@notionhq/apps 0.0.18 → 0.0.20

package/dist/workflow-access.js

@@ -0,0 +1,135 @@
+const ACCESS_ALIAS_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]{0,127}$/;
+const RESERVED_ACCESS_ALIASES = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+const RESOURCE_TYPES = {
+  page: true,
+  database: true,
+  dataSource: true,
+  customAgent: true
+};
+function normalizeWorkflowAccess(declarations) {
+  const source = declarations ?? {};
+  assertPlainObject(source, "Workflow access must be an object keyed by alias.");
+  const keys = Object.keys(source);
+  if (Reflect.ownKeys(source).length !== keys.length) {
+    throw new Error("Workflow access aliases must be enumerable strings.");
+  }
+  if (keys.length > 100) {
+    throw new Error("Workflows support at most 100 access requirements.");
+  }
+  const normalized = /* @__PURE__ */ Object.create(null);
+  for (const alias of keys) {
+    if (!ACCESS_ALIAS_PATTERN.test(alias) || RESERVED_ACCESS_ALIASES.has(alias)) {
+      throw new Error(`Invalid workflow access alias: ${alias}`);
+    }
+    const declaration = source[alias];
+    if (!isRecord(declaration) || !Object.hasOwn(declaration, "resource") || !Object.hasOwn(declaration, "level")) {
+      throw new Error(`Workflow access "${alias}" must declare a resource and level.`);
+    }
+    const resource = declaration.resource;
+    if (!isRecord(resource) || !Object.hasOwn(resource, "resourceType") || !Object.hasOwn(resource, "resourceId") || typeof resource.resourceId !== "string" || resource.resourceId.length === 0 || !isWorkflowAccessResourceType(resource.resourceType)) {
+      throw new Error(
+        `Workflow access "${alias}" must reference a supported NaC resource handle.`
+      );
+    }
+    let requirement;
+    if (resource.resourceType === "customAgent") {
+      if (declaration.level !== "call") {
+        throw new Error(
+          `Workflow access "${alias}" custom agents only support level "call".`
+        );
+      }
+      requirement = {
+        type: resource.resourceType,
+        resourceId: resource.resourceId,
+        level: declaration.level
+      };
+    } else {
+      if (!isWorkflowAccessResourceLevel(declaration.level)) {
+        throw new Error(
+          `Workflow access "${alias}" ${resource.resourceType} level must be view, comment, edit, or fullAccess.`
+        );
+      }
+      requirement = {
+        type: resource.resourceType,
+        resourceId: resource.resourceId,
+        level: declaration.level
+      };
+    }
+    normalized[alias] = Object.freeze(requirement);
+  }
+  return Object.freeze(normalized);
+}
+function hydrateWorkflowAccess(requirements) {
+  const expected = requirements ?? {};
+  const aliases = Object.keys(expected);
+  const empty = /* @__PURE__ */ Object.create(null);
+  if (aliases.length === 0) {
+    return Object.freeze(empty);
+  }
+  const rawBindings = process.env.NOTION_ACCESS_BINDINGS;
+  if (rawBindings === void 0) {
+    throw new Error(
+      "Workflow access requirements are not bound. Deploy and configure this requirement before running it."
+    );
+  }
+  if (rawBindings.length === 0) {
+    throw new Error("Invalid NOTION_ACCESS_BINDINGS metadata.");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(rawBindings);
+  } catch (error) {
+    throw new Error("Invalid NOTION_ACCESS_BINDINGS metadata.", { cause: error });
+  }
+  assertPlainObject(parsed, "Invalid NOTION_ACCESS_BINDINGS metadata.");
+  const bindingKeys = Object.keys(parsed);
+  if (Reflect.ownKeys(parsed).length !== bindingKeys.length || bindingKeys.length !== aliases.length || bindingKeys.some((alias) => !Object.hasOwn(expected, alias))) {
+    throw new Error(
+      "Invalid NOTION_ACCESS_BINDINGS metadata: aliases do not match workflow access."
+    );
+  }
+  const resolved = /* @__PURE__ */ Object.create(null);
+  for (const alias of aliases) {
+    const requirement = expected[alias];
+    if (!requirement) {
+      throw new Error(`Workflow access "${alias}" is not declared.`);
+    }
+    const binding = parsed[alias];
+    if (!isBinding(binding)) {
+      throw new Error(`Invalid NOTION_ACCESS_BINDINGS metadata for access "${alias}".`);
+    }
+    if (binding.type !== requirement.type || binding.resourceId !== requirement.resourceId || binding.level !== requirement.level) {
+      throw new Error(
+        `Workflow access "${alias}" binding does not match its declared type, resourceId, or level.`
+      );
+    }
+    resolved[alias] = Object.freeze({ type: binding.type, id: binding.id });
+  }
+  return Object.freeze(resolved);
+}
+function isWorkflowAccessResourceType(value) {
+  return typeof value === "string" && Object.hasOwn(RESOURCE_TYPES, value);
+}
+function isWorkflowAccessResourceLevel(value) {
+  return value === "view" || value === "comment" || value === "edit" || value === "fullAccess";
+}
+function isBinding(value) {
+  if (!isRecord(value) || Reflect.ownKeys(value).length !== 4) return false;
+  const keys = Object.keys(value);
+  if (keys.length !== 4 || !keys.includes("type") || !keys.includes("resourceId") || !keys.includes("level") || !keys.includes("id")) {
+    return false;
+  }
+  return isWorkflowAccessResourceType(value.type) && typeof value.resourceId === "string" && value.resourceId.length > 0 && typeof value.level === "string" && (isWorkflowAccessResourceLevel(value.level) || value.level === "call") && typeof value.id === "string" && value.id.length > 0;
+}
+function assertPlainObject(value, message) {
+  if (!isRecord(value)) throw new Error(message);
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) throw new Error(message);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export {
+  hydrateWorkflowAccess,
+  normalizeWorkflowAccess
+};

