@notionhq/apps 0.0.16 → 0.0.17

package/src/connections.test.ts

@@ -1,9 +1,10 @@
 import { Client } from "@notionhq/client";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, expectTypeOf, it, vi } from "vitest";
 import {
 	connections,
 	createWorkflowConnections,
-	validateConnectionRequirements,
+	normalizeConnectionRequirements,
+	type WorkflowConnections,
 } from "./connections.js";
 
 afterEach(() => {
@@ -12,37 +13,95 @@ afterEach(() => {
 });
 
 describe("connection requirements", () => {
-	it("declares generated providers", () => {
-		expect(connections.calendar()).toEqual({ type: "calendar" });
-		expect(connections.box({ key: "documents" })).toEqual({ type: "box", key: "documents" });
-		expect(connections.googleDriveOauth()).toEqual({ type: "googleDriveOauth" });
-		expect(connections.discord({ key: "community" })).toEqual({
-			type: "discord",
-			key: "community",
-		});
+	it("normalizes object keys into manifest requirements", () => {
+		expect(
+			normalizeConnectionRequirements({
+				work: connections.calendar(),
+				support: connections.slack(),
+				team: connections.slack(),
+			}),
+		).toEqual([
+			{ type: "calendar", key: "work" },
+			{ type: "slack", key: "support" },
+			{ type: "slack", key: "team" },
+		]);
 	});
-
-	it("rejects duplicate keys across providers", () => {
-		expect(() =>
-			validateConnectionRequirements([
-				connections.calendar({ key: "work" }),
-				connections.slack({ key: "work" }),
-			]),
-		).toThrow("Duplicate");
+	it.each(["bad/key", "__proto__", "constructor", "prototype"])(
+		"rejects invalid or prototype-sensitive keys: %s",
+		(key) => {
+			expect(() => normalizeConnectionRequirements({ [key]: connections.slack() })).toThrow(
+				"Invalid",
+			);
+		},
+	);
+	it("rejects excessive requirements", () => {
+		const requirements: Record<string, { type: string }> = {};
+		for (let i = 0; i < 101; i++) requirements[`team${i}`] = connections.slack();
+		expect(() => normalizeConnectionRequirements(requirements)).toThrow("100");
 	});
-	it("rejects invalid keys and excessive requirements", () => {
-		expect(() =>
-			validateConnectionRequirements([connections.slack({ key: "bad/key" })]),
-		).toThrow("Invalid");
+	it("rejects old arrays and declarations with hidden or inherited keys", () => {
 		expect(() =>
-			validateConnectionRequirements(
-				Array.from({ length: 101 }, (_, i) => connections.slack({ key: `team${i}` })),
-			),
-		).toThrow("100");
+			Reflect.apply(normalizeConnectionRequirements, undefined, [[connections.slack()]]),
+		).toThrow("must be an object");
+		const inherited = { support: connections.slack() };
+		Object.setPrototypeOf(inherited, { hidden: connections.calendar() });
+		expect(() => normalizeConnectionRequirements(inherited)).toThrow("only own");
+		const hidden = { support: connections.slack() };
+		Object.defineProperty(hidden, "hidden", { value: connections.calendar() });
+		expect(() => normalizeConnectionRequirements(hidden)).toThrow("enumerable strings");
+		const symbolic = { [Symbol("support")]: connections.slack() };
+		expect(() => normalizeConnectionRequirements(symbolic)).toThrow("enumerable strings");
+		const legacyDeclaration = { support: { ...connections.slack(), key: "other" } };
+		expect(() => normalizeConnectionRequirements(legacyDeclaration)).toThrow("object property");
 	});
 });
 
