@alfe.ai/notion-mcp 0.3.16 → 0.3.18

package/dist/server.js

@@ -1,287 +1,797 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
+import { realpathSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { AgentApiClient } from "@alfe.ai/agent-api-client";
+import { resolveConfig } from "@alfe.ai/config";
+import { assertPatternA } from "@alfe.ai/mcp-bundler";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { resolveConfig } from "@alfe.ai/config";
-import { AgentApiClient } from "@alfe.ai/agent-api-client";
-import { assertPatternA } from "@alfe.ai/mcp-bundler";
-//#region src/server.ts
-/**
-* Notion MCP Proxy Server (Pattern A multi-account)
-*
-* A thin proxy that fans out to one official `@notionhq/notion-mcp-server`
-* child process per connected Notion workspace. Every credential-touching
-* tool requires the LLM to pass a `workspaceId` selector arg; the proxy
-* strips that arg, dispatches to the right child, and returns the result.
-*
-* Pattern A locked in PR 7.2 of channels-and-credential-driven-
-* integrations. See `packages/mcp-bundler/DEVELOPING.md` for the
-* contract; `services/connect/DEVELOPING.md` for the provider table.
-*
-* Architecture:
-*   OpenClaw ←(stdio)→ this proxy ←(stdio fan-out)→ N × @notionhq/notion-mcp-server
-*
-* Notion access tokens persist until the user revokes the integration,
-* so there's no token-refresh path.
-*
-* Uses the low-level Server class (not McpServer) because child tools
-* return JSON Schema objects — McpServer.registerTool requires Zod.
-*/
-const workspaces = /* @__PURE__ */ new Map();
-/**
-* Full snapshot of every Notion connection returned by getNotionAccounts(),
-* including ones we couldn't spawn a child for (e.g. missing access token).
-* `notion_list_accounts` returns this so the LLM can surface partial-failure
-* connections instead of silently dropping them.
-*/
-const allAccountsSnapshot = [];
-/** Cached, selector-injected tool list returned to OpenClaw. */
-let cachedTools = [];
-function log(msg) {
-	process.stderr.write(`[notion-mcp-proxy] ${msg}\n`);
-}
-function resolveWorkspace(workspaceId) {
-	if (!workspaceId) throw new Error("Missing required workspaceId argument. Call notion_list_accounts to see the connected Notion workspaces and pass the workspaceId you want to target.");
-	const ws = workspaces.get(workspaceId);
-	if (!ws) {
-		const known = allAccountsSnapshot.find((s) => s.workspaceId === workspaceId);
-		if (known && !known.connected) throw new Error(`workspaceId ${workspaceId} is connected on this agent but the proxy could not initialise a child server for it (reason: ${known.reason ?? "unknown"}). Ask the user to reconnect this Notion workspace from the dashboard.`);
-		throw new Error(`Unknown workspaceId: ${workspaceId}. Call notion_list_accounts to see the connected Notion workspaces on this agent.`);
+import { createHash } from "node:crypto";
+const MAX_FORWARDED_ARGUMENT_BYTES = 2 * 1024 * 1024;
+const MAX_TOOL_RESULT_BYTES = 5 * 1024 * 1024;
+const MAX_SCHEMA_BYTES = 768 * 1024;
+const MAX_CHECK_RESPONSE_BYTES = 64 * 1024;
+const MAX_JSON_DEPTH = 16;
+const MAX_JSON_NODES = 1e5;
+const MAX_JSON_ARRAY_ITEMS = 5e3;
+const MAX_ARGUMENT_STRING_CHARS = 15e5;
+const MAX_TOKEN_CHARS = 32768;
+const MAX_ERROR_CHARS = 2048;
+const NOTION_CHECK_TIMEOUT_MS = 15e3;
+const WORKSPACE_ID_PATTERN = /^[A-Za-z0-9_-]{1,256}$/u;
+const TOOL_NAME_PATTERN = /^[A-Za-z0-9_.:-]{1,128}$/u;
+const UNSAFE_KEYS = new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+const RESERVED_TOOLS = new Set(["notion_list_accounts", "notion_check_connection"]);
+const CHILD_ENV_ALLOWLIST = [
+	"HOME",
+	"TMPDIR",
+	"TMP",
+	"TEMP",
+	"LANG",
+	"LC_ALL",
+	"LC_CTYPE",
+	"TZ",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"NODE_EXTRA_CA_CERTS",
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"NO_PROXY",
+	"http_proxy",
+	"https_proxy",
+	"no_proxy"
+];
+function buildChildEnvironment(accessToken, source = process.env) {
+	const token = validateAccessToken(accessToken, false);
+	const environment = Object.create(null);
+	for (const name of CHILD_ENV_ALLOWLIST) {
+		const value = source[name];
+		if (value !== void 0 && !containsControlCharacter(value)) environment[name] = value;
 	}
-	return ws;
+	return {
+		...environment,
+		NOTION_TOKEN: token
+	};
 }
-async function spawnChild(accessToken) {
-	const transport = new StdioClientTransport({
-		command: "npx",
-		args: ["-y", "@notionhq/notion-mcp-server"],
-		env: {
-			...process.env,
-			NOTION_TOKEN: accessToken
-		}
-	});
-	const client = new Client({
-		name: "notion-mcp-proxy",
-		version: "2.0.0"
-	});
-	await client.connect(transport);
-	return client;
+function normalizeNotionAccount(value) {
+	if (!isRecord(value)) throw new Error("Notion account must be an object");
+	return {
+		connectionId: validateText("connectionId", value.connectionId, 128),
+		workspaceId: validateWorkspaceId(value.workspaceId),
+		workspaceName: validateDisplayText("workspace name", value.workspaceName, 512),
+		connectedAt: validateConnectedAt(value.connectedAt),
+		accessToken: validateAccessToken(value.accessToken, true)
+	};
 }
-async function killAllChildren() {
-	for (const ws of workspaces.values()) try {
-		await ws.client.close();
-	} catch {}
-	workspaces.clear();
+function assertAccountCount(value) {
+	if (!Array.isArray(value)) throw new Error("Notion accounts response must be an array");
+	if (value.length > 50) throw new Error(`Notion accounts response exceeds ${String(50)} accounts`);
+}
+function readNotionAccountsResponse(value) {
+	if (!isRecord(value)) throw new Error("Notion accounts response must be an object");
+	assertAccountCount(value.accounts);
+	return value.accounts;
 }
-/**
-* Take a tool descriptor from the child Notion MCP server and inject a
-* required `workspaceId` string property into its inputSchema. The proxy
-* strips this arg before forwarding the call.
