ocean-brain 0.13.3 → 0.15.0

package/server/dist/modules/server-events.js

@@ -1,4 +1,5 @@
 import { EventEmitter } from "node:events";
+import { emitNoteChange } from "../features/note/services/change-events.js";
 const SERVER_EVENT_CHANNEL = "server-event";
 const serverEventEmitter = new EventEmitter();
 serverEventEmitter.setMaxListeners(0);
@@ -9,6 +10,8 @@ const emitServerEvent = (event) => {
     ...event
   };
   serverEventEmitter.emit(SERVER_EVENT_CHANNEL, nextEvent);
+  const type = event.type.replace(/^(mcp|integration)\./, "");
+  emitNoteChange({ type, noteId: Number(event.noteId) });
   return nextEvent;
 };
 const subscribeServerEvents = (listener) => {

package/server/dist/routes/api.js

@@ -16,6 +16,7 @@ import {
 import { createCsrfProtection, requireSessionForWrite } from "../modules/auth-guard.js";
 import { createAuthAttemptRateLimit, createSessionAccessRateLimit } from "../modules/rate-limit.js";
 import { createServerEventsHandler } from "../modules/server-events-handler.js";
+import { createIntegrationRouter } from "./integrations.js";
 import { createMcpRouter } from "./mcp.js";
 const createApiRouter = (authConfig, mcpAdminService) => {
   return async (app) => {
@@ -23,6 +24,7 @@ const createApiRouter = (authConfig, mcpAdminService) => {
     const requireSession = requireSessionForWrite(authConfig);
     const sessionAccessRateLimit = app.rateLimit(createSessionAccessRateLimit());
     app.register(createMcpRouter(authConfig, mcpAdminService), { prefix: "/mcp" });
+    app.register(createIntegrationRouter(authConfig));
     app.get("/auth/session", createSessionStatusHandler(authConfig));
     app.post(
       "/auth/login",