package/dist/workflow.d.ts

@@ -1,4 +1,5 @@
 import { type WorkflowConnectionDeclarations, type WorkflowConnectionRequirement, type WorkflowConnections } from "./connections.js";
+import { type WorkflowAccess, type WorkflowAccessDeclarations, type WorkflowAccessRequirements } from "./workflow-access.js";
 import type { CapabilityContext } from "./context.js";
 import { type RunMetadata } from "./runtime-metadata.js";
 import { type WorkflowState } from "./workflow-state.js";
@@ -37,6 +38,7 @@ export type WorkflowWaitUntilResult = {
 type WorkflowHandlerResult = {
     status: "success";
 } | WorkflowWaitUntilResult;
+export type { WorkflowAccess, WorkflowAccessAgentLevel, WorkflowAccessBindings, WorkflowAccessDeclaration, WorkflowAccessDeclarations, WorkflowAccessLevel, WorkflowAccessLevelFor, WorkflowAccessResource, WorkflowAccessResourceLevel, WorkflowAccessResourceType, WorkflowAccessRequirement, WorkflowAccessRequirements, WorkflowAccessValue, } from "./workflow-access.js";
 export type WorkflowEvent = WorkflowEventMap[keyof WorkflowEventMap];
 export type WorkflowEventForTrigger<T extends WorkflowTrigger> = WorkflowEventMap[T["type"]];
 export type WorkflowEventForTriggers<T extends readonly WorkflowTrigger[]> = WorkflowEventForTrigger<T[number]>;
@@ -44,7 +46,7 @@ export { connections, type WorkflowConnection, type WorkflowConnectionDeclaratio
 /**
  * Configuration passed to {@link workflow}.
  */
-export type WorkflowConfiguration<TTriggers extends readonly [WorkflowTrigger, ...WorkflowTrigger[]], TConnections extends WorkflowConnectionDeclarations = WorkflowConnectionDeclarations> = {
+export type WorkflowConfiguration<TTriggers extends readonly [WorkflowTrigger, ...WorkflowTrigger[]], TConnections extends WorkflowConnectionDeclarations = WorkflowConnectionDeclarations, TAccess extends WorkflowAccessDeclarations = WorkflowAccessDeclarations> = {
     /**
      * A human-readable name for the workflow, shown in the UI when viewing workflows
      */
@@ -59,14 +61,20 @@ export type WorkflowConfiguration<TTriggers extends readonly [WorkflowTrigger, .
      * Each trigger defines a specific event or condition that causes the workflow to run.
      */
     triggers: TTriggers;
+    /**
+     * Notion-as-Code resources whose access is configured during cloud deployment.
+     * Deployment reconciles grants through the existing Notion-module permissions
+     * and supplies named runtime bindings on `context.access`.
+     */
+    access?: TAccess;
     /**
      * Connections that must be set up before this workflow can run.
      */
     connections?: TConnections;
-    handler: (event: WorkflowEventForTriggers<TTriggers>, context: WorkflowContext<TConnections>) => Promise<void> | void;
+    handler: (event: WorkflowEventForTriggers<TTriggers>, context: WorkflowContext<TConnections, TAccess>) => Promise<void> | void;
 };
 /** Configuration that checks trigger keys against declared connections. */
-export type WorkflowTriggerConfiguration<TTriggers extends readonly [WorkflowTrigger, ...WorkflowTrigger[]], TConnections extends WorkflowConnectionDeclarations> = Omit<WorkflowConfiguration<TTriggers, TConnections>, "triggers"> & {
+export type WorkflowTriggerConfiguration<TTriggers extends readonly [WorkflowTrigger, ...WorkflowTrigger[]], TConnections extends WorkflowConnectionDeclarations, TAccess extends WorkflowAccessDeclarations = WorkflowAccessDeclarations> = Omit<WorkflowConfiguration<TTriggers, TConnections, TAccess>, "triggers"> & {
     triggers: (context: {
         triggers: WorkflowTriggerCreators<NoInfer<TConnections>>;
     }) => TTriggers;
@@ -87,6 +95,7 @@ export type Workflow<TTriggers extends readonly [WorkflowTrigger, ...WorkflowTri
         description: string;
         triggers: TTriggers;
         connections?: readonly WorkflowConnectionRequirement[];
+        access?: WorkflowAccessRequirements;
     };
     handler: (event: WorkflowEventForTriggers<TTriggers>, options?: HandlerOptions) => Promise<WorkflowHandlerResult | undefined>;
 };
@@ -119,8 +128,8 @@ export type Workflow<TTriggers extends readonly [WorkflowTrigger, ...WorkflowTri
 export declare function workflow<const TTriggers extends readonly [
     WorkflowTriggerForConnections<NoInfer<TConnections>>,
     ...WorkflowTriggerForConnections<NoInfer<TConnections>>[]
-], const TConnections extends WorkflowConnectionDeclarations = Record<never, never>>(configuration: WorkflowTriggerConfiguration<TTriggers, TConnections>): Workflow<TTriggers>;
-export declare function workflow<const TTriggers extends readonly [WorkflowTrigger, ...WorkflowTrigger[]], const TConnections extends WorkflowConnectionDeclarations = Record<never, never>>(configuration: WorkflowConfiguration<TTriggers, TConnections>): Workflow<TTriggers>;
+], const TConnections extends WorkflowConnectionDeclarations = Record<never, never>, const TAccess extends WorkflowAccessDeclarations = Record<never, never>>(configuration: WorkflowTriggerConfiguration<TTriggers, TConnections, TAccess>): Workflow<TTriggers>;
+export declare function workflow<const TTriggers extends readonly [WorkflowTrigger, ...WorkflowTrigger[]], const TConnections extends WorkflowConnectionDeclarations = Record<never, never>, const TAccess extends WorkflowAccessDeclarations = Record<never, never>>(configuration: WorkflowConfiguration<TTriggers, TConnections, TAccess>): Workflow<TTriggers>;
 /** Context passed to a workflow step. */
 export type StepContext = {
     /**
@@ -158,7 +167,9 @@ type WorkflowWait = {
     until(name: string, options: WorkflowWaitUntilOptions): Promise<void>;
 };
 /** Context passed to a workflow handler. */
-export type WorkflowContext<TConnections extends WorkflowConnectionDeclarations = WorkflowConnectionDeclarations> = CapabilityContext & {
+export type WorkflowContext<TConnections extends WorkflowConnectionDeclarations = WorkflowConnectionDeclarations, TAccess extends WorkflowAccessDeclarations = WorkflowAccessDeclarations> = CapabilityContext & {
+    /** Resolved NaC bindings for this invocation; UI-granted resources are not added here. */
+    readonly access: WorkflowAccess<TAccess>;
     connections: WorkflowConnections<TConnections>;
 } & RunMetadata & {
     /**

