@open-everywhere/provider-notion 0.1.0

package/dist/agent/channels/notion-supervisor.js

@@ -0,0 +1,482 @@
+// The Notion ambient supervisor — the eve-FREE tested core that turns every comment on a
+// connected doc into a JUDGED wake to a standing per-doc supervisor session (the "agent lives in
+// the doc" UX, notion-ambient-surface-design.md). It is the first NON-Slack adopter of the
+// surface-general ambient-supervision pattern (surface-adapter-port.md §"Ambient supervision
+// everywhere"), so it is deliberately THIN and mirrors the Slack routeSupervisorEvent shape
+// (slack-events.ts) — GitHub/Linear copy this file next.
+//
+// WHAT'S REUSED WHOLESALE (zero Notion-specific logic in any of it):
+//   • renderWake + the channel-watch preamble (the judge) — normalized-wake.ts
+//   • shouldRotate — the pure rotation policy — slack-events.ts
+//   • the (org, surfaceKey) channel_session registry + the :oe-sup:g spend counter — via deps
+// WHAT'S NEW (this file): the supervisor token/sentinel carrying the :oe-sup:g infix, a pure
+// classifier (self / bot / unresolved-fail-closed / @mention / ambient), the NormalizedWake
+// builder, and the dispatch-core (session get-or-create → build → wake).
+//
+// The Notion doc-session is the container-session's ORCHESTRATION HALF ONLY (surface-adapter-port
+// §"container session"): a page-scoped standing session aware of all the doc's discussions,
+// holding page memory, that judges every comment and replies into the triggering discussion.
+// There is NO container-conversation half — a Notion doc has no top-level conversation to post to.
+import { spreadVendorTs, renderWake, mkMessageTrigger, shouldRotate, mintWakeId, singleWindowMentionPolicy, matchesAgentName, stampNonMemberChatAuth, resolveExternalPolicy, withholdsBody, withholdWakeBodies, ingestedAfterWithholding, tailAuthorGrain, seatCatchUpSinceMs, engagedFollowUpContract, } from "@open-everywhere/core/agent/adapter-api.js";
+import { mentionsUser, richTextToPlainText } from "./notion-api.js";
+// The §2.5 engagement writer (OPE-1501). A VALUE import, not a type — the dispatch core calls it as
+// the default for `NotionSupervisorDeps.markEngaged`. `notion-engagement.ts` imports only
+// `notion-identity.ts` and core, so this adds no cycle.
+import { markNotionEngaged } from "./notion-engagement.js";
+/** The catch-up's REACHBACK FLOOR (hours): how far back a seat that has been quiet for a long time
+ *  reads. 7 days, the same floor every other surface uses. */
+const NOTION_CATCH_UP_REACHBACK_HOURS = 168;
+// --- supervisor token / sentinel (carry the :oe-sup:g infix — load-bearing) ----------
+//
+// hooks/spend.ts isSupervisorToken keys off the `:oe-sup:g` substring to (a) tag the usage-event
+// `kind="supervisor"` and (b) drive the per-generation cumulative-token rotation counter. Carry
+// the infix and the ENTIRE cost/rotation apparatus works for free (design §3.1). The sentinel
+// mirrors Slack's; the token puts the pageId in the channel-id slot, `notion:`-namespaced.
+/** The reserved pseudo-thread sentinel for a supervisor generation (mirrors Slack's). */
+export function notionSupervisorSentinel(generation) {
+    return `oe-sup:g${generation}`;
+}
+/** The reserved continuation token for a page's supervisor session at a given generation:
+ *  `notion:<pageId>:oe-sup:g<generation>`. Contains the `:oe-sup:g` infix hooks/spend.ts keys on,
+ *  and is stable+explicit by construction (a custom-channel token eve never re-anchors — so,
+ *  UNLIKE Slack, no non-empty state.threadTs re-anchor sentinel is needed; design §3.1). */
+export function notionSupervisorToken(pageId, generation) {
+    return `notion:${pageId}:${notionSupervisorSentinel(generation)}`;
+}
+/**
+ * The Notion synthetic-mention (name-drop) convention. Notion CANNOT @mention an internal
+ * integration (notion-webhook.ts — the structured `mentionsUser` path is STRUCTURALLY DEAD for the
+ * agent), so a person addresses the doc agent by NAME instead: the deployment's configured names
+ * (OE_AGENT_NAME / OE_AGENT_SHORT_NAME, defaulting to the brand "open everywhere" / "oe" when unset)
+ * or the platform-resolved integration name (botName). This is the ONLY ambient-INDEPENDENT directed
+ * input Notion has, so — unlike Slack/GitHub/Linear, where a name-drop stays a judged input because a
+ * real @mention is available — here it is promoted to `direct`.
+ *
+ * The name set + word-boundary matcher live in core (identity/bot-name.ts matchesAgentName), which
+ * is ALSO what the addressed link-claim recogniser strips its leading token with (hooks/link-claim.ts)
+ * — one source of truth for "what does this agent answer to". Word-boundary matched (`\b`) so the
+ * short "oe" token never fires inside "Zoe"/"poet"/"does". A hit flows through the SAME seam a real
+ * @mention would: planNotionSingleWindow stamps `direct-mention`, which marks the wake as OWED a
+ * reply and tells the seat so. 🔴 THE STAMP DELIVERS NOTHING BY ITSELF (OPE-1982): the terminal-prose
+ * bridge it used to arm is deleted, so the reply lands via createCommentReply only when the seat
+ * calls `reply` — on its own turn, or on the ONE corrective re-drive a prose ending earns.
