@open-everywhere/provider-notion 0.1.0

package/dist/agent/channels/notion-catch-up.js

@@ -0,0 +1,289 @@
+// notion-catch-up — Notion's registered SEAT CATCH-UP FETCH (OPE-1726): the seat's own page
+// discussion since its last wake, normalized for core's shared catch-up path
+// (channels/seat-catch-up.ts).
+//
+// WHAT "THE SEAT'S CONTAINER" IS HERE. A Notion seat is bound to a PAGE and every wake arrives scoped
+// to one DISCUSSION on it. The read is the PAGE's comment sweep, narrowed to that discussion here.
+// 🔴 THERE IS NO PER-DISCUSSION ENDPOINT. Notion lists comments by their PAGE/BLOCK anchor, while a
+// discussion id is only the reply/filter identity. For an INLINE trigger, ingress carries the
+// fetched comment's authenticated parent block as `threadAnchor`; this fetch drills into that exact
+// block, then filters by `threadRoot`. A PAGE-level trigger has no block anchor and preserves the
+// full page sweep. Guessing the discussion id as a block id would 404 on every wake.
+//
+// WHY A STANDALONE CALLER, not `notionReadAdapter.readChannel`: that method takes a live
+// {@link BindableContext} and runs the turn-time domain-scope fence over it. A catch-up fires from a
+// webhook route with no turn, and its container is the one the wake itself already admitted. The
+// CREDENTIAL is resolved the SAME way the read adapter resolves it — from the DOMAIN that binds this
+// surface (`notionChannelCredentialForSurface`), never the org default alone — so a deployment whose
+// Notion domain binds its own integration reads the page over that integration, and this opens no
+// second transport: the same endpoint fence and the same 429 backoff.
+//
+// 🔴 THE VENDOR CANNOT FILTER BY TIME: Notion's comments endpoint takes no `since`, so the bound is
+// applied on this side and again by the shared path.
+//
+// 🔴 …AND IT SERVES OLDEST-FIRST, WHICH IS WHAT RED `J-ENGAGED-notion` ON SHIP #208 (OPE-1831).
+// THE CAUSE IS THE COMMENT CAP, CHARGED FROM THE OLD END. `readNotionComments` sweeps the PAGE's own
+// comments first and only THEN walks the page's blocks. `maxComments` was charged over the whole
+// history, so on the pinned journey page — which had collected every prior ship's page-level comments
+// — the oldest hundred filled the cap and `take` returned STOP. The sweep ended with `blocksScanned`
+// at ZERO: the block sweep never ran at all. The journey's own comment lives in a BLOCK-anchored
+// discussion on a block the run appends itself (`scripts/e2e/scenarios.ts`: `appendParagraphBlock`
+// then `createBlockDiscussion`), and a page-id comment query never returns a child block's comments
+// (`scripts/e2e/notion-driver.ts` records that, live-confirmed). So the read returned `[]` with no
+// error at all, on a discussion that HAD carried the message.
+// THE FIX IS `sinceMs`, handed to the sweep so the cap counts comments IN the seat's window. The
+// ancient page-level comments are then skipped without charging it, `take` does not stop, and the
+// block sweep runs — which is where the seat's discussion actually is.
+// 🔴 `maxCommentPages` IS A SECOND, SEPARATE BOUND, and it is NOT what fixed ship #208. One call
+// returns an anchor's oldest hundred comments and nothing follows `next_cursor`, so a PAGE-ANCHORED
+// discussion on a busy page is unreachable for the same oldest-first reason. Real, and worth closing
+// while the file is open — but a page follow could never have reached a BLOCK-anchored comment, so do
+// not read it as the ship #208 cause.
+// 🔴 THE 80-BLOCK PAGE-SWEEP BOUND STILL EXISTS FOR PAGE-LEVEL CATCH-UP, AND IT IS NOW SPENT ON THE
+// PAGE'S NEWEST BLOCKS (OPE-1843). It never hid the triggering INLINE discussion, because that path
+// uses the authenticated block drill-in. A PAGE-level seat has no narrower anchor, so it keeps the
+// bounded sweep — but in document order the whole budget went to the oldest material of a page that
+// had outgrown the cap, and Notion pages grow by APPENDING. A discussion on a recently appended
+// block was therefore never scanned, and the read returned zero comments with no error: byte for
+// byte the answer a quiet page gives. `blockScanOrder: "newest-first"` spends the same 80 scans on
+// the last blocks instead, which is where a live conversation on an append-only page is.
+// 🔴 IT MOVES THE BLIND SPOT RATHER THAN CLOSING IT: a comment posted today on an ANCIENT block of
+// an over-cap page is now the unread case. Notion can neither query "blocks with recent comments"
+// nor stamp a block when one is commented on, so no scan order is complete at any cap below the
+// page's own length. `notion-api.ts` `blockScanOrder` carries the full reasoning.
+//
+// An unresolvable credential yields `[]` because no transport was attempted. An attempted read
+// failure propagates to core's shared fail-soft boundary and records `outcome=failed` (OPE-1842).
+// 🔴 THE ROW CANNOT CARRY THE RESIDUAL COVERAGE MISS, AND THAT IS A CONTRACT LIMIT, NOT A CHOICE.
