negotium 0.2.24 → 0.2.26

package/dist/types/packages/core/src/mcp/session-comm/topic-catalog.d.ts

@@ -5,6 +5,8 @@ export interface SessionTopicRow {
     agent: string | null;
     sessionId: string | null;
     description: string | null;
+    /** Product surface the topic lives on; rows from other surfaces are not addressable. */
+    surface?: string | null;
 }
 export interface SessionTopicEntry<TAgent extends string = string> {
     sessionId: string;
@@ -36,6 +38,11 @@ export interface SessionTargetCatalogHost<TAgent extends string = string> {
     readonly listRows: () => SessionTopicRow[];
     readonly currentTopicId?: string;
     readonly currentTopicName?: string;
+    /**
+     * Surface of the calling topic. Sessions only converse within their own
+     * surface: terminal with terminal, telegram with telegram, otium with otium.
+     */
+    readonly currentSurface?: string;
     readonly isAgent: (value: string | null) => value is TAgent;
 }
 export interface SessionTargetCatalog<TAgent extends string = string> {

package/dist/types/packages/core/src/storage/api-topics.d.ts

@@ -1,5 +1,16 @@
 import type { AgentKind, EffortLevel } from "../types";
-import type { AiMode, TopicAccessMode, TopicDto, TopicKind, TopicVisibility } from "../types/api";
+import type { AiMode, TopicDto, TopicKind, TopicSurface, TopicVisibility } from "../types/api";
+/**
+ * Surface used when a caller does not name one — and the value every existing
+ * row is backfilled with on first boot after the surface migration.
+ *
+ * Hosts that only ever serve one surface declare it once in their environment
+ * (`NEGOTIUM_DEFAULT_SURFACE=otium` on the Otium hub and worker); a developer
+ * Mac leaves it unset and gets `terminal`, with the telegram adapter
+ * reclassifying its own mapped rooms afterwards.
+ */
+export declare function defaultTopicSurface(): TopicSurface;
+export declare function normalizeTopicSurface(value: unknown): TopicSurface;
 /** Persist the authoritative agent and, when supplied, its normalized base defaults. */
 export declare function setApiTopicAgent(topicId: string, agent: AgentKind, defaults?: {
     model: string;
@@ -23,7 +34,7 @@ export interface TopicRow {
     is_subagent: number;
     subagent_report_mode: string | null;
     visibility: string | null;
-    access_mode: string | null;
+    surface: string | null;
     browser_profile_owner: string | null;
     session_id: string | null;
 }
@@ -32,9 +43,6 @@ export interface TopicSessionLogContext {
     queryId?: string;
     agent?: AgentKind;
 }
-export declare function normalizeTopicAccessMode(value: unknown): TopicAccessMode;
-/** Otium and other non-local adapters may only address shared topics. */
-export declare function isTopicShared(topic: Pick<TopicDto, "accessMode">): boolean;
 export declare function normalizeTopicVisibility(value: unknown): TopicVisibility;
 /** Discovery boundary shared by user-facing adapters. */
 export declare function isTopicVisible(topic: Pick<TopicDto, "visibility">): boolean;
@@ -64,21 +72,15 @@ export declare function normalizeTopicState(input: {
 };
 export declare function upsertTopic(t: TopicDto): void;
 /**
- * Apply one access mode to a set of topics as a single all-or-nothing write.
+ * List topics, optionally restricted to one surface.
  *
- * A partial write is not a cosmetic glitch here: a public parent left with
- * private subagent children (or the reverse) is exactly the half-exposed state
- * the access-mode cascade exists to prevent, so every row commits or none do.
- *
- * Deliberately a narrow UPDATE instead of a loop over {@link upsertTopic}.
- * That helper opens its own transaction, and the node:sqlite shim in
- * `sqlite.ts` emulates transactions with bare BEGIN/COMMIT rather than
- * savepoints — nesting one inside an outer transaction would fail outright.
- * It also rewrites participants and browser-profile ownership, none of which
- * an access-mode change should touch.
+ * The filter lives here rather than in each adapter so a forgotten call site
+ * cannot leak a telegram room into the terminal picker; adapters pass their own
+ * surface and get a closed world back.
  */
-export declare function setTopicAccessModes(topicIds: readonly string[], accessMode: TopicAccessMode): void;
-export declare function listTopics(): TopicDto[];
+export declare function listTopics(opts?: {
+    surface?: TopicSurface;
+}): TopicDto[];
 export declare function getTopic(id: string): TopicDto | null;
 /** Return the private manager room owned by a user, excluding the retired shared General row. */
 export declare function getManagerTopicForUser(userId: string): TopicDto | null;
@@ -93,11 +95,24 @@ export declare function getTopicMemoryOrigin(id: string): TopicDto | null;
 /** Look up a topic by its user-visible title (case-insensitive exact match). */
 export declare function getTopicByName(title: string): TopicDto | null;
 export declare function getTopicByNameAndKind(title: string, kind: TopicKind): TopicDto | null;
+/**
+ * Titles are unique **per surface**, not per node: `otium` may exist once on
+ * the terminal, once on telegram and once on the Otium hub.
+ */
 export declare function findTopicTitleConflict(title: string, kind: TopicKind, opts?: {
     excludeTopicId?: string;
+    surface?: TopicSurface;
 }): TopicDto | null;
+/**
+ * Move topics onto a surface. Used by adapters that own a classification the
+ * canonical store cannot derive on its own (the telegram chat↔topic mapping
+ * lives in that adapter's database, not this one).
+ */
+export declare function setTopicSurfaces(topicIds: readonly string[], surface: TopicSurface): number;
 /** Look up a topic by title, restricted to topics where `userId` participates. */
-export declare function getTopicByNameForUser(title: string, userId: string): TopicDto | null;
+export declare function getTopicByNameForUser(title: string, userId: string, opts?: {
+    surface?: TopicSurface;
+}): TopicDto | null;
 /** Persist the agent session ID for a topic after a successful turn. */
 export declare function setTopicSessionId(topicId: string, sessionId: string, context?: TopicSessionLogContext): void;
 /** Clear the session ID (e.g. on topic reset). */

