npm - @rubytech/create-maxy-code - Versions diffs - 0.1.346 → 0.1.348 - Mend

@rubytech/create-maxy-code 0.1.346 → 0.1.348

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (32) hide show

package/payload/server/public/chat.html CHANGED Viewed

@@ -5,14 +5,14 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Chat — Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/chat-cxTK--65.js"></script>
+  <script type="module" crossorigin src="/assets/chat-Ct86qtMI.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-CAM3fms7.js">
-  <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-g7aAQCDn.js">
-  <link rel="modulepreload" crossorigin href="/assets/AdminShell-D3N3Aq04.js">
+  <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-Bp-g80PM.js">
+  <link rel="modulepreload" crossorigin href="/assets/AdminShell-CMV3XY-s.js">
   <link rel="modulepreload" crossorigin href="/assets/admin-types-Dg11L4MQ.js">
   <link rel="modulepreload" crossorigin href="/assets/preload-helper-uTix4PVD.js">
-  <link rel="modulepreload" crossorigin href="/assets/page-BPIaNNW1.js">
-  <link rel="stylesheet" crossorigin href="/assets/OperatorConversations-DLfQEw1r.css">
+  <link rel="modulepreload" crossorigin href="/assets/page-drg1V-yA.js">
+  <link rel="stylesheet" crossorigin href="/assets/OperatorConversations-C4Cx814-.css">
 </head>
 <body>
   <div id="root"></div>

package/payload/server/public/data.html CHANGED Viewed

@@ -5,11 +5,11 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Data — Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/data-BVPOzSZ7.js"></script>
+  <script type="module" crossorigin src="/assets/data-HwT5wPmj.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-CAM3fms7.js">
-  <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-g7aAQCDn.js">
-  <link rel="modulepreload" crossorigin href="/assets/graph-labels-C4dkheQ8.js">
-  <link rel="stylesheet" crossorigin href="/assets/OperatorConversations-DLfQEw1r.css">
+  <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-Bp-g80PM.js">
+  <link rel="modulepreload" crossorigin href="/assets/graph-labels-kCti2CaC.js">
+  <link rel="stylesheet" crossorigin href="/assets/OperatorConversations-C4Cx814-.css">
 </head>
 <body>
   <div id="root"></div>

package/payload/server/public/graph.html CHANGED Viewed

@@ -5,13 +5,13 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Graph — Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/graph-D0fPx1nX.js"></script>
+  <script type="module" crossorigin src="/assets/graph-DFQbqmi9.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-CAM3fms7.js">
-  <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-g7aAQCDn.js">
-  <link rel="modulepreload" crossorigin href="/assets/graph-labels-C4dkheQ8.js">
-  <link rel="modulepreload" crossorigin href="/assets/AdminShell-D3N3Aq04.js">
-  <link rel="modulepreload" crossorigin href="/assets/Checkbox-DQGuYIRH.js">
-  <link rel="stylesheet" crossorigin href="/assets/OperatorConversations-DLfQEw1r.css">
+  <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-Bp-g80PM.js">
+  <link rel="modulepreload" crossorigin href="/assets/graph-labels-kCti2CaC.js">
+  <link rel="modulepreload" crossorigin href="/assets/AdminShell-CMV3XY-s.js">
+  <link rel="modulepreload" crossorigin href="/assets/Checkbox-LplFUKpb.js">
+  <link rel="stylesheet" crossorigin href="/assets/OperatorConversations-C4Cx814-.css">
 </head>
 <body>
   <div id="root"></div>