+// `readNotionComments` returns a `truncated` bit, but {@link SeatCatchUpFetch} answers with
+// `NormalizedMessage[]` and nothing else, so a surface has no slot to report partial coverage in
+// and `seat.catch_up` writes `outcome=empty raw=0 kept=0 reason=fetch-returned-none` for an
+// over-cap miss exactly as for a quiet page. Closing that needs the shared fetch contract to carry
+// a coverage bit — core's decision, not this surface's.
+import { readNotionComments, resolveNotionCredential } from "./notion-api.js";
+import { notionChannelCredentialForSurface, notionIntegrations, NOTION_CHANNEL_CREDENTIAL } from "./notion-credentials.js";
+import { resolveNotionBotUser } from "./notion-bot-user.js";
+import { catchUpSender, getConfig } from "@open-everywhere/core/agent/adapter-api.js";
+/** The loaded domain roster, or none. FAIL-SOFT: a config that will not load must not throw out of a
+ *  read contracted never to throw — it degrades to the org-default credential, which is what a
+ *  surface bound to no domain resolves anyway. */
+function safeDomains() {
+    try {
+        return getConfig().loadDomains();
+    }
+    catch {
+        return [];
+    }
+}
+/** One sweep. The catch-up window is "since the seat last woke", and a page that collected more than
+ *  this in that window is one core's token cap would trim regardless. */
+const CATCH_UP_MAX_COMMENTS = 100;
+/** Blocks the page sweep scans. Matches the read adapter's own bound, so a catch-up never costs more
+ *  API calls than a `read_channel` on the same page. */
+const CATCH_UP_MAX_BLOCK_SCANS = 80;
+/**
+ * Pages of comments the sweep follows PER ANCHOR (`notion-api.ts listBlockComments`).
+ * 🔴 ONE PAGE IS THE OLDEST HUNDRED, WHICH IS WHY THIS IS NOT 1 (OPE-1831). Notion serves comments
+ * oldest-first, so an anchor that has collected more than a page puts today's comment on the LAST
+ * page and the default single call can never reach it. A PAGE-ANCHORED discussion on any long-lived
+ * doc then reads as permanently quiet to its seat, with no error to show for it.
+ * IT COSTS NOTHING ON A NORMAL ANCHOR: the follow stops the moment Notion reports no more, so an
+ * anchor under a hundred comments is still exactly one call. Only an overflowing anchor pays, and
+ * five pages is five hundred comments — far past any window a seat's last wake can span.
+ *
+ * 🔴 THE PER-WAKE CALL BUDGET, STATED BECAUSE THIS CHANGE GREW IT (OPE-1831). One catch-up now costs
+ * up to `1 + CATCH_UP_MAX_BLOCK_SCANS` list calls (the page anchor, then one per block), each up to
+ * `CATCH_UP_MAX_COMMENT_PAGES` pages — so 81 calls typically and 405 at the theoretical ceiling,
+ * against the shared 60 s-per-call 429 budget (`channels/rate-limit-retry.ts`, OPE-1254).
+ * 🔴 AND THE OLD CHEAP PATH WAS THE BUG. Before `sinceMs`, a page whose own comments filled
+ * `maxComments` returned after ONE call — cheap, and WRONG: that early return is exactly what stopped
+ * the block sweep and shipped #208. Paying the sweep is the correction, not a regression to undo.
+ * The 405 ceiling needs every one of 81 anchors to hold over 100 comments, which no real page does;
+ * the realistic cost is one extra call or two on the page anchor alone.
+ */
+const CATCH_UP_MAX_COMMENT_PAGES = 5;
+/**
+ * Normalize ONE Notion comment, applying the VISIBILITY GATE every fetch adapter owes core: a comment
+ * with no author, no text or no readable time is dropped, because an unattributable body must never
+ * reach a seat. The deployment's OWN integration id resolves `self`.
+ *
+ * 🔴 `authorKind` IS ABSENT ON ALMOST EVERY COMMENT, AND READING THAT AS "NOT A PERSON" IS OPE-1857.
+ * It is Notion's own actor type, and Notion serves a comment's `created_by` as a PARTIAL user —
+ * `id` and `object`, no `type` (notion-api.ts, whose interface says so). This line used to read
+ * `authorKind === "person" ? "human" : "bot"`, so EVERY comment this surface read arrived tagged
+ * `bot` — and the default `wide` admission policy refuses every bot, on every wake, for ever. Ship
+ * #212 measured it: `seat.catch_up outcome=empty raw=4 kept=0 reason=admission-dropped-all` on a
+ * read the bounds had kept in full. A real page member's comment was refused by that arithmetic
+ * exactly as the e2e driver's was, so the seat read a page it was being spoken on as silent.
+ * 🔴 THE RULE IS CORE'S NOW ({@link catchUpSender}), and this surface contributes only the SIGNAL:
+ * a kind Notion actually stated, or `undefined` when it stated none. The repository's own trigger
+ * road already read it this way — `classifyNotionComment` (notion-supervisor.ts) drops on
+ * `author?.type && author.type !== "person"`, so an absent type is a person there too. The two roads
+ * disagreeing about one comment is the whole defect.
+ */
+function normalizeComment(c, selfActorIds) {
+    const text = c.text.trim();
+    if (text.length === 0 || !c.authorId || !c.discussionId)
+        return undefined;
+    const ms = Date.parse(c.createdTime ?? "");
+    if (!Number.isFinite(ms))
+        return undefined;
+    // OUR OWN VOICE IS THE DEPLOYMENT'S, NOT ONE INTEGRATION'S (OPE-1921) — see collectCatchUpSelfIds.