-*/
 function injectWorkspaceSelector(tool) {
-	const original = tool.inputSchema ?? {};
-	const originalProperties = original.properties ?? {};
-	const originalRequired = Array.isArray(original.required) ? original.required : [];
-	const injectedProperties = {
+	if (!isRecord(tool)) throw new Error("Child tool descriptor must be an object");
+	const name = validateToolName(tool.name);
+	if (RESERVED_TOOLS.has(name)) throw new Error(`Child tool collides with reserved proxy tool: ${name}`);
+	const original = cloneJsonRecord("tool input schema", tool.inputSchema, MAX_SCHEMA_BYTES, 5e5);
+	const originalProperties = Object.hasOwn(original, "properties") ? cloneJsonRecord("tool schema properties", original.properties, MAX_SCHEMA_BYTES, 5e5) : Object.create(null);
+	const originalRequired = validateRequired(original.required);
+	const properties = {
 		...originalProperties,
 		workspaceId: {
 			type: "string",
-			description: "Notion workspaceId — use the value from notion_list_accounts to pick which connected workspace this call should target."
+			pattern: WORKSPACE_ID_PATTERN.source,
+			maxLength: 256,
+			description: "Notion workspaceId from notion_list_accounts. This required selector chooses the exact connected OAuth workspace."
 		}
 	};
-	const injectedRequired = originalRequired.includes("workspaceId") ? originalRequired : ["workspaceId", ...originalRequired];
-	return {
-		name: tool.name,
-		description: tool.description,
+	const required = new Set(["workspaceId", ...originalRequired]);
+	if (name === "API-delete-a-block") {
+		properties.confirmBlockId = {
+			type: "string",
+			maxLength: 256,
+			description: "Repeat the exact block_id to confirm deletion of this Notion block."
+		};
+		required.add("confirmBlockId");
+	}
+	if (name === "API-update-a-block") {
+		const archived = properties.archived;
+		if (isRecord(archived)) properties.archived = {
+			...archived,
+			default: false,
+			description: "Set true only to archive/delete this block; confirmBlockId must then exactly match block_id."
+		};
+		properties.confirmBlockId = {
+			type: "string",
+			maxLength: 256,
+			description: "Required only when archived=true; repeat the exact block_id to confirm deletion."
+		};
+	}
+	if (name === "API-patch-page") properties.confirmPageId = {
+		type: "string",
+		maxLength: 256,
+		description: "Required only when in_trash=true or archived=true; repeat the exact page_id to confirm deletion."
+	};
+	const result = {
+		name,
 		inputSchema: {
 			...original,
-			type: original.type ?? "object",
-			properties: injectedProperties,
-			required: injectedRequired
+			type: "object",
+			properties,
+			required: [...required]
 		}
 	};
+	if (tool.title !== void 0) result.title = validateText("tool title", tool.title, 256);
+	if (tool.description !== void 0) result.description = validateDocumentationText("tool description", tool.description, 2e4);
+	if (tool.outputSchema !== void 0) result.outputSchema = cloneJsonRecord("tool output schema", tool.outputSchema, MAX_SCHEMA_BYTES, 5e5);
+	if (tool.annotations !== void 0) result.annotations = validateAnnotations(tool.annotations);
+	if (tool.execution !== void 0) result.execution = validateExecution(tool.execution);
+	return result;
 }
-async function main() {
-	const config = resolveConfig();
-	const { accounts } = await new AgentApiClient({
-		apiKey: config.apiKey,
-		apiUrl: config.apiUrl
-	}).getNotionAccounts();
-	if (accounts.length === 0) log("No Notion workspaces connected — proxy will start with notion_list_accounts and notion_check_connection only");
-	for (const acct of accounts) {
-		if (!acct.accessToken) {
-			log(`Skipping workspace ${acct.workspaceId} — no access token`);
-			allAccountsSnapshot.push({
-				workspaceId: acct.workspaceId,
-				workspaceName: acct.workspaceName,
-				connectedAt: acct.connectedAt,
-				connected: false,
-				reason: "missing_access_token"
-			});
-			continue;
-		}
-		if (workspaces.has(acct.workspaceId)) {
-			log(`Duplicate workspaceId ${acct.workspaceId} returned by getNotionAccounts() — keeping the first cached child`);
-			continue;
-		}
+function validateToolCatalog(tools) {
+	if (!Array.isArray(tools)) throw new Error("Child tool catalog must be an array");
+	if (tools.length > 100) throw new Error(`Child tool catalog exceeds ${String(100)} tools`);
+	const names = /* @__PURE__ */ new Set();
+	return tools.map((tool) => {
+		const proxied = injectWorkspaceSelector(tool);
+		if (names.has(proxied.name)) throw new Error(`Child tool catalog contains duplicate name: ${proxied.name}`);
+		names.add(proxied.name);
+		return proxied;
+	});
+}
+function prepareForwardedArguments(toolName, value) {