 describe("workflow connection runtime", () => {
+	it("invokes separate bindings for multiple keys of the same provider", async () => {
+		vi.stubEnv(
+			"NOTION_CONNECTION_BINDINGS",
+			JSON.stringify([
+				{ key: "support", type: "slack", id: "support-id" },
+				{ key: "team", type: "slack", id: "team-id" },
+				{ key: "undeclared", type: "slack", id: "hidden-id" },
+			]),
+		);
+		const notion = new Client({ auth: "test" });
+		const request = vi.spyOn(notion, "request").mockResolvedValue({ result: undefined });
+		const declarations = { support: connections.slack(), team: connections.slack() };
+		const runtime = createWorkflowConnections(notion, declarations);
+		Object.assign(declarations, {
+			support: connections.calendar(),
+			injected: connections.slack(),
+		});
+		await runtime.support.findUserByEmail({ email: "support@example.com" });
+		await runtime.team.findUserByEmail({ email: "team@example.com" });
+		expect(request.mock.calls.map(([input]) => input.body)).toEqual([
+			{
+				connection: "support-id",
+				action: "findUserByEmail",
+				args: { email: "support@example.com" },
+			},
+			{
+				connection: "team-id",
+				action: "findUserByEmail",
+				args: { email: "team@example.com" },
+			},
+		]);
+		expect(Object.keys(runtime)).toEqual(["support", "team"]);
+		expect(Reflect.get(runtime, "undeclared")).toBeUndefined();
+		expect(Reflect.get(runtime, "injected")).toBeUndefined();
+		expect(Reflect.get(runtime, "toString")).toBeUndefined();
+		expect(runtime.support).toBe(runtime.support);
+	});
+	it("does not parse missing or malformed bindings until a declared client is used", () => {
+		vi.stubEnv("NOTION_CONNECTION_BINDINGS", "not json");
+		const runtime = createWorkflowConnections(new Client(), { support: connections.slack() });
+		expect(Object.keys(runtime)).toEqual(["support"]);
+		expect(() => runtime.support).toThrow();
+		expect(Object.keys(createWorkflowConnections(new Client(), {}))).toEqual([]);
+	});
+
 	it("preserves pagination through a generated OAuth provider method", async () => {
 		vi.stubEnv(
 			"NOTION_CONNECTION_BINDINGS",
@@ -52,9 +111,9 @@ describe("workflow connection runtime", () => {
 		const request = vi
 			.spyOn(notion, "request")
 			.mockResolvedValue({ result: { files: [], nextPageToken: "next" } });
-		const result = await createWorkflowConnections(notion)
-			.googleDriveOauth("documents")
-			.listFiles({ folderId: "folder", pageToken: "previous" });
+		const result = await createWorkflowConnections(notion, {
+			documents: connections.googleDriveOauth(),
+		}).documents.listFiles({ folderId: "folder", pageToken: "previous" });
 		expect(result.nextPageToken).toBe("next");
 		expect(request).toHaveBeenCalledWith({
 			path: "tools/run/internal",
@@ -73,9 +132,9 @@ describe("workflow connection runtime", () => {
 		);
 		const notion = new Client({ auth: "test" });
 		const request = vi.spyOn(notion, "request").mockResolvedValue({ result: [] });
-		await createWorkflowConnections(notion)
-			.box("documents")
-			.search({ question: "Quarterly report" });
+		await createWorkflowConnections(notion, { documents: connections.box() }).documents.search({
+			question: "Quarterly report",
+		});
 		expect(request).toHaveBeenCalledWith({
 			path: "tools/run/internal",
 			method: "post",
@@ -91,7 +150,9 @@ describe("workflow connection runtime", () => {
 		vi.stubEnv("NOTION_CONNECTION_BINDINGS", '[{"key":"support","type":"calendar","id":"a"}]');
 		const notion = new Client({ auth: "test" });
 		const request = vi.spyOn(notion, "request");
-		expect(() => createWorkflowConnections(notion).slack("support")).toThrow("not slack");
+		expect(
+			() => createWorkflowConnections(notion, { support: connections.slack() }).support,
+		).toThrow("not slack");
 		expect(request).not.toHaveBeenCalled();
 	});
 	it("invokes a typed Calendar method with the default binding", async () => {
@@ -101,7 +162,9 @@ describe("workflow connection runtime", () => {
 		);
 		const notion = new Client({ auth: "test" });
 		const request = vi.spyOn(notion, "request").mockResolvedValue({ result: { accounts: [] } });
-		const result = await createWorkflowConnections(notion).calendar().listCalendars({});
+		const result = await createWorkflowConnections(notion, {
+			calendar: connections.calendar(),
+		}).calendar.listCalendars({});
 		expect(result.accounts).toEqual([]);
 		expect(request).toHaveBeenCalledWith({
 			path: "tools/run/internal",
@@ -117,9 +180,12 @@ describe("workflow connection runtime", () => {
 		);
 		const notion = new Client({ auth: "test" });
 		const request = vi.spyOn(notion, "request").mockResolvedValue({ result: { ok: true } });
-		const runtime = createWorkflowConnections(notion);
+		const runtime = createWorkflowConnections(notion, {
+			support: connections.slack(),
+			team: connections.slack(),
+		});
 		await expect(
-			runtime.slack("support").findUserByEmail({ email: "person@example.com" }),
+			runtime.support.findUserByEmail({ email: "person@example.com" }),
 		).resolves.toEqual({
 			ok: true,
 		});
@@ -132,7 +198,7 @@ describe("workflow connection runtime", () => {
 				args: { email: "person@example.com" },
