libre-webui 0.25.0 → 0.27.0

package/backend/dist/services/webauthnService.d.ts

@@ -0,0 +1,58 @@
+export declare class PasskeyError extends Error {
+    readonly statusCode: number;
+    constructor(message: string, statusCode?: number);
+}
+/** The relying-party id and origin policy for a request host. */
+export declare const resolveRelyingParty: (requestHost: string) => {
+    rpId: string;
+};
+export interface PublicPasskey {
+    id: string;
+    name: string | null;
+    createdAt: number;
+    lastUsedAt: number | null;
+}
+export declare const listPasskeys: (userId: string) => Promise<PublicPasskey[]>;
+export declare const deletePasskey: (userId: string, passkeyId: string) => Promise<boolean>;
+export declare const deleteAllPasskeys: (userId: string) => Promise<number>;
+export declare const registrationOptions: (user: {
+    id: string;
+    username: string;
+}, requestHost: string) => Promise<{
+    challengeToken: string;
+    publicKey: Record<string, unknown>;
+}>;
+export interface RegistrationSubmission {
+    challengeToken: string;
+    name?: string;
+    credential: {
+        rawId: string;
+        response: {
+            clientDataJSON: string;
+            attestationObject: string;
+            transports?: string[];
+        };
+    };
+}
+export declare const registerPasskey: (userId: string, submission: RegistrationSubmission, requestHost: string) => Promise<PublicPasskey>;
+export declare const loginOptions: (requestHost: string) => Promise<{
+    challengeToken: string;
+    publicKey: Record<string, unknown>;
+}>;
+export interface AssertionSubmission {
+    challengeToken: string;
+    credential: {
+        rawId: string;
+        response: {
+            clientDataJSON: string;
+            authenticatorData: string;
+            signature: string;
+        };
+    };
+}
+/** Verify a passwordless sign-in assertion; returns the credential owner. */
+export declare const verifyPasskeyLogin: (submission: AssertionSubmission, requestHost: string) => Promise<{
+    userId: string;
+    passkeyId: string;
+}>;
+//# sourceMappingURL=webauthnService.d.ts.map

package/backend/dist/services/webauthnService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthnService.d.ts","sourceRoot":"","sources":["../../src/services/webauthnService.ts"],"names":[],"mappings":"AAyDA,qBAAa,YAAa,SAAQ,KAAK;aAGnB,UAAU;IAF5B,YACE,OAAO,EAAE,MAAM,EACC,UAAU,SAAM,EAGjC;CACF;AAyBD,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,gBAAiB,MAAM,KAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAQvE,CAAC;AAuEF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AASD,eAAO,MAAM,YAAY,WAAkB,MAAM,KAAG,OAAO,CAAC,aAAa,EAAE,CACV,CAAC;AAElE,eAAO,MAAM,aAAa,WAChB,MAAM,aACH,MAAM,KAChB,OAAO,CAAC,OAAO,CAAqD,CAAC;AAExE,eAAO,MAAM,iBAAiB,WAAkB,MAAM,KAAG,OAAO,CAAC,MAAM,CACzB,CAAC;AAE/C,eAAO,MAAM,mBAAmB,SACxB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,eACzB,MAAM,KAClB,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CA0CxE,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE;YACR,cAAc,EAAE,MAAM,CAAC;YACvB,iBAAiB,EAAE,MAAM,CAAC;YAC1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;SACvB,CAAC;KACH,CAAC;CACH;AAED,eAAO,MAAM,eAAe,WAClB,MAAM,cACF,sBAAsB,eACrB,MAAM,KAClB,OAAO,CAAC,aAAa,CAgGvB,CAAC;AAEF,eAAO,MAAM,YAAY,gBACV,MAAM,KAClB,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAYxE,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE;YACR,cAAc,EAAE,MAAM,CAAC;YACvB,iBAAiB,EAAE,MAAM,CAAC;YAC1B,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC;KACH,CAAC;CACH;AAED,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,eACjB,mBAAmB,eAClB,MAAM,KAClB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAqF/C,CAAC"}

package/backend/dist/services/webauthnService.js

@@ -0,0 +1,300 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Passkey (WebAuthn) registration and passwordless sign-in.
+ *
+ * Attestation policy is 'none' (statements are not evaluated), credentials
+ * are discoverable with user verification required, and ES256/EdDSA are the
+ * accepted algorithms. Credential ids are stored as keyed one-way lookup
+ * tokens with the key material encrypted at rest. Challenges are one-use
+ * through the coordinator cache and carried in a signed token using a secret
+ * derived from (but distinct from) the session JWT secret.