+	const cloned = cloneJsonRecord("tool arguments", value, MAX_FORWARDED_ARGUMENT_BYTES, MAX_ARGUMENT_STRING_CHARS);
+	const workspaceId = validateWorkspaceId(cloned.workspaceId);
+	if (toolName === "API-delete-a-block") requireConfirmation(cloned, "block_id", "confirmBlockId");
+	if (toolName === "API-update-a-block" && cloned.archived === true) requireConfirmation(cloned, "block_id", "confirmBlockId");
+	if (toolName === "API-patch-page" && (cloned.in_trash === true || cloned.archived === true)) requireConfirmation(cloned, "page_id", "confirmPageId");
+	const proxyFields = new Set([
+		"workspaceId",
+		"confirmBlockId",
+		"confirmPageId"
+	]);
+	return {
+		workspaceId,
+		forwarded: Object.fromEntries(Object.entries(cloned).filter(([key]) => !proxyFields.has(key)))
+	};
+}
+function assertBoundedToolArguments(value) {
+	return cloneJsonRecord("tool arguments", value, MAX_FORWARDED_ARGUMENT_BYTES, MAX_ARGUMENT_STRING_CHARS);
+}
+function assertBoundedToolResult(value) {
+	return cloneJsonRecord("child tool result", value, MAX_TOOL_RESULT_BYTES, MAX_TOOL_RESULT_BYTES);
+}
+function childResultIsError(value) {
+	if (value.isError === true) return true;
+	if (isRecord(value.structuredContent) && value.structuredContent.status === "error") return true;
+	const content = value.content;
+	if (!Array.isArray(content)) return false;
+	return content.some((entry) => {
+		if (!isRecord(entry) || typeof entry.text !== "string") return false;
 		try {
-			const client = await spawnChild(acct.accessToken);
-			workspaces.set(acct.workspaceId, {
-				workspaceId: acct.workspaceId,
-				workspaceName: acct.workspaceName,
-				accessToken: acct.accessToken,
-				client
-			});
-			allAccountsSnapshot.push({
-				workspaceId: acct.workspaceId,
-				workspaceName: acct.workspaceName,
-				connectedAt: acct.connectedAt,
-				connected: true
-			});
-			log(`Spawned child server for workspace ${acct.workspaceId} (${acct.workspaceName || "unnamed"})`);
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			log(`Failed to spawn child for workspace ${acct.workspaceId}: ${message}`);
-			allAccountsSnapshot.push({
-				workspaceId: acct.workspaceId,
-				workspaceName: acct.workspaceName,
-				connectedAt: acct.connectedAt,
-				connected: false,
-				reason: `spawn_failed: ${message}`
-			});
+			const parsed = JSON.parse(entry.text);
+			return isRecord(parsed) && parsed.status === "error";
+		} catch {
+			return false;
 		}
+	});
+}
+function extractToolErrorText(value) {
+	if (!Array.isArray(value.content)) return "";
+	return value.content.slice(0, 100).map((entry) => isRecord(entry) && typeof entry.text === "string" ? entry.text.slice(0, MAX_ERROR_CHARS) : "").join("\n").slice(0, MAX_ERROR_CHARS);
+}
+async function checkNotionConnection(accessToken, fetchFn = fetch) {
+	const response = await fetchFn("https://api.notion.com/v1/users/me", {
+		headers: {
+			Authorization: `Bearer ${validateAccessToken(accessToken, false)}`,
+			"Notion-Version": "2025-09-03"
+		},
+		redirect: "error",
+		signal: AbortSignal.timeout(NOTION_CHECK_TIMEOUT_MS)
+	});
+	if (!response.ok) {
+		await response.body?.cancel().catch(() => void 0);
+		return {
+			ok: false,
+			status: response.status
+		};
 	}
-	const firstWorkspace = workspaces.values().next().value;
-	if (firstWorkspace) {
-		const { tools } = await firstWorkspace.client.listTools();
-		cachedTools = tools.map(injectWorkspaceSelector);
-		log(`Child MCP server provides ${String(cachedTools.length)} tools (selector injected)`);
-	} else {
-		cachedTools = [];
-		log("No child server available — only notion_list_accounts and notion_check_connection will be exposed");
+	const text = await readResponseText(response, MAX_CHECK_RESPONSE_BYTES);
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new Error("Notion /users/me returned invalid JSON");
 	}
-	cachedTools.push({
-		name: "notion_list_accounts",
-		description: "List the Notion workspaces the agent has connected. Returns one entry per OAuth connection — use the returned workspaceId values as the `workspaceId` selector arg on every other Notion tool.",
-		inputSchema: {
-			type: "object",
-			properties: {}
+	if (!isRecord(parsed) || parsed.object !== "user") throw new Error("Notion /users/me returned an invalid user object");
+	validateText("Notion user id", parsed.id, 128);
+	if (parsed.type !== "bot" && parsed.type !== "person") throw new Error("Notion /users/me returned an invalid user type");
+	return {
+		ok: true,
+		status: response.status
+	};
+}
+function snapshotToolCatalog(tools) {
+	return tools.map((tool) => structuredClone(tool));
+}
+function safeErrorMessage(error, secrets = []) {
+	let message = (error instanceof Error ? error.message : String(error)).slice(0, MAX_ERROR_CHARS);
