@open-everywhere/provider-notion 0.1.0

package/dist/agent/channels/notion-identity.d.ts

@@ -0,0 +1,119 @@
+import type { SessionMode, Visibility, IdentityMapper } from "@open-everywhere/core/agent/adapter-api.js";
+/** Structural match for eve's SessionAuthContext (attributes + principal). */
+export interface OpenEverywhereNotionAuth {
+    readonly authenticator: string;
+    readonly principalId: string;
+    readonly principalType: string;
+    readonly attributes: Record<string, string>;
+}
+export interface NotionIdentityInput {
+    /** Notion workspace id — becomes the OpenEverywhere `workspace` (tenant tier). */
+    readonly workspaceId?: string;
+    /** The page the comment lives on — becomes the OpenEverywhere `surface` (the silo grain). */
+    readonly pageId?: string;
+    /** The discussion thread the comment belongs to — the post-back anchor (create-comment
+     *  targets `discussion_id`), NOT the partition key. */
+    readonly discussionId?: string;
+    /** The specific comment that triggered this turn — for audit/provenance. */
+    readonly commentId?: string;
+    /** The acting Notion user (comment author), if known — becomes the principal. */
+    readonly principalId?: string;
+    /**
+     * The Notion channel credential this DELIVERY was selected to run under (OPE-467) — the
+     * integration whose secret verified it. Stowed so every reply for this turn posts under the SAME
+     * integration that fetched the comment. Without it a reply re-derives the credential from the
+     * page's domain binding alone, and a page shared with an integration its domain does not bind
+     * would fetch under one key and answer under another whose integration was never shared the page
+     * — `createCommentReply` throws and the agent silently never answers.
+     *
+     * HOST-SET (§AUTH-ATTRIBUTE PROVENANCE): built from the HMAC gate's verdict, never from the
+     * comment body, so it cannot be forged into naming another integration's credential.
+     */
+    readonly credentialId?: string;
+    /**
+     * The declared TRUST ROOT this page sits under, canonical form, when the ancestor walk matched one
+     * (OPE-492; channels/notion-ancestry-trust.ts resolveNotionDeliveryTrust). Present ⇒ the operator
+     * declared a page above this one internal, so {@link bindNotion} binds `internal` instead of the
+     * fail-closed `external`. Absent on every untrusted verdict, which is every verdict on a
+     * deployment that declares no roots.
+     *
+     * HOST-SET (§AUTH-ATTRIBUTE PROVENANCE): the webhook core resolves it from Notion's own parent
+     * chain under the VERIFIED credential, never from the comment body, so it cannot be forged into
+     * claiming a root.
+     */
+    readonly trustRoot?: string;
+}
+/** Build the auth context OpenEverywhere dispatches with — raw facts as string attributes. */
+export declare function buildNotionAuth(input: NotionIdentityInput): OpenEverywhereNotionAuth;
+/**
+ * The workspaceKey a Notion surface resolves to (`notion/<workspace id>`) — the value an
+ * operator lists in agent/identity/surfaces.ts to vouch a whole Notion workspace
+ * as internal (which lets its pages' learnings flow to shared memory despite the
+ * fail-closed default below). Takes the raw workspace id as Notion reports it on the
+ * webhook, so the operator pastes what they see. Notion ids are UUIDs, already within the
+ * binding's `seg` charset (hyphens allowed), so no encoding is needed. notion-test.ts pins
+ * this key against the one bindFrom actually produces.
+ */
+export declare function notionWorkspaceKey(workspaceId: string): string;
+/**
+ * The fully-qualified surfaceKey a Notion page resolves to — `notion/<workspace>/<page>` — the
+ * SAME shape resolvePartition(ctx) produces for a bound Notion session (memory/partition.ts:
+ * `platform/workspace/surface`, surface = the page). The ambient-supervisor gate + the
+ * channel_session registry are keyed by this, so the webhook core (which runs BEFORE any eve
+ * binding) must compute the identical key. Falls back through discussion → "unknown" the same way
+ * bindNotion picks its surface, so an under-identified event still keys to a stable string.
+ */
+export declare function notionSurfaceKey(workspaceId: string | undefined, surface: string | undefined): string;
+/**
+ * The CONVERSATION key the stop registry keys a Notion turn by (OPE-989) — `<workspace>/<page>`.
+ * ONE derivation, used by BOTH sides of the affordance: {@link bindNotion} writes it onto the
+ * anchor row at turn start (as `anchorChannelId`), and the stop leg (channels/notion-stop.ts)
+ * rebuilds it from the fetched comment. Two spellings of this key would make the arm silently miss
+ * — the same discipline githubConversationKey documents.
+ *
+ * THE PAGE, NOT THE DISCUSSION. The Notion doc-session is page-scoped (notion-supervisor.ts's
+ * `notionSupervisorToken` keys the standing session by page, not by discussion — "a page-scoped
+ * standing session aware of all the doc's discussions"), so the conversation a stop trigger can
+ * name is the page, mirroring how a GitHub stop names the issue/PR and a Teams stop names the
+ * reply chain.
+ *
+ * Returns undefined on any missing part — never "unknown" (unlike {@link notionSurfaceKey}, which
+ * exists for a different purpose: a STABLE partition key even under-identified). A partial anchor
+ * key would let two different under-identified deliveries collide and cancel each other's turns.
+ */
+export declare function notionConversationKey(workspaceId: string | undefined, pageId: string | undefined): string | undefined;
+/**
+ * The inverse of {@link notionConversationKey} — split the `<workspace>/<page>` string back into its
+ * two Notion ids. Undefined on anything that is not exactly two non-empty segments: a malformed or
+ * partial address must never resolve to a guessed page. Notion ids are UUIDs (no `/`), so splitting
+ * on the first slash is exact — there is no ambiguity to resolve.
