@open-everywhere/core 0.1.0

package/dist/agent/channels/unified-reply.js

@@ -0,0 +1,247 @@
+// unified-reply — the single-window reply DISPATCH: post a unified-session reply back into the surface a wake came from, addressed EXCLUSIVELY by a resolved UnifiedWakeOrigin. Never the per-turn auth snapshot, which a cross-surface merge would make name one wake only, and never model prose. (That merge is unreachable on eve 0.54.3 — only the caller-less task completion cohort folds, and it carries no `auth` — but the map is not defensive: every reply resolves its target from it, single-wake turns included — OPE-2042.)
+// This spine keeps the choke-point audit, the spoof seam and the injectable deps, and dispatches by `origin.platform` through the post-arms registry, so it holds no vendor imports of its own. Every arm fails VISIBLE — thrown and token-free — when the post did not land, never a silent no-op.
+import { auditReplyPost, notePostFailure, recordLandedPost, releasePostKeyOnFailure, REPLY_DEDUPE_SKIPPED_ID, } from "./reply-post.js";
+import { recordContainerAnswered } from "./answered-container-ledger.js";
+import { withReplierPrefix, truncateMemoryCitationPaths } from "./turn-delivery.js";
+import { applyReplyProvenance, auditReplyProvenance } from "./reply-provenance.js";
+import { auditWithheldMemoryClaim, guardMemoryClaims } from "./memory-claim-guard.js";
+import { auditWithheldApprovalClaim, guardApprovalClaims } from "./approval-claim-guard.js";
+import { auditWithheldRequestClaim, guardRequestClaims } from "./request-claim-guard.js";
+import { swallowRoomPost } from "./egress-spoof.js";
+import { postArm } from "./post-arms.js";
+import { outboundKey, postOnce } from "../operational/post-once.js";
+/**
+ * The (channel, threadTs) pair a unified reply's DEDUPE key hashes on. It mirrors {@link UnifiedWakeOrigin}'s discriminated union field for field, and is the single-window sibling of reply-post.ts's `replyDedupeLocus`.
+ * Both Discord variants share the `channelId` field, so no further discrimination is needed here.
+ */
+function unifiedDedupeLocus(origin) {
+    switch (origin.platform) {
+        case "slack":
+            return { channel: origin.channelId, threadTs: origin.threadTs };
+        case "github":
+            return { channel: `${origin.owner}/${origin.repo}#${origin.issueNumber}` };
+        case "linear":
+            return { channel: origin.agentSessionId ?? `ambient:${origin.issueId}` };
+        case "notion":
+            return { channel: origin.discussionId };
+        case "discord":
+            return { channel: origin.channelId };
+        case "teams":
+            return { channel: `${origin.serviceUrl}::${origin.conversationId}`, threadTs: origin.replyToActivityId };
+        default:
+            // Same totality guard as replyDedupeLocus: an origin outside the typed union (test fake /
+            // out-of-tree arm) must dedupe on the serialized origin, never crash the post.
+            return { channel: JSON.stringify(origin) };
+    }
+}
+/**
+ * Post `text` into the conversation `origin` names and return the platform message id. It throws an honest, token-free error when the post did not land, so the model knows the reply failed rather than silently believing it posted.
+ * THE CHOKE POINT: when `audit` is supplied the single canonical `reply.post` row is written HERE, after the id is known, for BOTH callers — and it lands even under the egress spoof, because the eval targets score from the row. Idempotent across a step re-run or a genuine double call: a distinct action tag keeps its outbound key from ever colliding with the per-surface choke point's.
+ */
+export async function postUnifiedReply(origin, text, deps = {}, audit, replier, intent, 
+/**
+ * TAPPABLE ACTIONS beside the text (OPE-1720) — rendered only by an arm that declares
+ * {@link PostArm.dispatchUnifiedActions}, and silently absent on every other surface, where the
+ * same text posts alone. The caller's copy must therefore stand on its own, exactly as it must for
+ * a DM ({@link DirectMessageAction}).
+ * They ride OUTSIDE the dedupe payload on purpose: the key is already the body, and two posts of
+ * one body differing only in their button row would be the same duplicate post this key exists to
+ * suppress.
+ */
+actions = []) {
+    // OPE-916: same truncation reply-post.ts's postReply applies, and for the same reason — before
+    // the prefix / dedupe key / audit chars.
+    // OPE-1608: and the same connector footer. THIS DOOR IS THE ONE A UNIFIED SEAT ACTUALLY USES, so
+    // leaving it out would have shipped the feature backwards: the post would carry nothing and an
+    // `edit_reply` of that same post — which funnels through the shared edit spine — would grow a host
+    // line out of nowhere. What the footer SAYS here is decided by the reach rule, and on this door the
+    // proof is the WAKE: the audit's `wakeId` is the fenced conversation this post lands in, and only
+    // the reads recorded under that same wake are named (channels/reply-provenance.ts, OPE-1713).
+    const claimGuard = guardMemoryClaims(truncateMemoryCitationPaths(text), audit);
+    // OPE-1876: and the no-approval claim, on the same body, at the same choke point — a door that
+    // struck one and posted the other would read as a rendering glitch.
+    const approvalGuard = guardApprovalClaims(claimGuard.body, audit);
+    // OPE-2022: and the propose claim, on the same body, at the same choke point. A seat may not say
+    // it submitted a request the host never saw the propose plane make.
+    const requestGuard = guardRequestClaims(approvalGuard.body, audit);
+    const provenance = applyReplyProvenance(requestGuard.body, audit);
+    const clean = provenance.body;
+    // OPE-508: the same choice reply-post.ts's postReply makes — Slack (displayNameCapable) gets
+    // `replier` passed through untouched; every other origin gets the shared bracket prefix baked
+    // into the body ONCE here, before dedupe-keying and dispatch.