+	for (const secret of secrets) if (secret.length >= 4) message = message.split(secret).join("[REDACTED]");
+	return flattenControls(message).replace(/\b(Bearer|Basic)\s+[^\s,;]+/giu, "$1 [REDACTED]").replace(/\b(api[_-]?key|access[_-]?token|refresh[_-]?token|secret|password)\s*[=:]\s*[^\s,;]+/giu, "$1=[REDACTED]").replace(/https?:\/\/[^\s/@:]+:[^\s/@]+@/giu, "https://[REDACTED]@").replace(/\balfe_[A-Za-z0-9_-]{8,}/gu, "[REDACTED]").slice(0, MAX_ERROR_CHARS);
+}
+function connectionLogId(value) {
+	return createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
+async function withDeadline(promise, timeoutMs, label) {
+	let timer;
+	try {
+		return await Promise.race([promise, new Promise((_resolve, reject) => {
+			timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(`${label} timed out`));
+			}, timeoutMs);
+			timer.unref();
+		})]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+function requireConfirmation(value, targetField, confirmationField) {
+	const target = value[targetField];
+	const confirmation = value[confirmationField];
+	if (typeof target !== "string" || target.length < 1) throw new Error(`${targetField} must be a non-empty string`);
+	if (confirmation !== target) throw new Error(`${confirmationField} must exactly match ${targetField}`);
+}
+function validateWorkspaceId(value) {
+	if (typeof value !== "string" || !WORKSPACE_ID_PATTERN.test(value)) throw new Error("workspaceId must contain 1 to 256 letters, digits, underscores, or hyphens");
+	return value;
+}
+function validateAccessToken(value, allowEmpty) {
+	if (allowEmpty && value === "") return "";
+	if (typeof value !== "string" || value.length < 8 || value.length > MAX_TOKEN_CHARS || containsControlCharacter(value) || value !== value.trim()) throw new Error("Notion access token is invalid");
+	return value;
+}
+function validateConnectedAt(value) {
+	const checked = validateText("connectedAt", value, 64);
+	const parsed = new Date(checked);
+	if (Number.isNaN(parsed.valueOf()) || parsed.toISOString() !== checked) throw new Error("connectedAt must be a canonical ISO date-time");
+	return checked;
+}
+function validateToolName(value) {
+	if (typeof value !== "string" || !TOOL_NAME_PATTERN.test(value)) throw new Error("Child tool name is invalid");
+	return value;
+}
+function validateText(label, value, maxChars) {
+	if (typeof value !== "string" || value.length < 1 || value.length > maxChars || containsControlCharacter(value)) throw new Error(`${label} must contain 1 to ${String(maxChars)} non-control characters`);
+	return value;
+}
+function validateDisplayText(label, value, maxChars) {
+	if (typeof value !== "string" || value.length > maxChars || containsControlCharacter(value)) throw new Error(`${label} must contain at most ${String(maxChars)} non-control characters`);
+	return value;
+}
+function validateDocumentationText(label, value, maxChars) {
+	if (typeof value !== "string" || value.length < 1 || value.length > maxChars || Array.from(value).some((character) => {
+		const codePoint = character.codePointAt(0) ?? 0;
+		return codePoint < 32 && character !== "\n" && character !== "\r" && character !== "	" || codePoint === 127;
+	})) throw new Error(`${label} must contain 1 to ${String(maxChars)} safe characters`);
+	return value;
+}
+function validateRequired(value) {
+	if (value === void 0) return [];
+	if (!Array.isArray(value) || value.length > 100) throw new Error("tool schema required must be an array");
+	const result = [];
+	for (const entry of value) {
+		if (typeof entry !== "string" || entry.length < 1 || entry.length > 128) throw new Error("tool schema required contains an invalid property name");
+		if (!result.includes(entry)) result.push(entry);
+	}
+	return result;
+}
+function validateAnnotations(value) {
+	if (!isRecord(value)) throw new Error("tool annotations must be an object");
+	const result = {};
+	if (value.title !== void 0) result.title = validateText("annotation title", value.title, 256);
+	for (const key of [
+		"readOnlyHint",
+		"destructiveHint",
+		"idempotentHint",
+		"openWorldHint"
+	]) {
+		const hint = value[key];
+		if (hint !== void 0) {
+			if (typeof hint !== "boolean") throw new Error(`tool annotation ${key} must be boolean`);
+			result[key] = hint;
 		}
-	});
-	cachedTools.push({
-		name: "notion_check_connection",
-		description: "Verify the Notion OAuth2 connection for a specific connected workspace is still valid. Use this if Notion API calls are failing with authentication errors.",
-		inputSchema: {
-			type: "object",
-			properties: { workspaceId: {
-				type: "string",
-				description: "Notion workspaceId — use the value from notion_list_accounts."