+ */
+export function notionNameDrop(text, botName) {
+    return matchesAgentName(text, botName);
+}
+/**
+ * Decide how the doc supervisor should treat one comment. The self-reply loop guard is HARDENED
+ * here (design §4.2), in cost order:
+ *  1. UNRESOLVED PRIMARY bot user id ⇒ DROP (fail closed) — self-identity is a precondition for the
+ *     loop guard; without it the agent would loop on its own replies (each createCommentReply fires a
+ *     fresh comment.created). This is the critical hardening over the old `if (botUserId && …)`.
+ *  2. SELF-authored ⇒ DROP — our own posted reply. The comparison is `created_by.id` against
+ *     {@link NotionOwnBotIds.all}: EVERY configured integration's bot user id, not only the one that
+ *     verified this delivery (OPE-1921). THAT IS THE WHOLE GUARD.
+ *     🔴 THE SET IS WHAT MAKES IT A GUARD ON A DEPLOYMENT RATHER THAN ON ONE INTEGRATION. Two
+ *     integrations can both see one page, so a reply integration A posted is delivered on B's
+ *     subscription too. Compared against B's id alone it matched nothing, read as a person and woke
+ *     a turn; A's subscription then saw B's answer. Each reply is a NEW comment id, so the OPE-1906
+ *     once-guard cannot bound that loop — only recognising our own words can.
+ *  3. UNIDENTIFIED AUTHOR (no `created_by.id`) ⇒ DROP (fail closed) — step 2 is the only check that
+ *     can recognise our own words, so a comment whose author id we cannot read defeats it.
+ *     🔴 WITHOUT THIS STEP THE GUARD FALLS BACK ON `created_by.type`, A FIELD NOTION MAY OMIT
+ *     (OPE-1857, notion-api.ts NotionComment): a comment's `created_by` is a PARTIAL user, so an
+ *     id-less author reached step 4 with nothing to test, read as a person, and woke a turn. That
+ *     is the same fail-closed posture step 1 takes for the other half of the comparison — an
+ *     identity we cannot establish never wakes the agent, in EITHER direction.
+ *  4. BOT/integration-authored (created_by.type present and not "person") ⇒ DROP — the Slack
+ *     authorIsBot analog, prevents bot-to-bot loops. A BACKSTOP for a foreign bot, never the
+ *     self-guard: an ABSENT `type` says nothing, and steps 2-3 have already answered "is it ours".
+ *  5. INCOMPLETE OWN-ID SET ⇒ DROP (fail closed, OPE-1921) — one configured integration's bot user
+ *     id did not resolve, so step 2 could not have recognised that integration's own reply. An
+ *     author Notion states is a `person` is still admitted; an author it says NOTHING about is
+ *     exactly the ambiguity the loop rides, so it drops.
+ *     🔴 IT COSTS AVAILABILITY AND THE TRADE IS DELIBERATE — see {@link NotionOwnBotIds.complete}.
+ *     A deployment that cannot resolve one integration's id is deaf to every comment Notion does not
+ *     mark `person`-authored until it can. 🔴 THAT IS NOT ONLY AMBIENT CHATTER: this step sits ABOVE
+ *     steps 6 and 7, so an addressed structured @mention, an addressed name-drop and an
+ *     `oe link <code>` identity claim all drop with it. Failing OPEN instead buys an unbounded reply
+ *     loop between two of our own integrations, which no once-guard can stop.
+ *  6. STRUCTURED bot @mention ⇒ direct (guaranteed engage). Structurally unreachable for an
+ *     internal integration today, but kept as the canonical addressed signal. Tested against the
+ *     PRIMARY id alone: a structured mention names ONE bot user, and answering a mention of a
+ *     sibling integration would put this integration in a conversation it was not addressed in.
+ *  7. NAME-DROP ⇒ direct ({@link notionNameDrop}). Notion's ONLY addressed path (no integration
+ *     @mention), so a brand/name hit is promoted to the owed-a-reply treatment, not left as a
+ *     judged input — this is the deliberate Notion-specific divergence from Slack/GitHub/Linear.
+ *  8. otherwise ⇒ channel-watch (judged by the standing doc supervisor).
+ *
+ * 🔴 THIS FUNCTION GUARDS ONE COMMENT, NOT ONE WAKE. It cannot tell a second delivery of the SAME
+ * comment from the first, because both carry identical bytes. The delivery once-guard is the other
+ * half of the loop defence and lives at the ingress
+ * (notion-engagement.ts `firstNotionDispatchOfComment`, called by notion-webhook.ts).
+ */
+export function classifyNotionComment(comment, own, botName) {
+    if (!own.primary)
+        return { addressing: "drop", reason: "unresolved bot user id — fail-closed loop guard" };
+    const author = comment.created_by;
+    if (author?.id !== undefined && own.all.has(author.id)) {
+        // The two are named apart because they send an operator to different places: our own reply
+        // coming back is ordinary, and a SIBLING integration's reply arriving here is the OPE-1921
+        // delivery shape — the one that used to wake a turn.