+    const arm = postArm(origin.platform);
+    const nativeReplier = arm?.displayNameCapable ? replier : undefined;
+    const body = replier && !arm?.displayNameCapable ? withReplierPrefix(clean, replier) : clean;
+    const locus = unifiedDedupeLocus(origin);
+    // stableId = wakeId, same rationale as postReply's key: dedupe within one wake, never across
+    // wakes whose replies happen to share bytes.
+    const key = outboundKey({
+        surface: origin.platform,
+        channel: locus.channel,
+        threadTs: locus.threadTs,
+        action: "reply.dispatch.unified",
+        stableId: audit?.wakeId,
+        payload: body,
+    });
+    const id = await postOnce({
+        org: audit?.org,
+        key,
+        run: async () => {
+            let realId;
+            try {
+                realId = await dispatchUnifiedReply(origin, body, deps, nativeReplier, intent, actions);
+            }
+            catch (err) {
+                // OPE-821 — the unified half of the same statement the per-surface choke point makes: one
+                // `reply.post.failed` row carrying the class, then the arm's own error re-thrown untouched.
+                await notePostFailure(audit, err, origin.platform);
+                throw err;
+            }
+            await auditReplyPost(audit, realId, origin.platform, body.length);
+            // OPE-1608 STORE-FIRST, the unified half: the row records the FULL source list, the footer
+            // carries the subset this reply's own WAKE proves, and `withheld` records the difference. On a
+            // turn that served several conversations the two genuinely differ, and the row is then the only
+            // place the turn's sibling sources are answerable at all.
+            await auditReplyProvenance(audit, realId, origin.platform, provenance.reads, provenance.shown);
+            await auditWithheldMemoryClaim(audit, origin.platform, claimGuard.withheld);
+            await auditWithheldApprovalClaim(audit, origin.platform, approvalGuard.withheld, approvalGuard.cause);
+            await auditWithheldRequestClaim(audit, origin.platform, requestGuard.withheld);
+            // The unified half of what a landed post owes — the own-post ledger row and the generation's tail ring, through the ONE seam both choke points share.
+            // The ledger key is the SAME locus the edit spine resolves from this origin, so a unified reply is editable by the wake that produced it.
+            await recordLandedPost({
+                org: audit?.org,
+                editLocus: unifiedEditLocus(origin),
+                messageId: realId,
+                body,
+                platform: origin.platform,
+                wake: audit?.wakeId,
+            });
+            // The DURABLE half of "this room has been answered", which the silent-turn close gate reads on a LATER turn to pick between its two fixed host lines.
+            // The per-turn reply record cannot carry it: the answer and the sibling wake's close ran in separate turns on the measured run.
+            await recordContainerAnswered(audit?.org, origin);
+            return realId;
+        },
+        // Same rule as the per-surface choke point: DEFINITIVE releases the claim (an identical retry
+        // must be able to post), AMBIGUOUS keeps it (an identical retry must not double-post).
+        releaseKeyOnFailure: releasePostKeyOnFailure,
+        skipped: () => REPLY_DEDUPE_SKIPPED_ID,
+    });
+    return id ?? REPLY_DEDUPE_SKIPPED_ID;
+}
+/**
+ * The {@link EditLocus} for a unified wake origin — the host-resolved half of `edit_reply`'s address on a cross-surface session, and the key the own-post ledger records under. PURE, and `null` for an origin with no editable address.
+ * THIS IS THE POST-TIME LOCUS, and `edit_reply` must not use it directly — call {@link resolveUnifiedEditLocus} instead. On Discord an arm can answer inside an auto-thread that did not exist when this origin was frozen, so the frozen channel id is the wrong address for an edit.
+ */
+export function unifiedEditLocus(origin) {
+    switch (origin.platform) {
+        case "slack":
+            return { platform: "slack", channelId: origin.channelId };
+        case "discord":
+            return { platform: "discord", channelId: origin.channelId };
+        case "teams":
+            return { platform: "teams", channelId: origin.conversationId, serviceUrl: origin.serviceUrl };
+        case "github":
+            // OPE-862: the same composite "owner/repo" locus replyEditLocus resolves for a mid-turn target.
+            return { platform: "github", channelId: `${origin.owner}/${origin.repo}` };
+        case "linear":
+            // OPE-872: the sibling of reply-post.ts's `replyEditLocus` linear case — read its note for why
+            // ONLY the ambient route (`origin.ambient`) has an editable address, and why the mention route's
+            // `null` is a permanent platform limit rather than a not-yet.
+            return origin.ambient
+                ? { platform: "linear", channelId: origin.issueId, ...(origin.organizationId ? { organizationId: origin.organizationId } : {}) }
+                : null;
+        case "notion":
+            // OPE-1046: the sibling of reply-post.ts's `replyEditLocus` notion case — read its note for the
+            // `<workspace>/<page>` composite and why a missing workspace/page falls to `null`.
+            return origin.workspaceId && origin.pageId
+                ? { platform: "notion", channelId: `${origin.workspaceId}/${origin.pageId}` }
+                : null;
+        default:
+            // `replyEditLocus`'s default arm — a new surface needs a case here AND an `editMessage` arm, and
+            // only the pair arms the verb.
+            return null;
+    }
+}
+/**
+ * Does a TERMINAL post on this origin CLOSE the conversation, so nothing further can land in the
+ * same turn? (OPE-1452.)
+ *
+ * 🔴 IT IS THE ONE PLACE A SECOND ANSWER IS IMPOSSIBLE RATHER THAN MERELY UNWANTED, and that is why
+ * the same-turn `done` teeth read it. A Linear MENTION reply is a `response` Agent Activity, and a
+ * `response` ENDS the agent session — measured over every session in the live workspace, 2026-08-20
+ * (OPE-869, and see the note on `activityTypeFor` in the Linear post arm). The next post on that
+ * session fails `Entity not found: AgentSession`; it cost deploy #99 the real answer to Linear
+ * TOM-67, 38 seconds after the hand-off note that closed the session.