+ */
+import jwt from 'jsonwebtoken';
+import { createHmac, randomBytes, randomUUID } from 'node:crypto';
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+import { JWT_SECRET } from './authService.js';
+import { getCoordinator } from '../platform/coordination/service.js';
+import { WebAuthnError, extractPublicKey, originMatchesRpId, parseAttestationObject, parseAuthenticatorData, parseClientDataJson, sha256, verifyAssertionSignature, } from '../utils/webauthn.js';
+const credentialRepository = () => getPersistence(encryptionService).repositories.security.webauthnCredentials;
+const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+const MAX_CREDENTIALS_PER_USER = 10;
+const CHALLENGE_SECRET = createHmac('sha256', JWT_SECRET)
+    .update('libre:webauthn-challenge:v1')
+    .digest();
+export class PasskeyError extends Error {
+    constructor(message, statusCode = 400) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
+const credentialLookup = (credentialIdBase64Url) => encryptionService.purposeLookupToken('webauthn-credential', credentialIdBase64Url);
+const decodeBase64Url = (value, name) => {
+    if (typeof value !== 'string' ||
+        value.length === 0 ||
+        value.length > 200000) {
+        throw new PasskeyError(`${name} is required`);
+    }
+    return Buffer.from(value, 'base64url');
+};
+/** The relying-party id and origin policy for a request host. */
+export const resolveRelyingParty = (requestHost) => {
+    const pinned = process.env.WEBAUTHN_RP_ID?.trim();
+    if (pinned)
+        return { rpId: pinned };
+    const hostname = requestHost.split(':')[0]?.trim().toLowerCase();
+    if (!hostname) {
+        throw new PasskeyError('Cannot determine the relying-party id', 500);
+    }
+    return { rpId: hostname };
+};
+const assertAcceptableOrigin = (origin, rpId) => {
+    if (!originMatchesRpId(origin, rpId)) {
+        throw new PasskeyError('This passkey response came from another site', 401);
+    }
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        throw new PasskeyError('This passkey response came from another site', 401);
+    }
+    const localhost = url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+    if (url.protocol !== 'https:' && !localhost) {
+        throw new PasskeyError('Passkeys require a secure (HTTPS) origin', 401);
+    }
+};
+const issueChallenge = async (purpose, userId) => {
+    const challenge = randomBytes(32).toString('base64url');
+    const jti = randomUUID();
+    await getCoordinator().setCache(`webauthn-challenge:${jti}`, { purpose }, CHALLENGE_TTL_MS);
+    const token = jwt.sign({ sub: userId, purpose, challenge, jti }, CHALLENGE_SECRET, { expiresIn: Math.floor(CHALLENGE_TTL_MS / 1000) });
+    return { token, challenge };
+};
+/** Verify and burn a challenge token; each token authorizes one ceremony. */
+const consumeChallenge = async (token, purpose) => {
+    let claims;
+    try {
+        claims = jwt.verify(token, CHALLENGE_SECRET);
+    }
+    catch {
+        throw new PasskeyError('This passkey challenge has expired', 401);
+    }
+    if (claims.purpose !== purpose || !claims.challenge || !claims.jti) {
+        throw new PasskeyError('This passkey challenge is not valid', 401);
+    }
+    const cached = await getCoordinator().consumeCache(`webauthn-challenge:${claims.jti}`);
+    if (!cached) {
+        throw new PasskeyError('This passkey challenge was already used', 401);
+    }
+    return {
+        ...(claims.sub ? { userId: claims.sub } : {}),
+        challenge: claims.challenge,
+    };
+};
+const toPublic = (record) => ({
+    id: record.id,
+    name: record.name,
+    createdAt: record.created_at,
+    lastUsedAt: record.last_used_at,
+});
+export const listPasskeys = async (userId) => (await credentialRepository().listByUser(userId)).map(toPublic);
+export const deletePasskey = async (userId, passkeyId) => credentialRepository().delete(passkeyId, userId);
+export const deleteAllPasskeys = async (userId) => credentialRepository().deleteForUser(userId);
+export const registrationOptions = async (user, requestHost) => {
+    const { rpId } = resolveRelyingParty(requestHost);
+    const { token, challenge } = await issueChallenge('webauthn-register', user.id);
+    const existing = await credentialRepository().listByUser(user.id);
+    const excludeCredentials = existing
+        .map(record => {
+        try {
+            const data = encryptionService.decryptObject(record.credential_data);
+            return { type: 'public-key', id: data.credentialId };
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter(Boolean);
+    return {
+        challengeToken: token,
+        publicKey: {
+            challenge,
+            rp: { id: rpId, name: 'Libre WebUI' },
+            user: {
+                id: Buffer.from(user.id, 'utf8').toString('base64url'),
+                name: user.username,
+                displayName: user.username,
+            },
+            pubKeyCredParams: [
+                { type: 'public-key', alg: -7 },
+                { type: 'public-key', alg: -8 },
+            ],
+            authenticatorSelection: {
+                residentKey: 'required',
+                userVerification: 'required',
+            },
+            attestation: 'none',
+            timeout: 120000,
+            excludeCredentials,
+        },
+    };
+};
+export const registerPasskey = async (userId, submission, requestHost) => {
+    const { rpId } = resolveRelyingParty(requestHost);
+    const consumed = await consumeChallenge(submission.challengeToken, 'webauthn-register');
+    if (consumed.userId !== userId) {
+        throw new PasskeyError('This passkey challenge belongs to another sign-in', 401);
+    }
+    const clientDataJson = decodeBase64Url(submission.credential?.response?.clientDataJSON, 'clientDataJSON');