package/dist/types/packages/core/src/storage/storage-public.d.ts

@@ -41,4 +41,4 @@ export * from "./wiki";
 export * as wikiSummaryNames from "./wiki-summary-names";
 export * from "./wiki-summary-names";
 export type { AgentKind, EffortLevel } from "../types";
-export type { AiMode, MessageDto, ParticipantDto, ResponsePolicy, TopicAccessMode, TopicDto, TopicKind, TopicVisibility, } from "../types/api";
+export type { AiMode, MessageDto, ParticipantDto, ResponsePolicy, TopicDto, TopicKind, TopicVisibility, } from "../types/api";

package/dist/types/packages/core/src/topics/derive.d.ts

@@ -8,10 +8,19 @@
  */
 import { type CompactSummaryRequest } from "./session";
 import type { AgentKind } from "../types";
-import type { TopicDto } from "../types/api";
-export declare function getTopics(): TopicDto[];
-/** Topics adapters may show in lists and selection UIs. */
-export declare function getVisibleTopics(): TopicDto[];
+import type { TopicDto, TopicSurface } from "../types/api";
+export declare function getTopics(opts?: {
+    surface?: TopicSurface;
+}): TopicDto[];
+/**
+ * Topics adapters may show in lists and selection UIs.
+ *
+ * Callers that represent one product surface pass it, so a telegram room never
+ * appears in the terminal picker and vice versa (S-6).
+ */
+export declare function getVisibleTopics(opts?: {
+    surface?: TopicSurface;
+}): TopicDto[];
 export declare function updateTopic(topicId: string, patch: Partial<TopicDto>): boolean;
 export declare function isParticipant(topic: TopicDto, userId: string): boolean;
 /** Thrown when a user-supplied derived-topic name collides with an existing

package/dist/types/packages/core/src/types/api.d.ts

@@ -12,8 +12,12 @@
 /** Agent identifier — one of the supported AI provider backends. */
 export type AgentKind = "maestro" | "claude" | "codex";
 export type TopicKind = "channel" | "agent" | "manager";
-/** Adapter access boundary for a user-facing topic. */
-export type TopicAccessMode = "private" | "shared";
+/**
+ * The one product surface a topic lives on. A topic belongs to exactly one
+ * surface for its whole life; names are unique per surface, not per node.
+ */
+export type TopicSurface = "terminal" | "telegram" | "otium";
+export declare const TOPIC_SURFACES: readonly TopicSurface[];
 /** Whether adapters may expose a topic in user-facing discovery surfaces. */
 export type TopicVisibility = "visible" | "hidden";
 export type ResponsePolicy = "off" | "mention" | "always";
@@ -115,8 +119,8 @@ export interface TopicDto {
     subagentReportMode?: SubagentReportMode;
     /** Hidden topics remain executable/addressable by id but stay out of adapter pickers. */
     visibility?: TopicVisibility;
-    /** Private stays on local adapters; shared may be exposed through Otium too. */
-    accessMode?: TopicAccessMode;
+    /** The product surface that owns this topic (terminal / telegram / otium). */
+    surface?: TopicSurface;
     /** Stable execution placement. Absent means the hub runs this topic locally. */
     executionNode?: {
         nodeId: string;