package/server/dist/routes/apps.js

@@ -0,0 +1,163 @@
+import { buildUnauthorizedPayload } from "@baejino/auth";
+import fastifyHttpProxy from "@fastify/http-proxy";
+import {
+  APP_GATEWAY_ACCESS_COOKIE_NAME,
+  APP_GATEWAY_ACCESS_HEADER,
+  APP_GATEWAY_ACCESS_TTL_MS,
+  createAppGatewayAccessService,
+  extractAppGatewayAccessCookie,
+  extractAppGatewayAccessToken,
+  selectAppGatewayProtocol
+} from "../features/app-gateway/access.js";
+import {
+  APP_GATEWAY_PUBLIC_PREFIX,
+  createGatewayResponseHeaders,
+  createProxyRequestHeaders,
+  createProxyWebSocketHeaders,
+  getAppGatewayUpstream,
+  resolveAppGatewayConnection,
+  resolveAppGatewayOptions,
+  validateAppGatewayRequestPath
+} from "../features/app-gateway/gateway.js";
+import { createCsrfProtection, requireSessionForWrite } from "../modules/auth-guard.js";
+import { createAppError } from "../modules/error-handler.js";
+import { createSessionAccessRateLimit } from "../modules/rate-limit.js";
+const PROXY_PREFIX = `${APP_GATEWAY_PUBLIC_PREFIX}/:connectionId`;
+const SUPPORTED_METHODS = "DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT";
+const CORS_ASSET_DESTINATIONS = /* @__PURE__ */ new Set(["audio", "font", "image", "manifest", "script", "style", "video", "worker"]);
+const getConnectionId = (request) => {
+  const params = request.params;
+  return typeof params.connectionId === "string" ? params.connectionId : "";
+};
+const isWebSocketUpgrade = (request) => request.headers.upgrade?.toLowerCase() === "websocket";
+const getHeaderValue = (value) => Array.isArray(value) ? value[0] : value;
+const getPublicProtocol = (request) => {
+  const origin = getHeaderValue(request.headers.origin);
+  if (origin && origin !== "null") {
+    try {
+      const url = new URL(origin);
+      if (url.host === request.headers.host && (url.protocol === "http:" || url.protocol === "https:")) {
+        return url.protocol.slice(0, -1);
+      }
+    } catch {
+    }
+  }
+  return request.protocol === "https" ? "https" : "http";
+};
+const requireAllowedOrigin = (request) => {
+  const origin = request.headers.origin;
+  if (!origin || origin === "null") return;
+  try {
+    if (new URL(origin).host === request.headers.host) return;
+  } catch {
+  }
+  throw createAppError(403, "APP_ORIGIN_FORBIDDEN", "App requests must originate from Ocean Brain.");
+};
+const isCorsPreflight = (request) => request.method === "OPTIONS" && request.headers.origin === "null" && typeof request.headers["access-control-request-method"] === "string";
+const sendCorsPreflight = (request, reply) => {
+  const requestedHeaders = request.headers["access-control-request-headers"];
+  return reply.status(204).headers({
+    "Access-Control-Allow-Credentials": "true",
+    "Access-Control-Allow-Headers": requestedHeaders ?? "Content-Type",
+    "Access-Control-Allow-Methods": SUPPORTED_METHODS,
+    "Access-Control-Allow-Origin": "null",
+    "Access-Control-Max-Age": "600",
+    Vary: "Origin, Access-Control-Request-Headers"
+  }).send();
+};
+const createAppGatewayRouter = (authConfig, gatewayOptions) => {
+  return async (app) => {
+    const accessRouteOptions = {
+      preHandler: [
+        app.rateLimit(createSessionAccessRateLimit()),
+        requireSessionForWrite(authConfig),
+        createCsrfProtection(authConfig)
+      ]
+    };
+    const options = resolveAppGatewayOptions(gatewayOptions);
+    const access = createAppGatewayAccessService();
+    const wsClientOptions = {
+      headers: {},
+      rewriteRequestHeaders: (_headers, request) => createProxyWebSocketHeaders(request)
+    };
+    app.post(
+      "/api/app-gateway/connections/:connectionId/access",
+      accessRouteOptions,
+      async (request, reply) => {
+        requireAllowedOrigin(request);
+        const connection = await resolveAppGatewayConnection(options, request.params.connectionId);
+        const grant = access.issue(connection.id, getPublicProtocol(request));
+        return reply.header("Cache-Control", "no-store").setCookie(APP_GATEWAY_ACCESS_COOKIE_NAME, grant.token, {
+          httpOnly: true,
+          maxAge: APP_GATEWAY_ACCESS_TTL_MS / 1e3,
+          path: `${APP_GATEWAY_PUBLIC_PREFIX}/${connection.id}`,
+          // The sandbox has an opaque origin, so app subresources need an explicitly cross-site cookie.
+          sameSite: "none",
+          secure: true
+        }).send({
+          connectionId: connection.id,
+          ...grant
+        });
+      }
+    );
+    app.removeContentTypeParser("application/x-www-form-urlencoded");
+    app.decorateRequest("appGatewayCorsAllowed", false);
+    app.decorateRequest("appGatewayConnection", null);
+    app.decorateRequest("appGatewayPublicProtocol", null);
+    app.register(fastifyHttpProxy, {
+      upstream: "",
+      prefix: PROXY_PREFIX,
+      rewritePrefix: "/",
+      websocket: true,
+      preHandler: async (request, reply) => {
+        validateAppGatewayRequestPath(request.url);
+        requireAllowedOrigin(request);
+        if (isCorsPreflight(request)) return sendCorsPreflight(request, reply);
+        const connectionId = getConnectionId(request);
+        const headerToken = getHeaderValue(request.headers[APP_GATEWAY_ACCESS_HEADER]);
+        const accessToken = isWebSocketUpgrade(request) ? extractAppGatewayAccessToken(request.headers["sec-websocket-protocol"]) : headerToken ?? extractAppGatewayAccessCookie(request.headers.cookie);
+        const accessGrant = access.resolve(connectionId, accessToken);
+        if (!accessGrant) {
+          const unauthorized = buildUnauthorizedPayload();
+          throw createAppError(401, unauthorized.code, unauthorized.message);
+        }
+        request.appGatewayPublicProtocol = accessGrant.publicProtocol;
+        request.appGatewayConnection = await resolveAppGatewayConnection(options, connectionId);
+        const requestUrl = new URL(request.url, "http://ocean-brain.invalid");
+        const publicRoot = `${APP_GATEWAY_PUBLIC_PREFIX}/${connectionId}`;
+        if (!isWebSocketUpgrade(request) && ["GET", "HEAD"].includes(request.method) && requestUrl.pathname === publicRoot) {
+          return reply.redirect(`${publicRoot}/${requestUrl.search}`, 308);
+        }
+        if (request.headers.origin === "null" && !["GET", "HEAD"].includes(request.method) && !headerToken && !isWebSocketUpgrade(request)) {
+          throw createAppError(
+            403,
+            "APP_ACCESS_HEADER_REQUIRED",
+            "Sandboxed app writes require the app access header."
+          );
+        }
+        const fetchDestination = request.headers["sec-fetch-dest"];
+        request.appGatewayCorsAllowed = request.headers.origin === "null" && (Boolean(headerToken) || typeof fetchDestination === "string" && CORS_ASSET_DESTINATIONS.has(fetchDestination));
+      },
+      replyOptions: {
+        timeout: options.requestTimeoutMs,
+        getUpstream: (request) => getAppGatewayUpstream(request),
+        rewriteRequestHeaders: (request, headers) => createProxyRequestHeaders(request, headers),
+        rewriteHeaders: (headers, request) => request ? createGatewayResponseHeaders(headers, request) : headers,
+        onError: (reply, { error }) => {
+          const timeout = error.name === "TimeoutError" || error.message.toLowerCase().includes("timeout");
+          return reply.status(timeout ? 504 : 502).send({
+            code: timeout ? "APP_PROXY_TIMEOUT" : "APP_PROXY_UNAVAILABLE",
+            message: timeout ? "The proxied app did not respond in time." : "The proxied app could not be reached."
+          });
+        }
+      },
+      wsClientOptions,
+      wsServerOptions: {
+        handleProtocols: selectAppGatewayProtocol
+      }
+    });
+  };
+};
+export {
+  createAppGatewayRouter
+};