 			},
 		});
-		expect(() => runtime.slack("slack")).toThrow("not bound");
+		expect(() => runtime.team).toThrow("not bound");
 		expect(request).toHaveBeenCalledTimes(1);
 	});
 	it.each([
@@ -141,17 +207,115 @@ describe("workflow connection runtime", () => {
 		'[{"key":"support","type":"slack","id":"a"},{"key":"support","type":"slack","id":"b"}]',
 	])("rejects malformed or ambiguous bindings: %s", (metadata) => {
 		vi.stubEnv("NOTION_CONNECTION_BINDINGS", metadata);
-		expect(() => createWorkflowConnections(new Client()).slack("support")).toThrow();
+		expect(
+			() => createWorkflowConnections(new Client(), { support: connections.slack() }).support,
+		).toThrow();
 	});
 	it("propagates permission failures without retrying an alternate connection", async () => {
 		vi.stubEnv("NOTION_CONNECTION_BINDINGS", '[{"key":"support","type":"slack","id":"a"}]');
 		const notion = new Client({ auth: "test" });
 		const request = vi.spyOn(notion, "request").mockRejectedValue(new Error("forbidden"));
 		await expect(
-			createWorkflowConnections(notion)
-				.slack("support")
-				.findUserByEmail({ email: "person@example.com" }),
+			createWorkflowConnections(notion, {
+				support: connections.slack(),
+			}).support.findUserByEmail({ email: "person@example.com" }),
 		).rejects.toThrow("forbidden");
 		expect(request).toHaveBeenCalledTimes(1);
 	});
 });
+
+describe("generic OAuth connections", () => {
+	const config = {
+		authorizationEndpoint: "https://github.com/login/oauth/authorize",
+		tokenEndpoint: "https://github.com/login/oauth/access_token",
+		clientId: "client",
+		clientSecretEnv: "GITHUB_CLIENT_SECRET",
+		scope: "repo",
+	};
+	it("declares configuration with a secret reference", () => {
+		expect(connections.oauth(config)).toEqual({ type: "oauth", oauth: config });
+		const declaration = connections.oauth(config);
+		expectTypeOf(declaration.type).toEqualTypeOf<"oauth">();
+		expectTypeOf<
+			keyof WorkflowConnections<{ github: typeof declaration }>
+		>().toEqualTypeOf<"github">();
+		expectTypeOf<keyof WorkflowConnections<Record<never, never>>>().toEqualTypeOf<never>();
+		expect(normalizeConnectionRequirements({ github: declaration })).toEqual([
+			{ type: "oauth", key: "github", oauth: config },
+		]);
+	});
+	it("returns only the token bound to this workflow execution", async () => {
+		vi.stubEnv(
+			"NOTION_CONNECTION_BINDINGS",
+			JSON.stringify([{ key: "github", type: "oauth", id: "ab-cd" }]),
+		);
+		vi.stubEnv("NOTION_OAUTH_CONNECTION_ABCD", "scoped-token");
+		const notion = new Client({ auth: "test" });
+		const request = vi.spyOn(notion, "request");
+		expect(
+			await createWorkflowConnections(notion, {
+				github: connections.oauth(config),
+			}).github.accessToken(),
+		).toBe("scoped-token");
+		expect(request).not.toHaveBeenCalled();
+		expect(
+			() => createWorkflowConnections(notion, { other: connections.oauth(config) }).other,
+		).toThrow("not bound");
+	});
+	it("keeps separately keyed OAuth tokens isolated and omits undeclared bindings", async () => {
+		vi.stubEnv(
+			"NOTION_CONNECTION_BINDINGS",
+			JSON.stringify([
+				{ key: "github", type: "oauth", id: "first-id" },
+				{ key: "other", type: "oauth", id: "second-id" },
+				{ key: "undeclared", type: "oauth", id: "hidden-id" },
+			]),
+		);
+		vi.stubEnv("NOTION_OAUTH_CONNECTION_FIRSTID", "first-token");
+		vi.stubEnv("NOTION_OAUTH_CONNECTION_SECONDID", "second-token");
+		const runtime = createWorkflowConnections(new Client({ auth: "test" }), {
+			github: connections.oauth(config),
+			other: connections.oauth(config),
+		});
+		expect(await runtime.github.accessToken()).toBe("first-token");
+		expect(await runtime.other.accessToken()).toBe("second-token");
+		expect(Object.keys(runtime)).toEqual(["github", "other"]);
+		expect(Reflect.get(runtime, "undeclared")).toBeUndefined();
+	});
+
+	it("requires explicit authorization and does not fall back to worker OAuth", async () => {
+		vi.stubEnv(
+			"NOTION_CONNECTION_BINDINGS",
+			JSON.stringify([{ key: "github", type: "oauth", id: "unconfigured" }]),
+		);
+		vi.stubEnv("OAUTH_676974687562_ACCESS_TOKEN", "global-token");
+		await expect(
+			createWorkflowConnections(new Client({ auth: "test" }), {
+				github: connections.oauth(config),
+			}).github.accessToken(),
+		).rejects.toThrow("requires authorization");
+	});
+	it("rejects a provider connection used as generic OAuth", () => {
+		vi.stubEnv(
+			"NOTION_CONNECTION_BINDINGS",
+			JSON.stringify([{ key: "github", type: "slack", id: "connection" }]),
+		);
+		expect(
+			() =>
+				createWorkflowConnections(new Client({ auth: "test" }), {
+					github: connections.oauth(config),
+				}).github,
+		).toThrow("not oauth");
+	});
+	it.each(["http://localhost/token", "https://user:password@example.com/token"])(
+		"rejects unsafe token endpoint %s",
+		(tokenEndpoint) => {
+			expect(() => connections.oauth({ ...config, tokenEndpoint })).toThrow("HTTPS URLs");
+		},
+	);
+	it("protects the callback state and PKCE parameters", () => {
+		expect(() =>
+			connections.oauth({ ...config, authorizationParams: { state: "forged" } }),
+		).toThrow("protocol fields");
+	});
+});

