@vibesdotdev/integrations-notion 0.0.0-stage → 1.0.0-rc.1

package/LICENSE

@@ -0,0 +1,126 @@
+Business Source License 1.1
+
+Parameters
+
+Licensor:             VIBES DEV LLC
+Licensed Work:        @vibesdotdev/integrations-notion
+                      The Licensed Work is (c) 2026 VIBES DEV LLC.
+Additional Use Grant: In this grant, "Vibes Platform" means the hosted services VIBES DEV LLC
+                      operates at vibes.dev and its subdomains.
+
+                      You may make production use of the Licensed Work, including commercial
+                      use, subject to the limits below. Permitted production use includes:
+                      building, operating and selling your own applications, agents and services
+                      on or with the Vibes Platform; self-hosting the Licensed Work for use inside
+                      your own organization; and providing consulting, integration or development
+                      services to clients who build on the Vibes Platform.
+
+                      The production use permitted above does not include use that:
+
+                      (a) offers third parties a hosted, managed or embedded service that
+                          substitutes for the Vibes Platform or a material part of it (including
+                          agent hosting; fleet, sandbox or container provisioning; package
+                          registry; source hosting and continuous integration; and managed AI,
+                          storage, secrets or messaging), where the Licensed Work provides a
+                          material part of that service's value and that service earns more than
+                          US$1,000,000 in gross revenue in any twelve-month period;
+                      (b) sells, rents, sublicenses or white-labels the Licensed Work, or access
+                          to Vibes Platform functionality, as a product in its own right;
+                      (c) removes, disables or works around entitlement checks, usage metering,
+                          quotas or plan limits, or reaches Vibes Platform features the user's
+                          account is not entitled to;
+                      (d) scrapes, bulk-exports or harvests data or content from the Vibes
+                          Platform or its users other than through documented interfaces and
+                          within their terms, or uses outputs or data obtained from the Vibes
+                          Platform to train or improve a product that competes with it;
+                      (e) violates applicable law, infringes anyone's rights, commits fraud or
+                          deception, conducts unlawful surveillance or harassment, distributes
+                          malware, or accesses systems without authorization; or
+                      (f) violates applicable antitrust or competition law.
+
+                      A written permission from the Licensor extends this grant.
+Change Date:          Four years from the date the Licensed Work is published.
+Change License:       MIT
+
+For information about alternative licensing arrangements for the Licensed Work,
+contact VIBES DEV LLC through https://vibes.dev.
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+License text copyright © 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark “Business Source License”,
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business
+Source License” name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where “compatible” means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text “None”.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