+ *
+ * So the reply path's duplicate-post valve stays SHUT here. Everywhere else a second message is a
+ * matter of style and the model's judgement decides it (Tommy's ruling, 2026-09-03); on this route
+ * the host would be inviting a call that cannot succeed, and the model would burn its remaining
+ * steps re-sending it with no steer left.
+ *
+ * The AMBIENT Linear route is not this shape: it posts a normal issue comment through
+ * `commentCreate` on the workspace token, which is editable and can be posted twice. Same split, and
+ * for the same underlying reason, as {@link unifiedEditLocus}'s `linear` case. The origin codec
+ * enforces the XOR, and `!== true` is the fail-closed read of it: an origin carrying neither flag
+ * refuses a second post rather than inviting a doomed one.
+ *
+ * Every other surface answers FALSE. This is deliberately not a general "is the room closed"
+ * question — {@link PostIntent} is read by exactly one post arm, so no other wired surface ends a
+ * conversation on a post, and inventing a broader predicate here would turn one measured platform
+ * limit into a policy nobody asked for.
+ */
+export function terminalPostClosesConversation(origin) {
+    return origin.platform === "linear" && origin.ambient !== true;
+}
+/**
+ * The address `edit_reply` uses on a unified session: {@link unifiedEditLocus}, then the post arm's optional `retargetEditLocus` on top. One arm can answer somewhere the FROZEN origin cannot name — a Discord auto-thread is its own channel id — so the reply lives at an address the origin does not carry, and the ownership READ and the PATCH must both address the conversation the message is actually in.
+ * The retarget runs BEFORE the ownership fence on purpose: checking the base channel and then dispatching to the thread would be a fence on one conversation and a write on another. It NEVER throws — an arm that cannot resolve a better address, or one that throws, degrades to the base locus, which is the correct answer for a reply that did land in the base channel.
+ */
+export async function resolveUnifiedEditLocus(origin) {
+    const locus = unifiedEditLocus(origin);
+    if (!locus)
+        return null;
+    const retarget = postArm(origin.platform)?.retargetEditLocus;
+    if (!retarget)
+        return locus;
+    return (await retarget(origin, locus).catch(() => locus)) ?? locus;
+}
+async function dispatchUnifiedReply(origin, text, deps = {}, replier, intent, actions = []) {
+    // LOCAL EVAL SPOOF — the shared exit, the same seam and rationale as the per-surface choke point. It stays SPINE-level, before the registry lookup, so no arm is reached with real credentials.
+    // The `unified-` id tag is load-bearing: it tells a unified post apart from a per-surface arm's own spoof id in the audit trail.
+    const swallowed = swallowRoomPost(`a unified ${origin.platform} reply (${text.length}c)`, `unified-${origin.platform}`);
+    if (swallowed !== undefined)
+        return swallowed;
+    // Dispatch by origin platform through the post-arms registry (channels/post-arms.ts); each arm
+    // resolves `deps.postX ?? live` internally. An unregistered origin fails LOUD (the typed
+    // UnifiedWakeOrigin union is exhaustive, so this only fires for a genuinely-unwired platform).
+    const arm = postArm(origin.platform);
+    if (!arm?.dispatchUnified) {
+        throw new Error(`unified reply couldn't post — no post arm registered for "${origin.platform}".`);
+    }
+    // THE COMPONENT PLANE (OPE-1720), and the fallback is STRUCTURAL rather than a flag: an arm that
+    // declares `dispatchUnifiedActions` renders the buttons, and one that does not posts the same text
+    // through `dispatchUnified`. Nothing here decides whether a surface "should" have buttons — the
+    // registry's own "presence IS the declaration" rule answers that, so a surface cannot be given a
+    // button row before its tap route exists.
+    if (actions.length > 0 && arm.dispatchUnifiedActions) {
+        return arm.dispatchUnifiedActions(origin, text, actions, deps, replier, intent);
+    }
+    return arm.dispatchUnified(origin, text, deps, replier, intent);
+}
+/**
+ * Complete the wake's OPEN session for a turn that judged SILENCE — no model prose ever posts — routed generically through the post arm's optional close. Only Linear has an open session to complete today: its @mention divert keeps the native agent session open so an async answer can complete it, and without this a silent turn would leave the session on a spinner forever.
+ * THE RENDERING IS THE ARM'S, and on Linear it is VISIBLE: the platform offers no activity that terminates a session invisibly, so the arm posts a FIXED HOST ack, never model prose. `answered` says the turn already answered this container through a SIBLING wake — the caller PROVES that and this function never re-derives it. The return says whether a session was actually completed, so the caller stamps its audit only when one was.
+ */
+export async function completeUnifiedSessionSilently(origin, deps = {}, answered = false) {
+    // AMBIENT origins hold no open session to close (the `ambient` discriminator lives on the linear
+    // arm of the union; absent/false on every other platform's origin). Nothing to stop, nothing to
+    // stamp — matching the previous linear-only `if (origin.ambient) return` short-circuit.