package/src/connections.ts

@@ -1,61 +1,127 @@
+import { validateOAuthConfiguration, type OAuthConfiguration } from "./oauth.js";
 import { connectionTriggerDefinitions } from "./connection-trigger-definitions.generated.js";
 import type { WorkflowTrigger } from "./triggers.generated.js";
 import type { Client } from "@notionhq/client";
-import { createConnectionProviders, type ConnectionProviders } from "./providers.generated.js";
+import {
+	connections as providerConnections,
+	createConnectionClient,
+	type ConnectionClients,
+} from "./providers.generated.js";
 import type { ConnectionActionInvoker } from "./connection-actions.js";
 
-/** A setup requirement. The server decides which providers are available. */
-export type WorkflowConnection<TProvider extends string = string, TKey extends string = string> = {
+/** A setup requirement. The property name in a workflow supplies its key. */
+export type WorkflowConnection<TProvider extends string = string> = {
 	type: TProvider;
-	key?: TKey;
+	oauth?: OAuthConfiguration;
 };
 
-/** Keys declared for one provider in a workflow. */
+export type WorkflowConnectionDeclarations = Readonly<Record<string, WorkflowConnection>>;
+
+/** Serialized connection requirement sent in the workflow manifest. */
+export type WorkflowConnectionRequirement = WorkflowConnection & { key: string };
+
+/** Declared property names belonging to one provider. */
 export type WorkflowConnectionKeys<
-	TConnections extends readonly WorkflowConnection[],
+	TConnections extends WorkflowConnectionDeclarations,
 	TProvider extends string,
-> = WorkflowConnectionKey<Extract<TConnections[number], { type: TProvider }>>;
-
-type WorkflowConnectionKey<TConnection extends WorkflowConnection> =
-	TConnection extends WorkflowConnection
-		? "key" extends keyof TConnection
-			? Exclude<TConnection["key"], undefined>
-			: TConnection["type"]
-		: never;
+> = Extract<
+	{
+		[TKey in keyof TConnections]: TConnections[TKey]["type"] extends TProvider ? TKey : never;
+	}[keyof TConnections],
+	string
+>;
+
 type ConnectionBinding = { key: string; type: string; id: string };
 