package/payload/server/public/index.html CHANGED Viewed

@@ -5,14 +5,14 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/admin-BU0dY3_T.js"></script>
+  <script type="module" crossorigin src="/assets/admin-3QQtd7j2.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-CAM3fms7.js">
-  <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-g7aAQCDn.js">
-  <link rel="modulepreload" crossorigin href="/assets/AdminShell-D3N3Aq04.js">
+  <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-Bp-g80PM.js">
+  <link rel="modulepreload" crossorigin href="/assets/AdminShell-CMV3XY-s.js">
   <link rel="modulepreload" crossorigin href="/assets/admin-types-Dg11L4MQ.js">
-  <link rel="modulepreload" crossorigin href="/assets/Checkbox-DQGuYIRH.js">
-  <link rel="modulepreload" crossorigin href="/assets/AdminLoginScreens-CpE_Nf5z.js">
-  <link rel="stylesheet" crossorigin href="/assets/OperatorConversations-DLfQEw1r.css">
+  <link rel="modulepreload" crossorigin href="/assets/Checkbox-LplFUKpb.js">
+  <link rel="modulepreload" crossorigin href="/assets/AdminLoginScreens-B_5wYcR-.js">
+  <link rel="stylesheet" crossorigin href="/assets/OperatorConversations-C4Cx814-.css">
   <link rel="stylesheet" crossorigin href="/assets/AdminLoginScreens-CWMpccrR.css">
   <link rel="stylesheet" href="/brand-defaults.css">
 </head>

package/payload/server/public/operator.html CHANGED Viewed

@@ -5,16 +5,16 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Operator — Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/operator-DyrF6PQi.js"></script>
+  <script type="module" crossorigin src="/assets/operator-BlCyq4q1.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-CAM3fms7.js">
-  <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-g7aAQCDn.js">
-  <link rel="modulepreload" crossorigin href="/assets/AdminShell-D3N3Aq04.js">
+  <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-Bp-g80PM.js">
+  <link rel="modulepreload" crossorigin href="/assets/AdminShell-CMV3XY-s.js">
   <link rel="modulepreload" crossorigin href="/assets/admin-types-Dg11L4MQ.js">
-  <link rel="modulepreload" crossorigin href="/assets/Checkbox-DQGuYIRH.js">
-  <link rel="modulepreload" crossorigin href="/assets/AdminLoginScreens-CpE_Nf5z.js">
+  <link rel="modulepreload" crossorigin href="/assets/Checkbox-LplFUKpb.js">
+  <link rel="modulepreload" crossorigin href="/assets/AdminLoginScreens-B_5wYcR-.js">
   <link rel="modulepreload" crossorigin href="/assets/preload-helper-uTix4PVD.js">
-  <link rel="modulepreload" crossorigin href="/assets/page-BPIaNNW1.js">
-  <link rel="stylesheet" crossorigin href="/assets/OperatorConversations-DLfQEw1r.css">
+  <link rel="modulepreload" crossorigin href="/assets/page-drg1V-yA.js">
+  <link rel="stylesheet" crossorigin href="/assets/OperatorConversations-C4Cx814-.css">
   <link rel="stylesheet" crossorigin href="/assets/AdminLoginScreens-CWMpccrR.css">
 </head>
 <body>

package/payload/server/public/public.html CHANGED Viewed

@@ -5,14 +5,14 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/public-BrIaS6m3.js"></script>
+  <script type="module" crossorigin src="/assets/public-BVjeYfsD.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-CAM3fms7.js">
-  <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-g7aAQCDn.js">
-  <link rel="modulepreload" crossorigin href="/assets/AdminShell-D3N3Aq04.js">
+  <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-Bp-g80PM.js">
+  <link rel="modulepreload" crossorigin href="/assets/AdminShell-CMV3XY-s.js">
   <link rel="modulepreload" crossorigin href="/assets/admin-types-Dg11L4MQ.js">
   <link rel="modulepreload" crossorigin href="/assets/preload-helper-uTix4PVD.js">
-  <link rel="modulepreload" crossorigin href="/assets/page-BPIaNNW1.js">
-  <link rel="stylesheet" crossorigin href="/assets/OperatorConversations-DLfQEw1r.css">
+  <link rel="modulepreload" crossorigin href="/assets/page-drg1V-yA.js">
+  <link rel="stylesheet" crossorigin href="/assets/OperatorConversations-C4Cx814-.css">
   <link rel="stylesheet" href="/brand-defaults.css">
 </head>
 <body class="public-surface">