+ *
+ * The one caller today is `notion-message-ops.ts` (OPE-1043): `SurfaceMessageOps.postText`/
+ * `editMessage` are handed only the composed `channelId` (this key), never the two ids apart, so a
+ * transport that needs the page or the workspace on its own has to parse it back out. Kept beside
+ * the composer rather than in that file, for the same reason the composer's own doc states: one
+ * derivation, read by both sides, so the write and the read can never drift into two spellings.
+ */
+export declare function parseNotionConversationKey(channelId: string): {
+    readonly workspaceId: string;
+    readonly pageId: string;
+} | undefined;
+/**
+ * Notion has NO 1:1 DM primitive — every comment is on a shared page/discussion — so a
+ * Notion surface is always `channel` mode. Total function (no input) kept for symmetry
+ * with the other platforms' mode helpers and so the mapper reads the same shape.
+ */
+export declare function notionMode(): SessionMode;
+/**
+ * Notion facts → visibility. FAIL CLOSED — Notion is ALWAYS private.
+ * An internal integration only sees pages EXPLICITLY shared with it, and the webhook
+ * carries no cheap, reliable "this page is workspace-public / world-visible" bit — the
+ * `accessible_by` array is a coarse who-can-see list, not a public/private classifier.
+ * With no positive signal that a page is a broadly-shared internal space, a surface's
+ * learnings must never flow up to a shared (workspace) tier: every Notion page stays
+ * surface-tier private. A future maintainer who finds a positive workspace-visible signal
+ * (or enriches page permissions from the API) flips this — until then it fails closed.
+ */
+export declare function notionVisibility(): Visibility;
+export declare const bindNotion: IdentityMapper;
+//# sourceMappingURL=notion-identity.d.ts.map

package/dist/agent/channels/notion-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion-identity.d.ts","sourceRoot":"","sources":["../../../agent/channels/notion-identity.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAmB,cAAc,EAAe,MAAM,4CAA4C,CAAC;AAExI,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;2DACuD;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,KAAK,EAAE,mBAAmB,GAAG,wBAAwB,CAcpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAErG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAErH;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAMnI;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,WAAW,CAExC;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAE7C;AAkCD,eAAO,MAAM,UAAU,EAAE,cA8DxB,CAAC"}

package/dist/agent/channels/notion-identity.js

@@ -0,0 +1,205 @@
+// Pure Notion→OpenEverywhere identity capture. The Notion channel (notion.ts) calls
+// these to stow RAW Notion facts (workspace / page / discussion / comment ids + the
+// commenting actor) into the session auth context's `attributes`. The INTERPRETATION of
+// those facts into mode/visibility lives here too — notionMode/notionVisibility — so the
+// test can call them and the security-critical "is this private?" decision sits in one
+// tested place. This file imports no eve types (only a type-only alias, erased at
+// compile), so it's trivially unit-testable.
+//
+// SILO CHOICE (why surface = the PAGE, not the workspace and not the comment thread):
+// the surface-fit criterion is "the persistent multi-instance container, NOT the
+// invocation point". Notion's tiers map onto ours exactly like Linear's do:
+//   Notion workspace  ≈ Linear organization ≈ our `workspace` (the tenant tier)
+//   Notion PAGE       ≈ Linear TEAM         ≈ our `surface`   (the silo — one page
+//                                              hosts many discussion threads over time,
+//                                              just as a team hosts many issues)
+//   Notion discussion ≈ Linear issue        ≈ the conversation ANCHOR (post-back target
+//                                              + continuation key), NOT the partition key
+// So a page's accumulated memory is reused across every comment thread on it, while a
+// bare comment thread (which comes and goes) is only the reply anchor. This mirrors Slack
+// too: surface = channel, the thread is the anchor. (A finer teamspace→page two-level silo
+// is a future refinement; page is the launch grain, matching the Linear team grain.)
+/** Build the auth context OpenEverywhere dispatches with — raw facts as string attributes. */
+export function buildNotionAuth(input) {
+    const attributes = {};
+    if (input.workspaceId)
+        attributes.workspace_id = input.workspaceId;
+    if (input.pageId)
+        attributes.page_id = input.pageId;
+    if (input.discussionId)
+        attributes.discussion_id = input.discussionId;
+    if (input.commentId)
+        attributes.comment_id = input.commentId;
+    if (input.credentialId)
+        attributes.credential_id = input.credentialId;
+    if (input.trustRoot)
+        attributes.trust_root = input.trustRoot;
+    return {
+        authenticator: "notion",
+        principalId: input.principalId ?? "",
+        principalType: "notion-user",
+        attributes,
+    };
+}
+/**
+ * The workspaceKey a Notion surface resolves to (`notion/<workspace id>`) — the value an
+ * operator lists in agent/identity/surfaces.ts to vouch a whole Notion workspace
+ * as internal (which lets its pages' learnings flow to shared memory despite the
+ * fail-closed default below). Takes the raw workspace id as Notion reports it on the
+ * webhook, so the operator pastes what they see. Notion ids are UUIDs, already within the
+ * binding's `seg` charset (hyphens allowed), so no encoding is needed. notion-test.ts pins
+ * this key against the one bindFrom actually produces.