+        const sibling = author.id !== own.primary;
+        return { addressing: "drop", reason: sibling ? "self-authored comment (a sibling integration of this deployment)" : "self-authored comment (our own reply)" };
+    }
+    if (!author?.id)
+        return { addressing: "drop", reason: "unidentified author (no created_by.id) — fail-closed loop guard" };
+    if (author.type && author.type !== "person")
+        return { addressing: "drop", reason: `bot/integration-authored (${author.type})` };
+    if (!own.complete && author.type !== "person") {
+        return { addressing: "drop", reason: "a configured integration's bot user id did not resolve, and this author is unattributable — fail-closed loop guard" };
+    }
+    if (mentionsUser(comment.rich_text, own.primary))
+        return { addressing: "direct", reason: "structured bot @mention" };
+    if (notionNameDrop(richTextToPlainText(comment.rich_text), botName)) {
+        return { addressing: "direct", reason: "bot name-drop (synthetic mention — Notion has no @mention for integrations)" };
+    }
+    return { addressing: "channel-watch", reason: "ambient comment — judged by the doc supervisor" };
+}
+/**
+ * The ONE single-window decision for a Notion delivery (channels/unified-window.ts
+ * singleWindowMentionPolicy is the SHARED seam — the exact function the GitHub reference's
+ * native-suppression AND classifier consult, github.ts:261 / github-supervisor.ts:139): given
+ * the grain's `singleWindow`, whether the classified comment is a structured @mention
+ * (classifyNotionComment returned `direct`), and the PRIVACY FLOOR `privacyOk`, return the
+ * {@link UnifiedWindowWake} the dispatch should carry, or undefined for the byte-identical
+ * native path.
+ *
+ * `privacyOk` is the OPERATOR-VOUCH fact the caller resolves (notion.ts): identity/trust.ts
+ * isVouchedInternal on the page's workspaceKey/surfaceKey (or the OE_TRUST=internal blanket
+ * switch), fail-closed when unregistered. This is the SAME per-surface allowlist that gates
+ * Notion's shared MEMORY (notion-identity.ts / bindNotion), so a page is admitted to the shared
+ * cross-surface WINDOW exactly when the operator has vouched it internal — never inferred from a
+ * misleading API field (a Notion page's `public_url` is set ONLY by publish-to-web and is null
+ * for the common guest-shared vector, so it would admit an external guest's mention; the vouch
+ * register is the doctrine-correct floor — operator vouches, code enforces, no inference).
+ *
+ * Notion's mention signal lives in ONE webhook delivery (unlike Slack's dual-event), and its
+ * "native" handler IS this same supervisor dispatch — so suppress-native and divert are the SAME
+ * act here: a window-carrying wake is delivered through the unified channel instead of the notion
+ * channel's own send (notion.ts's wake dep), and both legs read THIS one verdict off the one
+ * parsed event — structurally never a double-handle, never a gap:
+ *   • @mention on a singleWindow, VOUCHED-internal page → the seam suppresses the native session
+ *     and stamps `addressing:"direct-mention"` (the terminal-prose delivery bridge's arm);
+ *   • ambient (channel-watch) comment on the same page → Leg A: the window WITHOUT the addressed
+ *     stamp (judged treatment in the shared window, prose stays hard-dropped);
+ *   • un-vouched page, or singleWindow off, or no discussion id → undefined (the native
+ *     per-doc/domain path, byte-identical — a mention there keeps today's `direct` wake).
+ */
+export function planNotionSingleWindow(singleWindow, isMention, privacyOk, target) {
+    const policy = singleWindowMentionPolicy(singleWindow, isMention, privacyOk);
+    // A mention diverts iff the seam suppresses the native session; an ambient comment diverts on
+    // the same `singleWindow && privacyOk` floor (Leg A — never a public/unknown page into the
+    // shared window). Both derive from the seam's one predicate.
+    const divert = isMention ? policy.suppressNative : singleWindow && privacyOk;
+    if (!divert)
+        return undefined;
+    if (!target.discussionId)
+        return undefined; // no frozen reply target ⇒ no window (fail closed)
+    return {
+        wakeId: mintWakeId(),
+        origin: {
+            platform: "notion",
+            discussionId: target.discussionId,
+            ...(target.pageId ? { pageId: target.pageId } : {}),
+            ...(target.workspaceId ? { workspaceId: target.workspaceId } : {}),
+            ...(target.credentialId ? { credentialId: target.credentialId } : {}),
+        },
+        // ADDRESSED @mention ⇒ the seam's stamp marks the wake as OWED a reply, so the envelope tells
+        // the seat it owes an answer through the `reply` tool. Ambient wakes omit it. It is not a delivery
+        // path: a turn that ends in prose is dropped and re-driven once, on every addressing (OPE-1982).
+        ...(policy.addressing !== undefined ? { addressing: policy.addressing } : {}),
+        ...spreadVendorTs(target.vendorTs),
+    };
+}
+function toWakeSibling(m) {
+    return {
+        from: m.from,
+        author: m.authorId ?? (m.from === "self" ? "the doc agent" : "unknown"),
+        authorId: m.authorId,
+        id: m.id,
+        sentAt: m.sentAt,
+        trust: m.trust,
+        body: m.text,
+    };
+}
+/**
+ * Build the NormalizedWake for one doc-supervisor turn. platform "notion", containerNoun "doc",
+ * locus.channel = the page, locus.thread = the discussion, backscroll = the discussion's other
+ * comments as oldest-first envelope siblings, ending at the triggering comment. renderWake then
+ * emits the exact `{message, context}` shape every OE dispatch sends — the SAME renderer Slack
+ * uses, with NO platform branch. A `direct` wake carries no preamble/backscroll (the body is the
+ * driver, verbatim); a `channel-watch` wake gets the judged envelope + doc-noun preamble.