+    if (origin.ambient)
+        return false;
+    const arm = postArm(origin.platform);
+    if (!arm?.closeUnifiedSilently)
+        return false; // platform has no open-session-to-close (or unregistered)
+    await arm.closeUnifiedSilently(origin, deps, answered);
+    return true;
+}
+//# sourceMappingURL=unified-reply.js.map

package/dist/agent/channels/unified-reply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unified-reply.js","sourceRoot":"","sources":["../../../agent/channels/unified-reply.ts"],"names":[],"mappings":"AAAA,4gBAA4gB;AAC5gB,oSAAoS;AAGpS,OAAO,EACL,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,GAGxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,OAAO,EAA6C,MAAM,gBAAgB,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AA+BpE;;;GAGG;AACH,SAAS,kBAAkB,CAAC,MAAyB;IACnD,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,OAAO;YACV,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClE,KAAK,QAAQ;YACX,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7E,KAAK,QAAQ;YACX,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,IAAI,WAAW,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3E,KAAK,QAAQ;YACX,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QAC1C,KAAK,SAAS;YACZ,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QACvC,KAAK,OAAO;YACV,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC3G;YACE,0FAA0F;YAC1F,+EAA+E;YAC/E,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAyB,EACzB,IAAY,EACZ,IAAI,GAAqB,EAAE,EAC3B,KAAkB,EAClB,OAAsB,EACtB,MAAmB;AACnB;;;;;;;;GAQG;AACH,OAAO,GAAmC,EAAE;IAE5C,+FAA+F;IAC/F,yCAAyC;IACzC,iGAAiG;IACjG,+FAA+F;IAC/F,mGAAmG;IACnG,oGAAoG;IACpG,kGAAkG;IAClG,8FAA8F;IAC9F,MAAM,UAAU,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/E,+FAA+F;IAC/F,oEAAoE;IACpE,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClE,iGAAiG;IACjG,oEAAoE;IACpE,MAAM,YAAY,GAAG,kBAAkB,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,oBAAoB,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC;IAC9B,6FAA6F;IAC7F,8FAA8F;IAC9F,8DAA8D;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7F,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzC,6FAA6F;IAC7F,6CAA6C;IAC7C,MAAM,GAAG,GAAG,WAAW,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,wBAAwB;QAChC,QAAQ,EAAE,KAAK,EAAE,MAAM;QACvB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC;QACxB,GAAG,EAAE,KAAK,EAAE,GAAG;QACf,GAAG;QACH,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0FAA0F;gBAC1F,4FAA4F;gBAC5F,MAAM,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAClE,2FAA2F;YAC3F,+FAA+F;YAC/F,gGAAgG;YAChG,0DAA0D;YAC1D,MAAM,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;YAC/F,MAAM,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC5E,MAAM,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;YACtG,MAAM,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC/E,sJAAsJ;YACtJ,0IAA0I;YAC1I,MAAM,gBAAgB,CAAC;gBACrB,GAAG,EAAE,KAAK,EAAE,GAAG;gBACf,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC;gBACnC,SAAS,EAAE,MAAM;gBACjB,IAAI;gBACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,KAAK,EAAE,MAAM;aACpB,CAAC,CAAC;YACH,sJAAsJ;YACtJ,gIAAgI;YAChI,MAAM,uBAAuB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,8FAA8F;QAC9F,uFAAuF;QACvF,mBAAmB,EAAE,uBAAuB;QAC5C,OAAO,EAAE,GAAG,EAAE,CAAC,uBAAuB;KACvC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,uBAAuB,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IACxD,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,OAAO;YACV,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5D,KAAK,SAAS;YACZ,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9D,KAAK,OAAO;YACV,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QAChG,KAAK,QAAQ;YACX,gGAAgG;YAChG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7E,KAAK,QAAQ;YACX,+FAA+F;YAC/F,iGAAiG;YACjG,8DAA8D;YAC9D,OAAO,MAAM,CAAC,OAAO;gBACnB,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBAChI,CAAC,CAAC,IAAI,CAAC;QACX,KAAK,QAAQ;YACX,gGAAgG;YAChG,mFAAmF;YACnF,OAAO,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM;gBACxC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE;gBAC7E,CAAC,CAAC,IAAI,CAAC;QACX;YACE,iGAAiG;YACjG,+BAA+B;YAC/B,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAyB;IACtE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAAyB;IACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,MAAyB,EACzB,IAAY,EACZ,IAAI,GAAqB,EAAE,EAC3B,OAAsB,EACtB,MAAmB,EACnB,OAAO,GAAmC,EAAE;IAE5C,gMAAgM;IAChM,iIAAiI;IACjI,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,MAAM,CAAC,QAAQ,WAAW,IAAI,CAAC,MAAM,IAAI,EAAE,WAAW,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxH,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,+FAA+F;IAC/F,yFAAyF;IACzF,+FAA+F;IAC/F,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpG,CAAC;IACD,iGAAiG;IACjG,mGAAmG;IACnG,gGAAgG;IAChG,iGAAiG;IACjG,0CAA0C;IAC1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACrD,OAAO,GAAG,CAAC,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,MAAyB,EAAE,IAAI,GAAqB,EAAE,EAAE,QAAQ,GAAG,KAAK;IAC3H,iGAAiG;IACjG,gGAAgG;IAChG,wFAAwF;IACxF,IAAK,MAAgC,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,oBAAoB;QAAE,OAAO,KAAK,CAAC,CAAC,0DAA0D;IACxG,MAAM,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/agent/channels/unified-supervisor.d.ts

@@ -0,0 +1,100 @@
+import { type Domain } from "../memory/domain.js";
+/**
+ * The synthetic eve channel every SINGLE-WINDOW wake is fanned into; the file slug IS the channel name, by eve's rule.
+ * eve namespaces continuation tokens as `<channelName>:<rawToken>` at deliver time, so routing wakes from different surfaces through this ONE channel makes their effective tokens byte-identical — one durable hook, one workflow run, ONE literal model context window across providers. Kept here so the pure planning layer can name the channel without importing an eve-typed channel definition.
+ */
+export declare const UNIFIED_CHANNEL_NAME = "unified";
+/**
+ * The EFFECTIVE eve session token a raw continuation token resolves to when delivered through a channel, reproduced as a pure helper so the single-window proof can assert cross-provider token identity without a live eve runtime.
+ * Session identity in eve IS this exact string: one hook token, one parked workflow run, one context window.