 /** Requirements are declarations, not credentials or permission grants. */
-export { connections } from "./providers.generated.js";
+export const connections = {
+	...providerConnections,
+	oauth(options: OAuthConfiguration): WorkflowConnection<"oauth"> {
+		validateOAuthConfiguration(options);
+		return { type: "oauth", oauth: structuredClone(options) };
+	},
+};
+export type { OAuthConfiguration } from "./oauth.js";
+export type OAuthConnection = { accessToken(): Promise<string> };
+
+type WorkflowConnectionClients = ConnectionClients & { oauth: OAuthConnection };
+
+type WorkflowConnectionClient = WorkflowConnectionClients[keyof WorkflowConnectionClients];
 
 export type WorkflowConnections<
-	TConnections extends readonly WorkflowConnection[] = readonly WorkflowConnection[],
-> = Pick<ConnectionProviders, Extract<keyof ConnectionProviders, TConnections[number]["type"]>>;
+	TConnections extends WorkflowConnectionDeclarations = WorkflowConnectionDeclarations,
+> = {
+	readonly [TKey in keyof TConnections]: WorkflowConnectionClients[Extract<
+		keyof WorkflowConnectionClients,
+		TConnections[TKey]["type"]
+	>];
+};
 
 /** @internal */
-export function validateConnectionRequirements(requirements: readonly WorkflowConnection[]): void {
-	if (requirements.length > 100) throw new Error("Workflows support at most 100 connections.");
-	const keys = new Set<string>();
-	for (const requirement of requirements) {
-		if (!requirement.type) throw new Error("A workflow connection needs a provider type.");
-		const key = requirement.key ?? requirement.type;
-		if (!/^[a-zA-Z][a-zA-Z0-9_-]{0,127}$/.test(key)) {
+export function normalizeConnectionRequirements(
+	declarations: WorkflowConnectionDeclarations,
+): WorkflowConnectionRequirement[] {
+	if (typeof declarations !== "object" || declarations === null || Array.isArray(declarations)) {
+		throw new Error("Workflow connections must be an object keyed by connection name.");
+	}
+	const prototype: unknown = Object.getPrototypeOf(declarations);
+	if (prototype !== Object.prototype && prototype !== null) {
+		throw new Error("Workflow connections must contain only own connection declarations.");
+	}
+	const keys = Object.keys(declarations);
+	if (Reflect.ownKeys(declarations).length !== keys.length) {
+		throw new Error("Workflow connection keys must be enumerable strings.");
+	}
+	if (keys.length > 100) throw new Error("Workflows support at most 100 connections.");
+	return Object.entries(declarations).map(([key, requirement]) => {
+		if (
+			!/^[a-zA-Z][a-zA-Z0-9_-]{0,127}$/.test(key) ||
+			["__proto__", "prototype", "constructor"].includes(key)
+		) {
 			throw new Error("Invalid workflow connection key: " + key);
 		}
-		if (keys.has(key)) throw new Error("Duplicate workflow connection: " + key);
-		keys.add(key);
-	}
+		if (
+			typeof requirement !== "object" ||
+			requirement === null ||
+			typeof requirement.type !== "string" ||
+			!requirement.type ||
+			!Object.hasOwn(requirement, "type")
+		) {
+			throw new Error("A workflow connection needs a provider type.");
+		}
+		if ("key" in requirement)
+			throw new Error(
+				"Declare a connection key as its workflow object property, not in the provider options.",
+			);
+
+		if (requirement.type === "oauth") {
+			if (!requirement.oauth)
+				throw new Error("OAuth connections require provider configuration.");
+			validateOAuthConfiguration(requirement.oauth);
+		} else if (requirement.oauth !== undefined) {
+			throw new Error("OAuth configuration is only valid on OAuth connections.");
+		}
+
+		return {
+			type: requirement.type,
+			key,
+			...(requirement.oauth === undefined
+				? {}
+				: { oauth: structuredClone(requirement.oauth) }),
+		};
+	});
 }
 
