ocean-brain 0.13.3 → 0.15.0

package/server/dist/features/integration/access-events.js

@@ -0,0 +1,17 @@
+import { EventEmitter } from "node:events";
+const INTEGRATION_ACCESS_CHANGE_CHANNEL = "integration-access-change";
+const integrationAccessEmitter = new EventEmitter();
+integrationAccessEmitter.setMaxListeners(0);
+const emitIntegrationAccessChanged = (connectionId) => {
+  integrationAccessEmitter.emit(INTEGRATION_ACCESS_CHANGE_CHANNEL, connectionId);
+};
+const subscribeIntegrationAccessChanges = (listener) => {
+  integrationAccessEmitter.on(INTEGRATION_ACCESS_CHANGE_CHANNEL, listener);
+  return () => {
+    integrationAccessEmitter.off(INTEGRATION_ACCESS_CHANGE_CHANNEL, listener);
+  };
+};
+export {
+  emitIntegrationAccessChanged,
+  subscribeIntegrationAccessChanges
+};

package/server/dist/features/integration/auth.js

@@ -0,0 +1,21 @@
+import { enforceMcpCompatibility } from "../../modules/mcp-auth.js";
+import { createIntegrationService } from "./service.js";
+const requireIntegrationPermission = (permission, service = createIntegrationService()) => async (request, reply) => {
+  const header = request.headers.authorization;
+  if (!header?.startsWith("Bearer ") || header.length > 1024) {
+    return reply.status(401).send({ code: "UNAUTHORIZED", message: "An integration bearer token is required." });
+  }
+  const principal = await service.authenticate(header.slice(7).trim());
+  if (!principal)
+    return reply.status(403).send({
+      code: "INTEGRATION_ACCESS_DENIED",
+      message: "The integration token is invalid, revoked, or disabled."
+    });
+  if (!principal.permissions.includes(permission))
+    return reply.status(403).send({ code: "INTEGRATION_PERMISSION_DENIED", message: `Permission required: ${permission}` });
+  request.integration = principal;
+  if (principal.native && principal.connectionId === "mcp") await enforceMcpCompatibility(request, reply);
+};
+export {
+  requireIntegrationPermission
+};