package/README.md

@@ -1,3 +1,143 @@
-# Temporary Holding Version
+# @vibesdotdev/integrations-notion
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Canonical Notion API `2026-03-11` connector for Vibes.
+
+## Hosting model
+
+Platform-web registers the integrations kind owner, then the sync plugin, then
+the host plugin. The host also supplies integration/store with its backing storage, system/settings-reader, Logging, and Storage. It owns credential resolution and all Notion REST transport. Org-scoped credentials additionally need a live request org id (runtime context `orgId`); without it the core resolver refuses `PERMISSION_DENIED` `integration-organization-required` before any transport.
+The Vibes CLI composes this order in its app-owned integration host. Other apps
+register only the providers their scope supports. With the standard core runtime
+already composed, direct registration must be explicit:
+
+```ts
+import integrationsPlugin from '@vibesdotdev/integrations/plugin';
+import syncPlugin from '@vibesdotdev/sync/plugin';
+import notionHostPlugin from '@vibesdotdev/integrations-notion/plugin';
+
+await runtime.registerPlugin(integrationsPlugin);
+await runtime.registerPlugin(syncPlugin);
+await runtime.registerPlugin(notionHostPlugin);
+```
+
+Consumer apps never register the server host plugin. They register sync before
+the client plugin and resolve the typed runtime client. They never receive or
+read a Notion token:
+
+```ts
+import notionClientPlugin from '@vibesdotdev/integrations-notion/client-plugin';
+import { getVibesNotionClient } from '@vibesdotdev/integrations-notion/client';
+import syncPlugin from '@vibesdotdev/sync/plugin';
+
+await runtime.registerPlugin(syncPlugin);
+await runtime.registerPlugin(notionClientPlugin);
+const notion = await getVibesNotionClient(runtime);
+const { pages, nextCursor } = await notion.pull({ pageSize: 50 });
+```
+
+The four namespaces are users, databases, dataSources, and pages. Database,
+data-source, and page getters return null for confirmed absence; malformed or
+missing results raise typed failures. Consumers declare the platform infra/service
+origin and internal service credential.
+
+The same client plugin projects the canonical agent surface. Compose the
+tools/tool kind owner before resolving tools:
+
+- `notion.search`, `notion.data-sources.get/query`, and `notion.pages.get`
+  perform one bounded read.
+- `notion.pages.create/update` perform explicit approval-gated writes; update
+  cannot trash or archive a page.
+
+Tools take caller identity only from trusted execution metadata and never accept
+OAuth tokens or other credentials in model-authored input.
+
+## API vocabulary
+
+Notion databases are containers. Their child data sources own property schemas
+and rows:
+
+```ts
+const database = await notion.databases.get(databaseId);
+const dataSourceId = database?.dataSources[0]?.id;
+if (dataSourceId) {
+	const { pages } = await notion.dataSources.query({ dataSourceId, pageSize: 50 });
+}
+```
+
+- Configure `dataSourceId`. If an existing value names a database container,
+  the canonical data-source flow resolves its sole child and refuses when the
+  container has multiple data sources.
+- Query `/data_sources/:id/query`, never `/databases/:id/query`.
+- Create pages with `parentDataSourceId`.
+- Search filters are `page` and `data_source`.
+- Trash state is `inTrash` (`in_trash` on the wire).
+
+`pull()` and `sync.endpoint.notion.pages` are intentionally one cursor page.
+The endpoint preserves stable page identity across the pages of one scan,
+accepts destination identity carried by a completed core scan, validates the
+target title/key schema, and fails destructive writes that have no observed
+target. Pulled
+records can expose provider-neutral `title`, `contentText`, `contentType`,
+`projectId`, `status`, and `priority` envelope fields; hashes exclude Notion ids,
+timestamps, URLs, raw property envelopes, and the sync key. `Title` + `Content`
+work by default for knowledge data sources. Projects and work-item bindings can
+name their existing properties with `titleProperty`, `contentProperty`,
+`contentTypeProperty`, `projectIdProperty`, `statusProperty`, and
+`priorityProperty`. This package owns the versioned `knowledge.notion@1`,
+`projects.notion@1`, and `work.notion@1` mappings. Those profiles deliberately
+project only each domain's canonical surface: Knowledge requires title/content,
+Projects permits title/optional content, and Work requires validated
+status/priority alongside title/optional content (with project identity carried
+by binding scope). Work bindings explicitly name the Notion status and priority
+properties; absent configuration or blank/unknown values fail closed.
+An omitted Notion content field explicitly clears a staged non-empty destination
+description, while omission against an already-empty destination remains omitted;
+the Projects and Work endpoints preserve that absent-versus-clear distinction.
+Product features may register additional mapping profiles and remain
+responsible for cursor persistence, conflict policy, and bindings.
+
+## OAuth and failures
+
+Use ./server/oauth for code exchange, refresh, and token storage. Responses are
+schema validated. The host secret service provides list/create/update;
+replacement never deletes recoverable credentials, and an omitted refresh token
+preserves the previous refresh credential.
+
+Failures use CapabilityError codes and value-free reasons. Vendor bodies,
+remote messages, record contents, and credentials never appear in failure text.
+Mutations make one attempt; ambiguous outcomes remain unknown for reconciliation.
+Concrete provider implementations remain available through ./notion.
+
+## Verification
+
+```bash
+cd integrations/notion
+bun run test
+bun run check
+bun run build
+node ../../node_modules/@vibesdotdev/internal-oxlint-toolchain/ratchet.mjs
+```
+
+Also run workspace-rules for this package. Tests include OAuth, check includes
+tests, and build emits production sources only.
+
+See [SPEC.md](./SPEC.md) for ownership and migration details.
+
+## Replacing temporary database-query aliases
+
+The temporary database-query aliases are removed from the public client and
+operation schemas. Migrate `config.databaseId` to `config.dataSourceId`,
+`client.databases.query({databaseId})` to
+`client.dataSources.query({dataSourceId})`, `queryDatabase` to
+`queryDataSource`, and `pull-database` to `pull-data-source`.
+For low-level callers, replace `NotionAPIClient.queryDatabase({databaseId})`
+with `queryDataSource({dataSourceId})`, and provider `pullDatabase(options)`
+with `pullDataSource(options)`. Replace
+`resolveLegacyDatabaseDataSourceId(databaseId)` with `getDatabase(databaseId)`
+and explicitly select an id from its `dataSources`; query callers may instead
+pass the container id to `queryDataSource` for the same sole-child discovery;
+its result's `dataSourceId` is the resolved child id.
+Replace `QueryNotionDatabaseSchema/Input` imports with
+`QueryNotionDataSourceSchema/Input`. Database-container retrieval remains
+`databases.get`; a configured container id still resolves through the explicit
+sole-child discovery flow described below.

