@open-everywhere/provider-notion 0.1.0

package/dist/agent/tools/read_notion_page.js

@@ -0,0 +1,327 @@
+// The doc-body read tool for the ambient Notion surface (notion-ambient-surface-design.md
+// Step 0). The ambient supervisor judges + replies off the COMMENT context (a comment usually
+// anchors to specific text); when a reply needs the doc's own prose — to answer a question about
+// the page, or to catch a factual problem in it — the agent pulls the body with this tool. Body
+// BY REFERENCE (chat-vs-ticketing-and-tool-uniformity.md rec #3): the doc is fetched on demand,
+// NEVER inlined into the wake, so a big page can't blow the backscroll budget.
+//
+// SURFACE GATE: this reads a *Notion* page, so it only makes sense on a Notion session. Authored
+// as a per-session DYNAMIC resolver (defineDynamic) that returns the real tool only when the
+// session platform is `notion`, and `null` (the tool is absent, not merely throwing) elsewhere —
+// the exact discipline access/source-scoped-mount.ts states, so a Slack/Discord agent never sees it.
+//
+// TWO PLANES SINCE OPE-913, and they differ in mount, fence and CREDENTIAL:
+//   • CHAT plane — a Notion-origin turn reads its own wake container's page on the chat credential
+//     (`channel-key`). Narrowed to the DELEGATED-WORKER grain by OPE-1014 — see the note below.
+//   • WORK plane — any session whose DOMAIN declares a Notion work credential reads that domain's
+//     pages, from any surface, on the WORK credential. This is what makes a Slack-woken delegated
+//     worker able to ground itself in the spec it was told to build from (the OPE-913 soak
+//     finding). A domain that declares no work credential holds no grant and sees no change.
+// channels/notion-work.ts owns the grant decision; both planes fence the target page to the
+// caller's own domain, and neither can read a page the domain does not own.
+//
+// 🔴 THE CHAT ARM IS THE DELEGATED WORKER'S (OPE-1014), AND THE OPE-988 RULING IS WHY IT IS SAFE TO
+// NARROW. Tommy's ruling in channels/notion-read.ts states that PAGE CONTENT STAYS OUT OF THE CHAT
+// PLANE, and it names the seat's own route in the same breath: "a seat that needs the document
+// itself uses the GRANT-MOUNTED `read_notion_page` or delegates to a worker". Both of those survive
+// this change untouched — the WORK arm above is grain-blind, and a worker holds the chat arm. What
+// goes is the third route the ruling never named: an UNGRANTED conversational Notion seat reading
+// page prose off the chat credential. That seat now delegates, exactly as the ruling says.
+//
+// The worker keeps the arm for now, though it is no longer the ONLY route (OPE-1064): `WORK_ROLES`
+// gives Notion a CONTAINER row too (the same "team-key" role its entity row already names), so a
+// work-granted domain's delegated worker also holds the generic `read_work_channel` /
+// `read_work_thread` pair — access/worker-seat.ts still withholds `read_channel` / `read_thread`
+// from it, but the neutral pair now covers what only this vendor arm covered before. The two are
+// NOT identical: this tool returns the whole page (title + body) in one read, the generic pair
+// splits root/thread the Slack way. Retiring this arm in favour of the generic pair entirely is a
+// follow-up (filed on OPE-1064), not this change — it changes a shipped tool's shape and deserves
+// its own review.
+//
+// DOMAIN FENCE: the `page` argument is a caller-supplied id, and the one deployment-wide Notion
+// credential cannot tell one domain's pages from another's — so which pages this session may read is
+// OURS to decide, in channels/notion-scope.ts (OPE-236). Fail closed, and every refusal is audited.
+//
+// Output is wrapped untrusted (toModelOutput → ingestUntrusted): a page body is written by
+// arbitrary workspace members, so the model must treat it as DATA, not instructions.
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { readNotionPage, readNotionPageIdentity, resolveBlockOwningPage, resolveNotionCredential } from "../channels/notion-api.js";
+import { notionCallerCredential } from "../channels/notion-credentials.js";
+import { assertNotionActingIdentity } from "../channels/notion-acting-identity.js";
+import { assertNotionPageAllowed, assertNotionPageAllowedOrResolveBlock, assertNotionWorkPageAllowed } from "../channels/notion-scope.js";
+import { notionWorkGrant, notionWorkMount, notionWorkspacesOf } from "../channels/notion-work.js";
+import { ingestUntrustedModelOutput, assertTurnSurface, TurnOriginFenceError, auditOriginFenceRefusal, bindFrom, workerChatArmMount, getConfig, preRegisterDynamicEntry, resolvePartition, declaredWorkspaceTrust, noteAuthoredRecordRead, } from "@open-everywhere/core/agent/adapter-api.js";
+const MAX_CHARS = 20_000;
+const MAX_BLOCKS = 200;
+// FACTORED (see access/window-gated.ts's REPLAY DOCTRINE): a top-level defineTool const, never an
+// inline literal in the handler — eve's bundler transform hoists an inline one under a
+// build-order-counter name that shifts across deploys. eve derives a session-scoped step id for a
+// factored, unstamped entry and self-heals it on cold resume (OPE-867). Exported for the read-scope
+// test, which drives execute() to prove the DOMAIN FENCE is actually
+// WIRED here — a fence the tool forgets to call is worth nothing, and the module test alone would
+// not notice its removal.