package/server/dist/features/integration/manifest.js

@@ -0,0 +1,116 @@
+import { createAppError } from "../../modules/error-handler.js";
+const INTEGRATION_PERMISSIONS = ["notes:read", "notes:create", "notes:update", "notes:delete"];
+const MCP_CONNECTION_ID = "mcp";
+const MCP_INTEGRATION_MANIFEST = {
+  schemaVersion: 1,
+  apiVersion: 1,
+  id: "ocean-brain.mcp",
+  name: "MCP",
+  version: "1.0.0",
+  description: "Connect AI clients to Ocean Brain.",
+  permissions: [...INTEGRATION_PERMISSIONS]
+};
+const NATIVE_INTEGRATIONS = [{ connectionId: MCP_CONNECTION_ID, manifest: MCP_INTEGRATION_MANIFEST }];
+const invalid = (message) => {
+  throw createAppError(400, "INVALID_INTEGRATION_MANIFEST", message);
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parsePermissions = (value) => {
+  if (!Array.isArray(value) || value.some((item) => !INTEGRATION_PERMISSIONS.includes(item))) {
+    return invalid("Permissions must be a list of supported note permissions.");
+  }
+  return [...new Set(value)];
+};
+const textField = (value, name, max) => {
+  if (typeof value !== "string" || !value.trim() || value.length > max) {
+    return invalid(`${name} must be a nonempty string of at most ${max} characters.`);
+  }
+  return value.trim();
+};
+const parseManifest = (value) => {
+  if (!isRecord(value)) return invalid("An integration manifest object is required.");
+  if (value.schemaVersion !== 1 || value.apiVersion !== 1) {
+    return invalid("Only manifest schemaVersion 1 and apiVersion 1 are supported.");
+  }
+  const id = textField(value.id, "id", 100);
+  if (!/^[a-z0-9]+(?:[.-][a-z0-9]+)*$/.test(id))
+    return invalid("id must be a lowercase dotted or dashed identifier.");
+  const manifest = {
+    schemaVersion: 1,
+    apiVersion: 1,
+    id,
+    name: textField(value.name, "name", 80),
+    version: textField(value.version, "version", 40),
+    description: textField(value.description, "description", 500),
+    permissions: parsePermissions(value.permissions)
+  };
+  if (manifest.permissions.some((permission) => permission !== "notes:read") && !manifest.permissions.includes("notes:read")) {
+    return invalid("An integration requesting write access must also request notes:read.");
+  }
+  if (value.launch !== void 0) {
+    if (!isRecord(value.launch) || !["external", "iframe", "proxied"].includes(String(value.launch.mode))) {
+      return invalid("launch requires proxied mode or a url with external or iframe mode.");
+    }
+    if (value.launch.mode === "proxied") {
+      if (value.launch.url !== void 0) return invalid("A proxied launch cannot provide a url.");
+      manifest.launch = { mode: "proxied" };
+      return manifest;
+    }
+    let url;
+    try {
+      url = new URL(textField(value.launch.url, "launch.url", 2e3));
+    } catch {
+      return invalid("launch.url must be an absolute HTTP(S) URL.");
+    }
+    const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password) {
+      return invalid("launch.url requires HTTPS (HTTP is allowed on loopback only), without credentials.");
+    }
+    manifest.launch = { url: url.href, mode: value.launch.mode === "iframe" ? "iframe" : "external" };
+  }
+  return manifest;
+};
+const parseIntegrationProxyUrl = (value) => {
+  if (typeof value !== "string" || !value.trim() || value.length > 2e3) {
+    throw createAppError(
+      400,
+      "INVALID_INTEGRATION_PROXY_URL",
+      "The private app URL must be a nonempty string of at most 2000 characters."
+    );
+  }
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    throw createAppError(400, "INVALID_INTEGRATION_PROXY_URL", "The private app URL must be an absolute URL.");
+  }
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw createAppError(
+      400,
+      "INVALID_INTEGRATION_PROXY_URL",
+      "The private app URL must be an HTTP(S) origin without credentials, a path, query, or fragment."
+    );
+  }
+  return url.origin;
+};
+const validateGrants = (value, manifest) => {
+  const permissions = parsePermissions(value);
+  if (permissions.some((permission) => !manifest.permissions.includes(permission))) {
+    throw createAppError(400, "INVALID_INTEGRATION_GRANTS", "A grant must be requested by the manifest.");
+  }
+  if (permissions.some((permission) => permission !== "notes:read") && !permissions.includes("notes:read")) {
+    throw createAppError(400, "INVALID_INTEGRATION_GRANTS", "Write permissions also require notes:read.");
+  }
+  return permissions;
+};
+export {
+  INTEGRATION_PERMISSIONS,
+  MCP_CONNECTION_ID,
+  MCP_INTEGRATION_MANIFEST,
+  NATIVE_INTEGRATIONS,
+  isRecord,
+  parseIntegrationProxyUrl,
+  parseManifest,
+  parsePermissions,
+  validateGrants
+};