package/server/dist/routes/graphql.js

@@ -1,4 +1,5 @@
 import mercurius from "mercurius";
+import { integrationReadSchema } from "../features/integration/schema.js";
 import { createCsrfProtection, isAuthenticatedRequest, requireSessionForGraphql } from "../modules/auth-guard.js";
 import { createMcpAuthMiddleware, createReadOnlyMcpValidationRule } from "../modules/mcp-auth.js";
 import schema from "../schema/index.js";
@@ -13,7 +14,7 @@ const createGraphqlRouter = (authConfig, mcpAdminService) => {
     app.register(async (mcpEndpoint) => {
       mcpEndpoint.addHook("preHandler", createMcpAuthMiddleware(authConfig, mcpAdminService));
       mcpEndpoint.register(mercurius, {
-        schema,
+        schema: integrationReadSchema,
         path: "/graphql/mcp",
         graphiql: false,
         errorFormatter: (execution, context) => ({

package/server/dist/routes/index.js

@@ -1,9 +1,11 @@
 import { createApiRouter } from "./api.js";
+import { createAppGatewayRouter } from "./apps.js";
 import { createAuthPagesRouter } from "./auth-pages.js";
 import { createClientRouter } from "./client.js";
 import { createGraphqlRouter } from "./graphql.js";
 export {
   createApiRouter,
+  createAppGatewayRouter,
   createAuthPagesRouter,
   createClientRouter,
   createGraphqlRouter

