client
+     * cannot answer this, so verification is never silently skipped.
+     */
+    findMessageByTimestamp?(input: {
+        channel: string;
+        ts: string;
+    }): Promise<SlackMessageSearchResult | null>;
     readonly transportHealthy?: boolean;
 }
 /**
@@ -74,4 +83,9 @@ export declare class SlackProvider {
         clientMsgId: string;
         threadTs?: string;
     }): Promise<SlackMessageSearchResult | null>;
+    /** Fail-closed root verification: a client without this capability can never confirm a root. */
+    findMessageByTimestamp(input: {
+        channel: string;
+        ts: string;
+    }): Promise<SlackMessageSearchResult | null>;
 }