+ */
+export function buildNotionSupervisorWake(input) {
+    // SINGLE-WINDOW addressed @mention: an ENVELOPED render (wake-id + backscroll survive — the
+    // reply tool needs the id) with the addressed preamble. Guarded on `direct` so the flag can
+    // never re-shape a channel-watch wake; unset ⇒ today's renders, byte-identical.
+    const directMention = input.directMention === true && input.addressing === "direct";
+    const judged = input.addressing === "channel-watch";
+    const enveloped = judged || directMention;
+    // The carried TAIL leads, then this wake's own thread comments — one oldest-first list that
+    // reads straight across the rotation boundary (OPE-794).
+    const backscroll = enveloped ? [...(input.tail ?? []), ...(input.threadComments ?? []).map(toWakeSibling)] : undefined;
+    return {
+        platform: "notion",
+        reason: input.addressing === "direct" ? "mention" : "channel-activity",
+        addressing: directMention ? "direct-mention" : input.addressing,
+        containerNoun: "doc",
+        // The ambient calibration dial — an addressed mention is owed an answer, so watch-only.
+        engagementTier: judged ? input.engagementTier : undefined,
+        // The ENROLMENT fact ({@link NotionSupervisorWakeInput.threadEngaged}), through the ONE shared
+        // helper every enveloped surface now calls (channels/engaged-wake.ts, OPE-1740). It keeps both
+        // exclusions this line used to spell out: an addressed comment is owed an answer whatever the
+        // page's enrolment says, and a `direct` wake carries no envelope to hang an attribute on.
+        followUp: engagedFollowUpContract({
+            addressing: directMention ? "direct-mention" : input.addressing,
+            threadEngaged: input.threadEngaged,
+        }),
+        // Single-window wake id — only the singleWindow dispatch passes it (byte-identical off).
+        wakeId: input.wakeId,
+        locus: {
+            channel: { id: input.pageId },
+            thread: { ts: input.discussionId },
+        },
+        backscroll,
+        ...(input.catchUpUnavailable !== undefined ? { catchUpUnavailable: input.catchUpUnavailable } : {}),
+        trigger: mkMessageTrigger({
+            from: input.trigger.from,
+            author: input.trigger.authorId ?? "unknown",
+            authorId: input.trigger.authorId,
+            id: input.trigger.id,
+            sentAt: input.trigger.sentAt,
+            // The caller's stated per-person tier — no default (OPE-596). Directness is the `mention`
+            // flag below, never a trust tier.
+            trust: input.trigger.trust,
+            mention: input.addressing === "direct",
+            body: input.trigger.text,
+        }),
+    };
+}
+/**
+ * THE INGESTED SET for one Notion wake, graded for the non-member taint join (OPE-466 / OPE-516).
+ *
+ * 🔴 NOTION HAD NO AUTHOR LEG AT ALL BEFORE OPE-516, and it could not have had one. The join's
+ * `refuted` field is the SURFACE's positive refutation — Slack's `is_restricted`, Teams' Entra
+ * `userType: "guest"` — and Notion publishes NO membership fact about a comment author. So the
+ * question is answered from the operator's own AUTHOR-TRUST REGISTER instead
+ * (identity/author-trust.ts): on a workspace the operator has armed, an author they did not declare
+ * grades `external`. On an unarmed workspace the leg contributes nothing and this is a no-op.
+ *
+ * `refuted` is deliberately never set here. Leaving it absent is the honest statement — Notion has
+ * no verdict to give, and a hardcoded `false` would read as "we asked and it was fine".
+ *
+ * NOTION HAS NO GROUP CONCEPT, so no memberships are contributed and a Notion declaration is
+ * principal-keys-only. That is a platform fact, not a gap in this function.
+ *
+ * A `self` author (the bot's own prior comment) carries no `authorId` from the webhook core, and its
+ * resolved tier is the machine floor, so it can never reach the register leg — the join requires a
+ * positively-human tier.
+ *
+ * Pure and exported so the grading is testable without a store or a live wake.
+ */
+export function notionIngestedMessages(d) {
+    // No workspace id ⇒ no tenant key can be composed ⇒ no author question can be asked. Fail OPEN,
+    // matching every other carriage leg: an unnameable tenant is not evidence of anything.
+    const tenantKey = d.workspaceId ? `notion/${d.workspaceId}` : undefined;
+    const grade = (m) => ({
+        ...(m.trust === undefined ? {} : { trust: m.trust }),
+        ...(tenantKey === undefined ? {} : { authorTrust: { tenantKey, ...(m.authorId === undefined ? {} : { authorId: m.authorId }) } }),
+    });
+    return [grade(d.trigger), ...d.threadComments.map(grade)];
+}
+/**
+ * THE EXTERNAL-AUTHOR DECISION for one Notion dispatch (OPE-507). Pure, exported so the three
+ * behaviours are testable without a store or a live wake.
+ *
+ * Notion's three answers, and why they are what they are:
+ *   • the TRIGGER's author is excluded ⇒ NO WAKE AT ALL (`suppressed`). That covers behaviour 2
+ *     (ambient never triggers on their comment) and behaviour 1 (their @mention is not acted on).
+ *   • a SIBLING's author is excluded ⇒ the wake proceeds and that sibling's body is WITHHELD
+ *     (behaviour 3): a permitted member's later comment still wakes the agent, and the excluded
+ *     author's earlier comment reaches the model as the arrived-marker.