+    const isSelf = selfActorIds.has(c.authorId);
+    return {
+        // 🔴 THE COMMENT'S OWN NOTION ID, AND IT HAS TO BE (OPE-1847). The wake route passes the trigger's
+        // comment id as `excludeId`, and core removes the wake's own message BY ID alone — time cannot do
+        // it here, because `created_time` floors to the MINUTE and the trigger therefore shares its
+        // instant with every comment the seat is reading for. This slot used to hold a render label
+        // (`<discussion>:<created_time>`) that could never equal that id, so the trigger had to be bounded
+        // out by `untilMs` — which took the seat's whole catch-up with it and shipped #211 red.
+        // The label survives only as the fallback for a comment Notion served with no id, where nothing
+        // better exists; it is NOT unique (a coarse stamp lets two comments in one discussion collide).
+        id: c.id ?? `${c.discussionId}:${c.createdTime ?? ms}`,
+        ms,
+        // The bot's OWN posts carry no author id, matching every other surface's normalized shape.
+        ...(isSelf ? {} : { authorId: c.authorId }),
+        sender: catchUpSender({ self: isSelf, ...(c.authorKind === undefined ? {} : { bot: c.authorKind !== "person" }) }),
+        // A Notion wake is thread-first: every comment belongs to a discussion, which IS the thread.
+        type: "thread",
+        threadId: c.discussionId,
+        text,
+    };
+}
+const liveDeps = {
+    readComments: readNotionComments,
+    resolveCredential: resolveNotionCredential,
+    selfActorIdFor: async (credentialId, credential) => (await resolveNotionBotUser(credentialId, credential)()).id,
+};
+/**
+ * EVERY configured integration's bot user id, for the same reason the ingress road takes a SET
+ * (OPE-1921): this deployment posts under one bot user id PER INTEGRATION, and a reply a SIBLING
+ * integration posted lands in the very discussion this read sweeps. Against the reading
+ * integration's id alone it matched nothing, so the seat was handed its own words as another
+ * person's — at the `unauth` floor, in the context it then answers from.
+ *
+ * 🔴 THE BLOCKER THIS FILE USED TO NAME IS GONE. It said closing this needed the DELIVERY's
+ * credential id on the shared `SeatCatchUpRequest`, which carries none. That was true only while the
+ * answer had to be ONE id: the set does not care which integration posted, so no new request field
+ * is needed. What remains is the ordinary residual — an integration whose id will not resolve.
+ *
+ * FAIL-SOFT PER INTEGRATION, and DELIBERATELY NOT fail-closed like the ingress road. An id this
+ * cannot resolve just leaves that integration's comments reading as a person's, which is where this
+ * read already stood; blinding the catch-up on a transient `GET /v1/users/me` failure would
+ * re-create the OPE-1857 symptom — a seat that keeps nothing.
+ * 🔴 AND THE INGRESS ARM DOES NOT COVER THIS ONE, SO DO NOT READ IT AS A BACKSTOP. An unresolved
+ * PRIMARY id blocks every wake, so that case really does take no catch-up. An unresolved SIBLING
+ * does not: `classifyNotionComment` step 5 drops only authors Notion does not mark `person`, so a
+ * person-marked comment still wakes a turn, still takes a catch-up, and that integration's own
+ * prior replies then enter the seat's context as a person's words at the `unauth` floor. That
+ * residual is the price of the fail-soft posture here, and it is stated rather than covered.
+ *
+ * Cost: one `GET /v1/users/me` per SIBLING integration, memoised for the process lifetime by
+ * `resolveNotionBotUser`'s per-credential cache — against the up-to-81 list calls the sweep itself
+ * makes. The sibling's CREDENTIAL is passed as a thunk, so on a cache hit it is never resolved at
+ * all; `resolveNotionCredential` has no memo of its own, and an eager resolve here would charge
+ * every wake a store read and a decrypt. A single-integration deployment resolves exactly what it
+ * did before.
+ */
+async function collectCatchUpSelfIds(readingCredentialId, readingCredential, domains, deps) {
+    const ids = new Set();
+    const add = async (credentialId, credential) => {
+        try {
+            const id = await deps.selfActorIdFor?.(credentialId, credential);
+            if (id)
+                ids.add(id);
+        }
+        catch {
+            /* an id we cannot resolve leaves that integration's comments reading as a person's */
+        }
+    };
+    await add(readingCredentialId, async () => readingCredential);
+    for (const integration of notionIntegrations(domains)) {
+        if (integration.credentialId === readingCredentialId)
+            continue;
+        // 🔴 A THUNK, NOT A RESOLVED CREDENTIAL. `resolveNotionBotUser` memoises the bot user per
+        // credential and NEVER CALLS the thunk on a cache hit, while `resolveNotionCredential` has no
+        // memo of its own — so resolving eagerly here would charge every wake an operational-store read
+        // and a decrypt for an answer the cache already holds, and would write one
+        // credential-unresolved audit row per wake, for ever, on a sibling with no stored secret.