-			} },
-			required: ["workspaceId"]
+	}
+	return result;
+}
+function validateExecution(value) {
+	if (!isRecord(value)) throw new Error("tool execution metadata must be an object");
+	const taskSupport = value.taskSupport;
+	if (taskSupport !== void 0 && taskSupport !== "optional" && taskSupport !== "required" && taskSupport !== "forbidden") throw new Error("tool execution taskSupport is invalid");
+	return taskSupport === void 0 ? {} : { taskSupport };
+}
+async function readResponseText(response, maxBytes) {
+	const declared = response.headers.get("content-length");
+	if (declared !== null && (!/^\d+$/u.test(declared) || Number(declared) > maxBytes)) {
+		await response.body?.cancel().catch(() => void 0);
+		throw new Error("Notion /users/me response exceeds the byte limit");
+	}
+	if (response.body === null) return "";
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let bytes = 0;
+	let text = "";
+	try {
+		for (;;) {
+			const result = await reader.read();
+			if (result.done) break;
+			if (result.value === void 0) throw new Error("Notion response stream returned no bytes");
+			bytes += result.value.byteLength;
+			if (bytes > maxBytes) {
+				await reader.cancel("response too large").catch(() => void 0);
+				throw new Error("Notion /users/me response exceeds the byte limit");
+			}
+			text += decoder.decode(result.value, { stream: true });
 		}
+		text += decoder.decode();
+		return text;
+	} finally {
+		reader.releaseLock();
+	}
+}
+function cloneJsonRecord(label, value, maxBytes, maxStringChars) {
+	if (!isRecord(value)) throw new Error(`${label} must be an object`);
+	const cloned = cloneRecord(label, value, 0, { nodes: 0 }, maxStringChars);
+	if (Buffer.byteLength(JSON.stringify(cloned), "utf8") > maxBytes) throw new Error(`${label} exceeds the ${String(maxBytes)} byte limit`);
+	return cloned;
+}
+function cloneJson(label, value, depth, budget, maxStringChars) {
+	budget.nodes += 1;
+	if (budget.nodes > MAX_JSON_NODES) throw new Error(`${label} contains too many values`);
+	if (depth > MAX_JSON_DEPTH) throw new Error(`${label} exceeds the JSON depth limit`);
+	if (value === null || typeof value === "boolean") return value;
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new Error(`${label} contains a non-finite number`);
+		return value;
+	}
+	if (typeof value === "string") {
+		if (value.length > maxStringChars) throw new Error(`${label} contains an oversized string`);
+		return value;
+	}
+	if (Array.isArray(value)) {
+		if (value.length > MAX_JSON_ARRAY_ITEMS) throw new Error(`${label} contains an oversized array`);
+		return value.map((entry) => cloneJson(label, entry, depth + 1, budget, maxStringChars));
+	}
+	if (!isRecord(value)) throw new Error(`${label} contains a non-JSON value`);
+	return cloneRecord(label, value, depth, budget, maxStringChars);
+}
+function cloneRecord(label, value, depth, budget, maxStringChars) {
+	const result = Object.create(null);
+	for (const [key, nested] of Object.entries(value)) {
+		if (key.length < 1 || key.length > 256 || UNSAFE_KEYS.has(key)) throw new Error(`${label} contains an unsafe property name`);
+		result[key] = cloneJson(label, nested, depth + 1, budget, maxStringChars);
+	}
+	return result;
+}
+function containsControlCharacter(value) {
+	return Array.from(value).some((character) => {
+		const codePoint = character.codePointAt(0) ?? 0;
+		return codePoint < 32 || codePoint === 127;
 	});
-	assertPatternA(cachedTools.map((t) => ({
-		name: t.name,
-		parameters: t.inputSchema
-	})), {
-		selector: "workspaceId",
-		exempt: ["notion_list_accounts"]
-	});
-	const proxy = new Server({
-		name: "notion-mcp-proxy",
-		version: "2.0.0"
-	}, { capabilities: { tools: {} } });
-	proxy.setRequestHandler(ListToolsRequestSchema, () => ({ tools: cachedTools }));
-	proxy.setRequestHandler(CallToolRequestSchema, async (request) => {
-		const { name, arguments: args } = request.params;
-		const argMap = args ?? {};
-		if (name === "notion_list_accounts") return { content: [{
-			type: "text",
-			text: JSON.stringify({ workspaces: allAccountsSnapshot }, null, 2)
-		}] };
-		if (name === "notion_check_connection") try {
-			const ws = resolveWorkspace(typeof argMap.workspaceId === "string" ? argMap.workspaceId : void 0);
-			const response = await fetch("https://api.notion.com/v1/users/me", { headers: {
-				Authorization: `Bearer ${ws.accessToken}`,
-				"Notion-Version": "2022-06-28"
-			} });
-			if (!response.ok) return {
-				content: [{
-					type: "text",
-					text: JSON.stringify({
-						workspaceId: ws.workspaceId,
-						connected: false,
-						status: response.status,
-						error: "Token may have been revoked. Ask the user to reconnect this Notion workspace from the dashboard."
-					})
-				}],
-				isError: true
-			};
-			const user = await response.json();
-			return { content: [{
-				type: "text",
-				text: JSON.stringify({
-					workspaceId: ws.workspaceId,
+}
+function flattenControls(value) {
+	let output = "";
+	let previousWasControl = false;
+	for (const character of value) {
+		const codePoint = character.codePointAt(0) ?? 0;
+		const isControl = codePoint < 32 || codePoint === 127;
+		if (isControl) {
+			if (!previousWasControl) output += " ";
+		} else output += character;
+		previousWasControl = isControl;
+	}
+	return output;
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//#endregion
+//#region src/server.ts
+/**
+* Notion MCP proxy (Pattern A multi-account).
+*
+* OpenClaw communicates with this process over stdio. The proxy owns one
+* exact-version official Notion child per connected workspace and injects a
+* required workspaceId selector into every credential-touching child tool.