package/dist/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAKtD,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,KAAK,EACX,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,6BAA6B,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,KAAK,cAAc,GAAG;IACrB,yEAAyE;IACzE,cAAc,CAAC,EAAE,IAAI,CAAC;CACtB,CAAC;AAEF,KAAK,0BAA0B,GAAG;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;KACjC,IAAI,IAAI,MAAM,0BAA0B,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC,GAC7F,0BAA0B;CAC3B,CAAC,MAAM,0BAA0B,CAAC,CAAC;AAEpC,KAAK,eAAe,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAEzC,MAAM,MAAM,wBAAwB,GACjC;IACA,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,CAAC,EAAE,eAAe,CAAC;CACrB,GACD;IACA,KAAK,EAAE,oBAAoB,CAAC;IAC5B,GAAG,CAAC,EAAE,eAAe,CAAC;CACrB,CAAC;AAEL,MAAM,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,SAAS,CAAC;IAClB,IAAI,EAAE;QACL,IAAI,EAAE,OAAO,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;KACnB,CAAC;CACF,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG,uBAAuB,CAAC;AAI7E,MAAM,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAErE,MAAM,MAAM,uBAAuB,CAAC,CAAC,SAAS,eAAe,IAAI,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE7F,MAAM,MAAM,wBAAwB,CAAC,CAAC,SAAS,SAAS,eAAe,EAAE,IACxE,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpC,OAAO,EACN,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACpB,MAAM,kBAAkB,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,qBAAqB,CAChC,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,EAClE,YAAY,SAAS,8BAA8B,GAAG,8BAA8B,IACjF;IACH;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,QAAQ,EAAE,SAAS,CAAC;IAEpB;;OAEG;IACH,WAAW,CAAC,EAAE,YAAY,CAAC;IAE3B,OAAO,EAAE,CACR,KAAK,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAC1C,OAAO,EAAE,eAAe,CAAC,YAAY,CAAC,KAClC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,4BAA4B,CACvC,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,EAClE,YAAY,SAAS,8BAA8B,IAChD,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,UAAU,CAAC,GAAG;IACtE,QAAQ,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,uBAAuB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAA;KAAE,KAAK,SAAS,CAAC;CAC/F,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,CACnB,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,GAAG,SAAS;IAC7E,eAAe;IACf,GAAG,eAAe,EAAE;CACpB,IACE;IACH,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,SAAS,CAAC;QACpB,WAAW,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,CACR,KAAK,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAC1C,OAAO,CAAC,EAAE,cAAc,KACpB,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,QAAQ,CACvB,KAAK,CAAC,SAAS,SAAS,SAAS;IAChC,6BAA6B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,GAAG,6BAA6B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE;CACzD,EACD,KAAK,CAAC,YAAY,SAAS,8BAA8B,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/E,aAAa,EAAE,4BAA4B,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7F,wBAAgB,QAAQ,CACvB,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,EACxE,KAAK,CAAC,YAAY,SAAS,8BAA8B,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/E,aAAa,EAAE,qBAAqB,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;AAsFtF,yCAAyC;AACzC,MAAM,MAAM,WAAW,GAAG;IACzB;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,KAAK,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,KAAK,kBAAkB,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;AAEvD,mCAAmC;AACnC,MAAM,MAAM,mBAAmB,GAAG;IACjC;;;;OAIG;IACH,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACvB,CAAC;AAEF,KAAK,YAAY,GAAG;IACnB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC,CAAC,EACD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,mBAAmB,EAC5B,EAAE,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;CAClC,CAAC;AAEF,KAAK,YAAY,GAAG;IACnB;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE,CAAC;AAEF,4CAA4C;AAC5C,MAAM,MAAM,eAAe,CAC1B,YAAY,SAAS,8BAA8B,GAAG,8BAA8B,IACjF,iBAAiB,GAAG;IACvB,WAAW,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;CAC/C,GAAG,WAAW,GAAG;IAChB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,iEAAiE;IACjE,IAAI,EAAE,YAAY,CAAC;CACnB,CAAC"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGN,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,MAAM,sBAAsB,CAAC;AAK9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAKtD,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,KAAK,EACX,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,6BAA6B,