@open-everywhere/provider-notion 0.1.0

package/dist/agent/channels/notion-credentials.js

@@ -0,0 +1,360 @@
+// WHICH NOTION INTEGRATION SERVES THIS PAGE (OPE-467) — the one place the Notion bundle decides
+// which credential a call runs under, and which integrations may sign an inbound delivery.
+//
+// THE PROBLEM. Notion the vendor supports MANY internal integrations, and each one only sees the
+// page trees a human explicitly shared with it. That is a real, vendor-enforced boundary — the
+// strongest isolation any of OE's six surfaces can buy. Until this module OE wired ONE integration
+// for every domain, so the boundary was app-layer only: `notion-scope.ts` fenced the domain, and
+// the credential underneath could see every page in the workspace. `notion-scope.ts` still says so
+// in its own header, and it stays true for a domain on the org default.
+//
+// THE RULE FOR WORK THE AGENT INITIATES — a read tool, a proactive post: **the domain that owns the
+// page decides the credential.**
+//   • the page's domain declares a `credentials` override for notion `channel-key` ⇒ that credential;
+//   • it declares none (or the page is in no domain) ⇒ the org default `channel-key`.
+//
+// THE RULE FOR A DELIVERY, and for everything downstream of one: **the integration that VERIFIED it
+// serves it.** Each integration signs its deliveries with its OWN vendor-issued
+// `verification_token`, so a second integration's deliveries cannot verify against the first's
+// secret. {@link notionIntegrations} enumerates the configured integrations and the route tries each
+// one's secret in turn — the same "ordered keys, current first" shape `webhooks/secrets.ts` uses for
+// a rotation window — and THE SECRET THAT VERIFIES IDENTIFIES THE INTEGRATION THAT SENT THE
+// DELIVERY. That is the only authenticated fact a delivery carries.
+//
+// 🔴 THAT RULE REACHES THE READS TOO (OPE-499, ruled by Tommy 2026-08-13). A delivery-woken session's
+// READ TOOLS run under the SAME carried credential as its fetch and its reply — never a fresh lookup
+// off the page's domain binding. {@link notionCallerCredential} reads the `credential_id` auth
+// attribute the delivery stowed (notion-identity.ts buildNotionAuth) and prefers it when present. The
+// domain binding stays the rule for an AGENT-INITIATED session — a routine, a proactive post — where
+// no delivery ever ran and there is no carried credential to prefer.
+//
+// WHY THIS CLOSES A REAL GAP. An operator who shares one page with BOTH the org-default integration
+// and a domain's own integration lets either subscription's `verification_token` holder produce a
+// verified delivery for that page. Before this rule, the session that delivery woke still read under
+// the PAGE's domain binding — so a holder of the WEAKER (org) credential could ride a double-shared
+// page into every page the domain's OWN, narrower integration can see. Carrying the delivery's own
+// credential into the reads means a session only ever reads what the credential that actually
+// verified it was shared into — the vendor's own share-list boundary, working as designed.
+//
+// 🔴 WHY A BINDING DOES NOT OUTRANK THE HMAC. A delivery's page id is read off the payload, and
+// nothing authenticates the payload. If the page's binding decided, a forger holding integration
+// A's `verification_token` could name a domain-B page and have the delivery run under B's
+// credential. So what a binding actually buys on ingress is narrower than "this page is served by
+// this integration": **a binding routes the deliveries the bound subscription itself sent.** Both
+// rules meet at one credential id per delivery, and the REPLY carries that id forward (the auth
+// attributes stow it) — so the credential that fetched a comment is the credential that answers it,
+// on every path.
+//
+// A page shared with two integrations produces a delivery on EACH subscription. That is legitimate,
+// and each delivery correctly runs under its own verifying integration — which is why a disagreement
+// between the HMAC and the binding PREFERS the HMAC rather than refusing.
+//
+// 🔴 WHAT THIS DOES NOT BUY. Binding a domain to its own integration only fences the pages that
+// integration was SHARED into. If the operator leaves a payments page shared with the org-default
+// integration as well, that key can still read it — Notion enforces the share list, and OE cannot
+// widen or narrow it. The runbook says this plainly: bind the domain AND unshare the page from
+// every other integration.
+import { domainCredentialId, OperatorSecretNotSetError, resolveDomainForChannel, connectorIntegrations, resolvePartition, } from "@open-everywhere/core/agent/adapter-api.js";
+import { notionSurfaceKey } from "./notion-identity.js";
+import { notionPageDomain } from "./notion-scope.js";
+/** The provider name in `agent/access/providers.ts`. */
+export const NOTION_PROVIDER = "notion";
+/** The ORG-DEFAULT channel-plumbing credential id — the role a domain override replaces. */
+export const NOTION_CHANNEL_CREDENTIAL = "channel-key";
+/** The operator-secret name holding the DEFAULT integration's inbound signing key (Notion's
+ *  subscription `verification_token`). A domain that runs its own subscription names its own with
+ *  `inboundSecret`. Resolved through the operator-secret resolver, so a value stored with
+ *  `oe secret set NOTION_WEBHOOK_SECRET` wins over an env var of the same name. */
+const NOTION_WEBHOOK_SECRET_NAME = "NOTION_WEBHOOK_SECRET";
+/**
+ * The notion `channel-key` credential id a page's domain binds, or **undefined when it binds none**.