package/payload/server/server.js CHANGED Viewed

@@ -17580,6 +17580,102 @@ app42.post("/launch", requireAdminSession, async (c) => {
 });
 var browser_default = app42;
+// server/lib/calendar-ics.ts
+var CRLF = "\r\n";
+var PRODID = "-//Maxy//Calendar//EN";
+var MAX_LINE_OCTETS = 75;
+function escapeText(value) {
+  return value.replace(/\\/g, "\\\\").replace(/;/g, "\\;").replace(/,/g, "\\,").replace(/\r?\n/g, "\\n");
+}
+function foldLine(line) {
+  const buf = Buffer.from(line, "utf-8");
+  if (buf.length <= MAX_LINE_OCTETS) return line;
+  const parts = [];
+  let offset = 0;
+  let first = true;
+  while (offset < buf.length) {
+    const maxChunk = first ? MAX_LINE_OCTETS : MAX_LINE_OCTETS - 1;
+    let end = Math.min(offset + maxChunk, buf.length);
+    while (end < buf.length && end > offset && (buf[end] & 192) === 128) end--;
+    const chunk = buf.subarray(offset, end).toString("utf-8");
+    parts.push(first ? chunk : " " + chunk);
+    offset = end;
+    first = false;
+  }
+  return parts.join(CRLF);
+}
+function toICSDateTime(iso) {
+  const d = new Date(iso);
+  if (isNaN(d.getTime())) throw new Error(`Invalid date: ${iso}`);
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getUTCFullYear()}${pad(d.getUTCMonth() + 1)}${pad(d.getUTCDate())}T${pad(d.getUTCHours())}${pad(d.getUTCMinutes())}${pad(d.getUTCSeconds())}Z`;
+}
+function toICSDate(iso) {
+  const d = new Date(iso);
+  if (isNaN(d.getTime())) throw new Error(`Invalid date: ${iso}`);
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getUTCFullYear()}${pad(d.getUTCMonth() + 1)}${pad(d.getUTCDate())}`;
+}
+function attendeeLine(a) {
+  if (!a.email) return null;
+  const cn = a.name ? `;CN=${escapeText(a.name)}` : "";
+  return `ATTENDEE${cn}:mailto:${a.email}`;
+}
+function serializeMeetingICS(m, opts) {
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const lines = [];
+  lines.push("BEGIN:VCALENDAR");
+  lines.push("VERSION:2.0");
+  lines.push(`PRODID:${PRODID}`);
+  lines.push("CALSCALE:GREGORIAN");
+  lines.push("METHOD:PUBLISH");
+  lines.push("BEGIN:VEVENT");
+  lines.push(`UID:${m.uid ?? m.id}`);
+  lines.push(`DTSTAMP:${toICSDateTime(now.toISOString())}`);
+  if (m.isAllDay) {
+    lines.push(`DTSTART;VALUE=DATE:${toICSDate(m.startsAt)}`);
+    if (m.endsAt) lines.push(`DTEND;VALUE=DATE:${toICSDate(m.endsAt)}`);
+  } else {
+    lines.push(`DTSTART:${toICSDateTime(m.startsAt)}`);
+    if (m.endsAt) lines.push(`DTEND:${toICSDateTime(m.endsAt)}`);
+  }
+  lines.push(`SUMMARY:${escapeText(m.title ?? "")}`);
+  if (m.location) lines.push(`LOCATION:${escapeText(m.location)}`);
+  if (opts.includeAttendees) {
+    for (const a of m.attendees) {
+      const line = attendeeLine(a);
+      if (line) lines.push(line);
+    }
+  }
+  lines.push("END:VEVENT");
+  lines.push("END:VCALENDAR");
+  return lines.map(foldLine).join(CRLF) + CRLF;
+}
+function countVEvents(ics) {
+  const unfolded = ics.replace(/\r?\n[ \t]/g, "");
+  const lines = unfolded.split(/\r?\n/);
+  let count = 0;
+  let inEvent = false;
+  let nested = 0;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (line === "BEGIN:VEVENT") {
+      inEvent = true;
+      nested = 0;
+      continue;
+    }
+    if (!inEvent) continue;
+    if (line === "END:VEVENT") {
+      inEvent = false;
+      count++;
+      continue;
+    }
+    if (line.startsWith("BEGIN:")) nested++;
+    else if (line.startsWith("END:") && nested > 0) nested--;
+  }
+  return count;
+}
 // server/routes/admin/calendar.ts
 var app43 = new Hono();
 function normalizeAttendees(raw) {
@@ -17592,12 +17688,26 @@ function normalizeAttendees(raw) {
     };
   });
 }
-var EDITABLE_FIELDS = ["title", "startsAt", "endsAt", "location"];
-var MEETING_RETURN = `RETURN elementId(m) AS id, m.title AS title,
+var EDITABLE_FIELDS = ["title", "startsAt", "endsAt", "location", "privateNote"];
+var MEETING_COLS = `elementId(m) AS id, m.title AS title,