package/server/dist/features/integration/note-sync.js

@@ -0,0 +1,156 @@
+import { createHash } from "node:crypto";
+import { subscribeNoteChanges } from "../../features/note/services/change-events.js";
+import models from "../../models.js";
+import { createAppError } from "../../modules/error-handler.js";
+import { subscribeIntegrationAccessChanges } from "./access-events.js";
+const DEFAULT_PAGE_SIZE = 100;
+const MAX_PAGE_SIZE = 500;
+const KEEP_ALIVE_INTERVAL_MS = 3e4;
+const MAX_STREAMS_PER_CONNECTION = 2;
+const MAX_NOTE_ID = 2147483647;
+const activeStreamsByConnection = /* @__PURE__ */ new Map();
+const resolvePageSize = (value) => {
+  if (value === void 0) return DEFAULT_PAGE_SIZE;
+  if (!Number.isInteger(value) || Number(value) < 1 || Number(value) > MAX_PAGE_SIZE) {
+    throw createAppError(
+      400,
+      "INVALID_NOTE_CATALOG_PAGE_SIZE",
+      `limit must be an integer between 1 and ${MAX_PAGE_SIZE}.`
+    );
+  }
+  return Number(value);
+};
+const resolveAfterId = (value) => {
+  if (value === void 0) return 0;
+  const normalized = typeof value === "number" && Number.isSafeInteger(value) ? String(value) : value;
+  if (typeof normalized !== "string" || !/^(0|[1-9]\d*)$/.test(normalized)) {
+    throw createAppError(400, "INVALID_NOTE_CATALOG_CURSOR", "afterId must be a nonnegative integer.");
+  }
+  const parsed = Number(normalized);
+  if (!Number.isSafeInteger(parsed) || parsed > MAX_NOTE_ID) {
+    throw createAppError(400, "INVALID_NOTE_CATALOG_CURSOR", "afterId exceeds the supported range.");
+  }
+  return parsed;
+};
+const createIntegrationNoteCatalogHandler = () => {
+  return async (request, reply) => {
+    const limit = resolvePageSize(request.body?.limit);
+    const afterId = resolveAfterId(request.body?.afterId);
+    const [rows, propertySchema] = await Promise.all([
+      models.note.findMany({
+        where: { id: { gt: afterId } },
+        orderBy: { id: "asc" },
+        take: limit + 1,
+        select: { id: true, updatedAt: true }
+      }),
+      afterId === 0 ? models.propertyDefinition.findMany({
+        orderBy: { key: "asc" },
+        select: {
+          key: true,
+          name: true,
+          valueType: true,
+          updatedAt: true,
+          options: {
+            orderBy: [{ order: "asc" }, { id: "asc" }],
+            select: {
+              id: true,
+              label: true,
+              value: true,
+              color: true,
+              order: true,
+              updatedAt: true
+            }
+          }
+        }
+      }) : Promise.resolve(null)
+    ]);
+    const hasMore = rows.length > limit;
+    const page = hasMore ? rows.slice(0, limit) : rows;
+    return reply.status(200).send({
+      notes: page.map((note) => ({ id: String(note.id), updatedAt: note.updatedAt.toISOString() })),
+      ...propertySchema ? { propertySchemaHash: createHash("sha256").update(JSON.stringify(propertySchema)).digest("hex") } : {},
+      hasMore,
+      nextAfterId: hasMore ? String(page.at(-1)?.id) : null
+    });
+  };
+};
+const serializeIntegrationNoteEvent = (event) => {
+  const data = {
+    type: event.type,
+    noteId: String(event.noteId),
+    occurredAt: event.occurredAt
+  };
+  return `event: ${event.type}
+data: ${JSON.stringify(data)}
+
+`;
+};
+const createIntegrationNoteEventsHandler = (subscribe = subscribeNoteChanges) => {
+  return async (request, reply) => {
+    const connectionId = request.integration?.connectionId;
+    if (!connectionId) {
+      throw createAppError(401, "UNAUTHORIZED", "An authenticated integration connection is required.");
+    }
+    const activeStreamCount = activeStreamsByConnection.get(connectionId) ?? 0;
+    if (activeStreamCount >= MAX_STREAMS_PER_CONNECTION) {
+      throw createAppError(
+        429,
+        "INTEGRATION_EVENT_STREAM_LIMIT",
+        `A connection can open at most ${MAX_STREAMS_PER_CONNECTION} event streams.`
+      );
+    }
+    reply.hijack();
+    const response = reply.raw;
+    response.statusCode = 200;
+    response.setHeader("Content-Type", "text/event-stream; charset=utf-8");
+    response.setHeader("Cache-Control", "no-cache, no-transform");
+    response.setHeader("Connection", "keep-alive");
+    response.setHeader("X-Accel-Buffering", "no");
+    response.flushHeaders();
+    response.write(": connected\n\n");
+    activeStreamsByConnection.set(connectionId, activeStreamCount + 1);
+    let cleanedUp = false;
+    let keepAliveTimer = null;
+    let unsubscribeNoteChanges = () => void 0;
+    let unsubscribeAccessChanges = () => void 0;
+    const cleanup = () => {
+      if (cleanedUp) return;
+      cleanedUp = true;
+      if (keepAliveTimer) clearInterval(keepAliveTimer);
+      unsubscribeNoteChanges();
+      unsubscribeAccessChanges();
+      const remainingStreams = (activeStreamsByConnection.get(connectionId) ?? 1) - 1;
+      if (remainingStreams > 0) activeStreamsByConnection.set(connectionId, remainingStreams);
+      else activeStreamsByConnection.delete(connectionId);
+    };
+    const endStream = () => {
+      cleanup();
+      if (!response.writableEnded) {
+        try {
+          response.end();
+        } catch {
+        }
+      }
+    };
+    const write = (chunk) => {
+      try {
+        if (!response.write(chunk)) endStream();
+      } catch {
+        endStream();
+      }
+    };
+    unsubscribeNoteChanges = subscribe((event) => write(serializeIntegrationNoteEvent(event)));
+    unsubscribeAccessChanges = subscribeIntegrationAccessChanges((changedConnectionId) => {
+      if (changedConnectionId === connectionId) endStream();
+    });
+    keepAliveTimer = setInterval(() => write(": keepalive\n\n"), KEEP_ALIVE_INTERVAL_MS);
+    keepAliveTimer.unref?.();
+    request.raw.on("close", cleanup);
+    response.on("close", cleanup);
+  };
+};
+export {
+  createIntegrationNoteCatalogHandler,
+  createIntegrationNoteEventsHandler,
+  serializeIntegrationNoteEvent
+};

