@keystrokehq/notion 0.0.9 → 0.0.11

package/dist/integration-Dqf1rNJ6.mjs

@@ -0,0 +1,770 @@
+import { CredentialSet, Operation } from "@keystrokehq/core";
+import { z } from "zod";
+
+//#region ../../packages/integration-authoring/dist/official/runtime.mjs
+const REGISTRY_KEY = "__ks_official_integration_metadata_registry";
+function getRegistry() {
+	const globalStore = globalThis;
+	if (!globalStore[REGISTRY_KEY]) globalStore[REGISTRY_KEY] = /* @__PURE__ */ new WeakMap();
+	return globalStore[REGISTRY_KEY];
+}
+function registerOfficialOperation(operation, metadata) {
+	getRegistry().set(operation, Object.freeze({ ...metadata }));
+}
+
+//#endregion
+//#region ../../packages/integration-authoring/dist/official/index.mjs
+const OFFICIAL_CREDENTIAL_SET_ID_PREFIX = "keystroke:";
+function officialCredentialSetId(id) {
+	return `${OFFICIAL_CREDENTIAL_SET_ID_PREFIX}${id}`;
+}
+function stripOfficialCredentialSetIdPrefix(id) {
+	return id.startsWith(OFFICIAL_CREDENTIAL_SET_ID_PREFIX) ? id.slice(10) : id;
+}
+/**
+* Creates a factory for Keystroke-official integration operations.
+*
+* It keeps the same flat `run(input, credentials)` ergonomics as the generic
+* operation factory, while registering official metadata for builder/runtime
+* operation metadata.
+*/
+function createOfficialOperationFactory(credentialSet) {
+	const integrationId = stripOfficialCredentialSetIdPrefix(credentialSet.id);
+	return (config) => {
+		const wrappedRun = async (input, ctx) => {
+			const creds = ctx.credentials[credentialSet.id];
+			return config.run(input, creds);
+		};
+		const operation = new Operation({
+			id: config.id,
+			name: config.name,
+			description: config.description,
+			input: config.input,
+			output: config.output,
+			credentialSets: [credentialSet],
+			...config.tags !== void 0 ? { tags: config.tags } : {},
+			...config.needsApproval !== void 0 ? { needsApproval: config.needsApproval } : {},
+			...config.requiredOAuthScopes !== void 0 ? { requiredOAuthScopes: config.requiredOAuthScopes } : {},
+			...config.retries !== void 0 ? { retries: config.retries } : {},
+			...config.timeout !== void 0 ? { timeout: config.timeout } : {},
+			...config.maxDurationMs !== void 0 ? { maxDurationMs: config.maxDurationMs } : {},
+			run: wrappedRun
+		});
+		registerOfficialOperation(operation, { integrationId });
+		return operation;
+	};
+}
+/**
+* Creates an official integration bundle from a single config object.
+*
+* - Creates the public `CredentialSet` internally.
+* - Accepts optional `internal` fields for Keystroke-owned platform credentials.
+*/
+function defineOfficialIntegration(config) {
+	const internalCredentialSets = config.internal ?? {};
+	const allInternalCredentialSets = [
+		...internalCredentialSets.providerApp ? [internalCredentialSets.providerApp] : [],
+		...internalCredentialSets.providerAppVariants ?? [],
+		...internalCredentialSets.webhookVerification ? [internalCredentialSets.webhookVerification] : [],
+		...internalCredentialSets.other ?? []
+	];
+	const credentialSet = new CredentialSet({
+		id: config.id,
+		name: config.name,
+		description: config.description,
+		auth: config.auth,
+		...config.connections ? { connections: config.connections } : {},
+		...config.proxy ? { proxy: config.proxy } : {},
+		...config.needsRawSecret === true ? { needsRawSecret: true } : {}
+	});
+	return Object.freeze({
+		integration: {
+			id: config.id,
+			name: config.name,
+			...config.description !== void 0 ? { description: config.description } : {},
+			auth: config.auth,
+			...config.proxy ? { proxy: config.proxy } : {},
+			...config.needsRawSecret === true ? { needsRawSecret: true } : {},
+			...config.connections ? { connections: config.connections } : {}
+		},
+		credentialSet,