+ *
+ * Undefined is a load-bearing answer, not a failure: it means "this page's domain asked for no
+ * override", which every caller reads as "use the org default". Keeping it distinct from a resolved
+ * id is what lets the webhook route fall through to its own arms (the verifying integration, then
+ * the org default) instead of treating "no binding" as a refusal.
+ *
+ * Pure — `domains` is injected, exactly like `notionPageDomain`'s, so the whole decision is
+ * unit-testable with no config and no store.
+ */
+export function notionChannelCredentialFor(workspace, pageId, domains) {
+    if (!pageId)
+        return undefined;
+    const domain = notionPageDomain(workspace, pageId, domains).domain;
+    if (!domain)
+        return undefined;
+    const id = domainCredentialId(domain, NOTION_PROVIDER, NOTION_CHANNEL_CREDENTIAL);
+    return id === NOTION_CHANNEL_CREDENTIAL ? undefined : id;
+}
+/**
+ * {@link notionChannelCredentialFor} for a session's own surface key (`notion/<workspace>/<page>`) —
+ * the form `resolvePartition(ctx).surfaceKey` produces.
+ *
+ * The read tools resolve the CALLER'S surface, not the page argument. That is deliberate and it is
+ * not a weaker check: `notion-scope.ts` has already established that an admitted read is either the
+ * caller's own page or a page in the caller's own domain, so the two resolve to the same domain by
+ * construction — and the caller's surface is known BEFORE the fence runs, which the block-resolution
+ * walk needs (it must make a Notion call to find a block's owning page).
+ */
+export function notionChannelCredentialForSurface(surfaceKey, domains) {
+    const parts = surfaceKey.split("/");
+    if (parts.length !== 3 || parts[0] !== "notion")
+        return undefined;
+    return notionChannelCredentialFor(parts[1] || undefined, parts[2] || undefined, domains);
+}
+/**
+ * The `credential_id` auth attribute a DELIVERY stowed on this session (notion-identity.ts
+ * buildNotionAuth), or undefined when there is none — a plain, LOCAL structural read of
+ * `ctx.session.auth`, the same shape notion-identity.ts's own `notionAuthOf`/`notionAttr` probes
+ * read (kept as a separate three-line copy rather than an import for the same reason theirs is not a
+ * barrel port: a mapper/credential decision reads its own platform's attributes itself). `current` is
+ * this turn's auth; `initiator` is the fallback for a context that only carries the session's
+ * original one.
+ */
+function notionDeliveryCredential(ctx) {
+    const auth = ctx.session?.auth?.current ?? ctx.session?.auth?.initiator;
+    const v = auth?.attributes?.credential_id;
+    if (typeof v === "string" && v.length > 0)
+        return v;
+    if (Array.isArray(v) && typeof v[0] === "string" && v[0].length > 0)
+        return v[0];
+    return undefined;
+}
+/**
+ * The credential a READ TOOL runs under (OPE-499). **The delivery's own carried credential wins**
+ * when this session was woken by one — the same `credential_id` auth attribute the reply arm already
+ * reads (notion-post-arm.ts) — so a session only ever reads what the integration that verified its
+ * delivery was actually shared into, never a wider domain binding a double-shared page could reach.
+ *
+ * Falls back to the CALLING SESSION's own domain binding when no delivery credential rides the
+ * context — an agent-initiated session (a routine, a proactive post) never carried one, and that is
+ * the pre-OPE-499 rule, unchanged. Fail-soft throughout: a synthetic or identity-less ctx has no
+ * partition to read, so it resolves undefined and the caller falls back to the org default, exactly
+ * like an unbound domain. That is the correct direction here: the DOMAIN FENCE (notion-scope.ts) is
+ * what refuses an out-of-scope read, and it runs whether or not a credential was selected.
+ */
+export function notionCallerCredential(ctx, domains) {
+    const delivered = notionDeliveryCredential(ctx);
+    if (delivered)
+        return delivered;
+    try {
+        return notionChannelCredentialForSurface(resolvePartition(ctx).surfaceKey, domains);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Every Notion integration this deployment is reachable by — the ORG DEFAULT FIRST, then one per
+ * domain that binds its own. The ingress tries each entry's inbound secret in this order.
+ */
+export function notionIntegrations(domains) {
+    return connectorIntegrations(domains, NOTION_PROVIDER, NOTION_CHANNEL_CREDENTIAL, NOTION_WEBHOOK_SECRET_NAME);
+}
+export function notionSignerServesDomain(owner, signerCredentialId, integrations) {
+    const expected = domainCredentialId(owner, NOTION_PROVIDER, NOTION_CHANNEL_CREDENTIAL);
+    if (expected === signerCredentialId)
+        return { served: true, via: "credential", expected };
+    const secretOf = (credentialId) => integrations.find((i) => i.credentialId === credentialId)?.inboundSecret;
+    const signerSecret = secretOf(signerCredentialId);
+    if (signerSecret !== undefined && secretOf(expected) === signerSecret)
+        return { served: true, via: "shared-secret", expected };
+    return { served: false, expected };
+}
+/**
+ * Every domain a COMMENT delivery reaches THROUGH ITS WORKSPACE CLAIM — the domains the payload's
+ * `workspace_id` can steer, and therefore the only ones {@link notionDeliveryScopeVerdict} fences.
+ *
+ * 🔴 TWO RESOLVERS ANSWER "WHICH DOMAIN?" DOWNSTREAM, AND THEY DO NOT ALWAYS AGREE. Both are
+ * consulted on the session the delivery opens, so a check on one alone would leave the other open:
+ *
+ *   • {@link notionPageDomain} — the credential binding (agent-initiated work) and the read fence
+ *     (notion-scope.ts). Its roster leg compares the PAGE-ID segment alone.