+    const clientData = parseClientDataJson(clientDataJson);
+    if (clientData.type !== 'webauthn.create') {
+        throw new PasskeyError('Unexpected passkey ceremony type', 401);
+    }
+    if (clientData.challenge !== consumed.challenge) {
+        throw new PasskeyError('Passkey challenge mismatch', 401);
+    }
+    assertAcceptableOrigin(clientData.origin, rpId);
+    let authData;
+    let parsed;
+    let publicKey;
+    try {
+        authData = parseAttestationObject(decodeBase64Url(submission.credential?.response?.attestationObject, 'attestationObject'));
+        parsed = parseAuthenticatorData(authData);
+        if (!parsed.publicKey || !parsed.credentialId) {
+            throw new WebAuthnError('Attested credential data is missing');
+        }
+        publicKey = extractPublicKey(parsed.publicKey);
+    }
+    catch (error) {
+        if (error instanceof WebAuthnError) {
+            throw new PasskeyError(`Passkey registration failed: ${error.message}`);
+        }
+        throw error;
+    }
+    if (!parsed.rpIdHash.equals(sha256(rpId))) {
+        throw new PasskeyError('This passkey was created for another site', 401);
+    }
+    if (!parsed.userPresent || !parsed.userVerified) {
+        throw new PasskeyError('Passkeys require user verification', 401);
+    }
+    const credentialId = parsed.credentialId.toString('base64url');
+    const rawId = submission.credential.rawId;
+    if (typeof rawId === 'string' && rawId !== credentialId) {
+        throw new PasskeyError('Credential id mismatch', 401);
+    }
+    const lookup = credentialLookup(credentialId);
+    if (await credentialRepository().findByLookup(lookup)) {
+        throw new PasskeyError('This passkey is already registered', 409);
+    }
+    if ((await credentialRepository().countForUser(userId)) >=
+        MAX_CREDENTIALS_PER_USER) {
+        throw new PasskeyError(`You can register at most ${MAX_CREDENTIALS_PER_USER} passkeys`, 409);
+    }
+    const transports = Array.isArray(submission.credential.response.transports)
+        ? submission.credential.response.transports
+            .filter((entry) => typeof entry === 'string')
+            .slice(0, 8)
+        : [];
+    const name = submission.name?.trim().slice(0, 64) || null;
+    const record = {
+        id: randomUUID(),
+        user_id: userId,
+        credential_lookup: lookup,
+        credential_data: encryptionService.encryptObject({
+            credentialId,
+            publicKey,
+            transports,
+        }),
+        name,
+        sign_count: parsed.signCount,
+        created_at: Date.now(),
+        last_used_at: null,
+    };
+    await credentialRepository().insert(record);
+    return toPublic(record);
+};
+export const loginOptions = async (requestHost) => {
+    const { rpId } = resolveRelyingParty(requestHost);
+    const { token, challenge } = await issueChallenge('webauthn-login');
+    return {
+        challengeToken: token,
+        publicKey: {
+            challenge,
+            rpId,
+            userVerification: 'required',
+            timeout: 120000,
+        },
+    };
+};
+/** Verify a passwordless sign-in assertion; returns the credential owner. */
+export const verifyPasskeyLogin = async (submission, requestHost) => {
+    const { rpId } = resolveRelyingParty(requestHost);
+    const consumed = await consumeChallenge(submission.challengeToken, 'webauthn-login');
+    const clientDataJson = decodeBase64Url(submission.credential?.response?.clientDataJSON, 'clientDataJSON');
+    const clientData = parseClientDataJson(clientDataJson);
+    if (clientData.type !== 'webauthn.get') {
+        throw new PasskeyError('Unexpected passkey ceremony type', 401);
+    }
+    if (clientData.challenge !== consumed.challenge) {
+        throw new PasskeyError('Passkey challenge mismatch', 401);
+    }
+    assertAcceptableOrigin(clientData.origin, rpId);
+    const rawId = decodeBase64Url(submission.credential?.rawId, 'credential id');
+    const record = await credentialRepository().findByLookup(credentialLookup(rawId.toString('base64url')));
+    if (!record) {
+        throw new PasskeyError('This passkey is not registered here', 401);
+    }
+    let data;
+    try {
+        data = encryptionService.decryptObject(record.credential_data);
+    }
+    catch {
+        throw new PasskeyError('This passkey is not usable', 401);
+    }
+    const authData = decodeBase64Url(submission.credential?.response?.authenticatorData, 'authenticatorData');
+    let parsed;
+    try {
+        parsed = parseAuthenticatorData(authData);
+    }
+    catch (error) {
+        if (error instanceof WebAuthnError) {
+            throw new PasskeyError(`Passkey sign-in failed: ${error.message}`, 401);
+        }
+        throw error;
+    }
+    if (!parsed.rpIdHash.equals(sha256(rpId))) {
+        throw new PasskeyError('This passkey belongs to another site', 401);
+    }
+    if (!parsed.userPresent || !parsed.userVerified) {
+        throw new PasskeyError('Passkeys require user verification', 401);
+    }
+    const signature = decodeBase64Url(submission.credential?.response?.signature, 'signature');
+    if (!verifyAssertionSignature(data.publicKey, authData, clientDataJson, signature)) {
+        throw new PasskeyError('Passkey signature verification failed', 401);
+    }
+    // A nonzero counter that does not advance suggests a cloned authenticator.
+    if (parsed.signCount !== 0 &&
+        record.sign_count !== 0 &&
+        parsed.signCount <= record.sign_count) {
+        throw new PasskeyError('This passkey failed a clone check', 401);
+    }
+    await credentialRepository().updateSignCount(record.id, Math.max(parsed.signCount, record.sign_count), Date.now());
+    return { userId: record.user_id, passkeyId: record.id };
+};