+		internalCredentialSets,
+		allInternalCredentialSets
+	});
+}
+
+//#endregion
+//#region src/_official/provider-app.ts
+const notionAppCredentialSet = new CredentialSet({
+	id: officialCredentialSetId("notion-app"),
+	exposure: "platform-only",
+	name: "Notion App",
+	auth: z.object({
+		clientId: z.string().min(1),
+		clientSecret: z.string().min(1)
+	})
+});
+const notionOfficialProviderSeed = {
+	provider: "notion",
+	appRef: "notion-official",
+	displayName: "Notion Platform",
+	credentialSetName: "Keystroke Notion Platform App",
+	envShape: {
+		KEYSTROKE_OFFICIAL_NOTION_CLIENT_ID: z.string().optional(),
+		KEYSTROKE_OFFICIAL_NOTION_CLIENT_SECRET: z.string().optional()
+	},
+	requiredEnvKeys: ["KEYSTROKE_OFFICIAL_NOTION_CLIENT_ID", "KEYSTROKE_OFFICIAL_NOTION_CLIENT_SECRET"],
+	externalAppIdEnvKey: "KEYSTROKE_OFFICIAL_NOTION_CLIENT_ID",
+	buildCredentials: (env) => ({
+		clientId: env.KEYSTROKE_OFFICIAL_NOTION_CLIENT_ID,
+		clientSecret: env.KEYSTROKE_OFFICIAL_NOTION_CLIENT_SECRET
+	})
+};
+const notionWebhookCredentialSet = new CredentialSet({
+	id: officialCredentialSetId("notion-webhook"),
+	exposure: "platform-only",
+	name: "Notion Webhook",
+	auth: z.object({ verificationToken: z.string().min(1) })
+});
+
+//#endregion
+//#region ../../packages/credential-connection/dist/chunk-DQk6qfdC.mjs
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+
+//#endregion
+//#region ../../packages/credential-connection/dist/defaults-YE9AvLIc.mjs
+/**
+* Shared OAuth 2.0 token-response plumbing.
+*
+* `parseOAuthTokenResponse` handles the two common wire formats (JSON and
+* form-urlencoded, the latter used by GitHub unless you explicitly ask for
+* JSON). `normalizeOAuthTokens` pulls the standard fields out of the parsed
+* body in both the flat form and Slack's nested `authed_user.access_token`
+* form. These helpers are exposed so integration authors overriding
+* `exchangeCode` / `refreshToken` do not have to re-implement them.
+*/
+var TokenExchangeError = class extends Error {
+	httpStatus;
+	constructor(httpStatus) {
+		super(`Token exchange failed: HTTP ${httpStatus}`);
+		this.name = "TokenExchangeError";
+		this.httpStatus = httpStatus;
+	}
+};
+async function parseOAuthTokenResponse(response) {
+	const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+	if (contentType.includes("application/json")) return await response.json();
+	const text = await response.text();
+	if (!text.trim()) return {};
+	if (contentType.includes("application/x-www-form-urlencoded") || text.includes("=")) {
+		const params = new URLSearchParams(text);
+		return Object.fromEntries(params.entries());
+	}
+	throw new Error(`Unsupported OAuth token response content type: ${contentType || "unknown"}`);
+}
+function normalizeOAuthTokens(tokenData) {
+	const authedUser = tokenData.authed_user;
+	const rawAccessToken = tokenData.access_token ?? authedUser?.access_token;
+	const rawRefreshToken = tokenData.refresh_token;
+	const rawExpiresIn = tokenData.expires_in;
+	const rawInstanceUrl = tokenData.instance_url;
+	return {
+		accessToken: typeof rawAccessToken === "string" ? rawAccessToken : void 0,
+		refreshToken: typeof rawRefreshToken === "string" ? rawRefreshToken : void 0,
+		expiresIn: typeof rawExpiresIn === "number" ? rawExpiresIn : typeof rawExpiresIn === "string" ? Number(rawExpiresIn) || void 0 : void 0,
+		instanceUrl: typeof rawInstanceUrl === "string" ? rawInstanceUrl : void 0
+	};
+}
+function buildAuthUrl(ctx) {
+	const { oauthClient, redirectUri, state, connection } = ctx;
+	const scopes = ctx.requestedScopes ?? connection.scopes;
+	const url = new URL(connection.authUrl);
+	url.searchParams.set("client_id", oauthClient.clientId);
+	url.searchParams.set("scope", scopes.join(" "));
+	url.searchParams.set("redirect_uri", redirectUri);