package/dist/client/helper.d.ts

@@ -0,0 +1,16 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { NotionClient } from './runtime-client.ts';
+/**
+ * Resolve the canonical `NotionClient`.
+ *
+ * Equivalent to `runtime.query('runtime/client').withId('notion').resolve()`.
+ * Requires the integrations-notion plugin to be composed into the runtime.
+ *
+ * ```ts
+ * import { getVibesNotionClient } from '@vibesdotdev/integrations-notion/client';
+ * const notion = await getVibesNotionClient(runtime);
+ * const me = await notion.users.me();
+ * ```
+ */
+export declare function getVibesNotionClient(runtime: VibesRuntime): Promise<NotionClient>;
+//# sourceMappingURL=helper.d.ts.map

package/dist/client/helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../../src/client/helper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAEvF"}

package/dist/client/helper.js

@@ -0,0 +1,17 @@
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+/**
+ * Resolve the canonical `NotionClient`.
+ *
+ * Equivalent to `runtime.query('runtime/client').withId('notion').resolve()`.
+ * Requires the integrations-notion plugin to be composed into the runtime.
+ *
+ * ```ts
+ * import { getVibesNotionClient } from '@vibesdotdev/integrations-notion/client';
+ * const notion = await getVibesNotionClient(runtime);
+ * const me = await notion.users.me();
+ * ```
+ */
+export async function getVibesNotionClient(runtime) {
+    return getVibesClient('notion', runtime);
+}
+//# sourceMappingURL=helper.js.map

package/dist/client/helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../../src/client/helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAG5D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAqB;IAC/D,OAAO,cAAc,CAAe,QAAQ,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC"}

package/dist/client/index.d.ts

@@ -0,0 +1,3 @@
+export { NotionClient, type NotionInvokeIdentity } from './runtime-client.ts';
+export { getVibesNotionClient } from './helper.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}

package/dist/client/index.js

@@ -0,0 +1,3 @@
+export { NotionClient } from "./runtime-client.js";
+export { getVibesNotionClient } from "./helper.js";
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6B,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}