+ *   • `resolveDomainForChannel` — the ambient gate, the engagement tier, the supervisor grain and
+ *     the external-author policy, all keyed on the `notion/<workspace>/<page>` surface key. Its
+ *     roster leg compares the WHOLE key, so a workspace that does not match the `reach` entry
+ *     falls THROUGH to the claim leg.
+ *
+ * 🔴 WHY THE ROSTER LEGS ARE EXEMPT, AND THIS IS THE WHOLE DESIGN. A roster hit is not steerable by
+ * the payload's workspace:
+ *   • {@link notionPageDomain}'s roster leg ignores the workspace outright, and OPE-496 established
+ *     the page id from the comment Notion returned under the verified credential. Authenticated fact
+ *     in, config match out.
+ *   • `resolveDomainForChannel`'s roster leg needs the WHOLE key to appear in `reach`, so the
+ *     workspace it accepts is one the deployer typed themselves.
+ * A claim leg is the opposite: a container entry names a workspace, the payload names a workspace, and a
+ * match hands over every page under it.
+ *
+ * KEEPING THE ROSTER LEGS OUT IS LOAD-BEARING, not a shortcut. A page shared with two integrations
+ * produces a delivery on EACH subscription, and each one must run under its own verifying integration
+ * (the header's "prefer, don't refuse" rule, and the escalation OPE-499 closes by carrying the
+ * delivery's credential into the reads). Fencing a rostered page on the signer would refuse the
+ * second subscription's delivery outright and delete that behaviour.
+ *
+ * Pure — `domains` is injected, exactly like {@link notionPageDomain}'s.
+ */
+export function notionDeliveryClaimedDomains(workspaceId, pageId, domains) {
+    const out = [];
+    const add = (d) => {
+        if (d && !out.some((seen) => seen.name === d.name))
+            out.push(d);
+    };
+    const page = notionPageDomain(workspaceId, pageId, domains);
+    if (page.via === "container")
+        add(page.domain);
+    const channel = resolveDomainForChannel(notionSurfaceKey(workspaceId, pageId), domains);
+    if (channel.via.startsWith("container:"))
+        add(channel.domain);
+    return out;
+}
+/**
+ * ════════════════════════════════════════════════════════════════════════════════════════════════
+ * 🔴 THE COMMENT-PLANE INGRESS FENCE (OPE-502) — MAY THIS SIGNER OPEN A SESSION ON THIS PAGE?
+ * ════════════════════════════════════════════════════════════════════════════════════════════════
+ *
+ * `notion-webhook.ts` calls this after the page is established (OPE-496) and BEFORE the surface key
+ * decides anything. The rule is the trigger plane's rule, on the plane next door:
+ *
+ *   A delivery may open a session on a domain it reaches THROUGH ITS WORKSPACE CLAIM only when that
+ *   domain is one the SIGNING integration serves.
+ *
+ * WHY THE WORKSPACE NEEDS THIS AND THE PAGE DOES NOT. OPE-496 established the PAGE from the comment
+ * Notion returned under the verified credential, so the page is an authenticated fact. It left the
+ * WORKSPACE where it found it — `ev.workspace_id`, a payload field nothing authenticates — and the
+ * two are composed into `notion/<workspace>/<page>`. There is no verified source for the second
+ * half: Notion's REST surface returns no workspace id on any object (`/v1/users/me` gives
+ * `bot.workspace_name`, not an id), so no fetch under any credential can confirm the claim. Pinning
+ * the workspace to a config constant is wrong for a different reason — one deployment may hold
+ * several workspaces. So the claim is fenced instead of proved, exactly as OPE-500 fenced the
+ * trigger plane's scope path.
+ *
+ * WORKED THROUGH, because the point is what it REFUSES. Domain `security` claims workspace
+ * `notion/W-sec` in a container entry and binds integration `notion-security` with its own inbound
+ * secret. A holder of domain `payments`'s `verification_token` comments on a page their OWN
+ * integration can see, then signs a delivery whose `workspace_id` reads `W-sec`. The page reaches
+ * `security` through that claim, so without this fence the session opens on `security` — with
+ * `security`'s ambient flag, `security`'s read scope over every page under the claim, and (for an
+ * agent-initiated call) `security`'s credential. The fence reads that domain's credential, finds
+ * `notion-security` against a `notion-payments` signature, and refuses.
+ *
+ * FAIL CLOSED, AND THE REFUSALS ARE REAL:
+ *   • NO SIGNER ⇒ refuse. `webhooks.allowUnverifiedNotion` accepts a delivery with no secret
+ *     configured anywhere, so nothing identifies a sender and the fence has no fact to read. A fence
+ *     that says yes when it cannot tell is not a fence. The consequence is stated in the runbook: with
+ *     that dev hatch on, a CLAIMED page opens no session. A rostered page is unaffected, so the local
+ *     exercise the hatch exists for still runs.
+ *   • NO CLAIMED DOMAIN ⇒ allow. Either the page is rostered — see
+ *     {@link notionDeliveryClaimedDomains} for why a roster hit is not steerable — or it is in no
+ *     domain at all, where the `org` pseudo-domain answers and no payload field can steer that
+ *     either.