+export const readNotionPageEntry = defineTool({
+    description: "Read the text of a Notion page (this doc, or another page shared with the integration). " +
+        "Use it when a reply needs the doc's own content — to answer a question about the page or " +
+        "catch a problem in it. Returns the page's top-level text (truncated if very long); the " +
+        "comment thread you were woken on is already in your context. It reads under the shared " +
+        "team integration, never under the asker's own Notion account, so it sees what the team " +
+        "integration was shared and not what they can see.",
+    inputSchema: z.object({
+        page: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("The Notion page id to read (e.g. a UUID). Defaults to THIS doc — the page the comment you're on lives in."),
+    }),
+    outputSchema: z.object({
+        page: z.string(),
+        // OPE-1714 — the page's own title and Notion url, from a separate GET on the page object
+        // (the body read returns blocks alone). The model gets a name and a link it can hand a
+        // human instead of a bare uuid. Optional both ways: a stored output from before these
+        // fields existed still renders, and the identity fetch is fail-soft, so a page whose
+        // object could not be read renders exactly as it did before. UNTRUSTED — a workspace
+        // member chooses the title, and toModelOutput wraps the whole render accordingly.
+        title: z.string().optional(),
+        url: z.string().optional(),
+        blocks: z.number(),
+        truncated: z.boolean(),
+        text: z.string(),
+        // OPE-1026 — the moment the fetch below returned, stamped by execute and carried to
+        // toModelOutput. Optional for the same reason `read_linear_issue.ts`'s `readAt` is: a
+        // stored output from before this field existed still renders, with no invented read time.
+        readAt: z.string().optional(),
+        // OPE-331 — the BOUND WORKSPACE's declared tier, carried from execute (which has a ctx) to
+        // toModelOutput (which does not). It is the input the source-tier table's `notion` row needs, and
+        // the reason every row this seam produced read `assumed`. Model-INVISIBLE: an authored
+        // toModelOutput means the projection is what the model sees, never this object. Absent when
+        // the operator has not vouched the workspace — see declaredWorkspaceTrust for why silence
+        // stays absent rather than becoming `"public"`.
+        workspaceTrust: z.enum(["internal", "public"]).optional(),
+    }),
+    // NO `approval:` — a dynamic-tool approval fn only registers at session.started resolve
+    // time, so a resumed session's replay lookup fails and eve kills the turn (the same pin
+    // access/window-gated.ts documents). Read-only, so absent approval === never() is correct.
+    async execute(input, ctx2) {
+        const domains = getConfig().loadDomains();
+        // Per-turn surface fence (finding 1b): on a unified session a non-Notion-origin turn
+        // must not read Notion pages on the CHAT plane, even though the tool is armed for the
+        // session. OPE-732: the fence's refusal is audited here — assertTurnSurface itself stays
+        // a pure, synchronous, store-free check (see identity/binding.ts).
+        //
+        // OPE-913 — THE WORK PLANE IS THE ONE WAY PAST IT. A non-Notion-origin turn is admitted
+        // only when the caller's DOMAIN holds the Notion work grant (channels/notion-work.ts).
+        // That is not a hole in the fence: the grant is a reviewed config declaration naming the
+        // credential the read runs under, and the target page is still fenced to the caller's own
+        // domain below (assertNotionWorkPageAllowed). With no grant the refusal is byte-identical
+        // to before — same audit row, same thrown error.
+        let workGrant;
+        try {
+            assertTurnSurface(ctx2, "notion");
+        }
+        catch (err) {
+            if (!(err instanceof TurnOriginFenceError))
+                throw err;
+            workGrant = notionWorkGrant(ctx2, domains);
+            if (!workGrant) {
+                await auditOriginFenceRefusal(ctx2, "notion");
+                throw err;
+            }
+        }
+        // Default to THIS session's page (bindFrom(ctx).surface = the page id for Notion — see
+        // identity/binding.ts bindNotion). On the WORK plane there is no such default to take:
+        // the caller's surface is a Slack channel / a repo / a Linear team, and `bindFrom().surface`
+        // would hand a non-Notion id to the Notion API. Require the argument instead of guessing.
+        const requestedPage = input.page ?? (workGrant ? undefined : bindFrom(ctx2).surface);
+        if (!requestedPage) {
+            throw new Error(workGrant
+                ? "Pass `page` explicitly — this session was not woken on a Notion page, so there is no page to default to."
+                : "No Notion page id available for this session — pass `page` explicitly.");
+        }
+        // Credential resolved BEFORE the fence (OPE-352): resolving a block/discussion id to its
+        // owning page needs a working Notion API call, so the resolver has to be built first. This
+        // does NOT reintroduce a network dependency into a plain refusal — when there is no key, the
+        // resolver below is a no-op stub (never calls fetch), so an out-of-scope id still refuses
+        // with zero network and zero key, exactly as before (pinned in notion-read-scope-test.ts §6).
+        // OPE-467 / OPE-499 — a delivery-woken session reads under the credential that VERIFIED
+        // the delivery (carried on the auth attributes); an agent-initiated session (no delivery)
+        // falls back to the CALLING domain's own binding, or the org default when it binds none.
+        // Resolved off the caller's OWN surface/context, known before the fence runs (the
+        // block-resolution walk below needs a working key to run at all). That is not a weaker
+        // check: notion-scope.ts only ever admits the caller's own page or a page in the caller's
+        // own domain, so caller and target resolve to the same domain by construction.
+        // OPE-505: the key AND its endpoint rules, resolved together and spread together, so the
+        // credential's fence reaches every REST call below.
+        //
+        // OPE-913 — THE WORK PLANE RUNS ON A DIFFERENT CREDENTIAL, and that is the point of the
+        // split. `notionCallerCredential` resolves the CHAT key (`channel-key`, the comment
+        // surface's plumbing). A work-granted read runs on the credential the DOMAIN declared for
+        // its work role, so an organisation can share its chat integration with the comment pages
+        // only and its work integration with the page trees the agent may build from.