package/dist/client/runtime-client.d.ts

@@ -0,0 +1,89 @@
+import type { NotionOperationInput } from '../schemas/operations.ts';
+import type { KindContext } from '@vibesdotdev/kernel';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient, type RuntimeClientDescriptor } from '@vibesdotdev/kernel/client';
+import type { CreateNotionPageInput, NotionDataSource, NotionDatabase, NotionPage, NotionPullOptions, NotionPullResult, NotionUser, QueryNotionDataSourceInput, UpdateNotionPageInput } from '../notion/notion-schemas.ts';
+export type { NotionInvokeIdentity } from '../schemas/operations.ts';
+import { type NotionInvokeIdentity } from '../schemas/operations.ts';
+/**
+ * Canonical Notion runtime client.
+ *
+ * Thin typed shim over platform-web's
+ * `/api/internal/integrations/integration.notion/operations/[op]`
+ * dispatch. Apps consume `notion.pages.*`, `notion.dataSources.*`,
+ * `notion.databases.get()`, `notion.users.*`, `notion.search()`; platform-web hosts the
+ * integration provider impl, owns the API token, and runs all Notion
+ * REST API calls in its worker.
+ *
+ * Resolved via `getVibesNotionClient(runtime)` or
+ * `runtime.query('runtime/client').withId('notion').resolve()`.
+ *
+ * Requires `VIBES_INTERNAL_SERVICE_TOKEN` on the consuming worker so
+ * service-to-service calls authenticate.
+ */
+export declare class NotionClient extends BaseRuntimeClient {
+    readonly users: UsersNamespace;
+    readonly databases: DatabasesNamespace;
+    readonly dataSources: DataSourcesNamespace;
+    readonly pages: PagesNamespace;
+    constructor(descriptor?: RuntimeClientDescriptor, context?: KindContext, runtime?: VibesRuntime);
+    /** Integration descriptor id this client dispatches to. */
+    get integrationId(): string;
+    /** Pull one cursor page for a domain-owned sync endpoint to process. */
+    pull(args?: NotionPullOptions, identity?: NotionInvokeIdentity): Promise<NotionPullResult>;
+    /** Workspace-wide search across pages + data sources. */
+    search(query?: string, options?: {
+        filter?: 'data_source' | 'page';
+        pageSize?: number;
+        startCursor?: string;
+    }, identity?: NotionInvokeIdentity): Promise<{
+        dataSources: NotionDataSource[];
+        pages: NotionPage[];
+        hasMore: boolean;
+        nextCursor?: string;
+    }>;
+    /**
+     * Invoke an arbitrary declared operation. Internal escape hatch for
+     * ops without a typed wrapper; apps should prefer the namespaces.
+     */
+    invoke<T = unknown>(operationId: string, args?: NotionOperationInput, identity?: NotionInvokeIdentity): Promise<T>;
+}
+type Invoke = <T = unknown>(opId: string, args?: NotionOperationInput, identity?: NotionInvokeIdentity) => Promise<T>;
+declare class UsersNamespace {
+    private readonly invoke;
+    constructor(invoke: Invoke);
+    /** Fetch the authenticated bot user. */
+    me(): Promise<NotionUser>;
+    /** List users in the workspace. */
+    list(): Promise<NotionUser[]>;
+}
+declare class DatabasesNamespace {
+    private readonly invoke;
+    constructor(invoke: Invoke);
+    /** Fetch a database by id. Returns null if not found. */
+    get(databaseId: string): Promise<NotionDatabase | null>;
+}
+declare class DataSourcesNamespace {
+    private readonly invoke;
+    constructor(invoke: Invoke);
+    /** Fetch a data source schema by id. Returns null if not found. */
+    get(dataSourceId: string, identity?: NotionInvokeIdentity): Promise<NotionDataSource | null>;
+    /** Query rows of a data source with optional filter/sorts. */
+    query(input: QueryNotionDataSourceInput, identity?: NotionInvokeIdentity): Promise<{
+        dataSourceId: string;
+        pages: NotionPage[];
+        hasMore: boolean;
+        nextCursor?: string;
+    }>;
+}
+declare class PagesNamespace {
+    private readonly invoke;
+    constructor(invoke: Invoke);
+    /** Fetch a page by id. Returns null if not found. */
+    get(pageId: string, identity?: NotionInvokeIdentity): Promise<NotionPage | null>;
+    /** Create a new page. */
+    create(input: CreateNotionPageInput, identity?: NotionInvokeIdentity): Promise<NotionPage>;
+    /** Update an existing page. */
+    update(pageId: string, input: UpdateNotionPageInput, identity?: NotionInvokeIdentity): Promise<NotionPage>;
+}
+//# sourceMappingURL=runtime-client.d.ts.map