+ *
+ * THE PARTITION IS DECIDED SEPARATELY (OPE-254 §2, folding OPE-537). This fence decides the domain
+ * BOUNDARY; which partition a delivery lands in is notion-webhook.ts's step 8c, which composes the
+ * key from the workspace segment of the `reach` entry that MATCHED — `notionReachWorkspace`, on both
+ * legs. A page named outright therefore keys on config's workspace whatever a delivery claims. A
+ * page reached by a CONTAINER only matches when the payload's workspace equals the container's own
+ * text, so there the derived value equals the payload's by construction; a delivery naming a
+ * workspace no domain reaches matches nothing, and its key belongs to no domain — no memory, no
+ * bundle, and the ambient gate refuses it — rather than opening a second partition inside one.
+ *
+ * 🔴 WHY THE CONTAINER LEG NEEDED A CONFIG RULE, NOT JUST THE SAME READ. The exact-key match is
+ * workspace-BLIND — it finds a page by id alone, so the workspace read back off the matched entry
+ * is a signal INDEPENDENT of whatever the payload said. The container leg is the opposite shape:
+ * `notionPageDomain`'s container match composes `notion/<payload-workspace>/<page>` and only admits
+ * it when a container entry's tenant segment equals THAT SAME payload workspace verbatim
+ * (surface-key-grammar.ts refuses a glob on the tenant segment, so the compare is always exact). So
+ * whenever a container admits a delivery, the matched entry's workspace text and the payload's are,
+ * by construction, the identical string — reading the entry back is a no-op IN VALUE.
+ *
+ * What it is not is a no-op in PROPERTY, and that is the point. The remaining way one page could
+ * still key two ways was a domain reaching MORE THAN ONE Notion workspace: two honestly-signed
+ * deliveries for the same page, one naming each, opened two partitions. memory/domain.ts's
+ * `partitionTenantProblems` now refuses that config at load, so the matched entry names exactly one
+ * workspace per domain and the partition is a fact about config rather than about a delivery.
+ * No live re-keying follows: on every configuration that still loads, the derived value equals the
+ * value the payload carried, so no existing `channel_session` or memory row changes key.
+ *
+ * Pure — `domains` is injected, so the whole decision is unit-testable with no config and no store.
+ */
+export function notionDeliveryScopeVerdict(workspaceId, pageId, signerCredentialId, domains) {
+    const owners = notionDeliveryClaimedDomains(workspaceId, pageId, domains);
+    if (owners.length === 0)
+        return { ok: true, detail: "no domain reaches this page through a workspace claim" };
+    if (!signerCredentialId) {
+        return {
+            ok: false,
+            reason: `no integration's secret identified this delivery, and page ${quoteNotionId(pageId)} is claimed through workspace ${quoteNotionId(workspaceId)}`,
+        };
+    }
+    const integrations = notionIntegrations(domains);
+    let viaSharedSecret = false;
+    for (const owner of owners) {
+        const verdict = notionSignerServesDomain(owner, signerCredentialId, integrations);
+        if (!verdict.served) {
+            return {
+                ok: false,
+                reason: `page ${quoteNotionId(pageId)} reaches domain ${quoteNotionId(owner.name)} through its claim on workspace ` +
+                    `${quoteNotionId(workspaceId)}, and that domain is served by notion credential ${quoteNotionId(verdict.expected)} — ` +
+                    `this delivery was signed by ${quoteNotionId(signerCredentialId)}. A signed body cannot open a session on another domain.`,
+            };
+        }
+        if (verdict.via === "shared-secret")
+            viaSharedSecret = true;
+    }
+    const named = owners.map((d) => quoteNotionId(d.name)).join(", ");
+    return {
+        ok: true,
+        detail: viaSharedSecret
+            ? `domain ${named} is served by an integration that shares this deployment's inbound secret`
+            : `domain ${named} is served by ${quoteNotionId(signerCredentialId)}`,
+    };
+}
+/**
+ * One id, safe to put in a log line. A refusal names the workspace and the page the SENDER chose —
+ * the very fields nothing authenticates — so a raw newline in one would forge a second log line. The
+ * value is bounded and stripped of every control character before it is quoted.
+ *
+ * Notion ids are UUIDs, so 64 characters is far more than a real one needs and short enough that a
+ * padded id cannot push the rest of the line out of a truncated log. Same helper the trigger plane's
+ * fence keeps for the same reason (notion-event-normalizer.ts `quote`); the two are three lines each
+ * and live beside the refusal they protect rather than in a shared string module.
+ */
+function quoteNotionId(id) {
+    if (id === undefined)
+        return '"(none)"';
+    // The class is written in \u escapes on purpose: a raw control byte in a source file is its own
+    // defect class in this tree (`lint:invisible-bytes`).
+    return JSON.stringify(id.slice(0, 64).replace(/[\u0000-\u001f\u007f\u2028\u2029]/g, "?"));
+}
+/**
+ * One integration's INBOUND signing key by operator-secret name, or undefined — and the ONE place
+ * that decides whether a failure is REPORTED.
+ *
+ * 🔴 THE FAILURE THAT MUST BE LOUD. "Nobody stored this name" is the ordinary state for an
+ * integration the operator never configured: it contributes no key, a delivery it would have signed
+ * simply fails the gate, and saying so on every POST would be noise. Every OTHER failure — an
+ * unarmed `OE_CREDENTIAL_ENCRYPTION_KEY`, a store that will not open — makes EVERY delivery on that
+ * integration 401 with nothing in the log to explain it. It is reported.
+ *
+ * The two are told apart by the ERROR CLASS ({@link OperatorSecretNotSetError}), never by the
+ * message: the unarmed-key message ALSO contains the words "is not set", so the substring test this
+ * replaces reported neither and a broken credential store went silent.