+ */
+export function notionWorkspaceKey(workspaceId) {
+    return `notion/${workspaceId}`;
+}
+/**
+ * The fully-qualified surfaceKey a Notion page resolves to — `notion/<workspace>/<page>` — the
+ * SAME shape resolvePartition(ctx) produces for a bound Notion session (memory/partition.ts:
+ * `platform/workspace/surface`, surface = the page). The ambient-supervisor gate + the
+ * channel_session registry are keyed by this, so the webhook core (which runs BEFORE any eve
+ * binding) must compute the identical key. Falls back through discussion → "unknown" the same way
+ * bindNotion picks its surface, so an under-identified event still keys to a stable string.
+ */
+export function notionSurfaceKey(workspaceId, surface) {
+    return `notion/${workspaceId ?? "unknown"}/${surface ?? "unknown"}`;
+}
+/**
+ * The CONVERSATION key the stop registry keys a Notion turn by (OPE-989) — `<workspace>/<page>`.
+ * ONE derivation, used by BOTH sides of the affordance: {@link bindNotion} writes it onto the
+ * anchor row at turn start (as `anchorChannelId`), and the stop leg (channels/notion-stop.ts)
+ * rebuilds it from the fetched comment. Two spellings of this key would make the arm silently miss
+ * — the same discipline githubConversationKey documents.
+ *
+ * THE PAGE, NOT THE DISCUSSION. The Notion doc-session is page-scoped (notion-supervisor.ts's
+ * `notionSupervisorToken` keys the standing session by page, not by discussion — "a page-scoped
+ * standing session aware of all the doc's discussions"), so the conversation a stop trigger can
+ * name is the page, mirroring how a GitHub stop names the issue/PR and a Teams stop names the
+ * reply chain.
+ *
+ * Returns undefined on any missing part — never "unknown" (unlike {@link notionSurfaceKey}, which
+ * exists for a different purpose: a STABLE partition key even under-identified). A partial anchor
+ * key would let two different under-identified deliveries collide and cancel each other's turns.
+ */
+export function notionConversationKey(workspaceId, pageId) {
+    return workspaceId && pageId ? `${workspaceId}/${pageId}` : undefined;
+}
+/**
+ * The inverse of {@link notionConversationKey} — split the `<workspace>/<page>` string back into its
+ * two Notion ids. Undefined on anything that is not exactly two non-empty segments: a malformed or
+ * partial address must never resolve to a guessed page. Notion ids are UUIDs (no `/`), so splitting
+ * on the first slash is exact — there is no ambiguity to resolve.
+ *
+ * The one caller today is `notion-message-ops.ts` (OPE-1043): `SurfaceMessageOps.postText`/
+ * `editMessage` are handed only the composed `channelId` (this key), never the two ids apart, so a
+ * transport that needs the page or the workspace on its own has to parse it back out. Kept beside
+ * the composer rather than in that file, for the same reason the composer's own doc states: one
+ * derivation, read by both sides, so the write and the read can never drift into two spellings.
+ */
+export function parseNotionConversationKey(channelId) {
+    const i = channelId.indexOf("/");
+    if (i <= 0 || i === channelId.length - 1)
+        return undefined;
+    const workspaceId = channelId.slice(0, i);
+    const pageId = channelId.slice(i + 1);
+    return workspaceId.length > 0 && pageId.length > 0 ? { workspaceId, pageId } : undefined;
+}
+/**
+ * Notion has NO 1:1 DM primitive — every comment is on a shared page/discussion — so a
+ * Notion surface is always `channel` mode. Total function (no input) kept for symmetry
+ * with the other platforms' mode helpers and so the mapper reads the same shape.
+ */
+export function notionMode() {
+    return "channel";
+}
+/**
+ * Notion facts → visibility. FAIL CLOSED — Notion is ALWAYS private.
+ * An internal integration only sees pages EXPLICITLY shared with it, and the webhook
+ * carries no cheap, reliable "this page is workspace-public / world-visible" bit — the
+ * `accessible_by` array is a coarse who-can-see list, not a public/private classifier.
+ * With no positive signal that a page is a broadly-shared internal space, a surface's
+ * learnings must never flow up to a shared (workspace) tier: every Notion page stays
+ * surface-tier private. A future maintainer who finds a positive workspace-visible signal
+ * (or enriches page permissions from the API) flips this — until then it fails closed.
+ */
+export function notionVisibility() {
+    return "private";
+}
+function notionAuthOf(ctx) {
+    return ctx.session?.auth?.current ?? ctx.session?.auth?.initiator ?? null;
+}
+function notionAttr(a, keys) {
+    if (!a)
+        return undefined;
+    for (const k of keys) {
+        const v = a[k];
+        if (typeof v === "string" && v.length > 0)
+            return v;
+        if (Array.isArray(v) && typeof v[0] === "string" && v[0].length > 0)
+            return v[0];
+    }
+    return undefined;
+}
+export const bindNotion = (ctx) => {
+    const auth = notionAuthOf(ctx);
+    const a = auth?.attributes;
+    const workspaceId = notionAttr(a, ["workspace_id", "workspaceId"]);
+    // Surface = the PAGE (silo grain); fall back to the discussion, then the comment, so a
+    // session always keys to a stable surface even on an under-identified event.
+    const surface = notionAttr(a, ["page_id", "pageId"]) ??
+        notionAttr(a, ["discussion_id", "discussionId"]) ??
+        notionAttr(a, ["comment_id", "commentId"]);
+    const discussionId = notionAttr(a, ["discussion_id", "discussionId"]);
+    const pageId = notionAttr(a, ["page_id", "pageId"]);
+    // The delivery's selected integration (OPE-467), so `reply` posts under the credential that
+    // fetched. Absent on a session that predates the stamp ⇒ the reply arm falls back to the page's
+    // domain binding, which is the pre-OPE-467 behaviour.