package/dist/client/runtime-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-client.d.ts","sourceRoot":"","sources":["../../src/client/runtime-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAyB,MAAM,0BAA0B,CAAC;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAE7F,OAAO,KAAK,EACX,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,6BAA6B,CAAC;AAIrC,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAA8F,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEjK;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,YAAa,SAAQ,iBAAiB;IAClD,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;gBAG9B,UAAU,GAAE,uBAAkE,EAC9E,OAAO,CAAC,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE,YAAY;IAavB,2DAA2D;IAC3D,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,wEAAwE;IAClE,IAAI,CACT,IAAI,GAAE,iBAAsB,EAC5B,QAAQ,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IAI5B,yDAAyD;IACnD,MAAM,CACX,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EACtF,QAAQ,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC;QACV,WAAW,EAAE,gBAAgB,EAAE,CAAC;QAChC,KAAK,EAAE,UAAU,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAgBF;;;OAGG;IACG,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,oBAAoB,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,CAAC,CAAC;CAqBxH;AAED,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,OAAO,EACzB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,oBAAoB,EAC3B,QAAQ,CAAC,EAAE,oBAAoB,KAC3B,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,cAAM,cAAc;IACP,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C,wCAAwC;IAClC,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC;IAI/B,mCAAmC;IAC7B,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;CAGnC;AAED,cAAM,kBAAkB;IACX,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C,yDAAyD;IACnD,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;CAI7D;AAED,cAAM,oBAAoB;IACb,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C,mEAAmE;IAC7D,GAAG,CACR,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAInC,8DAA8D;IACxD,KAAK,CACV,KAAK,EAAE,0BAA0B,EACjC,QAAQ,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC;QACV,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,UAAU,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CAOF;AAED,cAAM,cAAc;IACP,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C,qDAAqD;IAC/C,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAItF,yBAAyB;IACnB,MAAM,CAAC,KAAK,EAAE,qBAAqB,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC;IAIhG,+BAA+B;IACzB,MAAM,CACX,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,qBAAqB,EAC5B,QAAQ,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,UAAU,CAAC;CAGtB"}