+        //
+        // 🔴 ONE VARIABLE FEEDS BOTH THE RESOLVE AND THE FAILURE MESSAGE, deliberately. Naming the
+        // credential in a literal string that a second expression resolves is how a test comes to
+        // assert a plane it is not actually exercising: the message says "work credential" while
+        // the call resolves the chat one, and nothing notices. Interpolating `credentialId` makes
+        // the message an OBSERVABLE of the resolution instead of a claim about it.
+        //
+        // 🔴 OPE-1525 — THE OWN-ACCOUNT GATE RUNS FIRST, ON THE LINE BELOW'S BEHALF. Both arms of
+        // the choice below resolve a TEAM key, so a member who asked to act with THEIR OWN Notion
+        // account has no answer here — and answering anyway is the defect the ticket traced. The
+        // gate refuses that turn (naming the consent route, or the granted tool, or saying plainly
+        // that neither exists) and writes the `connector.acting_identity` row either way.
+        await assertNotionActingIdentity(ctx2, "read_notion_page");
+        const credentialId = workGrant ? workGrant.credential : notionCallerCredential(ctx2, domains);
+        const cred = await resolveNotionCredential(credentialId);
+        // DOMAIN FENCE (OPE-236 + OPE-352). Notion's own enforcement bounds the WORKSPACE — one
+        // deployment-wide integration key, identical for every domain — so it cannot tell domain A's
+        // pages from domain B's. channels/notion-scope.ts is the allowlist on top: own page always,
+        // otherwise caller and target must land in the SAME domain (roster, then a container entry
+        // claim), and an unresolvable page is REFUSED, never defaulted readable. The refusal is
+        // audited there — the gap this closes was silent.
+        //
+        // OPE-352: the Notion worker intermittently hands this tool a DISCUSSION BLOCK id instead of
+        // the page it lives on, and a block id fails the plain page fence every time (it is never
+        // itself rostered/claimed) — a silent-looking `target-unassigned` refusal even when the
+        // block's owning page was perfectly in scope. With a working credential, fall back to
+        // resolving `requestedPage` as a block id to its parent page (bounded walk, see
+        // resolveBlockOwningPage) and fence THAT page through the exact same decision — never a
+        // separate, looser check. `page` below is the id actually authorized (the original id, or
+        // the resolved parent page when only resolution admitted it) — the content fetch and the
+        // reported `page` field both use it, never the raw `requestedPage`.
+        //
+        // OPE-913 — THE WORK PLANE TAKES THE PLAIN FENCE, deliberately. `notionReadScope` reads the
+        // caller's domain out of its own Notion surface key, which a Slack-woken caller does not
+        // have, so the work plane fences through `notionWorkScope` instead: the caller's domain
+        // comes from whatever surface woke it, and the target must still land in THAT domain. No
+        // block-parent resolution hop here — the OPE-352 hop exists because the Notion COMMENT
+        // worker is handed discussion-block ids by its own wake, which a cross-surface caller never
+        // is. A block id from the work plane refuses, and the refusal says how to pass a page id.
+        let page;
+        if (workGrant) {
+            await assertNotionWorkPageAllowed(ctx2, requestedPage, workGrant.domain, domains, notionWorkspacesOf(workGrant.domain));
+            page = requestedPage;
+        }
+        else if (cred) {
+            page = await assertNotionPageAllowedOrResolveBlock(ctx2, requestedPage, domains, (id) => resolveBlockOwningPage(id, { ...cred }));
+        }
+        else {
+            await assertNotionPageAllowed(ctx2, requestedPage, domains);
+            page = requestedPage;
+        }
+        if (!cred) {
+            throw new Error(workGrant
+                ? `no value stored for this domain's Notion work credential "${credentialId}" — cannot read the page.`
+                : "no value stored under db:notion:channel-key — cannot read the page.");
+        }
+        const res = await readNotionPage(page, { ...cred, maxChars: MAX_CHARS, maxBlocks: MAX_BLOCKS });
+        // OPE-1026 — the moment the fetch above returned. Stamped AFTER the fetch, so it never
+        // claims a read is fresher than it is (see read_linear_issue.ts's `readAt`).
+        const readAt = new Date().toISOString();
+        // OPE-331 — resolve the workspace tier HERE, where a ctx exists, and carry it on the
+        // output. Read-only and fail-soft: an unresolvable partition leaves it absent, which is the
+        // fail-closed answer the table already had.
+        //
+        // 🔴 OPE-913 — THE WORK PLANE LEAVES IT ABSENT, AND THAT IS THE WHOLE POINT. This resolves
+        // the tier of the CALLER'S OWN partition, which on the chat plane IS the Notion workspace
+        // the page lives in. On the work plane the caller is a Slack channel, a repo, a Linear
+        // team — so the same line would hand this Notion page the tier the operator vouched for
+        // SLACK, and a vouched Slack workspace would silently un-taint a page read from an
+        // unvouched Notion workspace. Absent means the read TAINTS (see toModelOutput below), which
+        // is the correct answer for a tier we genuinely cannot resolve here.
+        let workspaceTrust;
+        if (!workGrant) {
+            try {
+                workspaceTrust = declaredWorkspaceTrust(resolvePartition(ctx2).workspaceKey);
+            }
+            catch {
+                workspaceTrust = undefined;
+            }
+        }
+        // OPE-1714 — the page's own title and url, on the SAME credential and the SAME fenced page
+        // id the body read used. Separate call because the block-children endpoint carries neither;
+        // fail-soft inside the helper, so a page whose object cannot be read still returns its body.
+        const identity = await readNotionPageIdentity(page, { ...cred });
+        // OPE-1714 — THE REPLY FOOTER'S RECORD HALF, recorded HERE because here is where the host
+        // knows what it fetched. The door writes one reply-provenance entry (`notion`,
+        // `read_notion_page`) and decides on its own, from this turn's `page_id` stamp, whether the
+        // room already holds this page's id — a page the room never named is recorded WITHOUT its
+        // id, so it can never be footed. The title is turn-local and never stored. Never throws.