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,KAAK,cAAc,GAAG;IACrB,yEAAyE;IACzE,cAAc,CAAC,EAAE,IAAI,CAAC;CACtB,CAAC;AAEF,KAAK,0BAA0B,GAAG;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;KACjC,IAAI,IAAI,MAAM,0BAA0B,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC,GAC7F,0BAA0B;CAC3B,CAAC,MAAM,0BAA0B,CAAC,CAAC;AAEpC,KAAK,eAAe,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAEzC,MAAM,MAAM,wBAAwB,GACjC;IACA,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,CAAC,EAAE,eAAe,CAAC;CACrB,GACD;IACA,KAAK,EAAE,oBAAoB,CAAC;IAC5B,GAAG,CAAC,EAAE,eAAe,CAAC;CACrB,CAAC;AAEL,MAAM,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,SAAS,CAAC;IAClB,IAAI,EAAE;QACL,IAAI,EAAE,OAAO,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;KACnB,CAAC;CACF,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG,uBAAuB,CAAC;AAI7E,YAAY,EACX,cAAc,EACd,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,MAAM,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAErE,MAAM,MAAM,uBAAuB,CAAC,CAAC,SAAS,eAAe,IAAI,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE7F,MAAM,MAAM,wBAAwB,CAAC,CAAC,SAAS,SAAS,eAAe,EAAE,IACxE,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpC,OAAO,EACN,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACpB,MAAM,kBAAkB,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,qBAAqB,CAChC,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,EAClE,YAAY,SAAS,8BAA8B,GAAG,8BAA8B,EACpF,OAAO,SAAS,0BAA0B,GAAG,0BAA0B,IACpE;IACH;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,QAAQ,EAAE,SAAS,CAAC;IAEpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;OAEG;IACH,WAAW,CAAC,EAAE,YAAY,CAAC;IAE3B,OAAO,EAAE,CACR,KAAK,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAC1C,OAAO,EAAE,eAAe,CAAC,YAAY,EAAE,OAAO,CAAC,KAC3C,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,4BAA4B,CACvC,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,EAClE,YAAY,SAAS,8BAA8B,EACnD,OAAO,SAAS,0BAA0B,GAAG,0BAA0B,IACpE,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,GAAG;IAC/E,QAAQ,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,uBAAuB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAA;KAAE,KAAK,SAAS,CAAC;CAC/F,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,CACnB,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,GAAG,SAAS;IAC7E,eAAe;IACf,GAAG,eAAe,EAAE;CACpB,IACE;IACH,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,SAAS,CAAC;QACpB,WAAW,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;QACvD,MAAM,CAAC,EAAE,0BAA0B,CAAC;KACpC,CAAC;IACF,OAAO,EAAE,CACR,KAAK,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAC1C,OAAO,CAAC,EAAE,cAAc,KACpB,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,QAAQ,CACvB,KAAK,CAAC,SAAS,SAAS,SAAS;IAChC,6BAA6B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,GAAG,6BAA6B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE;CACzD,EACD,KAAK,CAAC,YAAY,SAAS,8BAA8B,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAChF,KAAK,CAAC,OAAO,SAAS,0BAA0B,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEvE,aAAa,EAAE,4BAA4B,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,GAC3E,QAAQ,CAAC,SAAS,CAAC,CAAC;AACvB,wBAAgB,QAAQ,CACvB,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,EACxE,KAAK,CAAC,YAAY,SAAS,8BAA8B,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAChF,KAAK,CAAC,OAAO,SAAS,0BAA0B,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EACtE,aAAa,EAAE,qBAAqB,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;AA0F/F,yCAAyC;AACzC,MAAM,MAAM,WAAW,GAAG;IACzB;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,KAAK,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,KAAK,kBAAkB,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;AAEvD,mCAAmC;AACnC,MAAM,MAAM,mBAAmB,GAAG;IACjC;;;;OAIG;IACH,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACvB,CAAC;AAEF,KAAK,YAAY,GAAG;IACnB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC,CAAC,EACD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,mBAAmB,EAC5B,EAAE,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;CAClC,CAAC;AAEF,KAAK,YAAY,GAAG;IACnB;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE,CAAC;AAEF,4CAA4C;AAC5C,MAAM,MAAM,eAAe,CAC1B,YAAY,SAAS,8BAA8B,GAAG,8BAA8B,EACpF,OAAO,SAAS,0BAA0B,GAAG,0BAA0B,IACpE,iBAAiB,GAAG;IACvB,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,WAAW,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;CAC/C,GAAG,WAAW,GAAG;IAChB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,iEAAiE;IACjE,IAAI,EAAE,YAAY,CAAC;CACnB,CAAC"}