package/dist/client/runtime-client.js

@@ -0,0 +1,130 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import { getVibesPlatformInternalClient } from '@vibesdotdev/platform/internal-api';
+const NOTION_INTEGRATION_ID = 'integration.notion';
+import { NotionInvokeIdentitySchema, OperationIdSchema, OperationInputs, OperationResults, contract } from "../schemas/operations.js";
+import * as z from 'zod/v4';
+/**
+ * Canonical Notion runtime client.
+ *
+ * Thin typed shim over platform-web's
+ * `/api/internal/integrations/integration.notion/operations/[op]`
+ * dispatch. Apps consume `notion.pages.*`, `notion.dataSources.*`,
+ * `notion.databases.get()`, `notion.users.*`, `notion.search()`; platform-web hosts the
+ * integration provider impl, owns the API token, and runs all Notion
+ * REST API calls in its worker.
+ *
+ * Resolved via `getVibesNotionClient(runtime)` or
+ * `runtime.query('runtime/client').withId('notion').resolve()`.
+ *
+ * Requires `VIBES_INTERNAL_SERVICE_TOKEN` on the consuming worker so
+ * service-to-service calls authenticate.
+ */
+export class NotionClient extends BaseRuntimeClient {
+    users;
+    databases;
+    dataSources;
+    pages;
+    constructor(descriptor = { id: 'notion', kind: 'runtime/client' }, context, runtime) {
+        super(descriptor, context, runtime);
+        this.users = new UsersNamespace((opId, args, identity) => this.invoke(opId, args, identity));
+        this.databases = new DatabasesNamespace((opId, args, identity) => this.invoke(opId, args, identity));
+        this.dataSources = new DataSourcesNamespace((opId, args, identity) => this.invoke(opId, args, identity));
+        this.pages = new PagesNamespace((opId, args, identity) => this.invoke(opId, args, identity));
+    }
+    /** Integration descriptor id this client dispatches to. */
+    get integrationId() {
+        return NOTION_INTEGRATION_ID;
+    }
+    /** Pull one cursor page for a domain-owned sync endpoint to process. */
+    async pull(args = {}, identity) {
+        return this.invoke('pull-data-source', args, identity);
+    }
+    /** Workspace-wide search across pages + data sources. */
+    async search(query, options, identity) {
+        return this.invoke('search', {
+            query,
+            ...options
+        }, identity);
+    }
+    async invoke(operationId, args, identity) {
+        const op = contract(OperationIdSchema).parse(operationId);
+        const input = contract(OperationInputs[op]).parse(args ?? {});
+        const explicit = contract(NotionInvokeIdentitySchema).parse(identity ?? {});
+        const userId = contract(z.string().min(1)).parse(explicit.userId ?? await this.runtime.context('userId'));
+        let org = explicit.orgId;
+        if (org === undefined) {
+            try {
+                org = contract(z.string().min(1).optional()).parse(await this.runtime.context('orgId'));
+            }
+            catch (error) {
+                if (!(error instanceof Error && CapabilityError.isAbsenceOf(error, 'context', 'orgId')))
+                    throw error;
+            }
+        }
+        const client = await getVibesPlatformInternalClient(this.runtime);
+        const result = await client.integrations.invoke({
+            userId, organizationId: org, integrationId: NOTION_INTEGRATION_ID, operationId: op, args: input
+        });
+        if (!result.ok)
+            throw new CapabilityError('Notion operation failed.', 'INTERNAL', { reason: 'notion-operation-failed' });
+        return contract(OperationResults[op]).parse(result.data);
+    }
+}
+class UsersNamespace {
+    invoke;
+    constructor(invoke) {
+        this.invoke = invoke;
+    }
+    /** Fetch the authenticated bot user. */
+    async me() {
+        return this.invoke('getMe');
+    }
+    /** List users in the workspace. */
+    async list() {
+        return this.invoke('listUsers');
+    }
+}
+class DatabasesNamespace {
+    invoke;
+    constructor(invoke) {
+        this.invoke = invoke;
+    }
+    /** Fetch a database by id. Returns null if not found. */
+    async get(databaseId) {
+        return this.invoke('getDatabase', { databaseId });
+    }
+}
+class DataSourcesNamespace {
+    invoke;
+    constructor(invoke) {
+        this.invoke = invoke;
+    }
+    /** Fetch a data source schema by id. Returns null if not found. */
+    async get(dataSourceId, identity) {
+        return this.invoke('getDataSource', { dataSourceId }, identity);
+    }
+    /** Query rows of a data source with optional filter/sorts. */
+    async query(input, identity) {
+        return this.invoke('queryDataSource', input, identity);
+    }
+}
+class PagesNamespace {
+    invoke;
+    constructor(invoke) {
+        this.invoke = invoke;
+    }
+    /** Fetch a page by id. Returns null if not found. */
+    async get(pageId, identity) {
+        return this.invoke('getPage', { pageId }, identity);
+    }
+    /** Create a new page. */
+    async create(input, identity) {
+        return this.invoke('createPage', input, identity);
+    }
+    /** Update an existing page. */
+    async update(pageId, input, identity) {
+        return this.invoke('updatePage', { pageId, input }, identity);
+    }
+}
+//# sourceMappingURL=runtime-client.js.map