package/dist/types/packages/core/src/version.d.ts

@@ -1 +1 @@
-export declare const NEGOTIUM_VERSION = "0.2.24";
+export declare const NEGOTIUM_VERSION = "0.2.26";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "negotium",
-  "version": "0.2.24",
+  "version": "0.2.26",
   "type": "module",
   "description": "Install the Negotium multi-agent runtime and CLI with one package",
   "license": "Apache-2.0",

package/dist/runtime/src/application/switch-topic-access-mode.ts

@@ -1,110 +0,0 @@
-import { WsHub } from "#bus";
-import { getTopic, listTopics, setTopicAccessModes } from "#storage/api-topics";
-import type { TopicAccessMode, TopicDto } from "#types/api";
-
-export type SwitchTopicAccessModeResult =
-  | { ok: true; accessMode: TopicAccessMode; text: string; topicIds: string[] }
-  | { ok: false; error: string };
-
-export interface SwitchTopicAccessModeParams {
-  topicId: string;
-  userId: string;
-  accessMode: TopicAccessMode;
-}
-
-/**
- * Every subagent room reachable from `rootTopicId`, deepest-first order aside.
- *
- * Mirrors the traversal `deleteTopicCascade` already uses: only `isSubagent`
- * children are owned by their parent, while fork/spawn rooms are independent
- * and must keep their own privacy. `seen` guards against a parent cycle left
- * behind by reparenting, which would otherwise loop forever.
- */
-function collectSubagentDescendants(rootTopicId: string): TopicDto[] {
-  const all = listTopics();
-  const childrenByParent = new Map<string, TopicDto[]>();
-  for (const topic of all) {
-    if (!topic.isSubagent || !topic.parentTopicId) continue;
-    const siblings = childrenByParent.get(topic.parentTopicId);
-    if (siblings) siblings.push(topic);
-    else childrenByParent.set(topic.parentTopicId, [topic]);
-  }
-  const descendants: TopicDto[] = [];
-  const seen = new Set<string>([rootTopicId]);
-  const queue = [rootTopicId];
-  while (queue.length > 0) {
-    const parentId = queue.shift() as string;
-    for (const child of childrenByParent.get(parentId) ?? []) {
-      if (seen.has(child.id)) continue;
-      seen.add(child.id);
-      descendants.push(child);
-      queue.push(child.id);
-    }
-  }
-  return descendants;
-}
-
-/** Change whether a user-owned topic is local-only or shared with connected adapters. */
-export function switchTopicAccessMode(
-  params: SwitchTopicAccessModeParams,
-): SwitchTopicAccessModeResult {
-  const topic = getTopic(params.topicId);
-  if (!topic) return { ok: false, error: "Topic not found" };
-  const owner = topic.participants.some(
-    (participant) => participant.userId === params.userId && participant.role === "owner",
-  );
-  if (!owner) return { ok: false, error: "Only topic owners can change privacy" };
-  // A subagent room is owned by the room that spawned it, so its privacy is not
-  // its own to change: allowing it would let a worker room escape the parent's
-  // setting, and the next parent switch would silently overwrite it anyway.
-  if (topic.isSubagent) {
-    return {
-      ok: false,
-      error: "Subagent rooms inherit privacy from their parent topic",
-    };
-  }
-
-  // Subagents hold the parent's conversation context, so leaving them behind on
-  // the old mode would either expose work the user just made private or strand
-  // half a delegation tree off the Hub. New rooms already inherit the parent's
-  // access mode at creation (`createDerivedTopic`); this keeps existing ones in
-  // step.
-  const descendants = collectSubagentDescendants(topic.id);
-  const changed = [topic, ...descendants].filter(
-    (candidate) => (candidate.accessMode ?? "private") !== params.accessMode,
-  );
-  if (changed.length === 0) {
-    return {
-      ok: true,
-      accessMode: params.accessMode,
-      text:
-        params.accessMode === "shared"
-          ? `"${topic.title}" is already public to the connected Otium Hub.`
-          : `"${topic.title}" is already private to this worker.`,
-      topicIds: [],
-    };
-  }
-
-  setTopicAccessModes(
-    changed.map((candidate) => candidate.id),
-    params.accessMode,
-  );
-  // Broadcast only after the write commits: an event emitted inside the
-  // transaction would announce a state a rollback could still take back.
-  for (const candidate of changed) WsHub.get().broadcastTopicUpdated(candidate.id);
-
-  const subagentCount = changed.filter((candidate) => candidate.id !== topic.id).length;
-  const suffix =
-    subagentCount > 0
-      ? ` (${subagentCount} subagent room${subagentCount === 1 ? "" : "s"} updated)`
-      : "";
-  return {
-    ok: true,
-    accessMode: params.accessMode,
-    topicIds: changed.map((candidate) => candidate.id),
-    text:
-      (params.accessMode === "shared"
-        ? `"${topic.title}" is public to the connected Otium Hub.`
-        : `"${topic.title}" is private to this worker.`) + suffix,
-  };
-}