+        noteAuthoredRecordRead(ctx2, {
+            kind: "notion-page",
+            id: page,
+            // The id the CALLER asked for as well as the one the fence authorized: OPE-352's hop
+            // resolves a discussion-block id to its owning page, and the room's stamp names the
+            // block. Both name the record this read pulled.
+            alsoKnownAs: [requestedPage],
+            name: identity.title,
+        });
+        return {
+            page,
+            ...(identity.title !== undefined ? { title: identity.title } : {}),
+            ...(identity.url !== undefined ? { url: identity.url } : {}),
+            blocks: res.blockCount,
+            truncated: res.truncated,
+            text: res.text,
+            readAt,
+            ...(workspaceTrust !== undefined ? { workspaceTrust } : {}),
+        };
+    },
+    toModelOutput(output) {
+        // OPE-1714 — name the page and link it where the identity fetch answered. `ref` degrades to
+        // the bare id, which is exactly what every render said before these fields existed.
+        const ref = [output.title, output.url].filter((v) => typeof v === "string" && v.length > 0).join(" — ");
+        const named = ref.length > 0 ? `${output.page} (${ref})` : output.page;
+        const header = output.text.length === 0 ? `Notion page ${named} has no readable text.` : `Notion page ${named}:`;
+        const suffix = output.truncated ? "\n\n[truncated — the page has more content than shown]" : "";
+        // OPE-1026 — THE PROVENANCE LINE (the pattern OPE-1012 shipped for Linear, §asOf). Only
+        // when there is text to date: this is the page's CURRENT content, as of this read — the
+        // counterpart to read_notion_comments, whose comments are HISTORY against the same clock.
+        const asOf = output.text.length > 0 && output.readAt ? `\n\nRead live at ${output.readAt}: the text above is the page's current content, as of that moment.` : "";
+        const body = output.text.length === 0 ? header : `${header}\n${output.text}${suffix}${asOf}`;
+        // 🔴 OPE-324 — `workspaceTrust` (plumbed OPE-331) IS NOW THE DECISION. A page read from a
+        // workspace the operator VOUCHED as internal fences without tainting; an unvouched or
+        // public workspace still taints. Tommy ratified that relaxation on 2026-08-09 — a vouched
+        // internal Notion workspace is org property with org membership, the same trust basis as a
+        // private channel, and the instance-binary rule says so.
+        //
+        // `toModelOutput` has no ctx to resolve config from, so execute resolves the bound
+        // workspace's declared tier and carries it on the output. Absent ⇒ the table falls closed
+        // and the read TAINTS, and the `assumed` flag says why: the operator has never vouched this
+        // workspace (agent/identity/surfaces.ts), not that OE could not look.
+        return ingestUntrustedModelOutput(body, {
+            source: `notion page ${output.page}`,
+            ingestion: {
+                kind: "notion",
+                label: "read_notion_page",
+                ...(output.workspaceTrust !== undefined ? { workspaceTrust: output.workspaceTrust } : {}),
+            },
+        });
+    },
+});
+preRegisterDynamicEntry("read_notion_page", "_single", readNotionPageEntry);
+export default defineDynamic({
+    events: {
+        // session.started ONLY: a session runs on exactly one surface, so the platform can't change
+        // mid-session — resolving once is correct and cheaper (see access/source-scoped-mount.ts).
+        "session.started": (_event, ctx) => {
+            // THE CHAT ARM (§A5, see access/source-scoped-mount.ts), narrowed to the DELEGATED-WORKER grain by
+            // OPE-1014: mount iff `notion ∈` this window's sources AND the grain is `task`. The per-turn
+            // origin fence in execute (assertTurnSurface) still stops a non-Notion-origin turn reading a
+            // page on a multi-source window.
+            //
+            // OPE-913 — OR the caller's DOMAIN holds the Notion WORK grant. That is the second, independent
+            // mount path, and it is GRAIN-BLIND: a Slack-woken delegated worker in a work-granted domain
+            // mounts this tool even though `notion ∉ sources` for its window, and so does a granted
+            // conversational seat. Without the grant nothing widens — a domain that declares no Notion work
+            // credential mounts this tool on its delegated workers only.