+*/
+const require = createRequire(import.meta.url);
+const CHILD_PACKAGE = "@notionhq/notion-mcp-server";
+const packageMetadata = require("../package.json");
+const childPackagePath = require.resolve(`${CHILD_PACKAGE}/package.json`);
+const childMetadata = require(childPackagePath);
+const SERVER_VERSION = validateSemver("notion-mcp package version", packageMetadata.version);
+const CHILD_VERSION = validateExactChildVersion(packageMetadata.dependencies?.[CHILD_PACKAGE], childMetadata.version);
+const CHILD_BIN_PATH = resolveChildBin(childPackagePath, childMetadata.bin);
+const CHILD_START_TIMEOUT_MS = 3e4;
+const CHILD_CATALOG_TIMEOUT_MS = 15e3;
+const CHILD_CALL_TIMEOUT_MS = 6e4;
+const CHILD_CLOSE_TIMEOUT_MS = 5e3;
+var NotionRuntime = class {
+	workspaces = /* @__PURE__ */ new Map();
+	claimedWorkspaceIds = /* @__PURE__ */ new Map();
+	allAccountsSnapshot = [];
+	catalogToolNames = /* @__PURE__ */ new Set();
+	cachedTools = [];
+	closePromise;
+	spawnChild;
+	fetchImpl;
+	constructor(apiClient, options = {}) {
+		this.apiClient = apiClient;
+		this.spawnChild = options.spawnChild ?? spawnOfficialChild;
+		this.fetchImpl = options.fetchImpl ?? fetch;
+	}
+	async initialize() {
+		await this.loadAccounts();
+		this.cachedTools = appendLocalTools(await this.discoverChildCatalog());
+		assertPatternA(this.cachedTools.map((tool) => ({
+			name: tool.name,
+			parameters: tool.inputSchema
+		})), {
+			selector: "workspaceId",
+			exempt: ["notion_list_accounts"]
+		});
+	}
+	listTools() {
+		return snapshotToolCatalog(this.cachedTools);
+	}
+	async handleToolCall(request) {
+		const { name } = request.params;
+		const args = request.params.arguments ?? {};
+		if (name === "notion_list_accounts") try {
+			const bounded = assertBoundedToolArguments(args);
+			if (Object.keys(bounded).length !== 0) throw new Error("notion_list_accounts takes no arguments");
+			return jsonResult({ workspaces: this.allAccountsSnapshot });
+		} catch (error) {
+			return errorResult(error);
+		}
+		if (name === "notion_check_connection") {
+			let workspace;
+			try {
+				const prepared = prepareForwardedArguments(name, args);
+				if (Object.keys(prepared.forwarded).length !== 0) throw new Error("notion_check_connection accepts only workspaceId");
+				workspace = this.resolveWorkspace(prepared.workspaceId);
+				const result = await checkNotionConnection(workspace.accessToken, this.fetchImpl);
+				if (!result.ok) return errorResult("Token may have been revoked. Ask the user to reconnect this Notion workspace from the dashboard.", {
+					workspaceId: workspace.workspaceId,
+					connected: false,
+					status: result.status
+				});
+				return jsonResult({
+					workspaceId: workspace.workspaceId,
 					connected: true,
-					user
-				})
-			}] };
-		} catch (err) {
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify({ error: err instanceof Error ? err.message : String(err) })
-				}],
-				isError: true
-			};
+					status: result.status
+				});
+			} catch (error) {
+				return errorResult(error, {}, workspace === void 0 ? [] : [workspace.accessToken]);
+			}
 		}
-		let ws;
+		if (!this.catalogToolNames.has(name)) return errorResult(`Unknown Notion tool: ${name}`);
+		let workspace;
+		let forwarded;
 		try {
-			ws = resolveWorkspace(typeof argMap.workspaceId === "string" ? argMap.workspaceId : void 0);
-		} catch (err) {
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify({ error: err instanceof Error ? err.message : String(err) })
-				}],
-				isError: true
-			};
+			const prepared = prepareForwardedArguments(name, args);
+			workspace = this.resolveWorkspace(prepared.workspaceId);
+			forwarded = prepared.forwarded;
+		} catch (error) {
+			return errorResult(error);
 		}
-		const { workspaceId: _ignored, ...forwarded } = argMap;
 		try {
-			return await ws.client.callTool({
+			const result = assertBoundedToolResult(await withDeadline(workspace.client.callTool({
 				name,
 				arguments: forwarded
-			});
-		} catch (err) {
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify({
-						workspaceId: ws.workspaceId,
-						tool: name,
-						error: err instanceof Error ? err.message : String(err)
-					})
-				}],
-				isError: true
-			};
+			}), CHILD_CALL_TIMEOUT_MS, `Notion ${name}`));
+			if (childResultIsError(result)) return errorResult(extractToolErrorText(result) || "Notion child tool returned an error", {
+				workspaceId: workspace.workspaceId,
+				tool: name
+			}, [workspace.accessToken]);
+			return result;
+		} catch (error) {
+			return errorResult(error, {
+				workspaceId: workspace.workspaceId,
+				tool: name
+			}, [workspace.accessToken]);
 		}
-	});
-	const transport = new StdioServerTransport();
-	await proxy.connect(transport);
-	log(`Proxy running with ${String(workspaces.size)} connected workspace(s) and Pattern A selector enforcement`);
+	}
+	async close() {
+		if (this.closePromise !== void 0) return this.closePromise;
+		this.closePromise = (async () => {