+	url.searchParams.set("state", state);
+	url.searchParams.set("response_type", "code");
+	return url.toString();
+}
+async function exchangeToken(params) {
+	const response = await fetch(params.tokenUrl, {
+		method: "POST",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/x-www-form-urlencoded"
+		},
+		body: params.body
+	});
+	if (!response.ok) throw new TokenExchangeError(response.status);
+	const raw = await parseOAuthTokenResponse(response);
+	const { accessToken, refreshToken, expiresIn, instanceUrl } = normalizeOAuthTokens(raw);
+	if (!accessToken) throw new Error("No access token in response");
+	return {
+		accessToken,
+		refreshToken,
+		expiresIn,
+		instanceUrl,
+		raw
+	};
+}
+async function exchangeCode(ctx) {
+	const { oauthClient, code, redirectUri, connection } = ctx;
+	if (!code) throw new Error("Missing authorization code");
+	return exchangeToken({
+		tokenUrl: connection.tokenUrl,
+		body: new URLSearchParams({
+			code,
+			client_id: oauthClient.clientId,
+			client_secret: oauthClient.clientSecret,
+			redirect_uri: redirectUri,
+			grant_type: "authorization_code"
+		})
+	});
+}
+async function refreshToken(ctx) {
+	const { oauthClient, refreshToken, connection } = ctx;
+	return exchangeToken({
+		tokenUrl: connection.tokenUrl,
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: oauthClient.clientId,
+			client_secret: oauthClient.clientSecret
+		})
+	});
+}
+const oauthDefaults = {
+	buildAuthUrl,
+	exchangeCode,
+	exchangeToken,
+	refreshToken
+};
+
+//#endregion
+//#region ../../packages/credential-connection/dist/index.mjs
+/**
+* Compose a base hook with zero or more customizers.
+*
+* Each customizer wraps the result of the previous. Execution order for
+* `pipe(base, a, b, c)` on input `ctx`:
+*
+* ```
+* c-pre → b-pre → a-pre → base(ctx) → a-post → b-post → c-post
+* ```
+*
+* Most presets in `./presets` only post-process, so ordering among them does
+* not matter. Presets that pre-process (rewrite `ctx` before `next`) state
+* their ordering sensitivity in their TSDoc.
+*
+* @example
+* ```ts
+* import { oauthDefaults, oauthPresets as p, pipe } from '@keystrokehq/credential-connection';
+*
+* buildAuthUrl: pipe(
+*   oauthDefaults.buildAuthUrl,
+*   p.scopeDelimiter(','),
+*   p.extraAuthParams({ prompt: 'consent' })
+* );
+* ```
+*/
+function pipe(base, ...customizers) {
+	return customizers.reduce((acc, customizer) => customizer(acc), base);
+}
+var presets_exports = /* @__PURE__ */ __exportAll({
+	basicAuthJsonBody: () => basicAuthJsonBody,
+	dynamicAuthUrlHost: () => dynamicAuthUrlHost,
+	dynamicTokenHost: () => dynamicTokenHost,
+	extraAuthParams: () => extraAuthParams,
+	fetchIdentityAfter: () => fetchIdentityAfter,
+	noScopeParam: () => noScopeParam,
+	rejectErrorField: () => rejectErrorField,
+	requireSuccessFlag: () => requireSuccessFlag,
+	scopeDelimiter: () => scopeDelimiter,
+	tokenExchangeUsing: () => tokenExchangeUsing
+});
+/**
+* Replace the `scope` query parameter's delimiter on the authorize URL.
+*
+* The default OAuth 2.0 implementation joins scopes with spaces. Slack and
+* Strava require commas.
+*
+* Ordering: post-processing only. Safe to compose in any order with other
+* authorize-URL presets.
+*
+* @example
+* ```ts
+* buildAuthUrl: pipe(oauthDefaults.buildAuthUrl, scopeDelimiter(','));
+* ```
+*
+* @see integrations/slack/src/oauth-connection.ts
+*/
+function scopeDelimiter(delim) {
+	return (next) => async (ctx) => {
+		const built = await next(ctx);
+		const url = new URL(built);
+		const scopes = ctx.requestedScopes ?? ctx.connection.scopes;
+		url.searchParams.set("scope", scopes.join(delim));
+		return url.toString();
+	};
+}
+/**
+* Remove the `scope` query parameter from the authorize URL entirely.