             toString(m.startsAt) AS startsAt, toString(m.endsAt) AS endsAt,
             m.location AS location, coalesce(m.isAllDay, false) AS isAllDay,
-            'meeting' AS kind, m.uid AS uid,
-            [(p:Person)-[:ATTENDED]->(m) | {name: coalesce(p.displayName, p.email), email: p.email}] AS attendees`;
+            'meeting' AS kind, m.uid AS uid, m.privateNote AS privateNote,
+            [(att:Person)-[:ATTENDED]->(m) | {name: coalesce(att.displayName, att.email), email: att.email}] AS attendees`;
+var MEETING_RETURN = `RETURN ${MEETING_COLS}`;
+function mapMeeting(r) {
+  return {
+    meetingId: r.get("id"),
+    title: r.get("title"),
+    startsAt: r.get("startsAt"),
+    endsAt: r.get("endsAt"),
+    location: r.get("location"),
+    isAllDay: r.get("isAllDay"),
+    kind: r.get("kind"),
+    attendees: normalizeAttendees(r.get("attendees")),
+    privateNote: r.get("privateNote")
+  };
+}
 app43.get("/meetings", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -17617,7 +17727,7 @@ app43.get("/meetings", requireAdminSession, async (c) => {
        RETURN elementId(m) AS id, m.title AS title,
               toString(m.startsAt) AS startsAt, toString(m.endsAt) AS endsAt,
               m.location AS location, coalesce(m.isAllDay, false) AS isAllDay,
-              'meeting' AS kind,
+              'meeting' AS kind, m.privateNote AS privateNote,
               [(p:Person)-[:ATTENDED]->(m) | {name: coalesce(p.displayName, p.email), email: p.email}] AS attendees
        UNION
        MATCH (e:Event {accountId: $accountId})
@@ -17628,7 +17738,7 @@ app43.get("/meetings", requireAdminSession, async (c) => {
               toString(datetime(e.startDate)) AS startsAt,
               CASE WHEN e.endDate IS NULL THEN null ELSE toString(datetime(e.endDate)) END AS endsAt,
               e.location AS location, false AS isAllDay,
-              'event' AS kind,
+              'event' AS kind, null AS privateNote,
               [] AS attendees
        UNION
        MATCH (t:Task {accountId: $accountId})
@@ -17638,20 +17748,11 @@ app43.get("/meetings", requireAdminSession, async (c) => {
        RETURN elementId(t) AS id, t.name AS title,
               toString(datetime(t.dueDate)) AS startsAt, null AS endsAt,
               null AS location, true AS isAllDay,
-              'task' AS kind,
+              'task' AS kind, null AS privateNote,
               [] AS attendees`,
       { accountId, from, to }
     );
-    const meetings = res.records.map((r) => ({
-      meetingId: r.get("id"),
-      title: r.get("title"),
-      startsAt: r.get("startsAt"),
-      endsAt: r.get("endsAt"),
-      location: r.get("location"),
-      isAllDay: r.get("isAllDay"),
-      kind: r.get("kind"),
-      attendees: normalizeAttendees(r.get("attendees"))
-    })).sort((a, b) => new Date(a.startsAt).getTime() - new Date(b.startsAt).getTime());
+    const meetings = res.records.map(mapMeeting).sort((a, b) => new Date(a.startsAt).getTime() - new Date(b.startsAt).getTime());
     const counts = { meeting: 0, event: 0, task: 0 };
     for (const m of meetings) counts[m.kind]++;
     console.log(
@@ -17666,6 +17767,68 @@ app43.get("/meetings", requireAdminSession, async (c) => {
     await session.close();
   }
 });
+function icsFilename(title) {
+  const slug = (title ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
+  return `${slug || "meeting"}.ics`;
+}
+app43.get("/meetings/:id/ics", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
+    console.error('[calendar] op=ics auth-rejected reason="no account for session"');
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  const id = c.req.param("id");
+  const includeAttendees = c.req.query("attendees") === "1";
+  console.log(`[calendar] op=ics-request id=${id} attendees=${includeAttendees}`);
+  const session = getSession();
+  try {
+    const res = await session.run(
+      `MATCH (m:Meeting {accountId: $accountId})