+ *
+ * `get` and `log` are injected so the decision is testable with no store and no eve boot; the route
+ * passes `getOperatorSecret` and its own channel logger. The report names the SECRET NAME and the
+ * reason, never a value. Both arms return undefined — this function never throws into a webhook.
+ */
+export async function resolveNotionInboundSecret(name, get, log) {
+    try {
+        const resolved = await get(name);
+        return resolved.value.length > 0 ? resolved.value : undefined;
+    }
+    catch (err) {
+        if (err instanceof OperatorSecretNotSetError)
+            return undefined;
+        const message = err instanceof Error ? err.message : String(err);
+        log(`inbound signing key "${name}" did not resolve — deliveries signed with it will 401: ${message}`);
+        return undefined;
+    }
+}
+//# sourceMappingURL=notion-credentials.js.map

package/dist/agent/channels/notion-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion-credentials.js","sourceRoot":"","sources":["../../../agent/channels/notion-credentials.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,2FAA2F;AAC3F,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,wEAAwE;AACxE,EAAE;AACF,oGAAoG;AACpG,iCAAiC;AACjC,sGAAsG;AACtG,sFAAsF;AACtF,EAAE;AACF,oGAAoG;AACpG,gFAAgF;AAChF,+FAA+F;AAC/F,qGAAqG;AACrG,qGAAqG;AACrG,4FAA4F;AAC5F,oEAAoE;AACpE,EAAE;AACF,sGAAsG;AACtG,qGAAqG;AACrG,+FAA+F;AAC/F,sGAAsG;AACtG,qGAAqG;AACrG,qEAAqE;AACrE,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,qGAAqG;AACrG,oGAAoG;AACpG,mGAAmG;AACnG,8FAA8F;AAC9F,2FAA2F;AAC3F,EAAE;AACF,gGAAgG;AAChG,iGAAiG;AACjG,0FAA0F;AAC1F,kGAAkG;AAClG,kGAAkG;AAClG,gGAAgG;AAChG,oGAAoG;AACpG,iBAAiB;AACjB,EAAE;AACF,oGAAoG;AACpG,qGAAqG;AACrG,0EAA0E;AAC1E,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,kGAAkG;AAClG,+FAA+F;AAC/F,2BAA2B;AAE3B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GAIjB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,wDAAwD;AACxD,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAEvD;;;mFAGmF;AACnF,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAA6B,EAC7B,MAA0B,EAC1B,OAA0B;IAE1B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAClF,OAAO,EAAE,KAAK,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAAC,UAAkB,EAAE,OAA0B;IAC9F,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,OAAO,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,GAAoB;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC;IACxE,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,OAA0B;IACrF,MAAM,SAAS,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,iCAAiC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA0B;IAC3D,OAAO,qBAAqB,CAAC,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,0BAA0B,CAAC,CAAC;AAChH,CAAC;AA0BD,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,kBAA0B,EAC1B,YAA6C;IAE7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACvF,IAAI,QAAQ,KAAK,kBAAkB;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,CAAC,YAAoB,EAAsB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,EAAE,aAAa,CAAC;IACxI,MAAM,YAAY,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAClD,IAAI,YAAY,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,YAAY;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IAC/H,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAA+B,EAC/B,MAAc,EACd,OAA0B;IAE1B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAQ,EAAE;QAC1C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAA+B,EAC/B,MAAc,EACd,kBAAsC,EACtC,OAA0B;IAE1B,MAAM,MAAM,GAAG,4BAA4B,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IAC9G,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8DAA8D,aAAa,CAAC,MAAM,CAAC,iCAAiC,aAAa,CAAC,WAAW,CAAC,EAAE;SACzJ,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAClF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,QAAQ,aAAa,CAAC,MAAM,CAAC,mBAAmB,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,kCAAkC;oBAC3G,GAAG,aAAa,CAAC,WAAW,CAAC,oDAAoD,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK;oBACrH,+BAA+B,aAAa,CAAC,kBAAkB,CAAC,0DAA0D;aAC7H,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,KAAK,eAAe;YAAE,eAAe,GAAG,IAAI,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,eAAe;YACrB,CAAC,CAAC,UAAU,KAAK,2EAA2E;YAC5F,CAAC,CAAC,UAAU,KAAK,iBAAiB,aAAa,CAAC,kBAAkB,CAAC,EAAE;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,EAAsB;IAC3C,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IACxC,gGAAgG;IAChG,sDAAsD;IACtD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAY,EACZ,GAAgE,EAChE,GAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,yBAAyB;YAAE,OAAO,SAAS,CAAC;QAC/D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,GAAG,CAAC,wBAAwB,IAAI,2DAA2D,OAAO,EAAE,CAAC,CAAC;QACtG,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/agent/channels/notion-engagement.d.ts

@@ -0,0 +1,219 @@
+import { type EngagementRow, type Partition } from "@open-everywhere/core/agent/adapter-api.js";
+import type { NotionVia } from "./notion-scope.js";
+/** The facts one Notion delivery contributes to the seam — everything the anchor and the partition
+ *  need, and nothing about the comment's text. */
+export interface NotionSeamFacts {
+    readonly workspaceId: string | undefined;
+    readonly pageId: string | undefined;
+    /** The acting Notion user, so the partition the seam keys is built from the delivery's identity. */
+    readonly principalId?: string;
+    /** The integration this delivery verified under — carried for binding parity with the wake. */
+    readonly credentialId?: string;
+}
+/** The engagement-registry anchor for one Notion delivery, or `undefined` when either id is missing.