+ *   • nothing is excluded, or the policy is `taint` ⇒ `withheldIds` is empty and every caller path
+ *     is byte-identical to before this existed.
+ *
+ * 🔴 NOTION POSTS NO PRIVATE NOTICE, AND THAT IS DELIBERATE. Behaviour 1 owes the excluded sender a
+ * PRIVATE notice, and Notion has no private channel back to a commenter — a comment reply lands in
+ * the shared discussion, where everyone reading the doc sees it. Announcing "I will not act on your
+ * message" into a shared doc is a disclosure, not a notice, so the Notion answer is to do nothing.
+ * The surfaces that HAVE a private channel (a Discord DM, a Slack DM) post the notice there.
+ */
+export function notionExternalAuthorDecision(d) {
+    // `ingested` is built by notionIngestedMessages in EXACTLY this order — trigger first, then the
+    // siblings — so the index join below is the same pairing the taint carriage already relies on.
+    const ordered = [d.trigger, ...d.threadComments];
+    const withheldIds = new Set();
+    let suppressed = false;
+    for (const [i, m] of ordered.entries()) {
+        const facts = d.ingested[i];
+        if (facts === undefined || !withholdsBody(facts, d.policy))
+            continue;
+        if (i === 0)
+            suppressed = true;
+        else
+            withheldIds.add(m.id);
+    }
+    return { suppressed, withheldIds };
+}
+/**
+ * Route one classified comment to the doc supervisor: get-or-create the session, build + render
+ * the wake for that generation, deliver it, and stash the triggering discussion on the session
+ * state so `message.completed` replies into the right thread.
+ *
+ * A DELIVERY failure (the send itself) propagates to the caller's catch. A session that dies at
+ * TURN time does not: nothing here observes it, so the trigger is lost SILENTLY, and no reactive
+ * arm can exist (OPE-174 removed the inert one; channels/session-resume.ts holds the measurement).
+ * The working remedy is PRE-DISPATCH — the live `getOrCreateSession` claims the OPE-599
+ * runtime-change rotation before this call and hands back a session the running eve build can read.
+ */
+/** The default {@link NotionSupervisorDeps.markEngaged}: the dispatch's own facts, in the seam's
+ *  vocabulary. One derivation, so the row this writes is the row `notion-engagement.ts` reads and
+ *  `stand_down` marks. */
+async function liveNotionEngagementMark(d) {
+    const facts = {
+        workspaceId: d.workspaceId ?? undefined,
+        pageId: d.pageId,
+        ...(d.trigger.authorId ? { principalId: d.trigger.authorId } : {}),
+        ...(d.credentialId ? { credentialId: d.credentialId } : {}),
+    };
+    // The TRIGGER COMMENT's own id is the guard key: Notion redelivers a comment this route answered
+    // with a 500 (an uncaught throw below this mark), and a redelivered name-drop must not lift a
+    // stand-down made in between. See `markNotionEngaged`.
+    await markNotionEngaged(facts, d.trigger.id);
+}
+export async function handleNotionSupervisorDispatch(d, deps) {
+    const atIso = deps.now ? deps.now() : new Date().toISOString();
+    // THE EXTERNAL-AUTHOR POLICY (OPE-507). Resolved once, ABOVE the session get-or-create: a
+    // suppressed wake must not mint a generation, touch a session or spend a rotation budget on a
+    // message the agent is not going to read. Absent policy ⇒ the org default ⇒ `taint` ⇒ this whole
+    // block is inert and every line below runs exactly as it did.
+    const policy = d.externalPolicy ?? resolveExternalPolicy();
+    const ingested = notionIngestedMessages(d);
+    const external = notionExternalAuthorDecision({ trigger: d.trigger, threadComments: d.threadComments, ingested, policy });
+    if (external.suppressed)
+        return; // the trigger's author may not task the agent — no wake, no notice (see above)
+    // 🔴 THE §2.5 MARK (OPE-1501) — an ADDRESSED wake ENROLS the page, and this is the FIRST line at
+    // which that is safe: the external-author decision above is Notion's author gate, and it is made
+    // here rather than at the ingress. `participating: true` inside the writer is the re-invitation,
+    // so naming the agent again clears a previous stand-down — which is exactly why a suppressed
+    // author must never reach this line. Best-effort: the writer swallows a store failure, because
+    // engagement bookkeeping must never fail a turn.
+    if (d.addressing === "direct")
+        await (deps.markEngaged ?? liveNotionEngagementMark)(d);
+    const session = await deps.getOrCreateSession(d.surfaceKey, d.pageId, atIso);
+    // `oeUnified` marks a session CREATED as the domain session (eve applies send-state at creation
+    // only, and a session's grain is fixed for its lifetime — the token shape can't change mid-gen),
+    // so notion.ts's message-tool-only gate keys on it. Absent on the per-doc path (byte-identical).
+    const state = {
+        discussionId: d.discussionId || null,
+        pageId: d.pageId || null,
+        workspaceId: d.workspaceId,
+        ...(d.unified ? { oeUnified: true } : {}),
+    };
+    // The "changed since your last wake" PUSH — computed ONCE from THIS session's cursor (its previous
+    // wake time), naming which shared-memory silos changed. Only when armed (deps.memoryDelta present)
+    // AND a prior wake exists (session.lastWakeAt); fail-soft (a delta failure never breaks the wake).