package/dist/workflow.js

@@ -3,6 +3,10 @@ import {
   normalizeConnectionRequirements,
   validateTriggerConnections
 } from "./connections.js";
+import {
+  hydrateWorkflowAccess,
+  normalizeWorkflowAccess
+} from "./workflow-access.js";
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
@@ -19,6 +23,7 @@ import {
 } from "./connections.js";
 function workflow(configuration) {
   const requirements = normalizeConnectionRequirements(configuration.connections ?? {});
+  const accessRequirements = normalizeWorkflowAccess(configuration.access);
   const connectionDeclarations = configuration.connections === void 0 ? void 0 : structuredClone(configuration.connections);
   const triggers = typeof configuration.triggers === "function" ? configuration.triggers({ triggers: createWorkflowTriggers() }) : configuration.triggers;
   validateTriggerConnections(triggers, requirements);
@@ -28,7 +33,8 @@ function workflow(configuration) {
       name: configuration.name,
       description: configuration.description,
       triggers,
-      ...configuration.connections === void 0 ? {} : { connections: requirements }
+      ...configuration.connections === void 0 ? {} : { connections: requirements },
+      ...configuration.access === void 0 ? {} : { access: accessRequirements }
     },
     async handler(event, options) {
       try {
@@ -38,6 +44,7 @@ function workflow(configuration) {
         const step = createStep(runMetadata);
         const capabilityContext = {
           ...baseContext,
+          access: hydrateWorkflowAccess(accessRequirements),
           connections: createWorkflowConnections(
             baseContext.notion,
             connectionDeclarations