+			const current = [...this.workspaces.values()];
+			this.workspaces.clear();
+			await Promise.all(current.map(async ({ client }) => closeChild(client)));
+		})();
+		return this.closePromise;
+	}
+	async loadAccounts() {
+		const rawAccounts = readNotionAccountsResponse(await this.apiClient.getNotionAccounts());
+		if (rawAccounts.length === 0) log("No Notion workspaces connected; starting in discovery-only mode");
+		for (const rawAccount of rawAccounts) {
+			let account;
+			try {
+				account = normalizeNotionAccount(rawAccount);
+			} catch (error) {
+				log(`Rejected invalid Notion connection ${typeof rawAccount.connectionId === "string" ? connectionLogId(rawAccount.connectionId) : "invalid"}: ${safeErrorMessage(error)}`);
+				this.allAccountsSnapshot.push({
+					workspaceId: null,
+					workspaceName: null,
+					connectedAt: null,
+					connected: false,
+					reason: "invalid_account"
+				});
+				continue;
+			}
+			if (this.claimedWorkspaceIds.has(account.workspaceId)) {
+				log(`Rejected duplicate Notion workspace from connection ${connectionLogId(account.connectionId)}`);
+				this.allAccountsSnapshot.push({
+					workspaceId: account.workspaceId,
+					workspaceName: account.workspaceName,
+					connectedAt: account.connectedAt,
+					connected: false,
+					reason: "duplicate_workspace"
+				});
+				continue;
+			}
+			this.claimedWorkspaceIds.set(account.workspaceId, account.connectionId);
+			if (account.accessToken.length === 0) {
+				log(`Missing token for Notion connection ${connectionLogId(account.connectionId)}`);
+				this.allAccountsSnapshot.push({
+					workspaceId: account.workspaceId,
+					workspaceName: account.workspaceName,
+					connectedAt: account.connectedAt,
+					connected: false,
+					reason: "missing_access_token"
+				});
+				continue;
+			}
+			try {
+				const controller = new AbortController();
+				let client;
+				try {
+					client = await withDeadline(this.spawnChild(account.accessToken, controller.signal), CHILD_START_TIMEOUT_MS, "Notion child startup");
+				} catch (error) {
+					controller.abort(error);
+					throw error;
+				}
+				this.workspaces.set(account.workspaceId, {
+					...account,
+					client
+				});
+				this.allAccountsSnapshot.push({
+					workspaceId: account.workspaceId,
+					workspaceName: account.workspaceName,
+					connectedAt: account.connectedAt,
+					connected: true
+				});
+				log(`Spawned child for Notion connection ${connectionLogId(account.connectionId)}`);
+			} catch (error) {
+				log(`Child startup failed for Notion connection ${connectionLogId(account.connectionId)}: ${safeErrorMessage(error, [account.accessToken])}`);
+				this.allAccountsSnapshot.push({
+					workspaceId: account.workspaceId,
+					workspaceName: account.workspaceName,
+					connectedAt: account.connectedAt,
+					connected: false,
+					reason: "spawn_failed"
+				});
+			}
+		}
+	}
+	async discoverChildCatalog() {
+		for (const workspace of this.workspaces.values()) try {
+			const tools = validateToolCatalog((await withDeadline(workspace.client.listTools(), CHILD_CATALOG_TIMEOUT_MS, "Notion child tool discovery")).tools);
+			for (const tool of tools) this.catalogToolNames.add(tool.name);
+			return tools;
+		} catch (error) {
+			log(`Tool discovery failed for Notion connection ${connectionLogId(workspace.connectionId)}: ${safeErrorMessage(error, [workspace.accessToken])}`);
+		}
+		return [];
+	}
+	resolveWorkspace(workspaceId) {
+		const workspace = this.workspaces.get(workspaceId);
+		if (workspace !== void 0) return workspace;
+		const known = this.allAccountsSnapshot.find((summary) => summary.workspaceId === workspaceId);
+		if (known !== void 0) throw new Error(`workspaceId ${workspaceId} is connected on this agent but its Notion credential process is unavailable (${known.reason ?? "unknown"}). Ask the user to reconnect this workspace from the dashboard.`);
+		throw new Error(`Unknown workspaceId: ${workspaceId}. Call notion_list_accounts to see the connected Notion workspaces on this agent.`);
+	}
+};
+function appendLocalTools(tools) {
+	return [
+		...tools,
+		{
+			name: "notion_list_accounts",
+			description: "List every connected Notion workspace and its local proxy readiness. Use workspaceId as the explicit selector on every other Notion tool.",
+			inputSchema: {
+				type: "object",
+				properties: {},
+				additionalProperties: false
+			},
+			annotations: {
+				readOnlyHint: true,
+				destructiveHint: false,
+				idempotentHint: true,
+				openWorldHint: false
+			}
+		},
+		{
+			name: "notion_check_connection",
+			description: "Verify that one selected Notion OAuth token is still valid. The result exposes only status, never the credential or Notion user profile.",
+			inputSchema: {
+				type: "object",
+				properties: { workspaceId: {
+					type: "string",
+					pattern: "^[A-Za-z0-9_-]{1,256}$",
+					maxLength: 256,
+					description: "Notion workspaceId from notion_list_accounts."