+    const credentialId = notionAttr(a, ["credential_id", "credentialId"]);
+    // The ANCESTOR-WALK verdict the webhook core resolved for THIS delivery (OPE-492). Present only
+    // when the page sits under a declared trust root; the stamp names the root that matched.
+    const trustRoot = notionAttr(a, ["trust_root", "trustRoot"]);
+    const principal = auth?.principalId;
+    return {
+        workspace: workspaceId,
+        surface,
+        mode: notionMode(),
+        visibility: notionVisibility(),
+        // Notion refutes no author and reports no room-grain external signal, so trust here is ALWAYS an
+        // operator declaration — never a platform verdict. Two declarations reach it, and this is the
+        // ONE the platform mapper carries: the page sits under a declared TRUST ROOT, walked and matched
+        // at ingestion (channels/notion-ancestry-trust.ts). The other is the flat per-surface vouch
+        // (identity/surfaces.ts), which bindFrom applies one rung lower.
+        //
+        // POSITIVE-ONLY. No root matched ⇒ undefined, NEVER "external": bindFrom must still fall through
+        // to the per-surface vouch and then to the fail-closed default. Returning "external" here would
+        // out-rank the operator's own `defineSurface` line and silently switch off shared memory on every
+        // Notion page of a deployment that declares no roots.
+        trust: trustRoot ? "internal" : undefined,
+        principalId: (principal && principal.length > 0 ? principal : undefined) ?? notionAttr(a, ["user_id", "userId"]),
+        // Post-back targets the DISCUSSION thread (create-comment's discussion_id), with the page
+        // riding along. Not a thread ts — Notion replies key off discussion_id, carried on the
+        // session state the channel stashes, so this target is for routine/proactive use.
+        target: discussionId ? { discussionId, ...(pageId ? { pageId } : {}), ...(credentialId ? { credentialId } : {}) } : undefined,
+        // THE STOP REGISTRY'S ADDRESS FOR THIS TURN (OPE-989). A Notion doc-session is PAGE-scoped
+        // (notionSupervisorToken keys the standing session by page), so that is what a stop directive
+        // posted on the page can name. It cannot ride `target`: that object composes the REPLY target
+        // (the discussion), a different grain that changes on every comment.
+        //
+        // Notion pushes no reaction webhook (comment.created/updated/deleted is the whole comment event
+        // catalogue — developers.notion.com/reference/webhooks-events-delivery, read 2026-08-23), so the
+        // trigger on this surface is a bare `stop` comment read at the ingress — see
+        // channels/notion-stop.ts. The key it resolves by is this one.
+        ...(notionConversationKey(workspaceId, pageId) ? { anchorChannelId: notionConversationKey(workspaceId, pageId) } : {}),
+        // THE ENGAGEMENT REGISTRY'S ADDRESS FOR THIS TURN (OPE-1501) — the SAME page key, and
+        // deliberately the same derivation rather than a second spelling of it. `stand_down` marks
+        // `binding.engagementKey ?? binding.threadTs`, and Notion carries no `threadTs`, so without this
+        // field the verb found no anchor and refused on every Notion turn.
+        //
+        // THE PAGE, NOT THE DISCUSSION, for the reason {@link notionConversationKey} states: the doc
+        // session is page-scoped and aware of all the page's discussions, so a person asking the agent
+        // to stop is asking it to stop on the page. A per-discussion mark would leave the same standing
+        // session answering the discussion next door.
+        ...(notionConversationKey(workspaceId, pageId) ? { engagementKey: notionConversationKey(workspaceId, pageId) } : {}),
+    };
+};
+//# sourceMappingURL=notion-identity.js.map

package/dist/agent/channels/notion-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion-identity.js","sourceRoot":"","sources":["../../../agent/channels/notion-identity.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oFAAoF;AACpF,wFAAwF;AACxF,yFAAyF;AACzF,uFAAuF;AACvF,kFAAkF;AAClF,6CAA6C;AAC7C,EAAE;AACF,sFAAsF;AACtF,iFAAiF;AACjF,4EAA4E;AAC5E,gFAAgF;AAChF,mFAAmF;AACnF,wFAAwF;AACxF,iFAAiF;AACjF,wFAAwF;AACxF,0FAA0F;AAC1F,sFAAsF;AACtF,0FAA0F;AAC1F,2FAA2F;AAC3F,qFAAqF;AAkDrF,8FAA8F;AAC9F,MAAM,UAAU,eAAe,CAAC,KAA0B;IACxD,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,IAAI,KAAK,CAAC,WAAW;QAAE,UAAU,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;IACnE,IAAI,KAAK,CAAC,MAAM;QAAE,UAAU,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;IACpD,IAAI,KAAK,CAAC,YAAY;QAAE,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;IACtE,IAAI,KAAK,CAAC,SAAS;QAAE,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IAC7D,IAAI,KAAK,CAAC,YAAY;QAAE,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;IACtE,IAAI,KAAK,CAAC,SAAS;QAAE,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IAC7D,OAAO;QACL,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;QACpC,aAAa,EAAE,aAAa;QAC5B,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,UAAU,WAAW,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA+B,EAAE,OAA2B;IAC3F,OAAO,UAAU,WAAW,IAAI,SAAS,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAA+B,EAAE,MAA0B;IAC/F,OAAO,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAC1D,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,SAAS,CAAC;AACnB,CAAC;AAoBD,SAAS,YAAY,CAAC,GAAoB;IACxC,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CAAC,CAAY,EAAE,IAAuB;IACvD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAmB,CAAC,GAAG,EAAe,EAAE;IAC7D,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC;IAC3B,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;IACnE,uFAAuF;IACvF,6EAA6E;IAC7E,MAAM,OAAO,GACX,UAAU,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpC,UAAU,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAChD,UAAU,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,4FAA4F;IAC5F,gGAAgG;IAChG,sDAAsD;IACtD,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;IACtE,gGAAgG;IAChG,yFAAyF;IACzF,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,EAAE,WAAW,CAAC;IACpC,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,OAAO;QACP,IAAI,EAAE,UAAU,EAAE;QAClB,UAAU,EAAE,gBAAgB,EAAE;QAC9B,iGAAiG;QACjG,8FAA8F;QAC9F,iGAAiG;QACjG,4FAA4F;QAC5F,iEAAiE;QACjE,EAAE;QACF,iGAAiG;QACjG,gGAAgG;QAChG,kGAAkG;QAClG,sDAAsD;QACtD,KAAK,EAAE,SAAS,CAAC,CAAC,CAAE,UAAoB,CAAC,CAAC,CAAC,SAAS;QACpD,WAAW,EAAE,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChH,0FAA0F;QAC1F,uFAAuF;QACvF,kFAAkF;QAClF,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7H,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,qEAAqE;QACrE,EAAE;QACF,gGAAgG;QAChG,iGAAiG;QACjG,6EAA6E;QAC7E,+DAA+D;QAC/D,GAAG,CAAC,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtH,sFAAsF;QACtF,2FAA2F;QAC3F,iGAAiG;QACjG,mEAAmE;QACnE,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,gGAAgG;QAChG,8CAA8C;QAC9C,GAAG,CAAC,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrH,CAAC;AACJ,CAAC,CAAC"}

package/dist/agent/channels/notion-ingress-drain.d.ts

@@ -0,0 +1,66 @@
+import { type ClaimedIngressDelivery, type OperationalStore } from "@open-everywhere/core/agent/adapter-api.js";
+import { type NotionIngressKey } from "./notion-ingress.js";
+export declare const NOTION_INGRESS_DRAIN_PATH = "/eve/v1/notion/drain";
+export declare const NOTION_INGRESS_DRAIN_SIGNATURE_HEADER = "x-oe-notion-drain-signature";
+export declare const NOTION_COMMENT_DISPATCH_SOURCE = "notion-comment-dispatch";
+export declare const NOTION_COMMENT_DISPATCH_AUTHORITY = "notion";
+export interface NotionIngressDrainKey extends NotionIngressKey {
+}
+export interface AcceptedNotionIngressDrain {
+    readonly key: NotionIngressDrainKey;
+    readonly claim: ClaimedIngressDelivery;
+    readonly rawBody: string;
+    readonly signerCredentialId: string;
+}
+export type NotionIngressDisposition = "complete" | "discard" | "retry";
+export interface NotionCommentDispatchGuard {
+    readonly claim: (commentId: string) => Promise<boolean>;
+    readonly complete: (commentId: string) => Promise<void>;
+}
+export interface AcceptNotionIngressDrainDeps {
+    readonly org: string;
+    readonly store: OperationalStore;
+    readonly secret?: string;
+    readonly now?: () => Date;
+    readonly claimId?: () => string;
+}
+export declare function signNotionIngressDrainBody(secret: string, body: string): string;
+/** Cheap public-ACK precondition: recovery can authenticate and reach this deployment. */
+export declare function notionIngressDrainAvailable(): boolean;
+/** Authenticate an internal row-key request and atomically claim its exact org-scoped row. */
+export declare function acceptNotionIngressDrainRequest(req: Request, deps: AcceptNotionIngressDrainDeps): Promise<{
+    readonly accepted: AcceptedNotionIngressDrain;
+} | {
+    readonly response: Response;
+}>;
+/** Finish one primary claim according to the processor's explicit semantic result. */
+export declare function settleNotionIngressDrain(accepted: AcceptedNotionIngressDrain, disposition: NotionIngressDisposition, deps: Pick<AcceptNotionIngressDrainDeps, "org" | "store" | "now">): Promise<void>;
+/**
+ * A comment-level guard for the crash seam between "accepted by Eve" and primary-row completion.
+ * Its lease is deliberately the same length as the primary retry delay: a retry never mistakes an
+ * active pre-dispatch lease for a completed duplicate. A stale lease is stolen and may duplicate
+ * after an ambiguous post-dispatch crash, which is the honest at-least-once side of the choice.