package/server/dist/features/integration/schema.js

@@ -0,0 +1,54 @@
+import { GraphQLError, GraphQLObjectType, GraphQLSchema } from "graphql";
+import { readMarkdownRange } from "../../features/note/services/markdown-read.js";
+import models from "../../models.js";
+import schema from "../../schema/index.js";
+const READ_FIELDS = /* @__PURE__ */ new Set([
+  "allNotes",
+  "note",
+  "noteRead",
+  "backReferences",
+  "notesByTagNames",
+  "allTags",
+  "tagsByNames",
+  "notePropertyKeys",
+  "notesByQuery",
+  "notesByProperties",
+  "viewSections",
+  "readViewSection",
+  "searchNotes"
+]);
+const readNote = async (_, { id }) => {
+  if (!/^[1-9]\d*$/.test(id) || !Number.isSafeInteger(Number(id))) throw new GraphQLError("Invalid note id.");
+  const note = await models.note.findUnique({ where: { id: Number(id) } });
+  if (!note) throw new GraphQLError("Note not found.");
+  return note;
+};
+const query = schema.getQueryType();
+if (!query) throw new Error("The core query schema is missing.");
+const fields = Object.fromEntries(Object.entries(query.toConfig().fields).filter(([name]) => READ_FIELDS.has(name)));
+fields.note = { ...fields.note, resolve: readNote };
+fields.noteRead = {
+  ...fields.noteRead,
+  resolve: async (_, { id, ...input }) => {
+    const note = await readNote(_, { id });
+    const { blocksToMarkdown } = await import("../../modules/blocknote.js");
+    return { note, ...readMarkdownRange(await blocksToMarkdown(note.content), note.updatedAt, input) };
+  }
+};
+for (const field of Object.values(fields)) {
+  const resolve = field.resolve;
+  if (!resolve) continue;
+  field.resolve = (source, args, context, info) => {
+    if (args.pagination && (!Number.isInteger(args.pagination.limit) || args.pagination.limit < 1 || args.pagination.limit > 100 || !Number.isInteger(args.pagination.offset) || args.pagination.offset < 0)) {
+      throw new GraphQLError("pagination requires limit 1\u2013100 and offset >= 0.");
+    }
+    const normalizedArgs = { ...args };
+    if (field.args?.pagination && !args.pagination) normalizedArgs.pagination = { limit: 25, offset: 0 };
+    if (field.args?.searchFilter && !args.searchFilter) normalizedArgs.searchFilter = { query: "" };
+    return resolve(source, normalizedArgs, context, info);
+  };
+}
+const integrationReadSchema = new GraphQLSchema({ query: new GraphQLObjectType({ name: "Query", fields }) });
+export {
+  integrationReadSchema
+};