+ */
+export declare function effectiveEveToken(channelName: string, rawToken: string): string;
+/** The reserved pseudo-thread sentinel for a UNIFIED supervisor generation — mirrors the per-container
+ *  `oe-sup:g<gen>` sentinel (channels/slack-events.ts supervisorSentinel), so the Slack re-anchor
+ *  guard (amendment A: a non-empty `state.threadTs`) is satisfied identically on the unified path. */
+export declare function unifiedSupervisorSentinel(generation: number): string;
+/**
+ * The reserved continuation token for a WINDOW's supervisor session at a generation. It carries the `:oe-sup:g` infix, so the cost, rotation and model apparatus recognises it as a supervisor token unchanged, plus the `oe-dom:<domain>:` prefix that says which domain it serves. The whole team shares ONE such token per generation, whichever surface a wake arrives on.
+ * This is the DEGENERATE id-equals-domain form: the windowId defaults to the domain name, and it serialises byte-identically to the pre-window shape. A distinct windowId is minted through {@link formatWindowToken} directly.
+ */
+export declare function unifiedSupervisorToken(domainName: string, generation: number): string;
+/** Is this a window (domain-keyed) supervisor token (as opposed to a per-container `${channelId}:oe-sup:g`
+ *  one, or any other token)? Fail-soft: a non-string / odd shape → false. Now recognises BOTH the
+ *  degenerate (`oe-dom:<domain>:oe-sup:g<n>`) and explicit-window (`…:win:<id>:…`) forms. */
+export declare function isUnifiedSupervisorToken(token: unknown): token is string;
+/**
+ * The domain name embedded in a window supervisor token, or undefined when it is not one.
+ * The access, audit and redrive consumers anchor on the DOMAIN, because memory, access and trust are domain-anchored rather than window-anchored. Both the degenerate and the explicit-window form yield it.
+ */
+export declare function unifiedDomainFromToken(token: unknown): string | undefined;
+/** The windowId embedded in a window supervisor token, or undefined if it isn't one. Equals the
+ *  domain for a degenerate token (the id-equals-domain default), differs for an explicit
+ *  window. Used by the spend hook + audit labels to key the WINDOW's registry row (§W step-1). */
+export declare function unifiedWindowFromToken(token: unknown): string | undefined;
+/** The generation embedded in a window supervisor token, or undefined if it isn't one. */
+export declare function unifiedGenerationFromToken(token: unknown): number | undefined;
+/**
+ * The synthetic `channel_session` registry surfaceKey for a WINDOW's supervisor session. The store keys are opaque strings, so the whole registry works on the window grain with no schema change — the re-key is a different KEY, not a different table.
+ * The argument is a WINDOW id, which in the degenerate id-equals-domain form is the domain name, so every existing row is byte-identical.
+ */
+export declare function unifiedDomainSessionKey(windowId: string): string;
+/**
+ * The `channel_session` registry surfaceKey for a DM SEAT's own standing window. A DM window is degenerate, so this is the domain-session key of the DM's pseudo-domain, expressed for the producer path that holds a surface key but no token yet. It THROWS on an empty or colon-bearing surface key.
+ * DISTINCT from `dmSeatRegistryKey`, which keys the DM's eve-native seat by its PLATFORM CHANNEL ID, where this keys the window seat by its OE SURFACE KEY; neither prefix can collide with the other or with a real surface key. It lives here rather than in window-key.ts, which is the pure token codec and must not import back up into the registry-key layer.
+ */
+export declare function dmWindowRegistryKey(dmSurfaceKey: string): string;
+/** Recover the windowId (degenerate: the domain name) from a synthetic window-session registry key,
+ *  or undefined if it isn't one. */
+export declare function domainFromSessionKey(key: string): string | undefined;
+/**
+ * A supervisor session's continuation token carries the `:oe-sup:g` infix, which is unique to it, so this positively identifies a supervisor step from `ctx.channel.continuationToken` alone — the seam that tags the usage row's kind, drives the cumulative-token rotation counter, and routes a session-limit PARK to the right registry row.
+ * Deliberately NOT the codec's anchored predicate: this is a bare UNANCHORED substring test and is BROADER on malformed input, so converging the two would change this truth table. The divergence is proven by its own test.
+ */
+export declare function isSupervisorToken(token: unknown): token is string;
+/**
+ * THE ONE registry-key derivation for a STANDING SEAT's continuation token — the `channel_session` row whose counters and generation that session is accounted against. A WINDOW token resolves to the SYNTHETIC window row rather than the woken message's per-container surface key; another supervisor-shaped token to the per-container key the caller resolved; a DM seat token to its own row.
+ * Anything else answers `undefined`, and a caller must treat that as "NOT a standing seat", never as "use the surface key": those sessions have no registry row, so there is no counter to bump and no generation to rotate. Pure, and both consumers call this one seam rather than deriving it twice.
+ */
+export declare function standingSeatRegistryKey(token: unknown, domainKey: string): string | undefined;
+/**
+ * The resolved supervisor GRAIN for a channel — the single decision every surface's supervisor wiring makes before it mints or looks up a session.
+ * When the channel's domain windows, the registry row and token are WINDOW-keyed; otherwise they stay per-container and the surface mints its own token, byte-identically to a pre-window build. It is expressed as DATA so every surface consumes it identically, with no per-surface re-derivation.
+ */
+export interface SupervisorGrain {
+    /** True iff this channel unifies into a domain session (both gates on + domain opted in). */
+    readonly unified: boolean;
+    /** The channel_session registry surfaceKey to use — the synthetic domain key when unified, else
+     *  the real per-container surfaceKey. */
+    readonly registryKey: string;
+    /** The domain name (present iff unified) — the grain the token/session are keyed by. */
+    readonly domainName?: string;
+    /**
+     * Present, and true, only when the domain ALSO opted into the single-context cross-surface WINDOW. The surface dispatch then DIVERTS the wake through eve's cross-channel receive into the synthetic unified channel instead of its own send, so every surface's wake lands under one effective eve token — one context window across providers.