+//# sourceMappingURL=webauthnService.js.map

package/backend/dist/services/webauthnService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthnService.js","sourceRoot":"","sources":["../../src/services/webauthnService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;GASG;AAEH,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,MAAM,EACN,wBAAwB,GAEzB,MAAM,sBAAsB,CAAC;AAG9B,MAAM,oBAAoB,GAAG,GAAG,EAAE,CAChC,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC;AAE9E,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;KACtD,MAAM,CAAC,6BAA6B,CAAC;KACrC,MAAM,EAAE,CAAC;AAEZ,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YACE,OAAe,EACC,UAAU,GAAG,GAAG;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;0BAFC,UAAU;IAG5B,CAAC;CACF;AAQD,MAAM,gBAAgB,GAAG,CAAC,qBAA6B,EAAU,EAAE,CACjE,iBAAiB,CAAC,kBAAkB,CAClC,qBAAqB,EACrB,qBAAqB,CACtB,CAAC;AAEJ,MAAM,eAAe,GAAG,CAAC,KAAc,EAAE,IAAY,EAAU,EAAE;IAC/D,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,MAAM,GAAG,MAAO,EACtB,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAoB,EAAE;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,YAAY,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAQ,EAAE;IACpE,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,YAAY,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,SAAS,GACb,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC/D,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CAAC;AASF,MAAM,cAAc,GAAG,KAAK,EAC1B,OAA+C,EAC/C,MAAe,EACgC,EAAE;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,cAAc,EAAE,CAAC,QAAQ,CAC7B,sBAAsB,GAAG,EAAE,EAC3B,EAAE,OAAO,EAAE,EACX,gBAAgB,CACjB,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CACpB,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,EACxC,gBAAgB,EAChB,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,EAAE,CACnD,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,KAAK,EAC5B,KAAa,EACb,OAA+C,EACE,EAAE;IACnD,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAoB,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACnE,MAAM,IAAI,YAAY,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC,YAAY,CAChD,sBAAsB,MAAM,CAAC,GAAG,EAAE,CACnC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC,CAAC;AASF,MAAM,QAAQ,GAAG,CAAC,MAAsC,EAAiB,EAAE,CAAC,CAAC;IAC3E,EAAE,EAAE,MAAM,CAAC,EAAE;IACb,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,SAAS,EAAE,MAAM,CAAC,UAAU;IAC5B,UAAU,EAAE,MAAM,CAAC,YAAY;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAc,EAA4B,EAAE,CAC7E,CAAC,MAAM,oBAAoB,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAAc,EACd,SAAiB,EACC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,MAAc,EAAmB,EAAE,CACzE,oBAAoB,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,IAAsC,EACtC,WAAmB,EACsD,EAAE;IAC3E,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAC/C,mBAAmB,EACnB,IAAI,CAAC,EAAE,CACR,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,kBAAkB,GAAG,QAAQ;SAChC,GAAG,CAAC,MAAM,CAAC,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,aAAa,CAC1C,MAAM,CAAC,eAAe,CACvB,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO;QACL,cAAc,EAAE,KAAK;QACrB,SAAS,EAAE;YACT,SAAS;YACT,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE;YACrC,IAAI,EAAE;gBACJ,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACtD,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,WAAW,EAAE,IAAI,CAAC,QAAQ;aAC3B;YACD,gBAAgB,EAAE;gBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;gBAC/B,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;aAChC;YACD,sBAAsB,EAAE;gBACtB,WAAW,EAAE,UAAU;gBACvB,gBAAgB,EAAE,UAAU;aAC7B;YACD,WAAW,EAAE,MAAM;YACnB,OAAO,EAAE,MAAO;YAChB,kBAAkB;SACnB;KACF,CAAC;AACJ,CAAC,CAAC;AAeF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,MAAc,EACd,UAAkC,EAClC,WAAmB,EACK,EAAE;IAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,UAAU,CAAC,cAAc,EACzB,mBAAmB,CACpB,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,mDAAmD,EACnD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,eAAe,CACpC,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,cAAc,EAC/C,gBAAgB,CACjB,CAAC;IACF,MAAM,UAAU,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1C,MAAM,IAAI,YAAY,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,sBAAsB,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEhD,IAAI,QAAgB,CAAC;IACrB,IAAI,MAAiD,CAAC;IACtD,IAAI,SAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,QAAQ,GAAG,sBAAsB,CAC/B,eAAe,CACb,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAClD,mBAAmB,CACpB,CACF,CAAC;QACF,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,IAAI,aAAa,CAAC,qCAAqC,CAAC,CAAC;QACjE,CAAC;QACD,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,YAAY,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,YAAY,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QACxD,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,MAAM,oBAAoB,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,IACE,CAAC,MAAM,oBAAoB,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACnD,wBAAwB,EACxB,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,4BAA4B,wBAAwB,WAAW,EAC/D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU;aACtC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;aAC7D,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IAC1D,MAAM,MAAM,GAAmC;QAC7C,EAAE,EAAE,UAAU,EAAE;QAChB,OAAO,EAAE,MAAM;QACf,iBAAiB,EAAE,MAAM;QACzB,eAAe,EAAE,iBAAiB,CAAC,aAAa,CAAC;YAC/C,YAAY;YACZ,SAAS;YACT,UAAU;SACc,CAAC;QAC3B,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;QACtB,YAAY,EAAE,IAAI;KACnB,CAAC;IACF,MAAM,oBAAoB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,WAAmB,EACsD,EAAE;IAC3E,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACpE,OAAO;QACL,cAAc,EAAE,KAAK;QACrB,SAAS,EAAE;YACT,SAAS;YACT,IAAI;YACJ,gBAAgB,EAAE,UAAU;YAC5B,OAAO,EAAE,MAAO;SACjB;KACF,CAAC;AACJ,CAAC,CAAC;AAcF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,UAA+B,EAC/B,WAAmB,EAC6B,EAAE;IAClD,