+       WHERE elementId(m) = $id
+       ${MEETING_RETURN}`,
+      { accountId, id }
+    );
+    if (res.records.length === 0) {
+      console.warn(`[calendar] op=ics-404 id=${id} reason="no meeting for account"`);
+      return c.json({ error: "Meeting not found for this account" }, 404);
+    }
+    const r = res.records[0];
+    const mapped = mapMeeting(r);
+    const uid = r.get("uid") ?? null;
+    const corr = uid ?? mapped.meetingId;
+    const input = {
+      uid,
+      id: mapped.meetingId,
+      title: mapped.title,
+      startsAt: mapped.startsAt,
+      endsAt: mapped.endsAt,
+      location: mapped.location,
+      isAllDay: mapped.isAllDay,
+      attendees: mapped.attendees
+    };
+    console.log(`[calendar] op=ics-resolved id=${corr} allDay=${input.isAllDay} attendees=${input.attendees.length}`);
+    const ics = serializeMeetingICS(input, { includeAttendees });
+    const bytes = Buffer.byteLength(ics, "utf-8");
+    const vevents = countVEvents(ics);
+    console.log(`[calendar] op=ics-serialized id=${corr} bytes=${bytes} vevents=${vevents}`);
+    if (vevents !== 1 || bytes === 0) {
+      console.error(`[calendar] op=ics-malformed id=${corr} vevents=${vevents} bytes=${bytes}`);
+      return c.json({ error: "Failed to produce a valid calendar file" }, 500);
+    }
+    console.log(`[calendar] op=ics-export id=${corr} bytes=${bytes} attendees=${includeAttendees}`);
+    return c.body(ics, 200, {
+      "content-type": "text/calendar; charset=utf-8",
+      "content-disposition": `attachment; filename="${icsFilename(mapped.title)}"`
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[calendar] op=ics-fail id=${id} err="${message}"`);
+    return c.json({ error: `ICS export failed: ${message}` }, 503);
+  } finally {
+    await session.close();
+  }
+});
 app43.patch("/meetings/:id", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -17677,7 +17840,7 @@ app43.patch("/meetings/:id", requireAdminSession, async (c) => {
   const body = await safeJson(c) ?? {};
   const fields = EDITABLE_FIELDS.filter((f) => f in body);
   if (fields.length === 0) {
-    return c.json({ error: "No editable field supplied (title, startsAt, endsAt, location)" }, 400);
+    return c.json({ error: "No editable field supplied (title, startsAt, endsAt, location, privateNote)" }, 400);
   }
   const setClauses = fields.map(
     (f) => f === "startsAt" || f === "endsAt" ? `m.${f} = datetime($${f})` : `m.${f} = $${f}`
@@ -17701,17 +17864,7 @@ app43.patch("/meetings/:id", requireAdminSession, async (c) => {
     const r = res.records[0];
     const uid = r.get("uid");
     console.log(`[calendar-edit] account=${accountId.slice(0, 8)} uid=${uid ?? "absent"} fields=${fields.join(",")}`);
-    const meeting = {
-      meetingId: r.get("id"),
-      title: r.get("title"),
-      startsAt: r.get("startsAt"),
-      endsAt: r.get("endsAt"),
-      location: r.get("location"),
-      isAllDay: r.get("isAllDay"),
-      kind: "meeting",
-      attendees: normalizeAttendees(r.get("attendees"))
-    };
-    return c.json({ meeting });
+    return c.json({ meeting: mapMeeting(r) });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     console.error(`[calendar-edit] op=fail err="${message}"`);
@@ -17720,6 +17873,102 @@ app43.patch("/meetings/:id", requireAdminSession, async (c) => {
     await session.close();
   }
 });
+app43.post("/meetings/:id/attendees", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
+    console.error('[calendar] op=attendee-add auth-rejected reason="no account for session"');
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  const id = c.req.param("id");
+  const body = await safeJson(c) ?? {};
+  const email = typeof body.email === "string" && body.email.trim() ? body.email.trim() : null;
+  const name = typeof body.name === "string" && body.name.trim() ? body.name.trim() : null;
+  if (!email && !name) {