+ *
+ *  🔴 IT IS THE ONE PREDICATE THE MAPPER AND THE SEAM SHARE. `bindNotion` publishes exactly this as
+ *  `engagementKey`, so `stand_down`'s mark and this seam's read address the same row. */
+export declare function notionEngagementAnchor(f: NotionSeamFacts): string | undefined;
+/** The partition one page's engagement row lives in — `notion/<workspace>/<page>`, which is what
+ *  `resolvePartition` gives a bound Notion session and therefore what `stand_down` writes under. It
+ *  is built through the same `buildNotionAuth` the wake dispatches, so the seam can never key a row
+ *  the turn would not. Null on an unresolvable identity — the caller then keeps today's path. */
+export declare function notionSeamPartition(f: NotionSeamFacts): Partition | null;
+/**
+ * What the seam says about one comment the classifier did NOT call `direct`. Three outcomes, each
+ * naming what the CALLER owes:
+ *
+ *  • `unanchored` — the delivery names no page (or no resolvable partition), so there is no row to
+ *    address and the caller keeps today's path exactly.
+ *  • `deliver` — a plain comment on an engaged page. The caller wakes a turn even where the page's
+ *    domain has not opted into the ambient supervisor: somebody addressed the agent on THIS page.
+ *  • `hold` — the seam does not admit it. `stopped` says WHY, and it is the one field a caller must
+ *    branch on: `stopped: true` means the agent was asked to stand down on this page, so the comment
+ *    must be SUPPRESSED outright — including where the ambient supervisor is enabled and would
+ *    otherwise answer. `stopped: false` means the page simply is not engaged, which is not a
+ *    suppression: the caller keeps today's path (the domain opt-in then decides).
+ */
+export type NotionEngagementVerdict = {
+    readonly kind: "unanchored";
+    readonly reason: string;
+} | {
+    readonly kind: "deliver";
+    readonly anchor: string;
+    readonly reason: string;
+} | {
+    readonly kind: "hold";
+    readonly anchor: string;
+    readonly reason: string;
+    readonly stopped: boolean;
+};
+/** Injectable seams so the whole verdict is unit-tested without a store. */
+export interface NotionEngagementDeps {
+    readonly getEngagement?: (p: Partition, anchor: string) => Promise<EngagementRow | null>;
+    readonly markEngaged?: (p: Partition, anchor: string, atIso: string) => Promise<void>;
+    /** The durable once-guard BOTH this module's guards take — the engage mark
+     *  ({@link markNotionEngaged}) and the wake ({@link firstNotionDispatchOfComment}). They key on
+     *  different prefixes, so one injected stub serves both. Injected so a test can drive a
+     *  redelivered comment without an operational store. */
+    readonly markEventSeen?: (org: string, key: string, atIso: string) => Promise<boolean>;
+    readonly now?: () => string;
+}
+/**
+ * Resolve the seam for one NON-ADDRESSED comment — READ-ONLY. An addressed comment never reaches
+ * this function: it marks instead ({@link markNotionEngaged}), so exactly one caller writes the row.
+ *
+ * THE DECISION ITSELF IS CORE'S. `shouldDeliverReply` owns the disqualifier order and the reasons;
+ * this function only translates Notion facts into its input. Nothing here re-states the policy.
+ *
+ * FAIL-CLOSED on a store error: `getThreadEngagement` reads a failure as `null`, so an unreadable
+ * registry holds rather than delivers.
+ *
+ * `authorIsBot` is the caller's own loop-guard verdict. The classifier drops a self-authored or
+ * integration-authored comment before this runs, so it is `false` on every live call; it stays a
+ * parameter rather than a hard-coded literal so the guard is visible at the call site and a test can
+ * drive the other direction.
+ */
+export declare function resolveNotionEngagement(f: NotionSeamFacts, authorIsBot: boolean, deps?: NotionEngagementDeps): Promise<NotionEngagementVerdict>;
+/**
+ * Mark one page ENGAGED on an addressed (name-drop or structured-mention) comment. ONCE PER COMMENT.
+ *
+ * `participating: true` is the re-invitation: it promotes the row and CLEARS a previous stand-down,
+ * which is what "name the agent to bring it back" means here.
+ *
+ * 🔴 THE MARK IS DEDUPED, AND THE STOP IS WHY — the same durable guard GitHub's and Linear's marks
+ * take. Clearing the flag is right for a person's second name-drop and WRONG for Notion redelivering
+ * the first one. THE ROUTE DOES NOT ALWAYS ACK, so the redelivery is reachable: `handleNotionDelivery`
+ * carries no top-level `catch`, and eve's channel dispatcher answers a throw with a 500 — while this
+ * mark sits ABOVE `getOrCreateSession` and the wake, either of which can throw on a store outage. The
+ * sequence that costs is then: name-drop marks the page, the mint throws, Notion is told 500, somebody
+ * asks the agent to stand down, and Notion's retry of the original comment lifts the stop.
+ * `commentId` is the trigger comment's own id, so the guard keys on the thing that must happen once.
+ * DURABLE layer only, and it expires with the store's TTL — a retry later than that window can still
+ * re-mark. FAIL-OPEN on a store error, the posture every dedupe in this repository takes.
+ *
+ * Best-effort throughout — `markThreadEngaged` swallows a store failure, because engagement
+ * bookkeeping must never fail a turn. Returns the anchor it marked, or null when it marked nothing.