package/docs/BUILD.md

@@ -43,10 +43,11 @@ natural capability owner.
 1. Discover top-level files in the capability directories.
 2. Generate `.notion/entry.ts` with workflow and sync imports and a dispatcher.
 3. Bundle the app's code into `dist/worker.js`, leaving npm packages external.
-4. Evaluate custom-block declarations separately, validate capability exports and
-   configuration, and write `dist/manifest.json`. Blocks do not enter `worker.js`.
+4. Evaluate custom-block declarations separately. Blocks do not enter `worker.js`.
 5. Evaluate worker capabilities in a separate build-only metadata bundle to record
-   Notion-as-Code declarations, then emit `dist/provisioning.json` if there are any.
+   Notion-as-Code declarations. Validate workflow access references against those
+   declarations before writing the manifest and optional provisioning artifact.
+6. Emit `dist/manifest.json` and, when declarations exist, `dist/provisioning.json`.
 
 Capability modules must therefore be importable without secrets or network access.
 Read required environment variables and make requests inside handlers or workflow
@@ -170,7 +171,8 @@ uploaded project must declare its SDK dependency and a `build` script that invok
 Worker using `workersCreateWorker` with `createApp: true`, or updates the existing
 Worker, then uploads source and calls `workersBuildWorker` with the Worker ID.
 For App-linked Workers, the build endpoint coordinates capability registration,
-Notion-as-Code provisioning, and database attachment before reporting build success.
+Notion-as-Code provisioning, database attachment, workflow binding resolution,
+and workflow permission reconciliation before reporting build success.
 It returns the normal build result and run ID, not provisioning state. No separate
 Apps deployment endpoint is required.
 
@@ -193,6 +195,9 @@ flow and local state, and reconciles attachments. It reads the optional
 `dist/provisioning.json` locally and does not upload it separately or invoke
 the cloud build endpoint.
 
+Workflows with nonempty `access` require cloud deployment. The local-build path
+rejects them after the SDK build and before uploading or deploying the bundle.
+
 Resource bindings are not stored in SDK build output. Local deployments retain a
 local state file and report `state_file`; cloud deployments keep installation-owned
 resource mappings and state on the server. Cloud builds do not import local state
@@ -202,6 +207,35 @@ switching between modes may recreate resources rather than reuse existing bindin
 Cloud failures never automatically retry locally. There is no rollback: code or
 resources may already have changed when a deployment fails.
 
+## Workflow access
+
+`workflow({ access: { handbook: { resource: handbook, level: "view" } }, ... })`
+declares access to a NaC resource and a named runtime binding. The manifest
+contains only the alias and its symbolic `{ type, resourceId, level }`
+requirement; live IDs are not build output.
+Build validation rejects references missing from the current provisioning
+declarations or having the wrong resource kind. `resourceId` is required because
+it identifies the declaration used for this validation and binding.
+
+After provisioning, cloud deployment resolves requirements against the successful
+NaC apply result. It reconciles code-managed grants through the existing
+Notion-module permissions and saves those permissions together with resolved
+bindings on the workflow's worker module, keyed by capability and alias, in one
+workflow transaction. Bindings are not authorization: the existing permissions
+authorize `context.notion` calls. Redeployment updates or removes code-managed
+grants as declarations change while preserving manually configured UI grants.
+
+Execution reads the selected workflow configuration, not the latest NaC state,
+validates the bindings against the capability requirements, and injects only that
+capability's declared bindings. The SDK exposes typed, readonly `{ type, id }`
+entries in `context.access`; UI-granted resources do not appear there. Use live
+record IDs directly in `context.notion` calls for UI-granted resources; those
+calls remain subject to the existing permissions. Missing or mismatched bindings
+fail before the handler executes.
+
+See the [workflow skill](../skills/workflow/SKILL.md#resources-created-with-the-app)
+for supported resource types, access levels, and an authoring example.
+
 ## Manifest
 
 The workflow-only manifest retains the platform's existing resource fields as empty arrays:

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@notionhq/apps",
-	"version": "0.0.18",
+	"version": "0.0.20",
 	"description": "An SDK for building workflow apps for Notion",
 	"license": "MIT",
 	"bin": {

package/skills/notion-as-code/SKILL.md

@@ -24,6 +24,14 @@ owned by one capability, use a local module such as
 are shared across capabilities or do not have a natural capability owner. Module
 evaluation must work without credentials or network access.
 