+    let memoryDelta;
+    if (deps.memoryDelta && session.lastWakeAt) {
+        try {
+            memoryDelta = (await deps.memoryDelta(session.lastWakeAt, atIso, session.token)) ?? undefined;
+        }
+        catch {
+            memoryDelta = undefined;
+        }
+    }
+    const doWake = async (token, generation, tail, catchUpUnavailable) => {
+        const built = {
+            ...buildNotionSupervisorWake({
+                addressing: d.addressing,
+                pageId: d.pageId,
+                discussionId: d.discussionId,
+                trigger: d.trigger,
+                threadComments: d.threadComments,
+                engagementTier: d.engagementTier,
+                wakeId: d.window?.wakeId,
+                directMention: d.directMention,
+                threadEngaged: d.engagedFollowUp,
+                tail,
+                catchUpUnavailable,
+            }),
+            ...(memoryDelta ? { memoryDelta } : {}),
+        };
+        // BEHAVIOUR 3 (OPE-507) — an excluded author's SIBLING comment reaches the model as the
+        // arrived-marker, not as text. It runs HERE, before renderWake, so the bytes never enter the
+        // envelope, the untrusted wrap, or the rendered context. Returns `built` by reference when
+        // nothing is withheld, so every existing render golden is untouched.
+        const nw = withholdWakeBodies(built, (m) => external.withheldIds.has(m.id));
+        const { message, context } = renderWake(nw, deps.now);
+        // OPE-466 CARRIAGE — over the trigger AND every hydrated thread sibling. Notion re-sends the
+        // whole discussion on every wake, so a guest's earlier comment ENTERS the context on a wake it
+        // did not trigger; the leg keys on INGESTION, not on who spoke last, so those siblings count.
+        //
+        // 🔴 `ingestedAfterWithholding` IS WHY A WITHHELD BODY NEVER KEYS TAINT. A withheld sibling did
+        // not enter the context, so the join must not be told it did — marking on it would set the bit
+        // on every withheld wake and stop it discriminating. On `taint` the same array passes through by
+        // reference and the stamp is byte-identical.
+        const auth = stampNonMemberChatAuth(d.auth, ingestedAfterWithholding(ingested, policy), { surfaceKey: d.surfaceKey });
+        await deps.wake({ token, auth, message, context: context ?? [], state, window: d.window });
+    };
+    // A wake failure PROPAGATES to the caller's catch. (OPE-174 removed a terminal-session-death
+    // force-rotate branch here: it could never fire — a conversation-mode session PARKS at eve's
+    // token bound rather than failing, and a turn-time error cannot reject the awaited enqueue
+    // anyway. The reachable handler is core's agent/channels/session-park.ts.)
+    // 🔴 EVERY WAKE READS THE PAGE SINCE THE SEAT LAST LOOKED (OPE-1695 (b), brought to Notion by
+    // OPE-1726). A FRESH generation renders its carried tail, as it always did; an ONGOING generation
+    // reads the comments this discussion collected since its own `lastWakeAt`, through the ONE shared
+    // catch-up path — same bounds, same admission policy, same cap as Slack's. FAIL-SOFT: the shared
+    // path never throws, and an unregistered fetch comes back as the UNAVAILABLE note rather than as a
+    // silent empty context.
+    const catchUp = session.freshGeneration || !deps.catchUp
+        ? undefined
+        : await deps.catchUp({
+            container: d.pageId,
+            ...(d.discussionId ? { threadRoot: d.discussionId } : {}),
+            ...(d.trigger.anchorId ? { threadAnchor: d.trigger.anchorId } : {}),
+            sinceMs: seatCatchUpSinceMs(session.lastWakeAt, Date.parse(atIso) || Date.now(), NOTION_CATCH_UP_REACHBACK_HOURS),
+            untilMs: Date.parse(d.trigger.sentAt) || Date.parse(atIso) || Date.now(),
+            excludeId: d.trigger.id,
+            channelKey: d.surfaceKey,
+        });
+    await doWake(session.token, session.generation, session.freshGeneration ? session.tail : (catchUp?.messages ?? []), catchUp?.unavailable);
+    if (deps.touchSession)
+        await deps.touchSession(d.surfaceKey, atIso);
+    if (deps.recordWake) {
+        // AFTER the wake landed, and only the TRIGGER — never the backscroll rendered beside it. That is
+        // what stops a tail inheriting a tail (channels/session-tail.ts).
+        await deps.recordWake({
+            kind: "wake",
+            at: atIso,
+            from: d.trigger.from,
+            trust: d.trigger.trust,
+            // THE AUTHOR GRAIN (OPE-1747) — `notionIngestedMessages` builds `ingested` trigger-FIRST, the
+            // same index pairing `notionExternalAuthorDecision` already relies on, so `[0]` is this row's
+            // author. Notion has no membership verdict of its own, so the OPERATOR's register query is the
+            // whole refutation and it must ride the row. Resolved through the one core road, off the SAME
+            // local the taint join above reads.
+            ...tailAuthorGrain(ingested[0] ?? { trust: d.trigger.trust }),
+            author: d.trigger.authorId ?? "unknown",
+            ...(d.trigger.authorId ? { authorId: d.trigger.authorId } : {}),
+            id: d.trigger.id,
+            platform: "notion",
+            container: d.surfaceKey,
+            threadRoot: d.discussionId,
+            text: d.trigger.text,
+        }, session.token, d.surfaceKey);
+    }
+}
+// Re-export shouldRotate so the live wiring (notion.ts) drives get-or-create/rotate with the SAME
+// pure policy Slack uses, without importing slack-events itself.