+     * OPTIONAL — absent, never `false` — so the flag-off grain object is byte-identical to the pre-feature shape, and it is never present without `unified`.
+     */
+    readonly singleWindow?: true;
+    /**
+     * The WINDOW id this container's supervisor session is keyed by, present and distinct from the domain on the two NON-DEGENERATE shapes: a SOLO per-channel window, whose id is the fully-qualified surface key, and a NAMED GROUP, whose id is the group name its members share.
+     * ABSENT — not set equal to the domain — on every other grain, so the token and the registry key default to the DEGENERATE id-equals-domain form. It is spread in only when non-degenerate, which keeps the flag-off grain object byte-identical.
+     */
+    readonly windowId?: string;
+}
+/**
+ * Does this grain deliver through a WINDOW — the cross-surface one, or any grain carrying an explicit windowId (a solo per-channel window, or a named group)? All of them divert the wake through the synthetic unified channel and use the single-window reply model, differing only in windowId, registryKey and sources.
+ * It is the ONE predicate every divert, window-build and privacy-floor gate reads instead of a bare `singleWindow === true`, so a GROUP window is floored by each surface's mention policy exactly as a solo or cross-surface one is.
+ */
+export declare function grainUsesUnifiedWindow(grain: SupervisorGrain): boolean;
+/** Resolve the supervisor grain for a channel (see {@link SupervisorGrain}). Pure over the domain
+ *  config; `surfaceKey` is the channel's fully-qualified `platform/workspace/surface` key. */
+export declare function supervisorGrainFor(surfaceKey: string, domains: readonly Domain[]): SupervisorGrain;
+/**
+ * The token for a supervisor generation UNDER a resolved grain — the one shared branch every surface's live session deps make.
+ * A windowed grain yields the window token, shared by every container in it; otherwise the surface's own per-container token through `perContainer`. Pure, so the re-key decision is goldenable without an eve import.
+ */
+export declare function supervisorTokenForGrain(grain: SupervisorGrain, generation: number, perContainer: () => string): string;
+/**
+ * The ONE mint-for-ROTATION seam: every surface's `getOrCreateSession` rotate leg calls THIS, never {@link supervisorTokenForGrain} directly, to build the token handed to `rotateChannelSession`.
+ * It is that function plus a freshly-minted rotation SALT, so every ACTUAL mint is unique even if the generation counter is ever reset to a previously-used integer. Impure by design — a caller that needs the deterministic pre-salt shape calls `supervisorTokenForGrain`.
+ */
+export declare function mintRotationToken(grain: SupervisorGrain, generation: number, perContainer: () => string): string;
+//# sourceMappingURL=unified-supervisor.d.ts.map

package/dist/agent/channels/unified-supervisor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unified-supervisor.d.ts","sourceRoot":"","sources":["../../../agent/channels/unified-supervisor.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiD,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAYjG;;;GAGG;AACH,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED;;sGAEsG;AACtG,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAErF;AAED;;6FAE6F;AAC7F,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEzE;AAED;;kGAEkG;AAClG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEzE;AAED,0FAA0F;AAC1F,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE7E;AAQD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;oCACoC;AACpC,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEjE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO7F;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;6CACyC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAEtE;AAED;8FAC8F;AAC9F,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAkBlG;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,MAAM,GAAG,MAAM,CAMtH;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,MAAM,GAAG,MAAM,CAEhH"}

package/dist/agent/channels/unified-supervisor.js

@@ -0,0 +1,143 @@
+// unified-supervisor — the platform-NEUTRAL grain, token and key helpers that re-key the ambient supervisor session from per-container to per-window. Given a channel's fully-qualified surface key and the domain config it answers "does this container window, and if so into which registry row and under which token?". PURE and config-only: it imports the domain flag resolvers alone — never a store, a session or a platform SDK — and a surface file imports THIS while this imports no surface file.
+// The token embeds the `:oe-sup:g` infix the existing spend, rotation and model-routing detectors already key on, and adds an `oe-dom:<domain>:` prefix carrying the grain. TINY-HANDS INVARIANT: the re-key changes only the token and the registry key, never the session's advertised tools, so the context with the widest view keeps the narrowest hands. Never add a tool-affecting field to this path.
+import { windowedDomainFor, windowIdFor, windowModeFor } from "../memory/domain.js";
+import { formatWindowToken, parseWindowToken, isWindowToken, windowKeyForDomain, saltSupervisorGeneration, parseDmSeatToken, dmSeatRegistryKey, dmAnchorDomain, } from "./window-key.js";
+/**
+ * The synthetic eve channel every SINGLE-WINDOW wake is fanned into; the file slug IS the channel name, by eve's rule.
+ * eve namespaces continuation tokens as `<channelName>:<rawToken>` at deliver time, so routing wakes from different surfaces through this ONE channel makes their effective tokens byte-identical — one durable hook, one workflow run, ONE literal model context window across providers. Kept here so the pure planning layer can name the channel without importing an eve-typed channel definition.
+ */
+export const UNIFIED_CHANNEL_NAME = "unified";
+/**
+ * The EFFECTIVE eve session token a raw continuation token resolves to when delivered through a channel, reproduced as a pure helper so the single-window proof can assert cross-provider token identity without a live eve runtime.
+ * Session identity in eve IS this exact string: one hook token, one parked workflow run, one context window.
+ */
+export function effectiveEveToken(channelName, rawToken) {
+    return `${channelName}:${rawToken}`;
+}
+/** The reserved pseudo-thread sentinel for a UNIFIED supervisor generation — mirrors the per-container
+ *  `oe-sup:g<gen>` sentinel (channels/slack-events.ts supervisorSentinel), so the Slack re-anchor
+ *  guard (amendment A: a non-empty `state.threadTs`) is satisfied identically on the unified path. */
+export function unifiedSupervisorSentinel(generation) {
+    return `oe-sup:g${generation}`;
+}
+/**
+ * The reserved continuation token for a WINDOW's supervisor session at a generation. It carries the `:oe-sup:g` infix, so the cost, rotation and model apparatus recognises it as a supervisor token unchanged, plus the `oe-dom:<domain>:` prefix that says which domain it serves. The whole team shares ONE such token per generation, whichever surface a wake arrives on.