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,UAAU,CAAC,cAAc,EACzB,gBAAgB,CACjB,CAAC;IAEF,MAAM,cAAc,GAAG,eAAe,CACpC,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,cAAc,EAC/C,gBAAgB,CACjB,CAAC;IACF,MAAM,UAAU,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACvC,MAAM,IAAI,YAAY,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,sBAAsB,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC,YAAY,CACtD,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAC9C,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,iBAAiB,CAAC,aAAa,CACpC,MAAM,CAAC,eAAe,CACvB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAC9B,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAClD,mBAAmB,CACpB,CAAC;IACF,IAAI,MAAiD,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,YAAY,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,YAAY,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAC/B,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAC1C,WAAW,CACZ,CAAC;IACF,IACE,CAAC,wBAAwB,CACvB,IAAI,CAAC,SAAS,EACd,QAAQ,EACR,cAAc,EACd,SAAS,CACV,EACD,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,2EAA2E;IAC3E,IACE,MAAM,CAAC,SAAS,KAAK,CAAC;QACtB,MAAM,CAAC,UAAU,KAAK,CAAC;QACvB,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,EACrC,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,oBAAoB,EAAE,CAAC,eAAe,CAC1C,MAAM,CAAC,EAAE,EACT,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,EAC7C,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;AAC1D,CAAC,CAAC"}

package/backend/dist/storage.d.ts

@@ -1,4 +1,4 @@
-import { CalendarEvent, ChatSession, ChatMessage, DocumentChunk, KnowledgeCollection, Note, SessionFolder, UserPreferences } from './types/index.js';
+import { Calendar, CalendarEvent, ChatSession, ChatMessage, DocumentChunk, KnowledgeCollection, Note, SessionFolder, UserPreferences } from './types/index.js';
 import { type Document } from './storageMappers.js';
 import type { ChatGenerationEnqueuer, ChatGenerationEnqueueInput } from './persistence/chatGenerationTypes.js';
 import type { StoredPreferenceRecord } from './persistence/resourceTypes.js';
@@ -34,6 +34,10 @@ declare class StorageService {
     deleteSession(sessionId: string, userId?: string, beforeCommit?: () => void | Promise<void>): Promise<boolean>;
     private siblingCounts;
     getKnowledgeCollections(userId?: string): Promise<KnowledgeCollection[]>;
+    /** Cross-owner read; callers must authorize before returning content. */
+    getKnowledgeCollectionById(collectionId: string): Promise<(KnowledgeCollection & {
+        ownerUserId: string;
+    }) | undefined>;
     saveKnowledgeCollection(collection: KnowledgeCollection, userId?: string): Promise<void>;
     deleteKnowledgeCollection(collectionId: string, userId?: string): Promise<boolean>;
     setDocumentCollection(documentId: string, collectionId: string | null, userId?: string): Promise<boolean>;
@@ -51,6 +55,29 @@ declare class StorageService {
     getCalendarEvent(eventId: string, userId?: string): Promise<CalendarEvent | undefined>;
     saveCalendarEvent(event: CalendarEvent, userId?: string): Promise<void>;
     deleteCalendarEvent(eventId: string, userId?: string): Promise<boolean>;
+    /** Cross-owner reads for shared calendars; callers authorize per calendar. */
+    getCalendarEventsForCalendarsBetween(calendarIds: readonly string[], from: number, to: number): Promise<CalendarEvent[]>;
+    getRecurringEventsForCalendars(calendarIds: readonly string[]): Promise<CalendarEvent[]>;
+    /** Cross-owner read; callers must authorize before returning content. */
+    getCalendarEventById(eventId: string): Promise<{
+        event: CalendarEvent;
+        ownerUserId: string;
+    } | undefined>;
+    listCalendarEventsWithReminders(): Promise<Array<{
+        event: CalendarEvent;
+        ownerUserId: string;
+    }>>;
+    markCalendarEventReminded(eventId: string, occurrenceStart: number): Promise<boolean>;
+    private mapCalendarRow;
+    getCalendars(userId?: string): Promise<Array<Calendar & {
+        ownerUserId: string;
+    }>>;
+    /** Cross-owner read; callers must authorize before returning content. */
+    getCalendarById(calendarId: string): Promise<(Calendar & {
+        ownerUserId: string;
+    }) | undefined>;
+    saveCalendar(calendar: Calendar, userId?: string): Promise<void>;
+    deleteCalendar(calendarId: string, userId?: string): Promise<boolean>;
     getSessionFolders(userId?: string): Promise<SessionFolder[]>;
     saveSessionFolder(folder: SessionFolder, userId?: string): Promise<void>;
     deleteSessionFolder(folderId: string, userId?: string): Promise<boolean>;

package/backend/dist/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAkBA,OAAO,EAEL,aAAa,EACb,WAAW,EACX,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,IAAI,EACJ,aAAa,EACb,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAgB1B,OAAO,EAEL,KAAK,QAAQ,EAGd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EACV,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAIV,sBAAsB,EACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EACV,0BAA0B,EAC1B,uBAAuB,EACxB,MAAM,oCAAoC,CAAC;AAI5C,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,cAAM,cAAc;IAKZ,cAAc,CAAC,MAAM,SAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAY/D;IAEK,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,SAAY,GACjB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAUlC;IAED,OAAO,CAAC,cAAc;IAmCtB,OAAO,CAAC,cAAc;IA4BhB,WAAW,CACf,OAAO,EAAE,WAAW,EACpB,MAAM,SAAY,EAClB,YAAY,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACxC,OAAO,CAAC,IAAI,CAAC,CAOf;IAEK,+BAA+B,CACnC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,sBAAsB,EAChC,KAAK,EAAE,0BAA0B,EACjC,YAAY,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACxC,OAAO,CAAC,IAAI,CAAC,CASf;IAEK,4BAA4B,CAAC,KAAK,EAAE;QACxC,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,WAAW,