+export { shouldRotate };
+//# sourceMappingURL=notion-supervisor.js.map

package/dist/agent/channels/notion-supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion-supervisor.js","sourceRoot":"","sources":["../../../agent/channels/notion-supervisor.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,iGAAiG;AACjG,2FAA2F;AAC3F,6FAA6F;AAC7F,4FAA4F;AAC5F,yDAAyD;AACzD,EAAE;AACF,qEAAqE;AACrE,+EAA+E;AAC/E,gEAAgE;AAChE,8FAA8F;AAC9F,6FAA6F;AAC7F,4FAA4F;AAC5F,yEAAyE;AACzE,EAAE;AACF,kGAAkG;AAClG,4FAA4F;AAC5F,6FAA6F;AAC7F,mGAAmG;AAEnG,OAAO,EACL,cAAc,EAEd,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,wBAAwB,EAQxB,eAAe,EAEf,kBAAkB,EAGlB,uBAAuB,GACxB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAsB,MAAM,iBAAiB,CAAC;AAMxF,oGAAoG;AACpG,0FAA0F;AAC1F,wDAAwD;AACxD,OAAO,EAAE,iBAAiB,EAAwB,MAAM,wBAAwB,CAAC;AAEjF;8DAC8D;AAC9D,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAE5C,wFAAwF;AACxF,EAAE;AACF,iGAAiG;AACjG,gGAAgG;AAChG,8FAA8F;AAC9F,2FAA2F;AAE3F,yFAAyF;AACzF,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,OAAO,WAAW,UAAU,EAAE,CAAC;AACjC,CAAC;AAED;;;4FAG4F;AAC5F,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,UAAkB;IACtE,OAAO,UAAU,MAAM,IAAI,wBAAwB,CAAC,UAAU,CAAC,EAAE,CAAC;AACpE,CAAC;AA4BD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAgB;IAC3D,OAAO,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAsB,EAAE,GAAoB,EAAE,OAAgB;IAClG,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC3G,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAClC,IAAI,MAAM,EAAE,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACvD,2FAA2F;QAC3F,2FAA2F;QAC3F,qDAAqD;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,CAAC;QAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,uCAAuC,EAAE,CAAC;IAChK,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,EAAE;QAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IAC1H,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,6BAA6B,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IAChI,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oHAAoH,EAAE,CAAC;IAC9J,CAAC;IACD,IAAI,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACrH,IAAI,cAAc,CAAC,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,6EAA6E,EAAE,CAAC;IACzH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;AACnG,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAqB,EACrB,SAAkB,EAClB,SAAkB,EAClB,MAAgC;IAEhC,MAAM,MAAM,GAAG,yBAAyB,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7E,8FAA8F;IAC9F,2FAA2F;IAC3F,6DAA6D;IAC7D,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,IAAI,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC,CAAC,mDAAmD;IAC/F,OAAO;QACL,MAAM,EAAE,UAAU,EAAE;QACpB,MAAM,EAAE;YACN,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE;QACD,8FAA8F;QAC9F,mGAAmG;QACnG,iGAAiG;QACjG,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;KACnC,CAAC;AACJ,CAAC;AAgGD,SAAS,aAAa,CAAC,CAAoB;IACzC,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAgC;IACxE,4FAA4F;IAC5F,4FAA4F;IAC5F,gFAAgF;IAChF,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC;IACpF,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,KAAK,eAAe,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,IAAI,aAAa,CAAC;IAC1C,4FAA4F;IAC5F,yDAAyD;IACzD,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB;QACtE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU;QAC/D,aAAa,EAAE,KAAK;QACpB,wFAAwF;QACxF,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACzD,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,0FAA0F;QAC1F,QAAQ,EAAE,uBAAuB,CAAC;YAChC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU;YAC/D,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC;QACF,yFAAyF;QACzF,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE;YACL,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE;YAC7B,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE;SACnC;QACD,UAAU;QACV,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,OAAO,EAAE,gBAAgB,CAAC;YACxB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;YACxB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,SAAS;YAC3C,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;YACpB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,0FAA0F;YAC1F,kCAAkC;YAClC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;YAC1B,OAAO,EAAE,KAAK,CAAC,UAAU,KAAK,QAAQ;YACtC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;SACzB,CAAC;KACH,CAAC;AACJ,CAAC;AAsLD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAItC;IACC,gGAAgG;IAChG,uFAAuF;IACvF,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,KAAK,GAAG,CAAC,CAAoB,EAAuB,EAAE,CAAC,CAAC;QAC5D,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACpD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;KAClI,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,CAK5C;IACC,gGAAgG;IAChG,+FAA+F;IAC/F,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACrE,IAAI,CAAC,KAAK,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;;YAC1B,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;GAUG;AACH;;0BAE0B;AAC1B,KAAK,UAAU,wBAAwB,CAAC,CAA2B;IACjE,MAAM,KAAK,GAAoB;QAC7B,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS;QACvC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,uDAAuD;IACvD,MAAM,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,CAA2B,EAAE,IAA0B;IAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/D,0FAA0F;IAC1F,8FAA8F;IAC9F,iGAAiG;IACjG,8DAA8D;IAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,cAAc,IAAI,qBAAqB,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,4BAA4B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1H,IAAI,QAAQ,CAAC,UAAU;QAAE,OAAO,CAAC,+EAA+E;IAChH,iGAAiG;IACjG,iGAAiG;IACjG,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,iDAAiD;IACjD,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7E,gGAAgG;IAChG,iGAAiG;IACjG,iGAAiG;IACjG,MAAM,KAAK,GAAuB;QAChC,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;QACxB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IAEF,mGAAmG;IACnG,mGAAmG;IACnG,mGAAmG;IACnG,IAAI,WAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,WAAW,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,UAAkB,EAAE,IAAiC,EAAE,kBAA2B,EAAE,EAAE;QACzH,MAAM,KAAK,GAAmB;YAC5B,GAAG,yBAAyB,CAAC;gBAC3B,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM;gBACxB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,aAAa,EAAE,CAAC,CAAC,eAAe;gBAChC,IAAI;gBACJ,kBAAkB;aACnB,CAAC;YACF,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC;QACF,wFAAwF;QACxF,6FAA6F;QAC7F,2FAA2F;QAC3F,qEAAqE;QACrE,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,6FAA6F;QAC7F,+FAA+F;QAC/F,8FAA8F;QAC9F,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,iGAAiG;QACjG,6CAA6C;QAC7C,MAAM,IAAI,GAAG,sBAAsB,CAAC,CAAC,CAAC,IAAI,EAAE,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QACtH,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC,CAAC;IAEF,6FAA6F;IAC7F,6FAA6F;IAC7F,2FAA2F;IAC3F,2EAA2E;IAC3E,8FAA8F;IAC9F,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,mGAAmG;IACnG,wBAAwB;IACxB,MAAM,OAAO,GACX,OAAO,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,OAAO;QACtC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,SAAS,EAAE,CAAC,CAAC,MAAM;YACnB,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,+BAA+B,CAAC;YACjH,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;YACvB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC;IACT,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1I,IAAI,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,iGAAiG;QACjG,kEAAkE;QAClE,MAAM,IAAI,CAAC,UAAU,CACnB;YACE,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;YACpB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;YACtB,8FAA8F;YAC9F,8FAA8F;YAC9F,+FAA+F;YAC/F,8FAA8F;YAC9F,oCAAoC;YACpC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7D,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,SAAS;YACvC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;YAChB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,UAAU,EAAE,CAAC,CAAC,YAAY;YAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;SACrB,EACD,OAAO,CAAC,KAAK,EACb,CAAC,CAAC,UAAU,CACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,iEAAiE;AACjE,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/agent/channels/notion-webhook-timing.d.ts

@@ -0,0 +1,35 @@
+export declare const NOTION_WEBHOOK_TIMING_ACTION = "notion.webhook_timing";
+export type NotionWebhookTimingPhase = "credential" | "botTriggerPage" | "ancestorSiblingTrust" | "engagementDedupe"
+/** Inclusive dispatch span. The public detail subtracts the nested Eve and final-audit spans. */
+ | "dispatch" | "eveSend" | "finalAudit";
+export interface NotionWebhookTimingDetail {
+    readonly [key: string]: unknown;
+    readonly outcome: string;
+    readonly failedPhase?: NotionWebhookTimingPhase;
+    readonly hmacCredentialMs?: number;
+    readonly botTriggerPageMs?: number;
+    readonly ancestorSiblingTrustMs?: number;
+    readonly engagementStoreDedupeMs?: number;
+    readonly dispatchPreflightCatchUpMs?: number;
+    readonly eveSendMs?: number;
+    readonly finalAuditMs?: number;
+    readonly totalMs: number;
+}
+export interface NotionWebhookTimingRecorder {
+    readonly measure: <T>(phase: NotionWebhookTimingPhase, operation: () => Promise<T>) => Promise<T>;
+    readonly measureSync: <T>(phase: NotionWebhookTimingPhase, operation: () => T) => T;
+    readonly detail: (outcome: string) => NotionWebhookTimingDetail;
+}
+/**
+ * Run one whole route request and emit exactly one final sample. The caller decides when a normal
+ * outcome is final; any throw before that point becomes `threw` and is rethrown unchanged. Emission
+ * itself is telemetry and therefore fail-soft — it can never replace the HTTP result or error.
+ */
+export declare function runNotionWebhookTimed<T>(timing: NotionWebhookTimingRecorder, emit: (detail: NotionWebhookTimingDetail) => void, operation: (finish: (outcome: string) => void) => Promise<T>): Promise<T>;
+/**
+ * Create one request-scoped recorder. Phases accumulate because some operations in a phase are
+ * separated by gates. `dispatch` deliberately contains `eveSend` and `finalAudit`; detail() removes
+ * those nested spans so the published buckets are mutually exclusive rather than double-counted.
+ */
+export declare function createNotionWebhookTiming(now?: () => number): NotionWebhookTimingRecorder;
+//# sourceMappingURL=notion-webhook-timing.d.ts.map

package/dist/agent/channels/notion-webhook-timing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion-webhook-timing.d.ts","sourceRoot":"","sources":["../../../agent/channels/notion-webhook-timing.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAEpE,MAAM,MAAM,wBAAwB,GAChC,YAAY,GACZ,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB;AACpB,iGAAiG;GAC/F,UAAU,GACV,SAAS,GACT,YAAY,CAAC;AAEjB,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAClG,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACpF,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,yBAAyB,CAAC;CACjE;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,MAAM,EAAE,2BAA2B,EACnC,IAAI,EAAE,CAAC,MAAM,EAAE,yBAAyB,KAAK,IAAI,EACjD,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3D,OAAO,CAAC,CAAC,CAAC,CAiBZ;AASD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,MAAgC,GAAG,2BAA2B,CAmDlH"}