+*
+* Use this for providers that configure scopes at the app level (Notion,
+* Intercom) rather than at authorize time.
+*
+* Ordering: post-processing only.
+*
+* @example
+* ```ts
+* buildAuthUrl: pipe(oauthDefaults.buildAuthUrl, noScopeParam);
+* ```
+*
+* @see integrations/notion/src/oauth-connection.ts
+*/
+const noScopeParam = (next) => async (ctx) => {
+	const built = await next(ctx);
+	const url = new URL(built);
+	url.searchParams.delete("scope");
+	return url.toString();
+};
+/**
+* Append extra query parameters to the authorize URL.
+*
+* Accepts a static record (for fixed parameters like Google's
+* `access_type=offline`) or a function of the build context (for parameters
+* that depend on `oauthClient.metadata` or `initiateInput`).
+*
+* Ordering: post-processing only.
+*
+* @example
+* ```ts
+* // Static
+* extraAuthParams({ access_type: 'offline', prompt: 'consent' });
+* // Dynamic (Shopify per-shop)
+* extraAuthParams(({ initiateInput }) => ({ shop: String(initiateInput?.shop) }));
+* ```
+*
+* @see integrations/google/src/oauth-connection.ts
+*/
+function extraAuthParams(params) {
+	return (next) => async (ctx) => {
+		const built = await next(ctx);
+		const url = new URL(built);
+		const resolved = typeof params === "function" ? params(ctx) : params;
+		for (const [key, value] of Object.entries(resolved)) url.searchParams.set(key, value);
+		return url.toString();
+	};
+}
+/**
+* Rewrite the authorize URL's host with a runtime-resolved origin.
+*
+* Use for providers where the OAuth host is tenant-specific (Shopify
+* per-shop) or environment-specific (Salesforce sandbox vs production). The
+* resolver should return a full origin string (`https://host[:port]`); the
+* path, query, and hash from `ctx.connection.authUrl` are preserved.
+*
+* Ordering: pre-processing. Compose BEFORE post-processing presets so the
+* final URL already reflects the resolved host.
+*
+* @example
+* ```ts
+* // Shopify
+* dynamicAuthUrlHost(({ initiateInput }) => `https://${String(initiateInput?.shop)}`);
+* // Salesforce sandbox
+* dynamicAuthUrlHost(({ oauthClient }) =>
+*   oauthClient.metadata?.environment === 'sandbox'
+*     ? 'https://test.salesforce.com'
+*     : 'https://login.salesforce.com'
+* );
+* ```
+*/
+function dynamicAuthUrlHost(resolve) {
+	return (next) => async (ctx) => {
+		const originalUrl = new URL(ctx.connection.authUrl);
+		const newBase = new URL(resolve(ctx));
+		originalUrl.host = newBase.host;
+		originalUrl.protocol = newBase.protocol;
+		if (newBase.port) originalUrl.port = newBase.port;
+		const rewrittenConnection = {
+			...ctx.connection,
+			authUrl: originalUrl.toString()
+		};
+		return next({
+			...ctx,
+			connection: rewrittenConnection
+		});
+	};
+}
+/**
+* Matched exchange + refresh customizers that POST to the token endpoint
+* using the selected authentication style and body format.
+*
+* This preset REPLACES `next`'s body-building logic entirely. Reach for it
+* when the provider diverges fundamentally (JSON body, HTTP Basic auth)
+* rather than just tweaking behavior around the default. Applying this via
+* `pipe(default, tokenExchangeUsing({...}).exchangeCode)` discards `next`.
+*
+* @remarks
+* Replacement, not wrapping. Stated twice because this is the single most
+* error-prone preset shape in the catalog.
+*/
+function tokenExchangeUsing(options) {
+	return {
+		exchangeCode: () => async ({ oauthClient, code, redirectUri, connection }) => {
+			if (!code) throw new Error("Missing authorization code");
+			return doTokenExchange(options.tokenUrl ?? connection.tokenUrl, options, oauthClient, {
+				grant_type: "authorization_code",
+				code,
+				redirect_uri: redirectUri
+			});
+		},
+		refreshToken: () => async ({ oauthClient, refreshToken, connection }) => {
+			return doTokenExchange(options.tokenUrl ?? connection.tokenUrl, options, oauthClient, {
+				grant_type: "refresh_token",
+				refresh_token: refreshToken
+			});
+		}
+	};
+}
+/**
+* Shorthand for {@link tokenExchangeUsing} with `{ auth: 'basic', bodyFormat: 'json' }`.