package/server/dist/features/integration/service.js

@@ -0,0 +1,246 @@
+import { createHash } from "node:crypto";
+import models from "../../models.js";
+import { createAppError } from "../../modules/error-handler.js";
+import { issueIntegrationToken } from "../../modules/integration-token.js";
+import { emitIntegrationAccessChanged } from "./access-events.js";
+import {
+  MCP_CONNECTION_ID,
+  NATIVE_INTEGRATIONS,
+  parseIntegrationProxyUrl,
+  parseManifest,
+  parsePermissions,
+  validateGrants
+} from "./manifest.js";
+import { parseStatusUpdate, readStatusReport } from "./status-report.js";
+const resolveManifest = (row) => {
+  if (row.native) {
+    const definition = NATIVE_INTEGRATIONS.find((integration) => integration.connectionId === row.id);
+    if (definition) return definition.manifest;
+  }
+  return parseManifest(JSON.parse(row.manifest));
+};
+const toConnection = (row) => ({
+  id: row.id,
+  native: row.native,
+  manifest: resolveManifest(row),
+  proxyConfigured: row.proxyUrl !== null,
+  grantedPermissions: parsePermissions(JSON.parse(row.grantedPermissions)),
+  enabled: row.enabled,
+  pinned: row.pinned,
+  createdAt: row.createdAt.toISOString(),
+  updatedAt: row.updatedAt.toISOString(),
+  statusReport: readStatusReport(row.credential?.statusReport ?? null),
+  token: row.credential ? {
+    id: row.credential.id,
+    createdAt: row.credential.createdAt.toISOString(),
+    lastUsedAt: row.credential.lastUsedAt?.toISOString() ?? null
+  } : null
+});
+const credentialSummary = { select: { id: true, createdAt: true, lastUsedAt: true, statusReport: true } };
+const parseConnectionProxyUrl = (manifest, value) => {
+  if (manifest.launch?.mode === "proxied") return parseIntegrationProxyUrl(value);
+  if (value !== void 0) {
+    throw createAppError(
+      400,
+      "UNEXPECTED_INTEGRATION_PROXY_URL",
+      "A private app URL can only be configured for proxied launches."
+    );
+  }
+  return null;
+};
+const createIntegrationService = (db = models) => {
+  const get = async (id) => {
+    const row = await db.integrationConnection.findUnique({
+      where: { id },
+      include: { credential: credentialSummary }
+    });
+    if (!row) throw createAppError(404, "INTEGRATION_NOT_FOUND", "The integration connection was not found.");
+    return toConnection(row);
+  };
+  return {
+    get,
+    async ensureNativeConnections() {
+      for (const integration of NATIVE_INTEGRATIONS) {
+        await db.integrationConnection.upsert({
+          where: { id: integration.connectionId },
+          create: {
+            id: integration.connectionId,
+            integrationId: integration.manifest.id,
+            native: true,
+            manifest: JSON.stringify(integration.manifest),
+            grantedPermissions: JSON.stringify(integration.manifest.permissions)
+          },
+          // Keep the owner's grants, enabled state and credentials on upgrade.
+          update: {}
+        });
+      }
+    },
+    async list() {
+      const rows = await db.integrationConnection.findMany({
+        orderBy: [{ native: "desc" }, { createdAt: "asc" }],
+        include: { credential: credentialSummary }
+      });
+      return rows.map(toConnection);
+    },
+    async connect(input) {
+      const manifest = parseManifest(input.manifest);
+      if (manifest.id.startsWith("ocean-brain."))
+        throw createAppError(
+          400,
+          "RESERVED_INTEGRATION_ID",
+          "The ocean-brain namespace is reserved for native integrations."
+        );
+      const grantedPermissions = validateGrants(input.grantedPermissions ?? [], manifest);
+      const proxyUrl = parseConnectionProxyUrl(manifest, input.proxyUrl);
+      const row = await db.integrationConnection.create({
+        data: {
+          integrationId: manifest.id,
+          manifest: JSON.stringify(manifest),