+        await add(integration.credentialId, () => deps.resolveCredential(integration.credentialId));
+    }
+    return ids;
+}
+/** The fetch, with its seams exposed so the contract test drives it with no network. */
+export async function fetchNotionCatchUpWindow(req, deps = liveDeps) {
+    // The DOMAIN's own integration where this surface binds one, else the org default — the same
+    // resolution `notionReadAdapter` makes, so the catch-up reads the page over the credential the
+    // operator selected for it rather than a broader one.
+    const domains = deps.domains ?? safeDomains();
+    const credentialId = req.channelKey ? notionChannelCredentialForSurface(req.channelKey, domains) : undefined;
+    const cred = await deps.resolveCredential(credentialId);
+    if (!cred)
+        return []; // unconfigured ⇒ nothing to read, never a guessed key
+    // OUR OWN IDENTITY, under the SAME key the ingress road caches it by: an absent `credentialId`
+    // means the ORG DEFAULT, which is stored as `NOTION_CHANNEL_CREDENTIAL` — so both roads memoise
+    // one integration under one key rather than resolving it twice. EVERY configured integration's id,
+    // for the reason the ingress road takes the set (OPE-1921) — see `selfActorIds` below.
+    const readingCredentialId = credentialId ?? NOTION_CHANNEL_CREDENTIAL;
+    const selfActorIds = deps.selfActorId !== undefined
+        ? new Set([deps.selfActorId])
+        : await collectCatchUpSelfIds(readingCredentialId, cred, domains, deps);
+    const res = await deps.readComments(req.container, {
+        // 🔴 THE ENDPOINT FENCE TRAVELS WITH THE KEY, unconditionally and ON ONE LINE: a bare `apiKey`
+        // silently disables it, and `notion-credential-fence-test.ts` §2 reads the pair line by line —
+        // so splitting them reads as a bare key to the rule that exists to stop one. An absent
+        // `endpoints` is already the unnarrowed reading, so the pair is always passed together.
+        apiKey: cred.apiKey, endpoints: cred.endpoints,
+        maxComments: CATCH_UP_MAX_COMMENTS,
+        maxBlockScans: CATCH_UP_MAX_BLOCK_SCANS,
+        // 🔴 THE WINDOW GOES TO THE SWEEP, not only to the loop below (OPE-1831). `maxComments` is
+        // charged in the order Notion serves — OLDEST FIRST — so a cap applied over the whole history
+        // fills with a page's most ancient comments and truncates before it reaches the seat's own
+        // window. Handing the bound down makes the cap count comments IN the window instead.
+        sinceMs: req.sinceMs,
+        maxCommentPages: CATCH_UP_MAX_COMMENT_PAGES,
+        // 🔴 THE BLOCK BUDGET IS SPENT ON THE PAGE'S NEWEST BLOCKS (OPE-1843). Document order spends
+        // all 80 scans on the oldest material of a page that has outgrown the cap, so a discussion on a
+        // recently appended block is never scanned and the seat reads a quiet room. A catch-up asks
+        // "what happened since I last woke", and the growth shape that crosses the cap is append-only.
+        // No effect on a page under the cap, and none on the `block` drill-in above, which scans one
+        // named block. The residual — a new comment on an ANCIENT block of an over-cap page — is
+        // `readNotionComments`'s own to state, and it does: see `blockScanOrder`.
+        blockScanOrder: "newest-first",
+        // An inline comment's authenticated parent block addresses the exact discussion anchor. The
+        // discussion id is not a block id and remains only the filter below.
+        ...(req.threadAnchor ? { block: req.threadAnchor } : {}),
+    });
+    const out = [];
+    for (const c of res.comments) {
+        // The seat's own discussion, filtered HERE — see the header for why there is no endpoint that
+        // could do it. A seat bound to no discussion reads the whole page.
+        if (req.threadRoot !== undefined && c.discussionId !== req.threadRoot)
+            continue;
+        const n = normalizeComment(c, selfActorIds);
+        if (n && n.ms >= req.sinceMs)
+            out.push(n);
+    }
+    return out;
+}
+/**
+ * 🔴 NOTION FLOORS `created_time` TO THE MINUTE, and this is the number the shared catch-up road
+ * widens both of its bounds by (OPE-1847, `core/agent/channels/seat-catch-up.ts`
+ * {@link SeatCatchUpDeclaration.timestampPrecisionMs}).
+ * It is the VENDOR'S UNIT, not a margin: every comment posted inside one wall-clock minute comes back
+ * carrying that minute's opening instant. Declare it too small and a comment in the trigger's own
+ * minute is bounded out of the window it belongs to — the ship #211 red, where the seat read two
+ * comments and kept none. Declare it too large and the seat is handed comments from before its window.
+ * Measured on the live workspace (OPE-1711) and the repository's own e2e driver floors to the same
+ * unit (`core/scripts/e2e/notion-driver.ts` `notionMinuteFloor`).