+ */
+export declare function markNotionEngaged(f: NotionSeamFacts, commentId: string | undefined, deps?: NotionEngagementDeps): Promise<string | null>;
+/**
+ * ONE WAKE PER COMMENT (OPE-1906). TRUE = this comment has not woken the agent inside the window,
+ * so the caller should dispatch. FALSE = the same comment id already did, so the caller must not.
+ *
+ * 🔴 THE OTHER HALF OF THE LOOP GUARD, AND THE CLASSIFIER CANNOT BE IT. `classifyNotionComment`
+ * reads one comment's author; a REDELIVERY of a person's comment carries the same author and the
+ * same text, so it classifies identically and dispatches again — a second model turn, a second
+ * `notion.dispatched` row, and a second reply into the discussion. Nothing else on this road is
+ * keyed on the delivery, so this is the only place that can say "again".
+ *
+ * REDELIVERY IS REACHABLE, and {@link markNotionEngaged} above already says why: the route does not
+ * always ack. `handleNotionDelivery` carries no top-level `catch`, and eve's channel dispatcher
+ * answers a throw with a 500, so Notion retries. A page shared with two subscriptions delivers the
+ * same comment twice by design (OPE-467), and a vendor retry needs no failure of ours at all.
+ *
+ * 🔴 THE MARK IS TAKEN BEFORE THE WAKE, AND THAT TRADE IS DELIBERATE. Marking afterwards would let
+ * two concurrent deliveries of one comment both run a turn, which is the cost this guard exists to
+ * stop; `markEventSeen` is atomic across instances, so marking first stops them. The price is that
+ * a delivery whose dispatch THROWS is not retried inside the window — the same price the engage
+ * mark one step above already pays, and the reason this guard sits as LATE as it can, below every
+ * cheaper refusal, so only a delivery that was really about to wake a turn ever spends a mark.
+ *
+ * 🔴 A SUITE THAT DRIVES `handleNotionDelivery` PAST THIS POINT MUST INJECT `markEventSeen`, or
+ * pin its own store path. The default is the DURABLE operational store, and an unpinned suite in
+ * this package shares one sqlite file (scripts/suite-store-isolation-lint.ts says why) — so a suite
+ * that replays a fixed comment id writes a mark that survives the run, and its NEXT run reads
+ * `duplicate-delivery` where it expected `dispatched`. `lint:suite-store` cannot catch that: its
+ * reach test is a source scan, and such a suite names no store entry point of its own. Five suites
+ * inject the stub today.
+ *
+ * FAIL-OPEN, three ways: a store error, an unresolvable partition and a delivery with no comment id
+ * all answer TRUE, so an outage costs a duplicate turn rather than a deaf deployment. The try/catch
+ * covers the INJECTED edge too, not just the live default (the shape webhooks/replay-dedupe.ts and
+ * webhooks/reject-audit.ts take) — which is how a test drives the fail-open arm without breaking a
+ * real store. `commentId` is the thing that must happen once, and a Notion comment id is globally
+ * unique, so the key needs no anchor.
+ */
+export declare function firstNotionDispatchOfComment(f: NotionSeamFacts, commentId: string | undefined, deps?: NotionEngagementDeps): Promise<boolean>;
+/** The two addressing values a Notion delivery can carry into a dispatch — `drop` never reaches one. */
+export type NotionDispatchAddressing = "direct" | "channel-watch";
+/**
+ * WHAT WOKE ONE ADMITTED DELIVERY, in the wake envelope's own vocabulary (core's `WakeAddressing`).
+ * It is the value the `notion.dispatched` audit row reports, and NO PRODUCT CODE BRANCHES ON IT.
+ * Every reader is an EVIDENCE reader outside the product: the journey pack's `reportedThreadFollow`
+ * (packages/core/scripts/e2e/engaged-rows.ts) gates `J-ENGAGED-notion`'s follow-up step on it,
+ * `drive-notion-namedrop.ts` prints and asserts it, and the test tiers read it. So changing the
+ * value moves what the pack can prove; it moves no delivery decision.
+ *
+ * 🔴 IT IS DELIBERATELY NOT THE CLASSIFIER'S VALUE. The classifier answers one question — did this
+ * comment ADDRESS the agent — and an engaged follow-up did not, so it stays `channel-watch`. The
+ * supervisor core needs that: `channel-watch` is what makes the turn a JUDGED one, and promoting it
+ * would silence the very wake this seam exists to admit.
+ *
+ * 🔴 BUT `channel-watch` ALSO NAMES UNOWNED ROOM CHATTER on an ambient page, and the audit row is
+ * the one place those two must not read alike. A row that reported `channel-watch` for both cannot
+ * tell an ENGAGED wake from an AMBIENT one, and that distinction is the whole evidentiary worth of
+ * the §2.5 seam on this surface: it is what `J-ENGAGED-notion` gates its follow-up step on
+ * (`reportedThreadFollow`, packages/core/scripts/e2e/engaged-rows.ts). Until OPE-1501 the row was
+ * unreachable on an addressed-only page — the ambient gate returned before the classifier ran — so
+ * the collision cost nothing. The gate now admits an engaged follow-up, and the collision costs the
+ * proof, which is what OPE-1510 fixed here.
+ *
+ * 🔴 IT REPORTS THE REGISTRY, NOT THE DOOR. The seam is read for every plain comment, above and
+ * independently of the ambient gate, so on an ambient-ENABLED page a plain comment on an engaged
+ * page also reads `thread-follow` — the ambient flag would have admitted it either way. The value
+ * therefore separates an engaged wake from an ambient one only where the domain has ambient OFF,
+ * which is the addressed-only posture the journeys drive.