+*
+* Notion and Asana both require HTTP Basic auth + a JSON body on their token
+* endpoints.
+*
+* @remarks Replacement semantics inherited from {@link tokenExchangeUsing}.
+*
+* @example
+* ```ts
+* const tokenExchange = basicAuthJsonBody();
+* exchangeCode: pipe(oauthDefaults.exchangeCode, tokenExchange.exchangeCode);
+* refreshToken: pipe(oauthDefaults.refreshToken, tokenExchange.refreshToken);
+* ```
+*
+* @see integrations/notion/src/oauth-connection.ts
+*/
+function basicAuthJsonBody() {
+	return tokenExchangeUsing({
+		auth: "basic",
+		bodyFormat: "json"
+	});
+}
+/**
+* Rewrite the token endpoint's host with a runtime-resolved origin before
+* invoking the downstream exchange / refresh hook.
+*
+* Use for providers where the token endpoint is tenant-specific (Shopify) or
+* environment-specific (Salesforce, Gusto).
+*
+* Ordering: pre-processing. Compose BEFORE other token-exchange presets so
+* they see the rewritten tokenUrl.
+*
+* @example
+* ```ts
+* // Salesforce sandbox
+* dynamicTokenHost(({ oauthClient }) =>
+*   oauthClient.metadata?.environment === 'sandbox'
+*     ? 'https://test.salesforce.com'
+*     : 'https://login.salesforce.com'
+* );
+* ```
+*/
+function dynamicTokenHost(resolve) {
+	return {
+		exchangeCode: (next) => async (ctx) => {
+			return next({
+				...ctx,
+				connection: rewriteTokenUrl(ctx.connection, resolve(ctx))
+			});
+		},
+		refreshToken: (next) => async (ctx) => {
+			return next({
+				...ctx,
+				connection: rewriteTokenUrl(ctx.connection, resolve(ctx))
+			});
+		}
+	};
+}
+/**
+* Throw when the token response is missing a truthy success flag.
+*
+* Slack returns `{ ok: true | false, ... }` on its v2 access endpoint; an
+* `ok: false` response still comes back HTTP 200 and often omits the
+* `access_token` field, so the default `!response.ok` and
+* "no access token" checks are both insufficient.
+*
+* @remarks REPLACEMENT, not wrapping. Because the flag check must happen
+* against the raw response body before the normalization step that throws on
+* missing `access_token`, this preset performs its own POST + parse instead
+* of delegating to `next`. Apply via
+* `pipe(oauthDefaults.exchangeCode, requireSuccessFlag('ok'))` for authoring
+* symmetry with other presets; `oauthDefaults.exchangeCode` is effectively
+* discarded.
+*
+* @throws An `Error` when `raw[key]` is falsy. The message includes
+* `raw[errorKey]` when present, so the resulting error surface is
+* actionable.
+*
+* @see integrations/slack/src/oauth-connection.ts
+*/
+function requireSuccessFlag(key = "ok", errorKey = "error") {
+	return () => async ({ oauthClient, code, redirectUri, connection }) => {
+		if (!code) throw new Error("Missing authorization code");
+		const response = await fetch(connection.tokenUrl, {
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/x-www-form-urlencoded"
+			},
+			body: new URLSearchParams({
+				client_id: oauthClient.clientId,
+				client_secret: oauthClient.clientSecret,
+				code,
+				redirect_uri: redirectUri,
+				grant_type: "authorization_code"
+			})
+		});
+		if (!response.ok) throw new TokenExchangeError(response.status);
+		const raw = await parseOAuthTokenResponse(response);
+		if (!raw[key]) {
+			const error = raw[errorKey];
+			const reason = typeof error === "string" ? error : "unknown error";
+			throw new Error(`Token exchange failed: ${reason}`);
+		}
+		const { accessToken, refreshToken, expiresIn, instanceUrl } = normalizeOAuthTokens(raw);
+		if (!accessToken) throw new Error("No access token in response");
+		return {
+			accessToken,
+			refreshToken,
+			expiresIn,
+			instanceUrl,
+			raw
+		};
+	};
+}
+/**
+* Throw when the token response carries a truthy `error` field.