+            const ok = workerChatArmMount(ctx, "notion", () => getConfig().loadDomains()) ||
+                notionWorkMount(ctx, () => getConfig().loadDomains());
+            if (!ok)
+                return null; // hide unless notion ∈ sources, or the domain holds the work grant
+            return readNotionPageEntry;
+        },
+    },
+});
+//# sourceMappingURL=read_notion_page.js.map

package/dist/agent/tools/read_notion_page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read_notion_page.js","sourceRoot":"","sources":["../../../agent/tools/read_notion_page.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,8FAA8F;AAC9F,iGAAiG;AACjG,gGAAgG;AAChG,gGAAgG;AAChG,+EAA+E;AAC/E,EAAE;AACF,iGAAiG;AACjG,6FAA6F;AAC7F,iGAAiG;AACjG,qGAAqG;AACrG,EAAE;AACF,4EAA4E;AAC5E,mGAAmG;AACnG,gGAAgG;AAChG,kGAAkG;AAClG,kGAAkG;AAClG,2FAA2F;AAC3F,6FAA6F;AAC7F,4FAA4F;AAC5F,4EAA4E;AAC5E,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,+FAA+F;AAC/F,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,2FAA2F;AAC3F,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,sFAAsF;AACtF,iGAAiG;AACjG,iGAAiG;AACjG,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,kBAAkB;AAClB,EAAE;AACF,gGAAgG;AAChG,qGAAqG;AACrG,oGAAoG;AACpG,EAAE;AACF,2FAA2F;AAC3F,qFAAqF;AAErF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpI,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,qCAAqC,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1I,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAwB,MAAM,4BAA4B,CAAC;AACxH,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,QAAQ,EACR,kBAAkB,EAClB,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GAGvB,MAAM,4CAA4C,CAAC;AAEpD,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,kGAAkG;AAClG,uFAAuF;AACvF,kGAAkG;AAClG,oGAAoG;AACpG,qEAAqE;AACrE,kGAAkG;AAClG,0BAA0B;AAC1B,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;IACtC,WAAW,EACT,0FAA0F;QAC1F,2FAA2F;QAC3F,yFAAyF;QACzF,yFAAyF;QACzF,yFAAyF;QACzF,mDAAmD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,2GAA2G,CAAC;KACzH,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,yFAAyF;QACzF,uFAAuF;QACvF,sFAAsF;QACtF,qFAAqF;QACrF,qFAAqF;QACrF,kFAAkF;QAClF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,oFAAoF;QACpF,sFAAsF;QACtF,0FAA0F;QAC1F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,2FAA2F;QAC3F,kGAAkG;QAClG,uFAAuF;QACvF,4FAA4F;QAC5F,0FAA0F;QAC1F,gDAAgD;QAChD,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAC;IACF,wFAAwF;IACxF,wFAAwF;IACxF,2FAA2F;IAC3F,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;QACvB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,qFAAqF;QACrF,sFAAsF;QACtF,yFAAyF;QACzF,mEAAmE;QACnE,EAAE;QACF,wFAAwF;QACxF,uFAAuF;QACvF,yFAAyF;QACzF,0FAA0F;QAC1F,0FAA0F;QAC1F,iDAAiD;QACjD,IAAI,SAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,iBAAiB,CAAC,IAAuB,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBAAE,MAAM,GAAG,CAAC;YACtD,SAAS,GAAG,eAAe,CAAC,IAAuB,EAAE,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,uBAAuB,CAAC,IAAuB,EAAE,QAAQ,CAAC,CAAC;gBACjE,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,uFAAuF;QACvF,uFAAuF;QACvF,6FAA6F;QAC7F,0FAA0F;QAC1F,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAuB,CAAC,CAAC,OAAO,CAAC,CAAC;QACxG,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,SAAS;gBACP,CAAC,CAAC,0GAA0G;gBAC5G,CAAC,CAAC,wEAAwE,CAC7E,CAAC;QACJ,CAAC;QACD,yFAAyF;QACzF,2FAA2F;QAC3F,6FAA6F;QAC7F,0FAA0F;QAC1F,8FAA8F;QAC9F,wFAAwF;QACxF,0FAA0F;QAC1F,yFAAyF;QACzF,kFAAkF;QAClF,uFAAuF;QACvF,0FAA0F;QAC1F,+EAA+E;QAC/E,yFAAyF;QACzF,oDAAoD;QACpD,EAAE;QACF,wFAAwF;QACxF,oFAAoF;QACpF,0FAA0F;QAC1F,0FAA0F;QAC1F,8EAA8E;QAC9E,EAAE;QACF,2FAA2F;QAC3F,0FAA0F;QAC1F,yFAAyF;QACzF,0FAA0F;QAC1F,2EAA2E;QAC3E,EAAE;QACF,0FAA0F;QAC1F,0FAA0F;QAC1F,yFAAyF;QACzF,2FAA2F;QAC3F,kFAAkF;QAClF,MAAM,0BAA0B,CAAC,IAAuB,EAAE,kBAAkB,CAAC,CAAC;QAC9E,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAuB,EAAE,OAAO,CAAC,CAAC;QACjH,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,CAAC;QACzD,wFAAwF;QACxF,6FAA6F;QAC7F,4FAA4F;QAC5F,2FAA2F;QAC3F,wFAAwF;QACxF,kDAAkD;QAClD,EAAE;QACF,6FAA6F;QAC7F,0FAA0F;QAC1F,wFAAwF;QACxF,sFAAsF;QACtF,gFAAgF;QAChF,wFAAwF;QACxF,0FAA0F;QAC1F,yFAAyF;QACzF,oEAAoE;QACpE,EAAE;QACF,4FAA4F;QAC5F,yFAAyF;QACzF,wFAAwF;QACxF,yFAAyF;QACzF,uFAAuF;QACvF,4FAA4F;QAC5F,0FAA0F;QAC1F,IAAI,IAAY,CAAC;QACjB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,2BAA2B,CAC/B,IAAuB,EACvB,aAAa,EACb,SAAS,CAAC,MAAM,EAChB,OAAO,EACP,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CACrC,CAAC;YACF,IAAI,GAAG,aAAa,CAAC;QACvB,CAAC;aAAM,IAAI,IAAI,EAAE,CAAC;YAChB,IAAI,GAAG,MAAM,qCAAqC,CAAC,IAAuB,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACvJ,CAAC;aAAM,CAAC;YACN,MAAM,uBAAuB,CAAC,IAAuB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YAC/E,IAAI,GAAG,aAAa,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,SAAS;gBACP,CAAC,CAAC,6DAA6D,YAAY,2BAA2B;gBACtG,CAAC,CAAC,qEAAqE,CAC1E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QAChG,uFAAuF;QACvF,6EAA6E;QAC7E,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,qFAAqF;QACrF,4FAA4F;