+ * This is the DEGENERATE id-equals-domain form: the windowId defaults to the domain name, and it serialises byte-identically to the pre-window shape. A distinct windowId is minted through {@link formatWindowToken} directly.
+ */
+export function unifiedSupervisorToken(domainName, generation) {
+    return formatWindowToken(windowKeyForDomain(domainName, generation));
+}
+/** Is this a window (domain-keyed) supervisor token (as opposed to a per-container `${channelId}:oe-sup:g`
+ *  one, or any other token)? Fail-soft: a non-string / odd shape → false. Now recognises BOTH the
+ *  degenerate (`oe-dom:<domain>:oe-sup:g<n>`) and explicit-window (`…:win:<id>:…`) forms. */
+export function isUnifiedSupervisorToken(token) {
+    return isWindowToken(token);
+}
+/**
+ * The domain name embedded in a window supervisor token, or undefined when it is not one.
+ * The access, audit and redrive consumers anchor on the DOMAIN, because memory, access and trust are domain-anchored rather than window-anchored. Both the degenerate and the explicit-window form yield it.
+ */
+export function unifiedDomainFromToken(token) {
+    return parseWindowToken(token)?.domain;
+}
+/** The windowId embedded in a window supervisor token, or undefined if it isn't one. Equals the
+ *  domain for a degenerate token (the id-equals-domain default), differs for an explicit
+ *  window. Used by the spend hook + audit labels to key the WINDOW's registry row (§W step-1). */
+export function unifiedWindowFromToken(token) {
+    return parseWindowToken(token)?.windowId;
+}
+/** The generation embedded in a window supervisor token, or undefined if it isn't one. */
+export function unifiedGenerationFromToken(token) {
+    return parseWindowToken(token)?.generation;
+}
+/** Prefix marking a SYNTHETIC registry surfaceKey for a domain-keyed supervisor session. Real surface
+ *  keys are `platform/workspace/surface` (a known platform id, slash-separated), so this `oe-domain::`
+ *  form can never collide with one — the `(org, domain)` registry row lives in the SAME channel_session
+ *  table as the per-container rows, keyed by this synthetic surfaceKey. */
+const UNIFIED_DOMAIN_KEY_PREFIX = "oe-domain::";
+/**
+ * The synthetic `channel_session` registry surfaceKey for a WINDOW's supervisor session. The store keys are opaque strings, so the whole registry works on the window grain with no schema change — the re-key is a different KEY, not a different table.
+ * The argument is a WINDOW id, which in the degenerate id-equals-domain form is the domain name, so every existing row is byte-identical.
+ */
+export function unifiedDomainSessionKey(windowId) {
+    return `${UNIFIED_DOMAIN_KEY_PREFIX}${windowId}`;
+}
+/**
+ * The `channel_session` registry surfaceKey for a DM SEAT's own standing window. A DM window is degenerate, so this is the domain-session key of the DM's pseudo-domain, expressed for the producer path that holds a surface key but no token yet. It THROWS on an empty or colon-bearing surface key.
+ * DISTINCT from `dmSeatRegistryKey`, which keys the DM's eve-native seat by its PLATFORM CHANNEL ID, where this keys the window seat by its OE SURFACE KEY; neither prefix can collide with the other or with a real surface key. It lives here rather than in window-key.ts, which is the pure token codec and must not import back up into the registry-key layer.
+ */
+export function dmWindowRegistryKey(dmSurfaceKey) {
+    return unifiedDomainSessionKey(dmAnchorDomain(dmSurfaceKey));
+}
+/** Recover the windowId (degenerate: the domain name) from a synthetic window-session registry key,
+ *  or undefined if it isn't one. */
+export function domainFromSessionKey(key) {
+    return key.startsWith(UNIFIED_DOMAIN_KEY_PREFIX) ? key.slice(UNIFIED_DOMAIN_KEY_PREFIX.length) : undefined;
+}
+/**
+ * A supervisor session's continuation token carries the `:oe-sup:g` infix, which is unique to it, so this positively identifies a supervisor step from `ctx.channel.continuationToken` alone — the seam that tags the usage row's kind, drives the cumulative-token rotation counter, and routes a session-limit PARK to the right registry row.
+ * Deliberately NOT the codec's anchored predicate: this is a bare UNANCHORED substring test and is BROADER on malformed input, so converging the two would change this truth table. The divergence is proven by its own test.
+ */
+export function isSupervisorToken(token) {
+    return typeof token === "string" && token.includes(":oe-sup:g");
+}
+/**
+ * THE ONE registry-key derivation for a STANDING SEAT's continuation token — the `channel_session` row whose counters and generation that session is accounted against. A WINDOW token resolves to the SYNTHETIC window row rather than the woken message's per-container surface key; another supervisor-shaped token to the per-container key the caller resolved; a DM seat token to its own row.
+ * Anything else answers `undefined`, and a caller must treat that as "NOT a standing seat", never as "use the surface key": those sessions have no registry row, so there is no counter to bump and no generation to rotate. Pure, and both consumers call this one seam rather than deriving it twice.
+ */
+export function standingSeatRegistryKey(token, domainKey) {
+    if (isSupervisorToken(token)) {
+        const windowId = unifiedWindowFromToken(token);
+        return windowId !== undefined ? unifiedDomainSessionKey(windowId) : domainKey;
+    }
+    const dm = parseDmSeatToken(token);
+    return dm ? dmSeatRegistryKey(dm.channelId) : undefined;
+}
+/**
+ * Does this grain deliver through a WINDOW — the cross-surface one, or any grain carrying an explicit windowId (a solo per-channel window, or a named group)? All of them divert the wake through the synthetic unified channel and use the single-window reply model, differing only in windowId, registryKey and sources.