GAAG;YAAE,IAAI,EAAE,WAAW,CAAA;SAAE,CAAC;QAC7C,KAAK,EAAE,uBAAuB,CAAC;QAC/B,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,EAAE,0BAA0B,CAAC;QAClC,YAAY,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC3C,GAAG,OAAO,CAAC,MAAM,CAAC,CAgClB;IAEK,6BAA6B,CAAC,KAAK,EAAE;QACzC,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,wBAAwB,EAAE,MAAM,CAAC;QACjC,wBAAwB,EAAE,MAAM,CAAC;QACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CAYnB;IAEK,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,MAAM,SAAY,EAClB,YAAY,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACxC,OAAO,CAAC,OAAO,CAAC,CAQlB;IAED,OAAO,CAAC,aAAa;IAiBf,uBAAuB,CAC3B,MAAM,SAAY,GACjB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAWhC;IAEK,uBAAuB,CAC3B,UAAU,EAAE,mBAAmB,EAC/B,MAAM,SAAY,GACjB,OAAO,CAAC,IAAI,CAAC,CAUf;IAEK,yBAAyB,CAC7B,YAAY,EAAE,MAAM,EACpB,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CAOlB;IAEK,qBAAqB,CACzB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CAMlB;IAMK,QAAQ,CAAC,MAAM,SAAY,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAWlD;IAEK,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAY,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAa3E;IAEK,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B5D;IAEK,UAAU,CACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAC7C,MAAM,SAAY,GACjB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CA6B3B;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAIrE;IAMD,OAAO,CAAC,mBAAmB;IAmBrB,wBAAwB,CAC5B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,MAAM,SAAY,GACjB,OAAO,CAAC,aAAa,EAAE,CAAC,CAS1B;IAEK,0BAA0B,CAC9B,MAAM,SAAY,GACjB,OAAO,CAAC,aAAa,EAAE,CAAC,CAQ1B;IAEK,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,MAAM,SAAY,GACjB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAKpC;IAEK,iBAAiB,CACrB,KAAK,EAAE,aAAa,EACpB,MAAM,SAAY,GACjB,OAAO,CAAC,IAAI,CAAC,CAuCf;IAEK,mBAAmB,CACvB,OAAO,EAAE,MAAM,EACf,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CAIlB;IAMK,iBAAiB,CAAC,MAAM,SAAY,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAapE;IAEK,iBAAiB,CACrB,MAAM,EAAE,aAAa,EACrB,MAAM,SAAY,GACjB,OAAO,CAAC,IAAI,CAAC,CA6Bf;IAEK,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CAIlB;IAEK,gBAAgB,CAAC,MAAM,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1D;IAMD;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAoB7B,OAAO,CAAC,iBAAiB;IA2BzB,OAAO,CAAC,iBAAiB;IAezB;;;;OAIG;IACH,0BAA0B,CACxB,OAAO,EAAE,SAAS,sBAAsB,EAAE,EAC1C,QAAQ,EAAE,CAAC,WAAW,EAAE,eAAe,GAAG,IAAI,KAAK,eAAe,GACjE,sBAAsB,EAAE,CAI1B;IAEK,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAwBrE;IAED;;;;OAIG;IACG,iBAAiB,CACrB,QAAQ,EAAE,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,KAAK,eAAe,GAAG,SAAS,EAC1E,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAcjC;IAEK,eAAe,CACnB,WAAW,EAAE,eAAe,EAC5B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAGf;IAMK,eAAe,CAAC,MAAM,SAAY,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAE7D;IAEK,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,MAAM,SAAY,GACjB,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAK/B;IAEK,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAKxE;IAEK,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CAKlB;IAMK,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAEpE;IAEK,kBAAkB,CACtB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,aAAa,EAAE,GACtB,OAAO,CAAC,IAAI,CAAC,CAKf;IAEK,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAI/D;CACF;AAGD,QAAA,MAAM,cAAc,gBAAuB,CAAC;eAC7B,cAAc"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAkBA,OAAO,EAEL,QAAQ,EACR,aAAa,EACb,WAAW,EACX,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,IAAI,EACJ,aAAa,EACb,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,EAEL,KAAK,QAAQ,EAGd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EACV,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAIV,sBAAsB,EACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EACV,0BAA0B,EAC1B,uBAAuB,EACxB,MAAM,oCAAoC,CAAC;AAI5C,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,cAAM,cAAc;IAKZ,cAAc,CAAC,MAAM,SAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAY/D;IAEK,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,SAAY,GACjB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAUlC;IAED,OAAO,CAAC,cAAc;IAmCtB,OAAO,CAAC,cAAc;IA4BhB,WAAW,CACf,OAAO,EAAE,WAAW,EACpB,MAAM,SAAY,EAClB,YAAY,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACxC,OAAO,CAAC,IAAI,CAAC,CAOf;IAEK,+BAA+B,CACnC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,sBAAsB,EAChC,KAAK,EAAE,0BAA0B,EACjC,YAAY,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACxC,OAAO,CAAC,IAAI,CAAC,CASf;IAEK,4BAA4B,CAAC,KAAK,EAAE;QACxC,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,WAAW,GAAG;YAAE,IAAI,EAAE,WAAW,CAAA;SAAE,CAAC;QAC7C,KAAK,EAAE,uBAAuB,CAAC;QAC/B,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,EAAE,0BAA0B,CAAC;QAClC,YAAY,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC3C,GAAG,OAAO,CAAC,MAAM,CAAC,CAgClB;IAEK,6BAA6B,CAAC,KAAK,EAAE;QACzC,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,wBAAwB,EAAE,MAAM,CAAC;QACjC,wBAAwB,EAAE,MAAM,CAAC;QACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CAYnB;IAEK,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,MAAM,SAAY,EAClB,YAAY,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACxC,OAAO,CAAC,OAAO,CAAC,CAQlB;IAED,OAAO,CAAC,aAAa;IAiBf,uBAAuB,CAC3B,MAAM,SAAY,GACjB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAWhC;IAED,yEAAyE;IACnE,0BAA0B,CAC9B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,CAAC,mBAAmB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC,CAatE;IAEK,uBAAuB,CAC3B,UAAU,EAAE,mBAAmB,EAC/B,MAAM,SAAY,GACjB,OAAO,CAAC,IAAI,CAAC,CAUf;IAEK,yBAAyB,CAC7B,YAAY,EAAE,MAAM,EACpB,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CAOlB;IAEK,qBAAqB,CACzB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CAMlB;IAMK,QAAQ,