+          proxyUrl,
+          grantedPermissions: JSON.stringify(grantedPermissions)
+        },
+        include: { credential: credentialSummary }
+      });
+      return toConnection(row);
+    },
+    async update(id, input) {
+      const connection = await db.$transaction(async (tx) => {
+        const current = await tx.integrationConnection.findUnique({ where: { id } });
+        if (!current)
+          throw createAppError(404, "INTEGRATION_NOT_FOUND", "The integration connection was not found.");
+        if (input.manifest !== void 0 && current.native)
+          throw createAppError(
+            400,
+            "NATIVE_INTEGRATION_MANIFEST",
+            "Native integration manifests are managed by Ocean Brain."
+          );
+        for (const key of ["enabled", "pinned"]) {
+          if (input[key] !== void 0 && typeof input[key] !== "boolean")
+            throw createAppError(400, "INVALID_INTEGRATION_SETTING", `${key} must be a boolean.`);
+        }
+        const currentManifest = resolveManifest(current);
+        const manifest = input.manifest === void 0 ? currentManifest : parseManifest(input.manifest);
+        if (manifest.id !== current.integrationId)
+          throw createAppError(400, "INTEGRATION_ID_CHANGED", "An upgrade cannot change the integration id.");
+        const previousGrants = parsePermissions(JSON.parse(current.grantedPermissions)).filter(
+          (permission) => manifest.permissions.includes(permission)
+        );
+        const grantedPermissions = validateGrants(input.grantedPermissions ?? previousGrants, manifest);
+        let proxyUrl = current.proxyUrl;
+        if (manifest.launch?.mode === "proxied") {
+          if (input.proxyUrl !== void 0) proxyUrl = parseIntegrationProxyUrl(input.proxyUrl);
+          const enteringProxiedMode = input.manifest !== void 0 && currentManifest.launch?.mode !== "proxied";
+          if ((enteringProxiedMode || input.enabled === true) && !proxyUrl) {
+            throw createAppError(
+              400,
+              "INTEGRATION_PROXY_URL_REQUIRED",
+              "Configure a private app URL before enabling a proxied integration."
+            );
+          }
+        } else {
+          if (input.proxyUrl !== void 0) {
+            throw createAppError(
+              400,
+              "UNEXPECTED_INTEGRATION_PROXY_URL",
+              "A private app URL can only be configured for proxied launches."
+            );
+          }
+          proxyUrl = null;
+        }
+        if (input.enabled !== void 0 || input.grantedPermissions !== void 0 || input.manifest !== void 0 || input.proxyUrl !== void 0) {
+          await tx.integrationCredential.updateMany({
+            where: { connectionId: id },
+            data: { statusReport: null }
+          });
+        }
+        const row = await tx.integrationConnection.update({
+          where: { id },
+          data: {
+            manifest: JSON.stringify(manifest),
+            proxyUrl,
+            grantedPermissions: JSON.stringify(grantedPermissions),
+            ...typeof input.enabled === "boolean" ? { enabled: input.enabled } : {},
+            ...typeof input.pinned === "boolean" ? { pinned: input.pinned } : {}
+          },
+          include: { credential: credentialSummary }
+        });
+        return toConnection(row);
+      });
+      if (input.enabled !== void 0 || input.grantedPermissions !== void 0 || input.manifest !== void 0) {
+        emitIntegrationAccessChanged(id);
+      }
+      return connection;
+    },
+    async disconnect(id) {
+      const connection = await get(id);
+      if (connection.native || id === MCP_CONNECTION_ID)
+        throw createAppError(
+          400,
+          "NATIVE_INTEGRATION_REQUIRED",
+          "Native integrations can be disabled, but cannot be disconnected."
+        );