+ * It is the ONE predicate every divert, window-build and privacy-floor gate reads instead of a bare `singleWindow === true`, so a GROUP window is floored by each surface's mention policy exactly as a solo or cross-surface one is.
+ */
+export function grainUsesUnifiedWindow(grain) {
+    return grain.singleWindow === true || grain.windowId !== undefined;
+}
+/** Resolve the supervisor grain for a channel (see {@link SupervisorGrain}). Pure over the domain
+ *  config; `surfaceKey` is the channel's fully-qualified `platform/workspace/surface` key. */
+export function supervisorGrainFor(surfaceKey, domains) {
+    const domain = windowedDomainFor(surfaceKey, domains);
+    if (!domain)
+        return { unified: false, registryKey: surfaceKey };
+    // ELECTION FIRST, RESIDUE SECOND. A NAMED window group wins: the group NAME is the windowId, so its members share one context window while memory stays domain-grained. Otherwise the domain's `mode` decides — `unified` means ONE cross-surface window for the whole domain, and `solo`, the default, means one window PER channel, keyed on the fully-qualified surface key.
+    // A grouped grain carries `windowId` and NOT `singleWindow`, because `singleWindow` means "the whole domain in one window", which a group is not. `grainUsesUnifiedWindow` reads either, so a group takes the same divert and window-build path solo already takes.
+    const grouped = windowIdFor(surfaceKey, domains);
+    const unifiedMode = grouped === undefined && windowModeFor(surfaceKey, domains) === "unified";
+    // The windowId when it is NOT the degenerate id-equals-domain form: a group name, else the
+    // surfaceKey under solo. Absent ⇒ the token and registry key default to the domain name.
+    const explicitWindow = grouped ?? (unifiedMode ? undefined : surfaceKey);
+    const windowId = explicitWindow ?? domain.name;
+    return {
+        unified: true,
+        registryKey: unifiedDomainSessionKey(windowId),
+        domainName: domain.name,
+        ...(unifiedMode ? { singleWindow: true } : {}),
+        ...(explicitWindow !== undefined ? { windowId: explicitWindow } : {}),
+    };
+}
+/**
+ * The token for a supervisor generation UNDER a resolved grain — the one shared branch every surface's live session deps make.
+ * A windowed grain yields the window token, shared by every container in it; otherwise the surface's own per-container token through `perContainer`. Pure, so the re-key decision is goldenable without an eve import.
+ */
+export function supervisorTokenForGrain(grain, generation, perContainer) {
+    if (grain.unified && grain.domainName !== undefined) {
+        // `formatWindowToken` emits the DEGENERATE string byte-for-byte when the windowId equals the domain, and the explicit `:win:<windowId>:` form otherwise; with no windowId on the grain it defaults to the domain, which is byte-identical to the pre-solo token.
+        return formatWindowToken({ domain: grain.domainName, windowId: grain.windowId ?? grain.domainName, generation });
+    }
+    return perContainer();
+}
+/**
+ * The ONE mint-for-ROTATION seam: every surface's `getOrCreateSession` rotate leg calls THIS, never {@link supervisorTokenForGrain} directly, to build the token handed to `rotateChannelSession`.
+ * It is that function plus a freshly-minted rotation SALT, so every ACTUAL mint is unique even if the generation counter is ever reset to a previously-used integer. Impure by design — a caller that needs the deterministic pre-salt shape calls `supervisorTokenForGrain`.
+ */
+export function mintRotationToken(grain, generation, perContainer) {
+    return saltSupervisorGeneration(supervisorTokenForGrain(grain, generation, perContainer));
+}
+//# sourceMappingURL=unified-supervisor.js.map

package/dist/agent/channels/unified-supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unified-supervisor.js","sourceRoot":"","sources":["../../../agent/channels/unified-supervisor.ts"],"names":[],"mappings":"AAAA,ifAAif;AACjf,8YAA8Y;AAE9Y,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAe,MAAM,qBAAqB,CAAC;AACjG,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,GACf,MAAM,iBAAiB,CAAC;AAEzB;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAE9C;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,QAAgB;IACrE,OAAO,GAAG,WAAW,IAAI,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED;;sGAEsG;AACtG,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,WAAW,UAAU,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB,EAAE,UAAkB;IAC3E,OAAO,iBAAiB,CAAC,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;6FAE6F;AAC7F,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;AACzC,CAAC;AAED;;kGAEkG;AAClG,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC3C,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,OAAO,gBAAgB,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;AAC7C,CAAC;AAED;;;2EAG2E;AAC3E,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,OAAO,GAAG,yBAAyB,GAAG,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,OAAO,uBAAuB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;oCACoC;AACpC,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,GAAG,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc,EAAE,SAAiB;IACvE,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,CAAC;IACD,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AA0BD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAsB;IAC3D,OAAO,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC;AACrE,CAAC;AAED;8FAC8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,OAA0B;IAC/E,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IAChE,gXAAgX;IAChX,oQAAoQ;IACpQ,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,KAAK,SAAS,IAAI,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC;IAC9F,2FAA2F;IAC3F,yFAAyF;IACzF,MAAM,cAAc,GAAG,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC;IAC/C,OAAO;QACL,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,uBAAuB,CAAC,QAAQ,CAAC;QAC9C,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAsB,EAAE,UAAkB,EAAE,YAA0B;IAC5G,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpD,iQAAiQ;QACjQ,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAsB,EAAE,UAAkB,EAAE,YAA0B;IACtG,OAAO,wBAAwB,CAAC,uBAAuB,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;AAC5F,CAAC"}