package/dist/client/runtime-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-client.js","sourceRoot":"","sources":["../../src/client/runtime-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAgC,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AAapF,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAGnD,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,QAAQ,EAA6B,MAAM,0BAA0B,CAAC;AACjK,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,YAAa,SAAQ,iBAAiB;IACzC,KAAK,CAAiB;IACtB,SAAS,CAAqB;IAC9B,WAAW,CAAuB;IAClC,KAAK,CAAiB;IAE/B,YACC,aAAsC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC9E,OAAqB,EACrB,OAAsB;QAEtB,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,cAAc,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,SAAS,GAAG,IAAI,kBAAkB,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAChE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,IAAI,oBAAoB,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CACpE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,cAAc,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,2DAA2D;IAC3D,IAAI,aAAa;QAChB,OAAO,qBAAqB,CAAC;IAC9B,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,IAAI,CACT,OAA0B,EAAE,EAC5B,QAA+B;QAE/B,OAAO,IAAI,CAAC,MAAM,CAAmB,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,MAAM,CACX,KAAc,EACd,OAAsF,EACtF,QAA+B;QAO/B,OAAO,IAAI,CAAC,MAAM,CAMjB,QAAQ,EACR;YACC,KAAK;YACL,GAAG,OAAO;SACV,EACD,QAAQ,CACR,CAAC;IACH,CAAC;IAOD,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,IAA2B,EAAE,QAA+B;QAC7F,MAAM,EAAE,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,0BAA0B,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1G,IAAI,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC;QACzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC;gBAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YAAC,CAAC;YAChG,OAAO,KAAK,EAAE,CAAC;gBACd,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;oBAAE,MAAM,KAAK,CAAC;YACtG,CAAC;QACF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YAC/C,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,qBAAqB,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK;SAC/F,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,EAAE,UAAU,EAAE,EAAC,MAAM,EAAC,yBAAyB,EAAC,CAAC,CAAC;QACtH,OAAO,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;CAED;AAQD,MAAM,cAAc;IACU;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,wCAAwC;IACxC,KAAK,CAAC,EAAE;QACP,OAAO,IAAI,CAAC,MAAM,CAAa,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,IAAI;QACT,OAAO,IAAI,CAAC,MAAM,CAAe,WAAW,CAAC,CAAC;IAC/C,CAAC;CACD;AAED,MAAM,kBAAkB;IACM;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,yDAAyD;IACzD,KAAK,CAAC,GAAG,CAAC,UAAkB;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAwB,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1E,CAAC;CAED;AAED,MAAM,oBAAoB;IACI;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,mEAAmE;IACnE,KAAK,CAAC,GAAG,CACR,YAAoB,EACpB,QAA+B;QAE/B,OAAO,IAAI,CAAC,MAAM,CAA0B,eAAe,EAAE,EAAE,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1F,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,KAAK,CACV,KAAiC,EACjC,QAA+B;QAO/B,OAAO,IAAI,CAAC,MAAM,CACjB,iBAAiB,EACjB,KAAK,EACL,QAAQ,CACR,CAAC;IACH,CAAC;CACD;AAED,MAAM,cAAc;IACU;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,qDAAqD;IACrD,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,QAA+B;QACxD,OAAO,IAAI,CAAC,MAAM,CAAoB,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,MAAM,CAAC,KAA4B,EAAE,QAA+B;QACzE,OAAO,IAAI,CAAC,MAAM,CAAa,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,+BAA+B;IAC/B,KAAK,CAAC,MAAM,CACX,MAAc,EACd,KAA4B,EAC5B,QAA+B;QAE/B,OAAO,IAAI,CAAC,MAAM,CAAa,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3E,CAAC;CACD"}