 /** @internal */
 export function validateTriggerConnections(
 	triggers: readonly WorkflowTrigger[],
-	requirements: readonly WorkflowConnection[],
+	requirements: readonly WorkflowConnectionRequirement[],
 ): void {
 	const seen = new Set<string>();
 	for (const trigger of triggers) {
 		if (!("connectionKey" in trigger) || trigger.connectionKey === undefined) continue;
 		const requirement = requirements.find(
-			(connection) => (connection.key ?? connection.type) === trigger.connectionKey,
+			(connection) => connection.key === trigger.connectionKey,
 		);
 		const definition = connectionTriggerDefinitions.find(
 			(definition) => definition.type === trigger.type,
@@ -75,10 +141,41 @@ export function validateTriggerConnections(
 }
 
 /** @internal */
-export function createWorkflowConnections(notion: Client): WorkflowConnections {
-	// Capture the execution's bindings; defer parsing so non-connection workflows
-	// remain usable without runtime connection metadata.
+export function createWorkflowConnections<TConnections extends WorkflowConnectionDeclarations>(
+	notion: Client,
+	declarations: TConnections | undefined,
+): WorkflowConnections<TConnections>;
+export function createWorkflowConnections(
+	notion: Client,
+	declarations: WorkflowConnectionDeclarations | undefined,
+): Record<string, WorkflowConnectionClient> {
+	const requirements = normalizeConnectionRequirements(declarations ?? {});
+	// Capture this execution's metadata, but do not parse unused bindings.
 	const rawBindings = process.env.NOTION_CONNECTION_BINDINGS;
+	const clients: Record<string, WorkflowConnectionClient> = {};
+	Object.setPrototypeOf(clients, null);
+	for (const requirement of requirements) {
+		let client: WorkflowConnectionClient | undefined;
+		Object.defineProperty(clients, requirement.key, {
+			enumerable: true,
+			get() {
+				if (client) return client;
+				const binding = resolveBinding(requirement.key);
+				if (binding.type !== requirement.type) {
+					throw new Error(
+						`Workflow connection "${requirement.key}" is ${binding.type}, not ${requirement.type}.`,
+					);
+				}
+				client =
+					requirement.type === "oauth"
+						? createOAuthConnection(binding)
+						: createConnectionClient(requirement.type, invoker(binding));
+				return client;
+			},
+		});
+	}
+	return Object.freeze(clients);
+
 	function resolveBinding(key: string): ConnectionBinding {
 		const bindings: unknown = JSON.parse(rawBindings ?? "[]");
 		if (!Array.isArray(bindings) || !bindings.every(isConnectionBinding)) {
@@ -92,11 +189,7 @@ export function createWorkflowConnections(notion: Client): WorkflowConnections {
 		}
 		return { ...matches[0] };
 	}
-	function invoker(provider: string, key: string): ConnectionActionInvoker {
-		const binding = resolveBinding(key);
-		if (binding.type !== provider) {
-			throw new Error(`Workflow connection "${key}" is ${binding.type}, not ${provider}.`);
-		}
+	function invoker(binding: ConnectionBinding): ConnectionActionInvoker {
 		return async <Result>(action: string, args: object): Promise<Result> => {
 			const response = await notion.request<{ result: Result }>({
 				path: "tools/run/internal",
@@ -106,7 +199,20 @@ export function createWorkflowConnections(notion: Client): WorkflowConnections {
 			return response.result;
 		};
 	}
-	return createConnectionProviders(invoker);
+}
+
+function createOAuthConnection(binding: ConnectionBinding): OAuthConnection {
+	const envKey = `NOTION_OAUTH_CONNECTION_${binding.id.replaceAll("-", "").toUpperCase()}`;
+	const token = process.env[envKey];
+	return {
+		async accessToken() {
+			if (!token)
+				throw new Error(
+					`Workflow OAuth connection "${binding.key}" requires authorization.`,
+				);
+			return token;
+		},
+	};
 }
 
 function isConnectionBinding(value: unknown): value is ConnectionBinding {

package/src/index.ts

@@ -3,5 +3,6 @@ export { customAgent } from "./notion-as-code/custom-agent.js";
 export { database } from "./notion-as-code/database.js";
 export { page } from "./notion-as-code/page.js";
 export { teamspace } from "./notion-as-code/teamspace.js";
+export { view } from "./notion-as-code/view.js";
 export { sync } from "./sync.js";
 export { workflow } from "./workflow.js";