+To configure a workflow's access to a declared page, database, data source, or
+custom agent, pass its handle in `access: { alias: { resource: handle, level } }`.
+The handler receives the live identity as `context.access.alias.id`; importing
+a declaration alone does not request access. See the
+[workflow skill](../workflow/SKILL.md#resources-created-with-the-app) for levels
+and examples. Nonempty workflow `access` requires cloud deployment; `--local-build`
+rejects it before upload.
+
 ## Where declarations are picked up
 
 The Apps build discovers direct `.ts` children of `src/workflows/` and
@@ -67,7 +75,8 @@ root exports support:
 
 - `teamspace({ resourceId, name, accessLevel })`, with `addPage` and
   `teamspace.addDatabase(id, args)` on the returned handle.
-- `page({ resourceId, parent?, properties?, content? })`, with
+- `page({ resourceId, parent?, properties?, content? })`; regular page titles use
+  `properties: { title: notion.text("My Page Title") }`. It also has
   `addPage` and `page.addDatabase(id, args)` for children.
 - `database(resourceId, { dataSourceResourceId, name, schema, parent?, views? })`,
   returning a single source as `handle.dataSource`, or
@@ -82,6 +91,11 @@ root exports support:
   Use property resource IDs in view filters, sorts, and layout options; calendar
   views require `calendarBy`, and timeline views require `timelineBy`.
 
+For a regular page, set the title with
+`properties: { title: notion.text("My Page Title") }`. A Markdown heading in
+`content` creates a child heading block; it does not set the page title. For a
+database page, use the title property's schema name instead of `title`.
+
 A database declaration must include at least one data source or at least one
 view. A linked-only database may omit `datasources`, or use `datasources: {}`,
 only when `views` is nonempty. `{}`, `{ datasources: {} }`, and
@@ -123,8 +137,7 @@ The Apps SDK exposes a subset of Notion as Code. Data sources are nested inside
 Apps deployment rejects workspace creation or changes and supplies the App's
 workspace binding itself. Value helpers and types stay on their existing
 subpaths. For example, import `{ notion }` from `@notionhq/apps/notion-as-code`
-for `notion.text(...)` or `notion.file(resourceId)`. The latter creates a file
-reference, not an upload or file declaration. These helpers are not root exports.
+for `notion.text(...)`. These helpers are not root exports.
 CLI acceptance of a serialized intent envelope alone does not establish server
 support for its contents.
 

package/skills/workflow/SKILL.md

@@ -110,8 +110,8 @@ configuration, and do not log secrets or private payloads.
 
 ## Resources created with the App
 
-Use [Notion as Code](../notion-as-code/SKILL.md) for pages and databases that
-should be created during deployment. Prefer it over equivalent manual setup
+Use [Notion as Code](../notion-as-code/SKILL.md) for pages, databases, and custom agents
+that should be created during deployment. Prefer it over equivalent manual setup
 or API calls that create the App's resources. Use runtime API calls for dynamic
 data changes, not as a substitute for supported Notion as Code setup.
 Keep declarations at module scope. A small workflow-specific resource can be
@@ -120,39 +120,76 @@ guide page in `src/workflows/sayHello/lib/notion.ts`:
 
 ```ts
 import { page } from "@notionhq/apps";
+import { notion } from "@notionhq/apps/notion-as-code";
 
 export const guide = page({
 	resourceId: "workflow-guide",
-	content: "# Workflow guide\nThis App runs a scheduled workflow.",
+	properties: { title: notion.text("Workflow guide") },
+	content: "This App runs a scheduled workflow.",
 });
 ```
 
-Import the module from `src/workflows/sayHello.ts` so the build records it:
+Import the handle into the workflow and declare the named binding it needs:
 
 ```ts
 import { workflow } from "@notionhq/apps";
 import { triggers } from "@notionhq/apps/triggers";
 
-import "./sayHello/lib/notion.js";
+import { guide } from "./sayHello/lib/notion.js";
 
 export default workflow({
-	name: "Say Hello",
-	description: "Says hello on a recurring schedule.",
+	name: "Read guide",
+	description: "Reads the App's guide on a recurring schedule.",
 	triggers: [triggers.scheduled()],
+	access: { guide: { resource: guide, level: "view" } },
 	handler: async (_event, context) => {
-		await context.step("Say hello", () => {
-			console.log("Hello from your workflow!");
-		});
+		await context.step("Read guide", () =>
+			context.notion.pages.retrieve({ page_id: context.access.guide.id }),
+		);
 	},
 });
 ```
 