+ */
+export const NOTION_TIMESTAMP_PRECISION_MS = 60_000;
+/** Notion's registered {@link SeatCatchUpFetch} — the one thing this surface contributes to the shared path. */
+export const notionSeatCatchUpFetch = (req) => fetchNotionCatchUpWindow({
+    container: req.container,
+    ...(req.threadRoot ? { threadRoot: req.threadRoot } : {}),
+    ...(req.threadAnchor ? { threadAnchor: req.threadAnchor } : {}),
+    sinceMs: req.sinceMs,
+    ...(req.channelKey ? { channelKey: req.channelKey } : {}),
+});
+//# sourceMappingURL=notion-catch-up.js.map

package/dist/agent/channels/notion-catch-up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion-catch-up.js","sourceRoot":"","sources":["../../../agent/channels/notion-catch-up.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,6EAA6E;AAC7E,+BAA+B;AAC/B,EAAE;AACF,sGAAsG;AACtG,mGAAmG;AACnG,oGAAoG;AACpG,8FAA8F;AAC9F,oGAAoG;AACpG,kGAAkG;AAClG,qFAAqF;AACrF,EAAE;AACF,yFAAyF;AACzF,qGAAqG;AACrG,iGAAiG;AACjG,qGAAqG;AACrG,qGAAqG;AACrG,kGAAkG;AAClG,sEAAsE;AACtE,EAAE;AACF,oGAAoG;AACpG,qDAAqD;AACrD,EAAE;AACF,gGAAgG;AAChG,qGAAqG;AACrG,iGAAiG;AACjG,sGAAsG;AACtG,qGAAqG;AACrG,iGAAiG;AACjG,mGAAmG;AACnG,oGAAoG;AACpG,mGAAmG;AACnG,8DAA8D;AAC9D,iGAAiG;AACjG,kGAAkG;AAClG,uEAAuE;AACvE,iGAAiG;AACjG,oGAAoG;AACpG,qGAAqG;AACrG,sGAAsG;AACtG,sCAAsC;AACtC,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,gGAAgG;AAChG,iGAAiG;AACjG,mGAAmG;AACnG,yFAAyF;AACzF,mGAAmG;AACnG,kGAAkG;AAClG,gGAAgG;AAChG,kFAAkF;AAClF,EAAE;AACF,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,4FAA4F;AAC5F,iGAAiG;AACjG,4FAA4F;AAC5F,mGAAmG;AACnG,wDAAwD;AAExD,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAA4D,MAAM,iBAAiB,CAAC;AACxI,OAAO,EAAE,iCAAiC,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAC3H,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,SAAS,EAA8D,MAAM,4CAA4C,CAAC;AAElJ;;kDAEkD;AAClD,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;yEACyE;AACzE,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC;wDACwD;AACxD,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,gBAAgB,CAAC,CAAuB,EAAE,YAAiC;IAClF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAC1E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,mGAAmG;IACnG,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO;QACL,mGAAmG;QACnG,kGAAkG;QAClG,4FAA4F;QAC5F,4FAA4F;QAC5F,mGAAmG;QACnG,wFAAwF;QACxF,gGAAgG;QAChG,gGAAgG;QAChG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE;QACtD,EAAE;QACF,2FAA2F;QAC3F,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC,EAAE,CAAC;QAClH,6FAA6F;QAC7F,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,CAAC,YAAY;QACxB,IAAI;KACL,CAAC;AACJ,CAAC;AA0CD,MAAM,QAAQ,GAAsB;IAClC,YAAY,EAAE,kBAAkB;IAChC,iBAAiB,EAAE,uBAAuB;IAC1C,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,MAAM,oBAAoB,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE;CAChH,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,KAAK,UAAU,qBAAqB,CAClC,mBAA2B,EAC3B,iBAA2C,EAC3C,OAA0B,EAC1B,IAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,GAAG,GAAG,KAAK,EAAE,YAAoB,EAAE,UAA+D,EAAiB,EAAE;QACzH,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YACjE,IAAI,EAAE;gBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC,CAAC;IACF,MAAM,GAAG,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAC9D,KAAK,MAAM,WAAW,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,WAAW,CAAC,YAAY,KAAK,mBAAmB;YAAE,SAAS;QAC/D,0FAA0F;QAC1F,8FAA8F;QAC9F,gGAAgG;QAChG,2EAA2E;QAC3E,0FAA0F;QAC1F,MAAM,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAA4G,EAC5G,IAAI,GAAsB,QAAQ;IAElC,6FAA6F;IAC7F,+FAA+F;IAC/F,sDAAsD;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,iCAAiC,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC,CAAC,sDAAsD;IAC5E,+FAA+F;IAC/F,gGAAgG;IAChG,mGAAmG;IACnG,uFAAuF;IACvF,MAAM,mBAAmB,GAAG,YAAY,IAAI,yBAAyB,CAAC;IACtE,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS;QACjD,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7B,CAAC,CAAC,MAAM,qBAAqB,CAAC,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE;QACjD,+FAA+F;QAC/F,+FAA+F;QAC/F,uFAAuF;QACvF,wFAAwF;QACxF,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;QAC9C,WAAW,EAAE,qBAAqB;QAClC,aAAa,EAAE,wBAAwB;QACvC,2FAA2F;QAC3F,8FAA8F;QAC9F,2FAA2F;QAC3F,qFAAqF;QACrF,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,eAAe,EAAE,0BAA0B;QAC3C,6FAA6F;QAC7F,gGAAgG;QAChG,4FAA4F;QAC5F,+FAA+F;QAC/F,6FAA6F;QAC7F,yFAAyF;QACzF,0EAA0E;QAC1E,cAAc,EAAE,cAAc;QAC9B,4FAA4F;QAC5F,qEAAqE;QACrE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC7B,8FAA8F;QAC9F,mEAAmE;QACnE,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,UAAU;YAAE,SAAS;QAChF,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAEpD,gHAAgH;AAChH,MAAM,CAAC,MAAM,sBAAsB,GAAqB,CAAC,GAAG,EAAE,EAAE,CAC9D,wBAAwB,CAAC;IACvB,SAAS,EAAE,GAAG,CAAC,SAAS;IACxB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC1D,CAAC,CAAC"}

package/dist/agent/channels/notion-credentials.d.ts

@@ -0,0 +1,210 @@
+import { type BindableContext, type Domain, type ConnectorIntegration } from "@open-everywhere/core/agent/adapter-api.js";
+/** The provider name in `agent/access/providers.ts`. */
+export declare const NOTION_PROVIDER = "notion";
+/** The ORG-DEFAULT channel-plumbing credential id — the role a domain override replaces. */
+export declare const NOTION_CHANNEL_CREDENTIAL = "channel-key";
+/**
+ * The notion `channel-key` credential id a page's domain binds, or **undefined when it binds none**.