+    return c.json({ error: "email or name required" }, 400);
+  }
+  const cypher = email ? `MATCH (m:Meeting {accountId: $accountId})
+       WHERE elementId(m) = $id
+       OPTIONAL MATCH (existing:Person {accountId: $accountId, email: $email})
+       WITH m, existing IS NULL AS personCreated
+       MERGE (p:Person {accountId: $accountId, email: $email})
+         ON CREATE SET p.displayName = $name
+       MERGE (p)-[:ATTENDED]->(m)
+       WITH m, personCreated
+       RETURN ${MEETING_COLS}, personCreated AS personCreated` : `MATCH (m:Meeting {accountId: $accountId})
+       WHERE elementId(m) = $id
+       CREATE (p:Person {accountId: $accountId, displayName: $name})
+       MERGE (p)-[:ATTENDED]->(m)
+       WITH m, true AS personCreated
+       RETURN ${MEETING_COLS}, personCreated AS personCreated`;
+  const session = getSession();
+  try {
+    const res = await session.run(cypher, { accountId, id, email, name });
+    if (res.records.length === 0) {
+      console.warn(`[calendar-attendee] op=add account=${accountId.slice(0, 8)} uid=absent email=${email ?? "none"} found=0`);
+      return c.json({ error: "Meeting not found for this account" }, 404);
+    }
+    const r = res.records[0];
+    const uid = r.get("uid");
+    const personCreated = r.get("personCreated");
+    console.log(
+      `[calendar-attendee] op=add account=${accountId.slice(0, 8)} uid=${uid ?? "absent"} email=${email ?? "none"} personCreated=${personCreated}`
+    );
+    return c.json({ meeting: mapMeeting(r) });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[calendar-attendee] op=add-fail err="${message}"`);
+    return c.json({ error: `Attendee add failed: ${message}` }, 503);
+  } finally {
+    await session.close();
+  }
+});
+app43.delete("/meetings/:id/attendees", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
+    console.error('[calendar] op=attendee-remove auth-rejected reason="no account for session"');
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  const id = c.req.param("id");
+  const body = await safeJson(c) ?? {};
+  const email = typeof body.email === "string" && body.email.trim() ? body.email.trim() : null;
+  const name = typeof body.name === "string" && body.name.trim() ? body.name.trim() : null;
+  if (!email && !name) {
+    return c.json({ error: "email or name required" }, 400);
+  }
+  const keyPredicate = email ? "att.email = $email" : "att.displayName = $name";
+  const cypher = `MATCH (m:Meeting {accountId: $accountId})
+       WHERE elementId(m) = $id
+       OPTIONAL MATCH (att:Person {accountId: $accountId})-[r:ATTENDED]->(m)
+       WHERE ${keyPredicate}
+       DELETE r
+       WITH m, count(att) AS removed, collect(att) AS survivors
+       RETURN ${MEETING_COLS}, removed AS removed,
+              all(s IN survivors WHERE s IS NOT NULL) AS personSurvived`;
+  const session = getSession();
+  try {
+    const res = await session.run(cypher, { accountId, id, email, name });
+    if (res.records.length === 0) {
+      console.warn(`[calendar-attendee] op=remove account=${accountId.slice(0, 8)} uid=absent key=${email ?? name} found=0`);
+      return c.json({ error: "Meeting not found for this account" }, 404);
+    }
+    const r = res.records[0];
+    const uid = r.get("uid");
+    const removed = Number(r.get("removed"));
+    const personSurvived = r.get("personSurvived");
+    console.log(
+      `[calendar-attendee] op=remove account=${accountId.slice(0, 8)} uid=${uid ?? "absent"} key=${email ?? name} removed=${removed} personSurvived=${personSurvived}`
+    );
+    return c.json({ meeting: mapMeeting(r), removed });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[calendar-attendee] op=remove-fail err="${message}"`);
+    return c.json({ error: `Attendee remove failed: ${message}` }, 503);
+  } finally {
+    await session.close();
+  }
+});
 app43.delete("/meetings/:id", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);