+				} },
+				required: ["workspaceId"],
+				additionalProperties: false
+			},
+			annotations: {
+				readOnlyHint: true,
+				destructiveHint: false,
+				idempotentHint: true,
+				openWorldHint: true
+			}
+		}
+	];
 }
-for (const signal of ["SIGTERM", "SIGINT"]) process.on(signal, () => {
-	killAllChildren().then(() => {
-		process.exit(0);
+async function spawnOfficialChild(accessToken, signal) {
+	const transport = new StdioClientTransport({
+		command: process.execPath,
+		args: [CHILD_BIN_PATH],
+		env: buildChildEnvironment(accessToken),
+		stderr: "ignore"
 	});
-});
-main().catch((err) => {
-	log(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
-	killAllChildren().finally(() => {
-		process.exit(1);
+	const client = new Client({
+		name: "notion-mcp-proxy",
+		version: SERVER_VERSION
 	});
+	const abort = () => {
+		closeChild(client);
+	};
+	signal.addEventListener("abort", abort, { once: true });
+	try {
+		await client.connect(transport);
+		if (signal.aborted) throw new Error("Notion child startup was aborted");
+		return client;
+	} catch (error) {
+		await closeChild(client);
+		throw error;
+	} finally {
+		signal.removeEventListener("abort", abort);
+	}
+}
+async function closeChild(client) {
+	await withDeadline(client.close(), CHILD_CLOSE_TIMEOUT_MS, "Notion child close").catch(() => void 0);
+}
+async function createProxyServer(apiClient, options = {}) {
+	const runtime = new NotionRuntime(apiClient, options);
+	try {
+		await runtime.initialize();
+	} catch (error) {
+		await runtime.close();
+		throw error;
+	}
+	const server = new Server({
+		name: "notion-mcp-proxy",
+		version: SERVER_VERSION
+	}, { capabilities: { tools: {} } });
+	server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: runtime.listTools() }));
+	server.setRequestHandler(CallToolRequestSchema, (request) => runtime.handleToolCall(request));
+	return {
+		server,
+		runtime
+	};
+}
+async function startServer(apiClient, options = {}) {
+	let client = apiClient;
+	if (client === void 0) {
+		const config = resolveConfig();
+		client = new AgentApiClient({
+			apiKey: config.apiKey,
+			apiUrl: config.apiUrl
+		});
+	}
+	const { server, runtime } = await createProxyServer(client, options);
+	let closePromise;
+	const close = () => {
+		closePromise ??= Promise.all([runtime.close(), withDeadline(server.close(), CHILD_CLOSE_TIMEOUT_MS, "Notion proxy close").catch(() => void 0)]).then(() => void 0);
+		return closePromise;
+	};
+	try {
+		await server.connect(new StdioServerTransport());
+		log(`Proxy running with ${String(runtime.listTools().length - 2)} child tool(s)`);
+		return {
+			server,
+			runtime,
+			close
+		};
+	} catch (error) {
+		await close();
+		throw error;
+	}
+}
+function isProcessEntrypoint(argvPath, metaUrl) {
+	try {
+		if (!argvPath) return false;
+		return pathToFileURL(realpathSync(argvPath)).href === pathToFileURL(realpathSync(fileURLToPath(metaUrl))).href;
+	} catch {
+		return false;
+	}
+}
+function resolveChildBin(packagePath, bin) {
+	if (bin === null || typeof bin !== "object" || Array.isArray(bin)) throw new Error(`${CHILD_PACKAGE} package bin metadata is invalid`);
+	const relativeBin = bin["notion-mcp-server"];
+	if (typeof relativeBin !== "string" || relativeBin.length === 0 || isAbsolute(relativeBin)) throw new Error(`${CHILD_PACKAGE} package bin path is invalid`);
+	const packageRoot = realpathSync(dirname(packagePath));
+	const binPath = realpathSync(resolve(packageRoot, relativeBin));
+	const childRelative = relative(packageRoot, binPath);
+	if (childRelative === "" || childRelative.startsWith("..") || isAbsolute(childRelative)) throw new Error(`${CHILD_PACKAGE} package bin resolves outside its package`);
+	return binPath;
+}
+function validateExactChildVersion(declared, installed) {
+	const declaredVersion = validateSemver(`${CHILD_PACKAGE} dependency`, declared);
+	const installedVersion = validateSemver(`${CHILD_PACKAGE} installed version`, installed);
+	if (declaredVersion !== installedVersion) throw new Error(`${CHILD_PACKAGE} installed version ${installedVersion} does not match exact dependency ${declaredVersion}`);
+	return declaredVersion;
+}
+function validateSemver(label, value) {
+	if (typeof value !== "string" || !/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u.test(value)) throw new Error(`${label} is invalid`);
+	return value;
+}
+function jsonResult(data) {
+	return { content: [{
+		type: "text",
+		text: JSON.stringify(data)
+	}] };
+}
+function errorResult(error, context = {}, secrets = []) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify({
+				...context,
+				error: safeErrorMessage(error, secrets)
+			})
+		}],
+		isError: true
+	};
+}
+function log(message) {
+	process.stderr.write(`[notion-mcp-proxy] ${message}\n`);
+}
+if (isProcessEntrypoint(process.argv[1], import.meta.url)) startServer().then((running) => {
+	let shutdownPromise;
+	const shutdown = () => {
+		if (shutdownPromise !== void 0) return;
+		shutdownPromise = running.close().catch((error) => {
+			log(`Failed to close cleanly: ${safeErrorMessage(error)}`);
+		}).then(() => process.exit(0));
+	};
+	process.once("SIGTERM", shutdown);
+	process.once("SIGINT", shutdown);
+}).catch((error) => {
+	log(`Fatal: ${safeErrorMessage(error)}`);
+	process.exitCode = 1;
 });
 //#endregion
-export {};
+export { CHILD_BIN_PATH, CHILD_VERSION, NotionRuntime, SERVER_VERSION, createProxyServer, isProcessEntrypoint, startServer };