+ *
+ * Undefined is a load-bearing answer, not a failure: it means "this page's domain asked for no
+ * override", which every caller reads as "use the org default". Keeping it distinct from a resolved
+ * id is what lets the webhook route fall through to its own arms (the verifying integration, then
+ * the org default) instead of treating "no binding" as a refusal.
+ *
+ * Pure — `domains` is injected, exactly like `notionPageDomain`'s, so the whole decision is
+ * unit-testable with no config and no store.
+ */
+export declare function notionChannelCredentialFor(workspace: string | undefined, pageId: string | undefined, domains: readonly Domain[]): string | undefined;
+/**
+ * {@link notionChannelCredentialFor} for a session's own surface key (`notion/<workspace>/<page>`) —
+ * the form `resolvePartition(ctx).surfaceKey` produces.
+ *
+ * The read tools resolve the CALLER'S surface, not the page argument. That is deliberate and it is
+ * not a weaker check: `notion-scope.ts` has already established that an admitted read is either the
+ * caller's own page or a page in the caller's own domain, so the two resolve to the same domain by
+ * construction — and the caller's surface is known BEFORE the fence runs, which the block-resolution
+ * walk needs (it must make a Notion call to find a block's owning page).
+ */
+export declare function notionChannelCredentialForSurface(surfaceKey: string, domains: readonly Domain[]): string | undefined;
+/**
+ * The credential a READ TOOL runs under (OPE-499). **The delivery's own carried credential wins**
+ * when this session was woken by one — the same `credential_id` auth attribute the reply arm already
+ * reads (notion-post-arm.ts) — so a session only ever reads what the integration that verified its
+ * delivery was actually shared into, never a wider domain binding a double-shared page could reach.
+ *
+ * Falls back to the CALLING SESSION's own domain binding when no delivery credential rides the
+ * context — an agent-initiated session (a routine, a proactive post) never carried one, and that is
+ * the pre-OPE-499 rule, unchanged. Fail-soft throughout: a synthetic or identity-less ctx has no
+ * partition to read, so it resolves undefined and the caller falls back to the org default, exactly
+ * like an unbound domain. That is the correct direction here: the DOMAIN FENCE (notion-scope.ts) is
+ * what refuses an out-of-scope read, and it runs whether or not a credential was selected.
+ */
+export declare function notionCallerCredential(ctx: BindableContext, domains: readonly Domain[]): string | undefined;
+/**
+ * Every Notion integration this deployment is reachable by — the ORG DEFAULT FIRST, then one per
+ * domain that binds its own. The ingress tries each entry's inbound secret in this order.
+ */
+export declare function notionIntegrations(domains: readonly Domain[]): readonly ConnectorIntegration[];
+/**
+ * Does the integration that SIGNED a delivery serve `owner`? The one comparison behind both signer
+ * fences — the trigger plane's {@link notionTriggerScopeVerdict} and the comment plane's
+ * {@link notionDeliveryScopeVerdict} — extracted so the two can never answer it differently.
+ *
+ * Three outcomes, because the caller's log line needs to tell them apart:
+ *   • `"credential"` — the signer IS the credential this domain binds. The ordinary yes.
+ *   • `"shared-secret"` — a different credential, signed with the SAME inbound secret. Accepted, and
+ *     named, because `connectorIntegrations` defaults a domain's `inboundSecret` to the deployment
+ *     default: a domain that binds a credential without declaring its own secret signs exactly like
+ *     the org default, and refusing would break a supported config in which the domain runs no
+ *     subscription of its own.
+ *   • `served: false` — neither, so the signer cannot speak for this domain.
+ *
+ * 🔴 THE PROPERTY THIS BUYS, STATED HONESTLY: **a domain is fenced from another domain's forged
+ * deliveries IFF it runs its own inbound secret.** That is not a hole either fence opens. It is the
+ * limit of what an HMAC can tell one sender from another when two senders hold the same key.
+ *
+ * `expected` rides on every outcome so a refusal can name the credential that WOULD have served.