QAC5F,4CAA4C;QAC5C,EAAE;QACF,2FAA2F;QAC3F,0FAA0F;QAC1F,uFAAuF;QACvF,wFAAwF;QACxF,mFAAmF;QACnF,4FAA4F;QAC5F,qEAAqE;QACrE,IAAI,cAAwC,CAAC;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,cAAc,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,IAAuB,CAAC,CAAC,YAAY,CAAC,CAAC;YAClG,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc,GAAG,SAAS,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,2FAA2F;QAC3F,4FAA4F;QAC5F,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACjE,0FAA0F;QAC1F,+EAA+E;QAC/E,4FAA4F;QAC5F,0FAA0F;QAC1F,yFAAyF;QACzF,sBAAsB,CAAC,IAAuB,EAAE;YAC9C,IAAI,EAAE,aAAa;YACnB,EAAE,EAAE,IAAI;YACR,qFAAqF;YACrF,oFAAoF;YACpF,gDAAgD;YAChD,WAAW,EAAE,CAAC,aAAa,CAAC;YAC5B,IAAI,EAAE,QAAQ,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,OAAO;YACL,IAAI;YACJ,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,EAAE,GAAG,CAAC,UAAU;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM;YACN,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,aAAa,CAAC,MAAM;QAClB,4FAA4F;QAC5F,oFAAoF;QACpF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxG,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,wBAAwB,CAAC,CAAC,CAAC,eAAe,KAAK,GAAG,CAAC;QACjH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,wFAAwF;QACxF,wFAAwF;QACxF,0FAA0F;QAC1F,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,MAAM,oEAAoE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvJ,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,MAAM,CAAC,IAAI,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;QAC7F,0FAA0F;QAC1F,sFAAsF;QACtF,0FAA0F;QAC1F,2FAA2F;QAC3F,yDAAyD;QACzD,EAAE;QACF,mFAAmF;QACnF,0FAA0F;QAC1F,4FAA4F;QAC5F,sEAAsE;QACtE,OAAO,0BAA0B,CAAC,IAAI,EAAE;YACtC,MAAM,EAAE,eAAe,MAAM,CAAC,IAAI,EAAE;YACpC,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,kBAAkB;gBACzB,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1F;SACF,CAAC,CAAC;IACL,CAAC;CACR,CAAC,CAAC;AACH,uBAAuB,CAAC,kBAAkB,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAE5E,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,4FAA4F;QAC5F,2FAA2F;QAC3F,iBAAiB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;YACjC,mGAAmG;YACnG,6FAA6F;YAC7F,6FAA6F;YAC7F,iCAAiC;YACjC,EAAE;YACF,gGAAgG;YAChG,6FAA6F;YAC7F,wFAAwF;YACxF,gGAAgG;YAChG,6DAA6D;YAC7D,MAAM,EAAE,GACN,kBAAkB,CAAC,GAAsB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrF,eAAe,CAAC,GAAsB,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,CAAC,mEAAmE;YACzF,OAAO,mBAAmB,CAAC;QAC7B,CAAC;KACF;CACF,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,231 @@
+{
+  "name": "@open-everywhere/provider-notion",
+  "version": "0.1.0",
+  "description": "Open Everywhere Notion provider — Notion as a wake surface plus page and database tools.",
+  "keywords": [
+    "agent",
+    "notion",
+    "notion-api",
+    "eve"
+  ],
+  "license": "Apache-2.0",
+  "type": "module",
+  "homepage": "https://github.com/open-everywhere/open-everywhere/tree/main/packages/providers/notion",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/open-everywhere/open-everywhere.git",
+    "directory": "packages/providers/notion"
+  },
+  "bugs": {
+    "url": "https://github.com/open-everywhere/open-everywhere/issues"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "agent",
+    "dist",
+    "tsconfig.json",
+    "tsconfig.build.json",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "exports": {
+    "./package.json": "./package.json",
+    "./agent/channels/notion-acting-identity.js": {
+      "types": "./dist/agent/channels/notion-acting-identity.d.ts",
+      "default": "./dist/agent/channels/notion-acting-identity.js"
+    },
+    "./agent/channels/notion-ancestry-trust.js": {
+      "types": "./dist/agent/channels/notion-ancestry-trust.d.ts",
+      "default": "./dist/agent/channels/notion-ancestry-trust.js"
+    },
+    "./agent/channels/notion-api.js": {
+      "types": "./dist/agent/channels/notion-api.d.ts",
+      "default": "./dist/agent/channels/notion-api.js"
+    },
+    "./agent/channels/notion-bot-user.js": {
+      "types": "./dist/agent/channels/notion-bot-user.d.ts",
+      "default": "./dist/agent/channels/notion-bot-user.js"
+    },
+    "./agent/channels/notion-catch-up.js": {
+      "types": "./dist/agent/channels/notion-catch-up.d.ts",
+      "default": "./dist/agent/channels/notion-catch-up.js"
+    },
+    "./agent/channels/notion-credentials.js": {
+      "types": "./dist/agent/channels/notion-credentials.d.ts",
+      "default": "./dist/agent/channels/notion-credentials.js"
+    },
+    "./agent/channels/notion-engagement.js": {
+      "types": "./dist/agent/channels/notion-engagement.d.ts",
+      "default": "./dist/agent/channels/notion-engagement.js"
+    },
+    "./agent/channels/notion-event-normalizer.js": {
+      "types": "./dist/agent/channels/notion-event-normalizer.d.ts",
+      "default": "./dist/agent/channels/notion-event-normalizer.js"
+    },
+    "./agent/channels/notion-identity.js": {
+      "types": "./dist/agent/channels/notion-identity.d.ts",
+      "default": "./dist/agent/channels/notion-identity.js"