-The page is provisioned during deployment, not on every workflow run.
-Database declarations follow the same import pattern; see the
-[sync example](../sync/SKILL.md#choose-the-database-source) for using a Notion as Code
-data source in a sync. Notion as Code resource IDs are declaration identities, not live
-Notion UUIDs to pass to `context.notion`. Runtime API calls still belong in
-durable steps and need actual resolved Notion IDs.
+The page is provisioned during deployment, not on every workflow run. Inline
+declarations in `access` work too. Importing a declaration alone provisions the
+resource but does not create a `context.access` alias. An `access` entry declares
+the needed permission level and a named binding for that NaC resource.
+
+`access` accepts page, database, data-source, and custom-agent handles. Pages,
+databases, and data sources support `view`, `comment`, `edit`, and `fullAccess`;
+custom agents support only `call`. Keys are workflow-local aliases. The handler's
+typed `context.access` exposes each declared alias as a readonly `{ type, id }`,
+not the declaration handle or a permission-management API. UI-granted resources
+are permissions only: they do not create `context.access` aliases.
+
+For a resource already granted to the workflow in Notion's UI, use its live
+record ID directly in a `context.notion` call:
+
+```ts
+await context.step("Read granted page", () =>
+	context.notion.pages.retrieve({ page_id: "page-id" }),
+);
+```
+
+Such a UI grant needs no `access` entry, NaC declaration, or NaC `resourceId`.
+The call remains subject to the workflow's existing Notion-module permissions.
+
+Use a data-source handle when calling `context.notion.dataSources`: its resolved
+ID is a collection ID. A database handle resolves to the database block ID;
+these identities are not interchangeable. Notion as Code `resourceId` values
+remain declaration identities, not live Notion UUIDs.
+
+Cloud deployment resolves declared handles to live IDs and reconciles their
+grants through the existing Notion-module permissions. It saves permissions and
+bindings together; bindings themselves do not authorize calls. Changing `access`
+updates code-managed grants and bindings while preserving manually configured
+UI grants. Normal draft/publish and runtime authorization still apply. Missing
+or mismatched required bindings fail before the handler runs.
+
+Deploy workflows with nonempty `access` using `ntn apps deploy`, without
+`--local-build`. Local-build deployment rejects them before upload. Runtime API
+calls still belong in durable steps. For syncs, see the
+[data-source example](../sync/SKILL.md#choose-the-database-source).
 
 ## Review a workflow
 

package/src/cli/build.test.ts

@@ -204,6 +204,30 @@ describe("buildApp", () => {
 			/hello.ts.*customBlock/,
 		);
 	});
+	it("emits symbolic access requirements for every NaC resource kind", async () => {
+		const { manifest } = await buildApp(fixture("workflow-access"));
+		expect(manifest.capabilities).toEqual([
+			{
+				type: "workflow",
+				key: "access",
+				config: {
+					name: "Access",
+					description: "Declares all workflow access resource kinds",
+					triggers: [{ type: "notion.page.created" }],
+					access: {
+						home: { type: "page", resourceId: "home", level: "view" },
+						records: { type: "database", resourceId: "records", level: "edit" },
+						source: {
+							type: "dataSource",
+							resourceId: "records-source",
+							level: "comment",
+						},
+						agent: { type: "customAgent", resourceId: "agent", level: "call" },
+					},
+				},
+			},
+		]);
+	});
 
 	it("builds a sync manifest with a Notion-as-Code meetings database", async () => {
 		const { manifest } = await buildApp(example("sync"));

package/src/cli/build.ts

@@ -54,24 +54,29 @@ export async function buildApp(projectRoot: string): Promise<BuildResult> {
 	}
 
 	const blockConfigs = await buildBlockDeclarations(projectRoot, capabilities);
-	const manifest = await extractManifest(bundlePath, capabilities, blockConfigs);
-	const manifestPath = path.join(projectRoot, "dist", "manifest.json");
-	await fs.promises.writeFile(manifestPath, `${JSON.stringify(manifest, null, "\t")}\n`);
-
-	await emitProvisioningArtifact(
+	const entityProvisioning = await buildMetadata(
 		projectRoot,
 		capabilities.filter((capability) => capability.runtime === "worker"),
 	);
+	const manifest = await extractManifest(
+		bundlePath,
+		capabilities,
+		blockConfigs,
+		entityProvisioning,
+	);
+	const manifestPath = path.join(projectRoot, "dist", "manifest.json");
+	await fs.promises.writeFile(manifestPath, `${JSON.stringify(manifest, null, "\t")}\n`);
+
+	await emitProvisioningArtifact(projectRoot, entityProvisioning);
 
 	return { manifest, bundlePath, manifestPath };
 }
 
-/** Build Notion-as-Code metadata separately so it does not ship in the Worker bundle. */
+/** Emit the Notion-as-Code artifact recorded by the build-only metadata bundle. */
 async function emitProvisioningArtifact(
 	projectRoot: string,
-	capabilities: readonly DiscoveredCapability[],
+	entityProvisioning: RecordedProvisioning,
 ): Promise<void> {
-	const entityProvisioning = await buildMetadata(projectRoot, capabilities);
 	const provisioningPath = path.join(projectRoot, "dist", "provisioning.json");
 	if (entityProvisioning.intents.length === 0) {
 		await fs.promises.rm(provisioningPath, { force: true });