+ */
+export declare function createNotionCommentDispatchGuard(input: {
+    readonly org: string;
+    readonly store: OperationalStore;
+    readonly now?: () => Date;
+    readonly claimId?: () => string;
+}): NotionCommentDispatchGuard;
+export interface PostNotionIngressDrainDeps {
+    readonly secret?: string;
+    readonly baseUrl?: string;
+    readonly fetchImpl?: typeof fetch;
+    readonly now?: () => Date;
+}
+/** Post one content-free row key to this deployment's private drain route. */
+export declare function postNotionIngressDrain(key: NotionIngressDrainKey, deps?: PostNotionIngressDrainDeps): Promise<void>;
+/** One recovery tick. A failed self-hop leaves the row pending for the next minute. */
+export declare function recoverNotionIngress(org: string, store: OperationalStore, deps?: PostNotionIngressDrainDeps & {
+    readonly now?: () => Date;
+}): Promise<{
+    readonly due: number;
+    readonly posted: number;
+    readonly failed: number;
+}>;
+//# sourceMappingURL=notion-ingress-drain.d.ts.map

package/dist/agent/channels/notion-ingress-drain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion-ingress-drain.d.ts","sourceRoot":"","sources":["../../../agent/channels/notion-ingress-drain.ts"],"names":[],"mappings":"AAOA,OAAO,EAML,KAAK,sBAAsB,EAE3B,KAAK,gBAAgB,EACtB,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAqD,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE/G,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAChE,eAAO,MAAM,qCAAqC,gCAAgC,CAAC;AAEnF,eAAO,MAAM,8BAA8B,4BAA4B,CAAC;AAGxE,eAAO,MAAM,iCAAiC,WAAW,CAAC;AAe1D,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;CAAG;AAElE,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;AAExE,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,QAAQ,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;CACjC;AAgBD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/E;AAQD,0FAA0F;AAC1F,wBAAgB,2BAA2B,IAAI,OAAO,CAErD;AAED,8FAA8F;AAC9F,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAqD9F;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,0BAA0B,EACpC,WAAW,EAAE,wBAAwB,EACrC,IAAI,EAAE,IAAI,CAAC,4BAA4B,EAAE,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;CACjC,GAAG,0BAA0B,CAwC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,qBAAqB,EAC1B,IAAI,GAAE,0BAA+B,GACpC,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,uFAAuF;AACvF,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,gBAAgB,EACvB,IAAI,GAAE,0BAA0B,GAAG;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAO,GACpE,OAAO,CAAC;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBrF"}

package/dist/agent/channels/notion-ingress-drain.js

@@ -0,0 +1,185 @@
+// DURABLE NOTION INGRESS DRAIN — the authenticated, fenced consumer of rows admitted by
+// notion-ingress.ts. The public webhook stores a projected provider envelope and returns; both its
+// immediate nudge and the minute recovery schedule send only the row key through this internal
+// HMAC route. The payload never leaves the operational store.
+import { createHmac, randomUUID } from "node:crypto";
+import { getOrMintSelfSecret, readCappedBody, selfDispatchBaseUrl, selfSecretsArmed, verifyWebhookSignature, } from "@open-everywhere/core/agent/adapter-api.js";
+import { decodeNotionIngressPayload, NOTION_INGRESS_SOURCE } from "./notion-ingress.js";
+export const NOTION_INGRESS_DRAIN_PATH = "/eve/v1/notion/drain";
+export const NOTION_INGRESS_DRAIN_SIGNATURE_HEADER = "x-oe-notion-drain-signature";
+const NOTION_INGRESS_DRAIN_SECRET_ENV = "OE_NOTION_INGRESS_DRAIN_SECRET";
+export const NOTION_COMMENT_DISPATCH_SOURCE = "notion-comment-dispatch";
+// Comment ids are globally unique inside Notion. Keep this authority constant so the same comment
+// arriving from two subscriptions shares ONE dispatch lease, matching the legacy OPE-1906 guard.
+export const NOTION_COMMENT_DISPATCH_AUTHORITY = "notion";
+const NOTION_INGRESS_LEASE_MS = 5 * 60_000;
+const NOTION_INGRESS_RETRY_MS = NOTION_INGRESS_LEASE_MS + 1_000;
+const NOTION_INGRESS_TOMBSTONE_MS = 24 * 60 * 60_000;
+const NOTION_COMMENT_DISPATCH_TOMBSTONE_MS = 10 * 60_000;
+const NOTION_INGRESS_DRAIN_MAX_BODY_BYTES = 16 * 1024;
+const NOTION_INGRESS_DRAIN_MAX_SKEW_MS = 5 * 60_000;
+const NOTION_INGRESS_DRAIN_BATCH = 25;
+function nonEmpty(value, max = 512) {
+    return typeof value === "string" && value.length > 0 && value.length <= max ? value : undefined;
+}
+function parseEnvelope(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const row = value;
+    const authorityId = nonEmpty(row.authorityId);
+    const deliveryId = nonEmpty(row.deliveryId);
+    const issuedAt = row.issuedAt;
+    if (!authorityId || !deliveryId || typeof issuedAt !== "number" || !Number.isFinite(issuedAt))
+        return undefined;
+    return { authorityId, deliveryId, issuedAt };
+}
+export function signNotionIngressDrainBody(secret, body) {
+    return `sha256=${createHmac("sha256", secret).update(body, "utf8").digest("hex")}`;
+}
+async function drainSecret(injected) {
+    if (injected !== undefined)
+        return injected;
+    if (!selfSecretsArmed())
+        return undefined;
+    return getOrMintSelfSecret(NOTION_INGRESS_DRAIN_SECRET_ENV);
+}
+/** Cheap public-ACK precondition: recovery can authenticate and reach this deployment. */
+export function notionIngressDrainAvailable() {
+    return selfSecretsArmed() && selfDispatchBaseUrl() !== undefined;
+}
+/** Authenticate an internal row-key request and atomically claim its exact org-scoped row. */
+export async function acceptNotionIngressDrainRequest(req, deps) {
+    const read = await readCappedBody(req, NOTION_INGRESS_DRAIN_MAX_BODY_BYTES);
+    if ("tooLarge" in read)
+        return { response: new Response("payload too large", { status: 413 }) };
+    const secret = await drainSecret(deps.secret);
+    if (!secret)
+        return { response: new Response("not found", { status: 404 }) };
+    if (!verifyWebhookSignature(secret, read.body, req.headers.get(NOTION_INGRESS_DRAIN_SIGNATURE_HEADER))) {
+        return { response: new Response("unauthorized", { status: 401 }) };
+    }
+    let envelope;
+    try {
+        envelope = parseEnvelope(JSON.parse(read.body));
+    }
+    catch {
+        // handled below
+    }
+    if (!envelope)
+        return { response: new Response("bad request", { status: 400 }) };
+    const now = (deps.now ?? (() => new Date()))();
+    if (Math.abs(now.getTime() - envelope.issuedAt) > NOTION_INGRESS_DRAIN_MAX_SKEW_MS) {
+        return { response: new Response("unauthorized", { status: 401 }) };
+    }
+    const key = {
+        source: NOTION_INGRESS_SOURCE,
+        authorityId: envelope.authorityId,
+        deliveryId: envelope.deliveryId,
+    };
+    const staleBefore = new Date(now.getTime() - NOTION_INGRESS_LEASE_MS).toISOString();
+    const claim = await deps.store.claimIngressDelivery(deps.org, key, (deps.claimId ?? randomUUID)(), now.toISOString(), staleBefore);
+    // A duplicate nudge, active lease or completed tombstone is already safely represented in the
+    // store. Return 200 so the self-client does not amplify it; the minute scan handles stale work.