+    },
+    "./agent/channels/notion-ingress-drain.js": {
+      "types": "./dist/agent/channels/notion-ingress-drain.d.ts",
+      "default": "./dist/agent/channels/notion-ingress-drain.js"
+    },
+    "./agent/channels/notion-ingress.js": {
+      "types": "./dist/agent/channels/notion-ingress.d.ts",
+      "default": "./dist/agent/channels/notion-ingress.js"
+    },
+    "./agent/channels/notion-message-ops.js": {
+      "types": "./dist/agent/channels/notion-message-ops.d.ts",
+      "default": "./dist/agent/channels/notion-message-ops.js"
+    },
+    "./agent/channels/notion-origin-codec.js": {
+      "types": "./dist/agent/channels/notion-origin-codec.d.ts",
+      "default": "./dist/agent/channels/notion-origin-codec.js"
+    },
+    "./agent/channels/notion-post-arm.js": {
+      "types": "./dist/agent/channels/notion-post-arm.d.ts",
+      "default": "./dist/agent/channels/notion-post-arm.js"
+    },
+    "./agent/channels/notion-question-return.js": {
+      "types": "./dist/agent/channels/notion-question-return.d.ts",
+      "default": "./dist/agent/channels/notion-question-return.js"
+    },
+    "./agent/channels/notion-read.js": {
+      "types": "./dist/agent/channels/notion-read.d.ts",
+      "default": "./dist/agent/channels/notion-read.js"
+    },
+    "./agent/channels/notion-scope.js": {
+      "types": "./dist/agent/channels/notion-scope.d.ts",
+      "default": "./dist/agent/channels/notion-scope.js"
+    },
+    "./agent/channels/notion-stop.js": {
+      "types": "./dist/agent/channels/notion-stop.d.ts",
+      "default": "./dist/agent/channels/notion-stop.js"
+    },
+    "./agent/channels/notion-supervisor.js": {
+      "types": "./dist/agent/channels/notion-supervisor.d.ts",
+      "default": "./dist/agent/channels/notion-supervisor.js"
+    },
+    "./agent/channels/notion-webhook-timing.js": {
+      "types": "./dist/agent/channels/notion-webhook-timing.d.ts",
+      "default": "./dist/agent/channels/notion-webhook-timing.js"
+    },
+    "./agent/channels/notion-webhook-verifier.js": {
+      "types": "./dist/agent/channels/notion-webhook-verifier.d.ts",
+      "default": "./dist/agent/channels/notion-webhook-verifier.js"
+    },
+    "./agent/channels/notion-webhook.js": {
+      "types": "./dist/agent/channels/notion-webhook.d.ts",
+      "default": "./dist/agent/channels/notion-webhook.js"
+    },
+    "./agent/channels/notion-work-search.js": {
+      "types": "./dist/agent/channels/notion-work-search.d.ts",
+      "default": "./dist/agent/channels/notion-work-search.js"
+    },
+    "./agent/channels/notion-work.js": {
+      "types": "./dist/agent/channels/notion-work.d.ts",
+      "default": "./dist/agent/channels/notion-work.js"
+    },
+    "./agent/channels/notion.js": {
+      "types": "./dist/agent/channels/notion.d.ts",
+      "default": "./dist/agent/channels/notion.js"
+    },
+    "./agent/contributions.js": {
+      "types": "./dist/agent/contributions.d.ts",
+      "default": "./dist/agent/contributions.js"
+    },
+    "./agent/docs-generated.js": {
+      "types": "./dist/agent/docs-generated.d.ts",
+      "default": "./dist/agent/docs-generated.js"
+    },
+    "./agent/memory/blocks.js": {
+      "types": "./dist/agent/memory/blocks.d.ts",
+      "default": "./dist/agent/memory/blocks.js"
+    },
+    "./agent/memory/memory.js": {
+      "types": "./dist/agent/memory/memory.d.ts",
+      "default": "./dist/agent/memory/memory.js"
+    },
+    "./agent/provider-events.js": {
+      "types": "./dist/agent/provider-events.d.ts",
+      "default": "./dist/agent/provider-events.js"
+    },
+    "./agent/register.js": {
+      "types": "./dist/agent/register.d.ts",
+      "default": "./dist/agent/register.js"
+    },
+    "./agent/schedules/notion-ingress.js": {
+      "types": "./dist/agent/schedules/notion-ingress.d.ts",
+      "default": "./dist/agent/schedules/notion-ingress.js"
+    },
+    "./agent/surface-parity.js": {
+      "types": "./dist/agent/surface-parity.d.ts",
+      "default": "./dist/agent/surface-parity.js"
+    },
+    "./agent/tools/notion_search.js": {
+      "types": "./dist/agent/tools/notion_search.d.ts",
+      "default": "./dist/agent/tools/notion_search.js"
+    },
+    "./agent/tools/read_notion_comments.js": {
+      "types": "./dist/agent/tools/read_notion_comments.d.ts",
+      "default": "./dist/agent/tools/read_notion_comments.js"
+    },
+    "./agent/tools/read_notion_page.js": {
+      "types": "./dist/agent/tools/read_notion_page.d.ts",
+      "default": "./dist/agent/tools/read_notion_page.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "npm run test:chain",