CAAC,MAAM,SAAY,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAYlD;IAEK,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAY,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAc3E;IAEK,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B5D;IAEK,UAAU,CACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAC7C,MAAM,SAAY,GACjB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CA6B3B;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAIrE;IAMD,OAAO,CAAC,mBAAmB;IAsBrB,wBAAwB,CAC5B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,MAAM,SAAY,GACjB,OAAO,CAAC,aAAa,EAAE,CAAC,CAS1B;IAEK,0BAA0B,CAC9B,MAAM,SAAY,GACjB,OAAO,CAAC,aAAa,EAAE,CAAC,CAQ1B;IAEK,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,MAAM,SAAY,GACjB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAKpC;IAEK,iBAAiB,CACrB,KAAK,EAAE,aAAa,EACpB,MAAM,SAAY,GACjB,OAAO,CAAC,IAAI,CAAC,CA0Cf;IAEK,mBAAmB,CACvB,OAAO,EAAE,MAAM,EACf,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CAIlB;IAED,8EAA8E;IACxE,oCAAoC,CACxC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,aAAa,EAAE,CAAC,CAU1B;IAEK,8BAA8B,CAClC,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAAC,aAAa,EAAE,CAAC,CAQ1B;IAED,yEAAyE;IACnE,oBAAoB,CACxB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAUpE;IAEK,+BAA+B,IAAI,OAAO,CAC9C,KAAK,CAAC;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CACrD,CAUA;IAEK,yBAAyB,CAC7B,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC,CAOlB;IAMD,OAAO,CAAC,cAAc;IAkBhB,YAAY,CAChB,MAAM,SAAY,GACjB,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAQpD;IAED,yEAAyE;IACnE,eAAe,CACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,QAAQ,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC,CAM3D;IAEK,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCxE;IAEK,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CAIlB;IAMK,iBAAiB,CAAC,MAAM,SAAY,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAapE;IAEK,iBAAiB,CACrB,MAAM,EAAE,aAAa,EACrB,MAAM,SAAY,GACjB,OAAO,CAAC,IAAI,CAAC,CA6Bf;IAEK,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CAIlB;IAEK,gBAAgB,CAAC,MAAM,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1D;IAMD;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAoB7B,OAAO,CAAC,iBAAiB;IA2BzB,OAAO,CAAC,iBAAiB;IAezB;;;;OAIG;IACH,0BAA0B,CACxB,OAAO,EAAE,SAAS,sBAAsB,EAAE,EAC1C,QAAQ,EAAE,CAAC,WAAW,EAAE,eAAe,GAAG,IAAI,KAAK,eAAe,GACjE,sBAAsB,EAAE,CAI1B;IAEK,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAwBrE;IAED;;;;OAIG;IACG,iBAAiB,CACrB,QAAQ,EAAE,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,KAAK,eAAe,GAAG,SAAS,EAC1E,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAcjC;IAEK,eAAe,CACnB,WAAW,EAAE,eAAe,EAC5B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAGf;IAMK,eAAe,CAAC,MAAM,SAAY,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAE7D;IAEK,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,MAAM,SAAY,GACjB,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAK/B;IAEK,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAKxE;IAEK,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CAKlB;IAMK,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAEpE;IAEK,kBAAkB,CACtB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,aAAa,EAAE,GACtB,OAAO,CAAC,IAAI,CAAC,CAKf;IAEK,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAI/D;CACF;AAGD,QAAA,MAAM,cAAc,gBAAuB,CAAC;eAC7B,cAAc"}

package/backend/dist/storage.js

@@ -19,7 +19,7 @@ import { encryptionService } from './services/encryptionService.js';
 import { getPersistence } from './persistence/index.js';
 import { PersistenceResourceLimitError } from './persistence/resourceTypes.js';
 import { createLogger } from './utils/logger.js';
-import { MAX_CALENDAR_EVENT_NOTES_LENGTH, MAX_CALENDAR_EVENT_TITLE_LENGTH, MAX_CALENDAR_EVENTS_PER_USER, MAX_NOTE_CONTENT_LENGTH, MAX_NOTES_PER_USER, MAX_NOTE_TITLE_LENGTH, MAX_SESSION_FOLDER_NAME_LENGTH, MAX_SESSION_FOLDERS_PER_USER, ResourcePolicyError, } from './utils/resourceLimits.js';
+import { MAX_CALENDAR_COLOR_LENGTH, MAX_CALENDAR_EVENT_NOTES_LENGTH, MAX_CALENDAR_EVENT_TITLE_LENGTH, MAX_CALENDAR_EVENTS_PER_USER, MAX_CALENDARS_PER_USER, MAX_CALENDAR_NAME_LENGTH, MAX_NOTE_CONTENT_LENGTH, MAX_NOTES_PER_USER, MAX_NOTE_TITLE_LENGTH, MAX_SESSION_FOLDER_NAME_LENGTH, MAX_SESSION_FOLDERS_PER_USER, ResourcePolicyError, } from './utils/resourceLimits.js';
 import { mapSessionRow, } from './storageMappers.js';
 import { getPlatformStorageRuntime } from './platform/storage/index.js';
 import { getDurableJobRuntime } from './platform/jobs/durableJobRuntime.js';
@@ -165,6 +165,19 @@ class StorageService {
             updatedAt: row.updated_at,
         }));
     }
+    /** Cross-owner read; callers must authorize before returning content. */
+    async getKnowledgeCollectionById(collectionId) {
+        const row = await getPersistence(encryptionService).repositories.resources.knowledgeCollections.findById(collectionId);
+        if (!row)
+            return undefined;
+        return {
+            id: row.id,
+            name: encryptionService.decrypt(row.name),
+            ownerUserId: row.user_id,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+        };
+    }
     async saveKnowledgeCollection(collection, userId = 'default') {
         await getPersistence(encryptionService).repositories.resources.knowledgeCollections.replace({
             id: collection.id,
@@ -189,6 +202,7 @@ class StorageService {
             id: row.id,
             title: encryptionService.decrypt(row.title),
             content: encryptionService.decrypt(row.content),
+            ...(row.pinned ? { pinned: true } : {}),
             createdAt: row.created_at,
             updatedAt: row.updated_at,
         }));
@@ -200,6 +214,7 @@ class StorageService {
                 id: row.id,
                 title: encryptionService.decrypt(row.title),