+*
+* Intercom and some other providers report failures with HTTP 200 + an
+* `error` / `error_description` pair. This preset converts that shape into a
+* normalized exception.
+*
+* @remarks REPLACEMENT, not wrapping. Mirrors {@link requireSuccessFlag}:
+* the error-field check must happen against the raw response body before
+* the normalization step that throws on missing `access_token`, so this
+* preset performs its own POST + parse instead of delegating to `next`.
+*
+* @throws An `Error` when `raw[errorKey]` is truthy. The message uses
+* `raw[descriptionKey]` when present, otherwise falls back to
+* `raw[errorKey]`.
+*/
+function rejectErrorField(errorKey = "error", descriptionKey = "error_description") {
+	return () => async ({ oauthClient, code, redirectUri, connection }) => {
+		if (!code) throw new Error("Missing authorization code");
+		const response = await fetch(connection.tokenUrl, {
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/x-www-form-urlencoded"
+			},
+			body: new URLSearchParams({
+				client_id: oauthClient.clientId,
+				client_secret: oauthClient.clientSecret,
+				code,
+				redirect_uri: redirectUri,
+				grant_type: "authorization_code"
+			})
+		});
+		if (!response.ok) throw new TokenExchangeError(response.status);
+		const raw = await parseOAuthTokenResponse(response);
+		const error = raw[errorKey];
+		if (error) {
+			const description = raw[descriptionKey];
+			const reason = typeof description === "string" ? description : typeof error === "string" ? error : "unknown error";
+			throw new Error(`Token exchange failed: ${reason}`);
+		}
+		const { accessToken, refreshToken, expiresIn, instanceUrl } = normalizeOAuthTokens(raw);
+		if (!accessToken) throw new Error("No access token in response");
+		return {
+			accessToken,
+			refreshToken,
+			expiresIn,
+			instanceUrl,
+			raw
+		};
+	};
+}
+/**
+* After a successful token exchange, call an identity / me endpoint and stash
+* fields on `tokenResult.raw` under a namespaced prefix. Replaces the
+* duplicated `fetch(...).json()` + `result.raw._providerFoo = ...` pattern in
+* Linear, Google, Sentry, and Strava.
+*
+* Enrichment is best-effort — network errors and non-2xx responses during
+* the identity fetch do not abort the exchange. If the identity data is
+* required for correctness, use a raw {@link ExchangeCodeCustomizer} and
+* throw explicitly.
+*
+* @remarks Stashed values are string-keyed on `raw`; reading them back in
+* `extractInstallationInfo` or in a function-form `vault` requires a cast.
+* That matches the status quo — a typed thread-through is a future
+* improvement.
+*
+* @example
+* ```ts
+* exchangeCode: pipe(
+*   oauthDefaults.exchangeCode,
+*   fetchIdentityAfter<LinearViewerResponse>({
+*     url: 'https://api.linear.app/graphql',
+*     method: 'POST',
+*     body: { query: '{ viewer { id name } organization { id name } }' },
+*     extract: (res) => ({
+*       viewer: res.data?.viewer,
+*       organization: res.data?.organization,
+*     }),
+*     namespace: '_linear',
+*   }),
+* );
+* ```
+*
+* @see integrations/linear/src/oauth-connection.ts
+*/
+function fetchIdentityAfter(options) {
+	return (next) => async (ctx) => {
+		const result = await next(ctx);
+		const namespace = options.namespace ?? "_identity";
+		try {
+			const url = typeof options.url === "function" ? options.url(result) : options.url;
+			const extraHeaders = typeof options.headers === "function" ? options.headers(result) : options.headers;
+			const headers = {
+				Authorization: `Bearer ${result.accessToken}`,
+				Accept: "application/json",
+				...extraHeaders
+			};
+			const requestInit = {
+				method: options.method ?? "GET",
+				headers
+			};
+			if (options.body !== void 0) {
+				headers["Content-Type"] = headers["Content-Type"] ?? "application/json";