+ */
+export type NotionSignerVerdict = {
+    readonly served: true;
+    readonly via: "credential" | "shared-secret";
+    readonly expected: string;
+} | {
+    readonly served: false;
+    readonly expected: string;
+};
+export declare function notionSignerServesDomain(owner: Domain, signerCredentialId: string, integrations: readonly ConnectorIntegration[]): NotionSignerVerdict;
+/**
+ * Every domain a COMMENT delivery reaches THROUGH ITS WORKSPACE CLAIM — the domains the payload's
+ * `workspace_id` can steer, and therefore the only ones {@link notionDeliveryScopeVerdict} fences.
+ *
+ * 🔴 TWO RESOLVERS ANSWER "WHICH DOMAIN?" DOWNSTREAM, AND THEY DO NOT ALWAYS AGREE. Both are
+ * consulted on the session the delivery opens, so a check on one alone would leave the other open:
+ *
+ *   • {@link notionPageDomain} — the credential binding (agent-initiated work) and the read fence
+ *     (notion-scope.ts). Its roster leg compares the PAGE-ID segment alone.
+ *   • `resolveDomainForChannel` — the ambient gate, the engagement tier, the supervisor grain and
+ *     the external-author policy, all keyed on the `notion/<workspace>/<page>` surface key. Its
+ *     roster leg compares the WHOLE key, so a workspace that does not match the `reach` entry
+ *     falls THROUGH to the claim leg.
+ *
+ * 🔴 WHY THE ROSTER LEGS ARE EXEMPT, AND THIS IS THE WHOLE DESIGN. A roster hit is not steerable by
+ * the payload's workspace:
+ *   • {@link notionPageDomain}'s roster leg ignores the workspace outright, and OPE-496 established
+ *     the page id from the comment Notion returned under the verified credential. Authenticated fact
+ *     in, config match out.
+ *   • `resolveDomainForChannel`'s roster leg needs the WHOLE key to appear in `reach`, so the
+ *     workspace it accepts is one the deployer typed themselves.
+ * A claim leg is the opposite: a container entry names a workspace, the payload names a workspace, and a
+ * match hands over every page under it.
+ *
+ * KEEPING THE ROSTER LEGS OUT IS LOAD-BEARING, not a shortcut. A page shared with two integrations
+ * produces a delivery on EACH subscription, and each one must run under its own verifying integration
+ * (the header's "prefer, don't refuse" rule, and the escalation OPE-499 closes by carrying the
+ * delivery's credential into the reads). Fencing a rostered page on the signer would refuse the
+ * second subscription's delivery outright and delete that behaviour.
+ *
+ * Pure — `domains` is injected, exactly like {@link notionPageDomain}'s.
+ */
+export declare function notionDeliveryClaimedDomains(workspaceId: string | undefined, pageId: string, domains: readonly Domain[]): readonly Domain[];
+/** {@link notionDeliveryScopeVerdict}'s answer. `ok` is the ONLY field a caller may branch on; the
+ *  `reason` and the `detail` are operator-facing prose for the log line and carry no control flow. */
+export type NotionDeliveryScopeVerdict = {
+    readonly ok: true;
+    readonly detail: string;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * ════════════════════════════════════════════════════════════════════════════════════════════════
+ * 🔴 THE COMMENT-PLANE INGRESS FENCE (OPE-502) — MAY THIS SIGNER OPEN A SESSION ON THIS PAGE?
+ * ════════════════════════════════════════════════════════════════════════════════════════════════
+ *
+ * `notion-webhook.ts` calls this after the page is established (OPE-496) and BEFORE the surface key
+ * decides anything. The rule is the trigger plane's rule, on the plane next door:
+ *
+ *   A delivery may open a session on a domain it reaches THROUGH ITS WORKSPACE CLAIM only when that
+ *   domain is one the SIGNING integration serves.
+ *
+ * WHY THE WORKSPACE NEEDS THIS AND THE PAGE DOES NOT. OPE-496 established the PAGE from the comment
+ * Notion returned under the verified credential, so the page is an authenticated fact. It left the
+ * WORKSPACE where it found it — `ev.workspace_id`, a payload field nothing authenticates — and the
+ * two are composed into `notion/<workspace>/<page>`. There is no verified source for the second
+ * half: Notion's REST surface returns no workspace id on any object (`/v1/users/me` gives
+ * `bot.workspace_name`, not an id), so no fetch under any credential can confirm the claim. Pinning
+ * the workspace to a config constant is wrong for a different reason — one deployment may hold
+ * several workspaces. So the claim is fenced instead of proved, exactly as OPE-500 fenced the
+ * trigger plane's scope path.
+ *
+ * WORKED THROUGH, because the point is what it REFUSES. Domain `security` claims workspace
+ * `notion/W-sec` in a container entry and binds integration `notion-security` with its own inbound
+ * secret. A holder of domain `payments`'s `verification_token` comments on a page their OWN
+ * integration can see, then signs a delivery whose `workspace_id` reads `W-sec`. The page reaches
+ * `security` through that claim, so without this fence the session opens on `security` — with
+ * `security`'s ambient flag, `security`'s read scope over every page under the claim, and (for an
+ * agent-initiated call) `security`'s credential. The fence reads that domain's credential, finds
+ * `notion-security` against a `notion-payments` signature, and refuses.