                 content: encryptionService.decrypt(row.content),
+                ...(row.pinned ? { pinned: true } : {}),
                 createdAt: row.created_at,
                 updatedAt: row.updated_at,
             }
@@ -216,6 +231,7 @@ class StorageService {
                 user_id: userId,
                 title: encryptionService.encrypt(note.title),
                 content: encryptionService.encrypt(note.content),
+                pinned: note.pinned ? 1 : 0,
                 created_at: note.createdAt,
                 updated_at: note.updatedAt,
             }, MAX_NOTES_PER_USER);
@@ -271,6 +287,9 @@ class StorageService {
             endAt: row.end_at ?? undefined,
             allDay: row.all_day === 1,
             ...(recurrence ? { recurrence } : {}),
+            calendarId: row.calendar_id ?? undefined,
+            reminderMinutes: row.reminder_minutes ?? undefined,
+            lastRemindedOccurrence: row.last_reminded_occurrence ?? undefined,
             createdAt: row.created_at,
             updatedAt: row.updated_at,
         };
@@ -306,6 +325,9 @@ class StorageService {
                 recurrence: event.recurrence
                     ? encryptionService.encrypt(JSON.stringify(event.recurrence))
                     : null,
+                calendar_id: event.calendarId ?? null,
+                reminder_minutes: event.reminderMinutes ?? null,
+                last_reminded_occurrence: event.lastRemindedOccurrence ?? null,
                 created_at: event.createdAt,
                 updated_at: event.updatedAt,
             }, MAX_CALENDAR_EVENTS_PER_USER);
@@ -320,6 +342,83 @@ class StorageService {
     async deleteCalendarEvent(eventId, userId = 'default') {
         return getPersistence(encryptionService).repositories.resources.calendarEvents.deleteByOwner(eventId, userId);
     }
+    /** Cross-owner reads for shared calendars; callers authorize per calendar. */
+    async getCalendarEventsForCalendarsBetween(calendarIds, from, to) {
+        const rows = await getPersistence(encryptionService).repositories.resources.calendarEvents.listByCalendarsBetween(calendarIds, from, to, MAX_CALENDAR_EVENTS_PER_USER);
+        return rows.map(row => this.mapCalendarEventRow(row));
+    }
+    async getRecurringEventsForCalendars(calendarIds) {
+        const rows = await getPersistence(encryptionService).repositories.resources.calendarEvents.listRecurringByCalendars(calendarIds, MAX_CALENDAR_EVENTS_PER_USER);
+        return rows.map(row => this.mapCalendarEventRow(row));
+    }
+    /** Cross-owner read; callers must authorize before returning content. */
+    async getCalendarEventById(eventId) {
+        const row = await getPersistence(encryptionService).repositories.resources.calendarEvents.findById(eventId);
+        if (!row)
+            return undefined;
+        return {
+            event: this.mapCalendarEventRow(row),
+            ownerUserId: row.user_id,
+        };
+    }
+    async listCalendarEventsWithReminders() {
+        const rows = await getPersistence(encryptionService).repositories.resources.calendarEvents.listWithReminders(MAX_CALENDAR_EVENTS_PER_USER);
+        return rows.map(row => ({
+            event: this.mapCalendarEventRow(row),
+            ownerUserId: row.user_id,
+        }));
+    }
+    async markCalendarEventReminded(eventId, occurrenceStart) {
+        return getPersistence(encryptionService).repositories.resources.calendarEvents.markReminded(eventId, occurrenceStart);
+    }
+    // =================================
+    // NAMED CALENDARS
+    // =================================
+    mapCalendarRow(row) {
+        return {
+            id: row.id,
+            name: encryptionService.decrypt(row.name),
+            ...(row.color ? { color: row.color } : {}),
+            ownerUserId: row.user_id,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+        };
+    }
+    async getCalendars(userId = 'default') {
+        const rows = await getPersistence(encryptionService).repositories.resources.calendars.listByOwner(userId, MAX_CALENDARS_PER_USER);
+        return rows.map(row => this.mapCalendarRow(row));
+    }
+    /** Cross-owner read; callers must authorize before returning content. */
+    async getCalendarById(calendarId) {
+        const row = await getPersistence(encryptionService).repositories.resources.calendars.findById(calendarId);
+        return row ? this.mapCalendarRow(row) : undefined;
+    }
+    async saveCalendar(calendar, userId = 'default') {
+        if (!calendar.name.trim() ||
+            calendar.name.length > MAX_CALENDAR_NAME_LENGTH ||
+            (calendar.color?.length ?? 0) > MAX_CALENDAR_COLOR_LENGTH) {
+            throw new ResourcePolicyError('Calendar name or color is missing or exceeds the maximum size', 400);
+        }
+        try {
+            await getPersistence(encryptionService).repositories.resources.calendars.replaceWithLimit({
+                id: calendar.id,
+                user_id: userId,
+                name: encryptionService.encrypt(calendar.name.trim()),
+                color: calendar.color ?? null,
+                created_at: calendar.createdAt,
+                updated_at: calendar.updatedAt,
+            }, MAX_CALENDARS_PER_USER);
+        }
+        catch (error) {
+            if (error instanceof PersistenceResourceLimitError) {
+                throw new ResourcePolicyError(`A user may store at most ${MAX_CALENDARS_PER_USER} calendars`, 409);
+            }
+            throw error;
+        }
+    }
+    async deleteCalendar(calendarId, userId = 'default') {
+        return getPersistence(encryptionService).repositories.resources.calendars.deleteAndDetach(calendarId, userId);
+    }
     // =================================
     // SESSION FOLDERS
     // =================================