+    if (!claim)
+        return { response: new Response("ok", { status: 200 }) };
+    const payload = decodeNotionIngressPayload(claim.payloadJson);
+    if (!payload) {
+        await deps.store.releaseIngressDelivery(deps.org, key, claim.claimId, new Date(now.getTime() + NOTION_INGRESS_RETRY_MS).toISOString());
+        return { response: new Response("stored payload invalid", { status: 500 }) };
+    }
+    return {
+        accepted: {
+            key,
+            claim,
+            rawBody: JSON.stringify(payload.event),
+            signerCredentialId: key.authorityId,
+        },
+    };
+}
+/** Finish one primary claim according to the processor's explicit semantic result. */
+export async function settleNotionIngressDrain(accepted, disposition, deps) {
+    const now = (deps.now ?? (() => new Date()))();
+    if (disposition === "discard") {
+        await deps.store.discardIngressDelivery(deps.org, accepted.key, accepted.claim.claimId);
+        return;
+    }
+    if (disposition === "retry") {
+        await deps.store.releaseIngressDelivery(deps.org, accepted.key, accepted.claim.claimId, new Date(now.getTime() + NOTION_INGRESS_RETRY_MS).toISOString());
+        return;
+    }
+    await deps.store.completeIngressDelivery(deps.org, accepted.key, accepted.claim.claimId, now.toISOString(), new Date(now.getTime() + NOTION_INGRESS_TOMBSTONE_MS).toISOString());
+}
+/**
+ * A comment-level guard for the crash seam between "accepted by Eve" and primary-row completion.
+ * Its lease is deliberately the same length as the primary retry delay: a retry never mistakes an
+ * active pre-dispatch lease for a completed duplicate. A stale lease is stolen and may duplicate
+ * after an ambiguous post-dispatch crash, which is the honest at-least-once side of the choice.
+ */
+export function createNotionCommentDispatchGuard(input) {
+    let held;
+    return {
+        async claim(commentId) {
+            const now = (input.now ?? (() => new Date()))();
+            const key = {
+                source: NOTION_COMMENT_DISPATCH_SOURCE,
+                authorityId: NOTION_COMMENT_DISPATCH_AUTHORITY,
+                deliveryId: commentId,
+            };
+            await input.store.enqueueIngressDelivery(input.org, {
+                ...key,
+                payloadJson: JSON.stringify({ schemaVersion: 1 }),
+                receivedAt: now.toISOString(),
+            });
+            const claim = await input.store.claimIngressDelivery(input.org, key, (input.claimId ?? randomUUID)(), now.toISOString(), new Date(now.getTime() - NOTION_INGRESS_LEASE_MS).toISOString());
+            if (!claim)
+                return false;
+            held = { key, claimId: claim.claimId };
+            return true;
+        },
+        async complete(commentId) {
+            if (!held || held.key.deliveryId !== commentId)
+                throw new Error("Notion dispatch guard was not claimed");
+            const now = (input.now ?? (() => new Date()))();
+            const completed = await input.store.completeIngressDelivery(input.org, held.key, held.claimId, now.toISOString(), new Date(now.getTime() + NOTION_COMMENT_DISPATCH_TOMBSTONE_MS).toISOString());
+            if (!completed)
+                throw new Error("Notion dispatch guard completion lost its lease");
+            held = undefined;
+        },
+    };
+}
+/** Post one content-free row key to this deployment's private drain route. */
+export async function postNotionIngressDrain(key, deps = {}) {
+    const base = deps.baseUrl ?? selfDispatchBaseUrl();
+    const secret = await drainSecret(deps.secret);
+    if (!base || !secret)
+        throw new Error("Notion ingress drain is unavailable");
+    const body = JSON.stringify({
+        authorityId: key.authorityId,
+        deliveryId: key.deliveryId,
+        issuedAt: (deps.now ?? (() => new Date()))().getTime(),
+    });
+    const response = await (deps.fetchImpl ?? fetch)(`${base}${NOTION_INGRESS_DRAIN_PATH}`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            [NOTION_INGRESS_DRAIN_SIGNATURE_HEADER]: signNotionIngressDrainBody(secret, body),
+        },
+        body,
+        signal: AbortSignal.timeout(20_000),
+    });
+    if (!response.ok)
+        throw new Error(`Notion ingress drain returned ${response.status}`);
+}
+/** One recovery tick. A failed self-hop leaves the row pending for the next minute. */
+export async function recoverNotionIngress(org, store, deps = {}) {
+    const now = (deps.now ?? (() => new Date()))();
+    const due = await store.listDueIngressDeliveries(org, NOTION_INGRESS_SOURCE, now.toISOString(), new Date(now.getTime() - NOTION_INGRESS_LEASE_MS).toISOString(), NOTION_INGRESS_DRAIN_BATCH);
+    const results = await Promise.allSettled(due.map((key) => postNotionIngressDrain({
+        source: NOTION_INGRESS_SOURCE,
+        authorityId: key.authorityId,
+        deliveryId: key.deliveryId,
+    }, deps)));
+    const posted = results.filter((result) => result.status === "fulfilled").length;
+    return { due: due.length, posted, failed: due.length - posted };
+}
+//# sourceMappingURL=notion-ingress-drain.js.map