package/dist/docs/integrations-notion.docs.descriptor.d.ts

@@ -0,0 +1,19 @@
+declare const descriptor: {
+    readonly kind: "docs/topic";
+    readonly id: "integrations.notion";
+    readonly title: "Notion Integration";
+    readonly summary: "Cursor-based Notion transport for domain-owned projections.";
+    readonly body: {
+        readonly type: "markdown";
+        readonly sourceType: "raw";
+        readonly source: "---\ntitle: Notion Integration\nsummary: Cursor-based Notion transport for domain-owned projections.\nparent: integrations\norder: 3\n---\n\n# Notion integration\n\nThe Notion package owns authenticated Notion API 2026-03-11 transport and a canonical runtime client. It does not decide whether a page becomes a knowledge item, project, or document.\n\n## Runtime surface\n\n- `notion.users.*`, `notion.dataSources.*`, `notion.databases.get`, and `notion.pages.*` expose typed operations.\n- `notion.search()` searches the connected workspace.\n- `notion.pull()` returns one cursor page, optionally filtered by `last_edited_time`.\n- `sync.endpoint.notion.pages` projects one bounded data-source page into `title`, `contentText`, `contentType`, `projectId`, `status`, and `priority`; it derives stable keys from an explicit rich-text property and returns provider page ids after apply.\n- Agent tools `notion.search`, `notion.data-sources.get/query`, and `notion.pages.get` expose bounded reads. `notion.pages.create/update` are approval-gated explicit writes through the canonical runtime client; there is no archive or delete tool.\n\nDatabase objects are containers. Retrieve one to discover its child data-source IDs, then query `notion.dataSources`. Search filters are `page` and `data_source`; page parents use `data_source_id`; trash state is `inTrash`.\n\nThe pull result reports only what Notion returned. This package owns versioned `knowledge.notion@1`, `projects.notion@1`, and `work.notion@1` mappings; product features may register additional mappings and own direction, authority, deletion policy, and trigger before changes are applied. The endpoint validates every mapped target property before writing. `Title` plus an existing rich-text `Content` property work by default; bindings can select existing properties with `titleProperty`, `contentProperty`, `contentTypeProperty`, `projectIdProperty`, `statusProperty`, and `priorityProperty`.\n\n## Contracts and OAuth\n\nAll four namespaces validate operation inputs and results. Database, data-source,\nand page getters return null for confirmed absence. Missing or malformed data\nraises a typed contract refusal. Explicit JSON contracts preserve extensible\nproperties and blocks. Generic invocation retains result validation.\n\nThe explicit server/oauth entrypoint validates token responses, replaces secrets\nthrough the host owner's list/create/update API, and preserves the previous\nrefresh token when no replacement is returned. Public failures contain no vendor\nbodies, remote messages, record contents, or credentials. Mutations make one\ntransport attempt; ambiguous writes remain unknown for sync reconciliation.\nRetry pacing and scheduling belong to lifecycle and Workers.\n\nHosts supply integration/store, system/settings-reader, storage backing, Logging,\nStorage, and the integrations owner. Consumers declare the platform infra/service\norigin and internal service credential. Tool resolution requires the tools/tool\nowner and trusted user identity. Concrete providers live at the explicit notion\nentrypoint.\n\n## Safety\n\nCredentials stay in the hosted integration provider. Direct hosts register `integrations`, then `sync`, then the host plugin; consumers register `sync` before the client plugin and never register the host provider. Agent writes reject credential fields and oversized payloads, and identity comes only from surface-asserted metadata projected by the runtime. Cursor state and synchronized anchors belong to the owning sync feature. Provider ids are scoped by data source. Content hashes cover semantic fields only—not Notion ids, timestamps, URLs, raw property envelopes, or sync keys. Trashed pages are explicit Notion tombstones; absence from a cursor page is never deletion evidence, and archive/delete without an observed page fails visibly.\n";
+    };
+    readonly parent: "integrations";
+    readonly order: 3;
+    readonly tags: readonly ["integrations", "notion", "sync"];
+    readonly surfaces: readonly ["web", "in-app"];
+    readonly hardware: readonly ["consumer", "cloud"];
+    readonly enabled: true;
+};
+export default descriptor;
+//# sourceMappingURL=integrations-notion.docs.descriptor.d.ts.map

package/dist/docs/integrations-notion.docs.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations-notion.docs.descriptor.d.ts","sourceRoot":"","sources":["../../src/docs/integrations-notion.docs.descriptor.ts"],"names":[],"mappings":"AAgDA,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;CAYN,CAAC;AAEX,eAAe,UAAU,CAAC"}