+    "test:chain": "npm run test:notion && npm run test:notion-ingress && npm run test:notion-ingress-drain && npm run test:notion-supervisor && npm run test:notion-identity && npm run test:notion-memory && npm run test:notion-memory-credential && npm run test:notion-memory-fence && npm run test:notion-tool-gate && npm run test:notion-read-scope && npm run test:notion-work-search && npm run test:notion-per-domain-credential && npm run test:notion-webhook-verifier && npm run test:notion-event-normalizer && npm run test:dynamic-replay && npm run test:notion-ancestry-trust && npm run test:notion-credential-fence && npm run test:notion-route-taint && npm run test:notion-post-arm && npm run test:notion-read && npm run test:notion-stop && npm run test:notion-engagement && npm run test:notion-reaction-parity && npm run test:notion-message-ops && npm run test:notion-file-upload && npm run test:notion-wake-heal && npm run test:notion-rate-limit && npm run test:notion-write-seam && npm run test:notion-question-return && npm run test:notion-turn-policy",
+    "test:notion": "NODE_NO_WARNINGS=1 tsx scripts/notion-test.ts",
+    "test:notion-ingress": "NODE_NO_WARNINGS=1 tsx scripts/notion-ingress-test.ts",
+    "test:notion-turn-policy": "NODE_NO_WARNINGS=1 tsx scripts/notion-turn-policy-test.ts",
+    "test:notion-rate-limit": "NODE_NO_WARNINGS=1 tsx scripts/notion-rate-limit-test.ts",
+    "test:notion-write-seam": "NODE_NO_WARNINGS=1 tsx scripts/notion-write-seam-test.ts",
+    "test:notion-wake-heal": "NODE_NO_WARNINGS=1 tsx scripts/notion-wake-heal-test.ts",
+    "test:notion-question-return": "NODE_NO_WARNINGS=1 tsx scripts/notion-question-return-test.ts",
+    "test:notion-read": "NODE_NO_WARNINGS=1 tsx scripts/notion-read-test.ts",
+    "test:notion-post-arm": "NODE_NO_WARNINGS=1 tsx scripts/notion-post-arm-test.ts",
+    "test:notion-supervisor": "NODE_NO_WARNINGS=1 tsx scripts/notion-supervisor-test.ts",
+    "test:notion-identity": "NODE_NO_WARNINGS=1 tsx scripts/notion-identity-test.ts",
+    "test:notion-memory": "NODE_NO_WARNINGS=1 tsx scripts/notion-memory-test.ts",
+    "test:notion-memory-credential": "NODE_NO_WARNINGS=1 tsx scripts/notion-memory-credential-test.ts",
+    "test:notion-memory-fence": "NODE_NO_WARNINGS=1 tsx scripts/notion-memory-fence-test.ts",
+    "test:notion-tool-gate": "NODE_NO_WARNINGS=1 tsx scripts/notion-tool-gate-test.ts",
+    "test:notion-per-domain-credential": "tsx scripts/notion-per-domain-credential-test.ts",
+    "test:notion-read-scope": "NODE_NO_WARNINGS=1 tsx scripts/notion-read-scope-test.ts",
+    "test:notion-work-search": "NODE_NO_WARNINGS=1 tsx scripts/notion-work-search-test.ts",
+    "test:notion-ancestry-trust": "NODE_NO_WARNINGS=1 tsx scripts/notion-ancestry-trust-test.ts",
+    "test:dynamic-replay": "NODE_NO_WARNINGS=1 tsx scripts/dynamic-replay-test.ts",
+    "test:notion-webhook-verifier": "NODE_NO_WARNINGS=1 tsx scripts/notion-webhook-verifier-test.ts",
+    "test:notion-event-normalizer": "NODE_NO_WARNINGS=1 tsx scripts/notion-event-normalizer-test.ts",
+    "test:notion-credential-fence": "NODE_NO_WARNINGS=1 tsx scripts/notion-credential-fence-test.ts",
+    "test:notion-route-taint": "NODE_NO_WARNINGS=1 tsx scripts/notion-route-taint-test.ts",
+    "test:notion-stop": "NODE_NO_WARNINGS=1 tsx scripts/notion-stop-test.ts",
+    "test:notion-reaction-parity": "NODE_NO_WARNINGS=1 tsx scripts/notion-reaction-parity-test.ts",
+    "test:notion-engagement": "NODE_NO_WARNINGS=1 tsx scripts/notion-engagement-test.ts",
+    "test:notion-message-ops": "NODE_NO_WARNINGS=1 tsx scripts/notion-message-ops-test.ts",
+    "test:notion-file-upload": "NODE_NO_WARNINGS=1 tsx scripts/notion-file-upload-test.ts",
+    "test:notion-ingress-drain": "NODE_NO_WARNINGS=1 tsx scripts/notion-ingress-drain-test.ts"
+  },
+  "dependencies": {
+    "@open-everywhere/core": "0.1.0",
+    "zod": "4.5.4"
+  },
+  "peerDependencies": {
+    "eve": "0.54.3"
+  },
+  "devDependencies": {
+    "@types/node": "latest",
+    "tsx": "latest",
+    "typescript": "latest"
+  }
+}

package/tsconfig.build.json

@@ -0,0 +1,22 @@
+{
+  // PUBLISH BUILD (OPE-406). See packages/core/tsconfig.build.json for the full rationale: the
+  // sibling tsconfig.json stays noEmit (it is the typecheck gate and covers scripts/** too); this
+  // config emits ONLY the published surface (agent/**) into dist/, because a registry install
+  // cannot execute raw TypeScript and "eve build" evaluates the authored agent modules.
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": false,
+    // Incremental: these run from every pre-hook (pretypecheck/pretest/prebuild), so a no-op
+    // rebuild has to be near-free or the gate chain pays a full tsc on every invocation.
+    "incremental": true,
+    // OUTSIDE outDir on purpose: a tsbuildinfo left in dist/ gets swept up by the files
+    // allowlist and PUBLISHED (caught by the tarball listing, 2026-08-12).
+    "tsBuildInfoFile": "./.tsbuildinfo",
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "outDir": "dist",
+    "rootDir": "."
+  },
+  "include": ["agent/**/*.ts"]
+}

package/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2023",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": ["ES2023"],
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "resolveJsonModule": true,
+    "types": ["node"]
+  },
+  "include": ["agent/**/*.ts", "scripts/**/*.ts"]
+}