package/src/notion-as-code/database.ts

@@ -12,6 +12,7 @@ import { createPage, type ChildPageArgs, type PageHandle } from "./page.js";
 import { recordIntent } from "./recorder.js";
 import { assertParent, assertUserResourceId } from "./resource.js";
 import { createAppsDatabase, type AppsSchemaForProperties } from "./schema.js";
+import type { ViewSchema } from "./views.js";
 
 /** Input for declaring a database and its optional data sources. */
 export type DatabaseArgs<
@@ -21,8 +22,7 @@ export type DatabaseArgs<
 	/** Omit to create a private top-level database in the Apps workspace. */
 	parent?: Parent;
 	dataSources?: DataSources;
-	// TODO: Port view types.
-	views?: readonly unknown[];
+	views?: readonly ViewSchema[];
 	icon?: NotionAsCodeIcon;
 	// TODO: Port cover types.
 	cover?: unknown;
@@ -81,7 +81,7 @@ export type DatabaseHandle<
 			DataSourcePropertiesForResourceId<DataSources, ResourceId>
 		>;
 	};
-	addView: (view: unknown) => void;
+	addView: (view: ViewSchema) => void;
 };
 
 /** A database whose sole data source is available without an ID lookup. */

package/src/notion-as-code/handles.ts

@@ -4,12 +4,14 @@ import { date, datetime } from "./date.js";
 import { page } from "./page.js";
 import { assertUserResourceId } from "./resource.js";
 import { teamspace } from "./teamspace.js";
+import { view } from "./view.js";
 
 const notionAsCodeFacade = {
 	teamspace,
 	database,
 	page,
 	customAgent,
+	view,
 	text: (value: string) => [[value]],
 	number: (value: number) => [[String(value)]],
 	date,

package/src/notion-as-code/index.ts

@@ -15,6 +15,61 @@ export type {
 } from "./database.js";
 export type { ChildPageArgs, PageArgs, PageHandle } from "./page.js";
 export type { TeamspaceArgs, TeamspaceHandle } from "./teamspace.js";
+export type { ViewArgs, ViewHandle } from "./view.js";
+export type {
+	AdvancedFilterSchema,
+	BasePropertyFilter,
+	BaseViewSchema,
+	BoardViewSchema,
+	CalendarViewSchema,
+	CheckboxGroupByFormat,
+	CheckboxPropertyFilter,
+	CoverAspectFormat,
+	CoverFormat,
+	CoverSizeFormat,
+	DatabaseViewSortDirection,
+	DateFilterMode,
+	DateGroupByFormat,
+	DatePropertyFilter,
+	DatePropertyFilterValue,
+	DatePropertyTypes,
+	ExactDatePropertyFilterValue,
+	ExactRangeDatePropertyFilterValue,
+	FeedViewSchema,
+	FilterSchema,
+	FormulaGroupByFormat,
+	GalleryViewSchema,
+	GroupByFormat,
+	GroupByFormatBase,
+	GroupFormat,
+	ListViewSchema,
+	LocationGroupByFormat,
+	MultiSelectPropertyFilter,
+	NumberGroupByFormat,
+	NumberPropertyFilter,
+	PersonGroupByFormat,
+	PersonPropertyFilter,
+	PropertyFilterSchema,
+	PropertyFormat,
+	PropertyViewSortSchema,
+	PropertyVisibility,
+	RelationGroupByFormat,
+	RelationPropertyFilter,
+	RelativeDatePreset,
+	RelativeDatePropertyFilterValue,
+	RelativeDateRangeUnit,
+	RelativeToTodayDatePropertyFilterValue,
+	SelectGroupByFormat,
+	SelectPropertyFilter,
+	StatusGroupByFormat,
+	StatusPropertyFilter,
+	TableViewSchema,
+	TextGroupByFormat,
+	TextPropertyFilter,
+	TimelineViewSchema,
+	ViewSchema,
+	ViewType,
+} from "./views.js";
 
 /** Experimental Notion-as-Code facade for Apps SDK project metadata. */
 export const notion = createNotion();