+ *
+ * `engagedFollowUp` is the webhook core's own seam verdict, and the `channel-watch` guard below is
+ * belt-and-braces: an ADDRESSED comment never asks the seam, so it can never carry the flag.
+ */
+export declare function notionWakeAddressing(addressing: NotionDispatchAddressing, engagedFollowUp: boolean | undefined): "direct" | "channel-watch" | "thread-follow";
+/** The `notion.dispatched` row's two seam fields: what woke the delivery, and how the operator's
+ *  config holds the page. */
+export interface NotionWakeAuditDetail {
+    readonly addressing: "direct" | "channel-watch" | "thread-follow";
+    readonly via: NotionVia;
+}
+/**
+ * THE SEAM'S WHOLE CONTRIBUTION TO THE AUDIT ROW, as one pure mapping.
+ *
+ * 🔴 THE TWO FIELDS ANSWER DIFFERENT QUESTIONS, AND A ROW NEEDS BOTH. `addressing` says WHAT WOKE
+ * the delivery. `via` says HOW THE OPERATOR DECLARED THE PAGE, which is the domain origin the
+ * addressed door gated on (`notionPageDomain`, channels/notion-scope.ts). A `container` claim
+ * reaches pages NOBODY ENUMERATED — the whole workspace, or a same-level page glob, which are the
+ * two shapes a container entry may take (memory/domain.ts); a `roster` entry is a page an
+ * operator wrote down. Both reach the same door, and a row carrying only `addressing` reports them
+ * identically — which leaves the wider admission looking exactly like the narrower one in the
+ * audit trail. The row says WHICH KIND of claim, never how wide that claim is: read the domain's
+ * own container entry for the breadth.
+ *
+ * `via` is the webhook core's own read, carried on the dispatch. An absent field reads `none`: the
+ * conservative word, so a caller that omits it can never claim a declaration it did not make.
+ */
+export declare function notionWakeAuditDetail(addressing: NotionDispatchAddressing, engagedFollowUp: boolean | undefined, via: NotionVia | undefined): NotionWakeAuditDetail;
+/** The three ids that let one Notion delivery be joined to the turn it woke. IDS ONLY. */
+export interface NotionDispatchJoinIds {
+    /** The WEBHOOK ENVELOPE's own `id` — unique to this delivery, so two deliveries of the SAME
+     *  comment are tellable apart. Absent when the body carried no id. */
+    readonly deliveryId?: string;
+    /** The TRIGGER COMMENT's id — what the delivery named, and what a replay leg configures. */
+    readonly commentId?: string;
+    /** The single-window wake this delivery minted — the join key `wake.ingress` and
+     *  `wake.turn_start` carry, and therefore the bridge to the session that answered. Absent on a
+     *  per-doc (non-unified) delivery, which mints no window wake. */
+    readonly wakeId?: string;
+}
+/**
+ * Build the join ids for the row. Pure, and EVERY FIELD IS AN ID — never a comment body, an author
+ * name or a page title.
+ *
+ * 🔴 WHY THE ROW NEEDS THEM. Before this, `notion.dispatched` recorded the discussion and the
+ * addressing but nothing that identified the DELIVERY, so a leg that forged one replay could only
+ * scan a time window for a verdict row and hope no other wake fell inside it. S-TAINT-DRYRUN Arm B
+ * did exactly that and the scan could not tell its own replay's verdict from an ambient one
+ * (OPE-1907). With the delivery id on the row, one forge joins one wake joins one session.
+ *
+ * An absent value is OMITTED rather than written as `undefined`: an audit row that carries a key
+ * with no value reads, to anyone querying it, like a value that was looked for and found empty.
+ */
+export declare function notionDispatchJoinDetail(ids: NotionDispatchJoinIds): Record<string, string>;
+//# sourceMappingURL=notion-engagement.d.ts.map

package/dist/agent/channels/notion-engagement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion-engagement.d.ts","sourceRoot":"","sources":["../../../agent/channels/notion-engagement.ts"],"names":[],"mappings":"AAiBA,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,SAAS,EACf,MAAM,4CAA4C,CAAC;AAIpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD;kDACkD;AAClD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,oGAAoG;IACpG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,+FAA+F;IAC/F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;yFAGyF;AACzF,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAE7E;AAED;;;iGAGiG;AACjG,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAaxE;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACzF,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF;;;4DAGwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAC3C,CAAC,EAAE,eAAe,EAClB,WAAW,EAAE,OAAO,EACpB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,uBAAuB,CAAC,CAiBlC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,GAAE,oBAAyB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAclJ;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,4BAA4B,CAChD,CAAC,EAAE,eAAe,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED,wGAAwG;AACxG,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,eAAe,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,wBAAwB,EACpC,eAAe,EAAE,OAAO,GAAG,SAAS,GACnC,QAAQ,GAAG,eAAe,GAAG,eAAe,CAE9C;AAED;6BAC6B;AAC7B,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,eAAe,GAAG,eAAe,CAAC;IAClE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;CACzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,wBAAwB,EACpC,eAAe,EAAE,OAAO,GAAG,SAAS,EACpC,GAAG,EAAE,SAAS,GAAG,SAAS,GACzB,qBAAqB,CAEvB;AAyCD,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC;0EACsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;sEAEkE;IAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM3F"}