+      await db.integrationConnection.delete({ where: { id } });
+      emitIntegrationAccessChanged(id);
+    },
+    async rotateToken(id) {
+      await get(id);
+      const token = issueIntegrationToken();
+      await db.integrationCredential.upsert({
+        where: { connectionId: id },
+        create: { connectionId: id, tokenHash: token.hash },
+        update: { tokenHash: token.hash, createdAt: /* @__PURE__ */ new Date(), lastUsedAt: null, statusReport: null }
+      });
+      emitIntegrationAccessChanged(id);
+      return { token: token.plaintext };
+    },
+    async revokeToken(id) {
+      await get(id);
+      await db.integrationCredential.deleteMany({ where: { connectionId: id } });
+      emitIntegrationAccessChanged(id);
+    },
+    async reportStatus(token, input) {
+      const update = parseStatusUpdate(input);
+      const tokenHash = createHash("sha256").update(token, "utf8").digest("hex");
+      return db.$transaction(async (tx) => {
+        const credential = await tx.integrationCredential.findUnique({
+          where: { tokenHash },
+          include: { connection: true }
+        });
+        if (!credential?.connection.enabled || !parsePermissions(JSON.parse(credential.connection.grantedPermissions)).includes("notes:read") || !resolveManifest(credential.connection).permissions.includes("notes:read")) {
+          throw createAppError(403, "INTEGRATION_ACCESS_DENIED", "This connection cannot report activity.");
+        }
+        const report = { ...update, reportedAt: (/* @__PURE__ */ new Date()).toISOString() };
+        await tx.integrationCredential.update({
+          where: { tokenHash },
+          data: { statusReport: JSON.stringify(report) }
+        });
+        return report;
+      });
+    },
+    async authenticate(token) {
+      const tokenHash = createHash("sha256").update(token, "utf8").digest("hex");
+      const credential = await db.integrationCredential.findUnique({
+        where: { tokenHash },
+        include: { connection: true }
+      });
+      if (!credential?.connection.enabled) return null;
+      const connection = credential.connection;
+      const touched = await db.integrationCredential.updateMany({
+        where: { connectionId: connection.id, tokenHash },
+        data: { lastUsedAt: /* @__PURE__ */ new Date() }
+      });
+      if (!touched.count) return null;
+      return {
+        connectionId: connection.id,
+        integrationId: connection.integrationId,
+        native: connection.native,
+        permissions: parsePermissions(JSON.parse(connection.grantedPermissions)).filter(
+          (permission) => resolveManifest(connection).permissions.includes(permission)
+        )
+      };
+    }
+  };
+};
+export {
+  createIntegrationService
+};

package/server/dist/features/integration/status-report.js

@@ -0,0 +1,22 @@
+import { createAppError } from "../../modules/error-handler.js";
+import { isRecord } from "./manifest.js";
+function parseStatusUpdate(value) {
+  if (!isRecord(value) || value.state !== "running" && value.state !== "succeeded" && value.state !== "failed" || typeof value.message !== "string" || !value.message.trim() || value.message.length > 300 || [...value.message].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) {
+    throw createAppError(
+      400,
+      "INVALID_INTEGRATION_STATUS",
+      "Provide a running, succeeded, or failed state and a message of 1\u2013300 characters without control characters."
+    );
+  }
+  return { state: value.state, message: value.message.trim() };
+}
+function readStatusReport(value) {
+  if (!value) return null;
+  const report = JSON.parse(value);
+  if (!isRecord(report) || typeof report.reportedAt !== "string") return null;
+  return { ...parseStatusUpdate(report), reportedAt: report.reportedAt };
+}
+export {
+  parseStatusUpdate,
+  readStatusReport
+};