+				requestInit.body = JSON.stringify(options.body);
+			}
+			const response = await fetch(url, requestInit);
+			if (!response.ok) return result;
+			const json = await response.json();
+			const extracted = options.extract(json);
+			for (const [key, value] of Object.entries(extracted)) result.raw[`${namespace}:${key}`] = value;
+		} catch {}
+		return result;
+	};
+}
+async function doTokenExchange(tokenUrl, options, oauthClient, grantBody) {
+	const body = { ...grantBody };
+	const headers = { Accept: "application/json" };
+	if (options.auth === "basic") headers.Authorization = `Basic ${Buffer.from(`${oauthClient.clientId}:${oauthClient.clientSecret}`, "utf8").toString("base64")}`;
+	else {
+		body.client_id = oauthClient.clientId;
+		body.client_secret = oauthClient.clientSecret;
+	}
+	let requestBody;
+	if (options.bodyFormat === "json") {
+		headers["Content-Type"] = "application/json";
+		requestBody = JSON.stringify(body);
+	} else {
+		headers["Content-Type"] = "application/x-www-form-urlencoded";
+		requestBody = new URLSearchParams(body);
+	}
+	const response = await fetch(tokenUrl, {
+		method: "POST",
+		headers,
+		body: requestBody
+	});
+	if (!response.ok) throw new TokenExchangeError(response.status);
+	const raw = await parseOAuthTokenResponse(response);
+	const { accessToken, refreshToken, expiresIn, instanceUrl } = normalizeOAuthTokens(raw);
+	if (!accessToken) throw new Error("No access token in response");
+	return {
+		accessToken,
+		refreshToken,
+		expiresIn,
+		instanceUrl,
+		raw
+	};
+}
+function rewriteTokenUrl(connection, resolved) {
+	const originalUrl = new URL(connection.tokenUrl);
+	const newBase = new URL(resolved);
+	originalUrl.host = newBase.host;
+	originalUrl.protocol = newBase.protocol;
+	if (newBase.port) originalUrl.port = newBase.port;
+	return {
+		...connection,
+		tokenUrl: originalUrl.toString()
+	};
+}
+
+//#endregion
+//#region src/oauth-connection.ts
+const notionTokenExchange = presets_exports.basicAuthJsonBody();
+const notionOAuthConnection = {
+	kind: "oauth",
+	tokenType: "refreshable",
+	authUrl: "https://api.notion.com/v1/oauth/authorize",
+	tokenUrl: "https://api.notion.com/v1/oauth/token",
+	revokeUrl: "https://api.notion.com/v1/oauth/revoke",
+	scopes: [
+		"content:read",
+		"content:write",
+		"comments:read",
+		"comments:write",
+		"users:read"
+	],
+	vault: { accessToken: "NOTION_ACCESS_TOKEN" },
+	oauth: { id: "official.notion.oauth" },
+	buildAuthUrl: pipe(oauthDefaults.buildAuthUrl, presets_exports.noScopeParam, presets_exports.extraAuthParams({ owner: "user" })),
+	exchangeCode: pipe(oauthDefaults.exchangeCode, notionTokenExchange.exchangeCode),
+	refreshToken: pipe(oauthDefaults.refreshToken, notionTokenExchange.refreshToken)
+};
+
+//#endregion
+//#region src/integration.ts
+const notionAuthSchema = z.object({ NOTION_ACCESS_TOKEN: z.string().min(1) });
+const notionOfficialIntegration = {
+	id: "notion",
+	name: "Notion",
+	description: "Notion pages, blocks, data sources, comments, users, search, and triggers",
+	auth: notionAuthSchema,
+	connections: [{
+		id: "oauth",
+		label: "Connect Notion workspace",
+		recommended: true,
+		...notionOAuthConnection
+	}, {
+		id: "integration-token",
+		kind: "manual",
+		label: "Use internal integration token",
+		advanced: true,
+		input: notionAuthSchema
+	}]
+};
+const notionBundle = defineOfficialIntegration({
+	...notionOfficialIntegration,
+	internal: {
+		providerApp: notionAppCredentialSet,
+		webhookVerification: notionWebhookCredentialSet
+	}
+});
+const notion = notionBundle.credentialSet;
+
+//#endregion
+export { notionOfficialProviderSeed as a, notionAppCredentialSet as i, notionBundle as n, notionWebhookCredentialSet as o, notionOfficialIntegration as r, createOfficialOperationFactory as s, notion as t };