package/dist/agent/channels/notion-ingress-drain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion-ingress-drain.js","sourceRoot":"","sources":["../../../agent/channels/notion-ingress-drain.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,mGAAmG;AACnG,+FAA+F;AAC/F,8DAA8D;AAE9D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,GAIvB,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,0BAA0B,EAAE,qBAAqB,EAAyB,MAAM,qBAAqB,CAAC;AAE/G,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAChE,MAAM,CAAC,MAAM,qCAAqC,GAAG,6BAA6B,CAAC;AACnF,MAAM,+BAA+B,GAAG,gCAAgC,CAAC;AACzE,MAAM,CAAC,MAAM,8BAA8B,GAAG,yBAAyB,CAAC;AACxE,kGAAkG;AAClG,iGAAiG;AACjG,MAAM,CAAC,MAAM,iCAAiC,GAAG,QAAQ,CAAC;AAC1D,MAAM,uBAAuB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC3C,MAAM,uBAAuB,GAAG,uBAAuB,GAAG,KAAK,CAAC;AAChE,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AACrD,MAAM,oCAAoC,GAAG,EAAE,GAAG,MAAM,CAAC;AACzD,MAAM,mCAAmC,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,gCAAgC,GAAG,CAAC,GAAG,MAAM,CAAC;AACpD,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAgCtC,SAAS,QAAQ,CAAC,KAAc,EAAE,GAAG,GAAG,GAAG;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAChH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAc,EAAE,IAAY;IACrE,OAAO,UAAU,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAiB;IAC1C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,IAAI,CAAC,gBAAgB,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;AAC9D,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,2BAA2B;IACzC,OAAO,gBAAgB,EAAE,IAAI,mBAAmB,EAAE,KAAK,SAAS,CAAC;AACnE,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,GAAY,EACZ,IAAkC;IAElC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;IAC5E,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAChG,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC7E,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC;QACvG,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,QAAmC,CAAC;IACxC,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACjF,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,gCAAgC,EAAE,CAAC;QACnF,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,GAAG,GAA0B;QACjC,MAAM,EAAE,qBAAqB;QAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAC;IACpF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CACjD,IAAI,CAAC,GAAG,EACR,GAAG,EACH,CAAC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,EAC9B,GAAG,CAAC,WAAW,EAAE,EACjB,WAAW,CACZ,CAAC;IACF,8FAA8F;IAC9F,gGAAgG;IAChG,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CACrC,IAAI,CAAC,GAAG,EACR,GAAG,EACH,KAAK,CAAC,OAAO,EACb,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAChE,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO;QACL,QAAQ,EAAE;YACR,GAAG;YACH,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;YACtC,kBAAkB,EAAE,GAAG,CAAC,WAAW;SACpC;KACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAoC,EACpC,WAAqC,EACrC,IAAiE;IAEjE,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAC/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxF,OAAO;IACT,CAAC;IACD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CACrC,IAAI,CAAC,GAAG,EACR,QAAQ,CAAC,GAAG,EACZ,QAAQ,CAAC,KAAK,CAAC,OAAO,EACtB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAChE,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,CACtC,IAAI,CAAC,GAAG,EACR,QAAQ,CAAC,GAAG,EACZ,QAAQ,CAAC,KAAK,CAAC,OAAO,EACtB,GAAG,CAAC,WAAW,EAAE,EACjB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,2BAA2B,CAAC,CAAC,WAAW,EAAE,CACpE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAKhD;IACC,IAAI,IAA8D,CAAC;IACnE,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,SAAS;YACnB,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,GAAG,GAAuB;gBAC9B,MAAM,EAAE,8BAA8B;gBACtC,WAAW,EAAE,iCAAiC;gBAC9C,UAAU,EAAE,SAAS;aACtB,CAAC;YACF,MAAM,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClD,GAAG,GAAG;gBACN,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;gBACjD,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;aAC9B,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAClD,KAAK,CAAC,GAAG,EACT,GAAG,EACH,CAAC,KAAK,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,EAC/B,GAAG,CAAC,WAAW,EAAE,EACjB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAChE,CAAC;YACF,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,SAAS;YACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACzG,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,uBAAuB,CACzD,KAAK,CAAC,GAAG,EACT,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,OAAO,EACZ,GAAG,CAAC,WAAW,EAAE,EACjB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,oCAAoC,CAAC,CAAC,WAAW,EAAE,CAC7E,CAAC;YACF,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACnF,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AASD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAA0B,EAC1B,IAAI,GAA+B,EAAE;IAErC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,mBAAmB,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE;KAC/B,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,GAAG,yBAAyB,EAAE,EAAE;QACtF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,CAAC,qCAAqC,CAAC,EAAE,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC;SAClF;QACD,IAAI;QACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,KAAuB,EACvB,IAAI,GAA+D,EAAE;IAErE,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAC9C,GAAG,EACH,qBAAqB,EACrB,GAAG,CAAC,WAAW,EAAE,EACjB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,uBAAuB,CAAC,CAAC,WAAW,EAAE,EAC/D,0BAA0B,CAC3B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,sBAAsB,CAAC;QAC/E,MAAM,EAAE,qBAAqB;QAC7B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACX,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IAChF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;AAClE,CAAC"}