+ *
+ * FAIL CLOSED, AND THE REFUSALS ARE REAL:
+ *   • NO SIGNER ⇒ refuse. `webhooks.allowUnverifiedNotion` accepts a delivery with no secret
+ *     configured anywhere, so nothing identifies a sender and the fence has no fact to read. A fence
+ *     that says yes when it cannot tell is not a fence. The consequence is stated in the runbook: with
+ *     that dev hatch on, a CLAIMED page opens no session. A rostered page is unaffected, so the local
+ *     exercise the hatch exists for still runs.
+ *   • NO CLAIMED DOMAIN ⇒ allow. Either the page is rostered — see
+ *     {@link notionDeliveryClaimedDomains} for why a roster hit is not steerable — or it is in no
+ *     domain at all, where the `org` pseudo-domain answers and no payload field can steer that
+ *     either.
+ *
+ * THE PARTITION IS DECIDED SEPARATELY (OPE-254 §2, folding OPE-537). This fence decides the domain
+ * BOUNDARY; which partition a delivery lands in is notion-webhook.ts's step 8c, which composes the
+ * key from the workspace segment of the `reach` entry that MATCHED — `notionReachWorkspace`, on both
+ * legs. A page named outright therefore keys on config's workspace whatever a delivery claims. A
+ * page reached by a CONTAINER only matches when the payload's workspace equals the container's own
+ * text, so there the derived value equals the payload's by construction; a delivery naming a
+ * workspace no domain reaches matches nothing, and its key belongs to no domain — no memory, no
+ * bundle, and the ambient gate refuses it — rather than opening a second partition inside one.
+ *
+ * 🔴 WHY THE CONTAINER LEG NEEDED A CONFIG RULE, NOT JUST THE SAME READ. The exact-key match is
+ * workspace-BLIND — it finds a page by id alone, so the workspace read back off the matched entry
+ * is a signal INDEPENDENT of whatever the payload said. The container leg is the opposite shape:
+ * `notionPageDomain`'s container match composes `notion/<payload-workspace>/<page>` and only admits
+ * it when a container entry's tenant segment equals THAT SAME payload workspace verbatim
+ * (surface-key-grammar.ts refuses a glob on the tenant segment, so the compare is always exact). So
+ * whenever a container admits a delivery, the matched entry's workspace text and the payload's are,
+ * by construction, the identical string — reading the entry back is a no-op IN VALUE.
+ *
+ * What it is not is a no-op in PROPERTY, and that is the point. The remaining way one page could
+ * still key two ways was a domain reaching MORE THAN ONE Notion workspace: two honestly-signed
+ * deliveries for the same page, one naming each, opened two partitions. memory/domain.ts's
+ * `partitionTenantProblems` now refuses that config at load, so the matched entry names exactly one
+ * workspace per domain and the partition is a fact about config rather than about a delivery.
+ * No live re-keying follows: on every configuration that still loads, the derived value equals the
+ * value the payload carried, so no existing `channel_session` or memory row changes key.
+ *
+ * Pure — `domains` is injected, so the whole decision is unit-testable with no config and no store.
+ */
+export declare function notionDeliveryScopeVerdict(workspaceId: string | undefined, pageId: string, signerCredentialId: string | undefined, domains: readonly Domain[]): NotionDeliveryScopeVerdict;
+/**
+ * One integration's INBOUND signing key by operator-secret name, or undefined — and the ONE place
+ * that decides whether a failure is REPORTED.
+ *
+ * 🔴 THE FAILURE THAT MUST BE LOUD. "Nobody stored this name" is the ordinary state for an
+ * integration the operator never configured: it contributes no key, a delivery it would have signed
+ * simply fails the gate, and saying so on every POST would be noise. Every OTHER failure — an
+ * unarmed `OE_CREDENTIAL_ENCRYPTION_KEY`, a store that will not open — makes EVERY delivery on that
+ * integration 401 with nothing in the log to explain it. It is reported.
+ *
+ * The two are told apart by the ERROR CLASS ({@link OperatorSecretNotSetError}), never by the
+ * message: the unarmed-key message ALSO contains the words "is not set", so the substring test this
+ * replaces reported neither and a broken credential store went silent.
+ *
+ * `get` and `log` are injected so the decision is testable with no store and no eve boot; the route
+ * passes `getOperatorSecret` and its own channel logger. The report names the SECRET NAME and the
+ * reason, never a value. Both arms return undefined — this function never throws into a webhook.
+ */
+export declare function resolveNotionInboundSecret(name: string, get: (secretName: string) => Promise<{
+    readonly value: string;
+}>, log: (message: string) => void): Promise<string | undefined>;
+//# sourceMappingURL=notion-credentials.d.ts.map

package/dist/agent/channels/notion-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion-credentials.d.ts","sourceRoot":"","sources":["../../../agent/channels/notion-credentials.ts"],"names":[],"mappings":"AAyDA,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,MAAM,EACX,KAAK,oBAAoB,EAC1B,MAAM,4CAA4C,CAAC;AAIpD,wDAAwD;AACxD,eAAO,MAAM,eAAe,WAAW,CAAC;AAExC,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,gBAAgB,CAAC;AAQvD;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAIpH;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAQ3G;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,oBAAoB,EAAE,CAE9F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,eAAe,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,EAC1B,YAAY,EAAE,SAAS,oBAAoB,EAAE,GAC5C,mBAAmB,CAOrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,SAAS,MAAM,EAAE,CAUnB;AAED;sGACsG;AACtG,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,0BAA0B,CA+B5B;AAmBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC7B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B"}