package/server/dist/routes/integrations.js

@@ -0,0 +1,137 @@
+import mercurius from "mercurius";
+import { requireIntegrationPermission } from "../features/integration/auth.js";
+import {
+  createIntegrationNoteCatalogHandler,
+  createIntegrationNoteEventsHandler
+} from "../features/integration/note-sync.js";
+import { integrationReadSchema } from "../features/integration/schema.js";
+import { createIntegrationService } from "../features/integration/service.js";
+import {
+  createAppendNoteMarkdownHandler,
+  createCreateNoteHandler,
+  createDeleteNoteHandler,
+  createNoteWriteBaselineHandler,
+  createPatchNoteMarkdownHandler,
+  createReplaceNoteMarkdownHandler,
+  createUpdateNoteMetadataHandler
+} from "../features/note/http/authoring.js";
+import { createCsrfProtection, requireSessionForWrite } from "../modules/auth-guard.js";
+import { createAppError } from "../modules/error-handler.js";
+import { createReadOnlyMcpValidationRule } from "../modules/mcp-auth.js";
+import { createSessionAccessRateLimit } from "../modules/rate-limit.js";
+const createIntegrationRouter = (authConfig) => async (app) => {
+  const service = createIntegrationService();
+  app.register(
+    async (api) => {
+      api.register(async (read) => {
+        read.addHook("preHandler", requireIntegrationPermission("notes:read", service));
+        read.register(mercurius, {
+          schema: integrationReadSchema,
+          path: "/graphql",
+          graphiql: false,
+          queryDepth: 16,
+          validationRules: [createReadOnlyMcpValidationRule("Integration GraphQL endpoint is read-only")],
+          context: (req) => ({ integration: req.integration })
+        });
+      });
+      api.get(
+        "/me",
+        { preHandler: requireIntegrationPermission("notes:read", service) },
+        async (request) => ({
+          apiVersion: 1,
+          ...request.integration
+        })
+      );
+      api.post(
+        "/status",
+        { bodyLimit: 2048, preHandler: requireIntegrationPermission("notes:read", service) },
+        async (request) => service.reportStatus(request.headers.authorization?.slice(7).trim() ?? "", request.body)
+      );
+      api.get(
+        "/events",
+        { preHandler: requireIntegrationPermission("notes:read", service) },
+        createIntegrationNoteEventsHandler()
+      );
+      api.post(
+        "/notes/catalog",
+        { preHandler: requireIntegrationPermission("notes:read", service) },
+        createIntegrationNoteCatalogHandler()
+      );
+      api.post(
+        "/notes/create",
+        { preHandler: requireIntegrationPermission("notes:create", service) },
+        createCreateNoteHandler()
+      );
+      api.post(
+        "/notes/baseline",
+        { preHandler: requireIntegrationPermission("notes:read", service) },
+        createNoteWriteBaselineHandler()
+      );
+      api.post(
+        "/notes/patch-markdown",
+        { preHandler: requireIntegrationPermission("notes:update", service) },
+        createPatchNoteMarkdownHandler()
+      );
+      api.post(
+        "/notes/append-markdown",
+        { preHandler: requireIntegrationPermission("notes:update", service) },
+        createAppendNoteMarkdownHandler()
+      );
+      api.post(
+        "/notes/replace-markdown",
+        { preHandler: requireIntegrationPermission("notes:update", service) },
+        createReplaceNoteMarkdownHandler()
+      );
+      api.post(
+        "/notes/metadata",
+        { preHandler: requireIntegrationPermission("notes:update", service) },
+        createUpdateNoteMetadataHandler()
+      );
+      api.post(
+        "/notes/delete",
+        { preHandler: requireIntegrationPermission("notes:delete", service) },
+        createDeleteNoteHandler()
+      );
+    },
+    { prefix: "/integrations/v1" }
+  );
+  app.register(
+    async (admin) => {
+      admin.addHook("preHandler", app.rateLimit(createSessionAccessRateLimit()));
+      admin.addHook("preHandler", requireSessionForWrite(authConfig));
+      admin.addHook("preHandler", createCsrfProtection(authConfig));
+      admin.get("/connections", async () => ({ connections: await service.list() }));
+      admin.post("/connections", { bodyLimit: 64 * 1024 }, async (request, reply) => {
+        if (!request.body)
+          throw createAppError(400, "INVALID_INTEGRATION_MANIFEST", "A manifest is required.");
+        const connection = await service.connect({
+          manifest: request.body.manifest,
+          grantedPermissions: request.body.grantedPermissions,
+          proxyUrl: request.body.proxyUrl
+        });
+        return reply.status(201).send(connection);
+      });
+      admin.patch(
+        "/connections/:id",
+        { bodyLimit: 64 * 1024 },
+        async (request) => service.update(request.params.id, request.body ?? {})
+      );
+      admin.delete("/connections/:id", async (request) => {
+        await service.disconnect(request.params.id);
+        return { disconnected: true };
+      });
+      admin.post(
+        "/connections/:id/token/rotate",
+        async (request) => service.rotateToken(request.params.id)
+      );
+      admin.post("/connections/:id/token/revoke", async (request) => {
+        await service.revokeToken(request.params.id);
+        return { revoked: true };
+      });
+    },
+    { prefix: "/integration-admin" }
+  );
+};
+export {
+  createIntegrationRouter
+};

package/server/dist/routes/mcp.js

@@ -11,27 +11,47 @@ import { createMcpCreateTagHandler } from "../features/tag/http/mcp.js";
 import { createMcpAuthMiddleware } from "../modules/mcp-auth.js";
 const createMcpRouter = (authConfig, mcpAdminService) => {
   return async (app) => {
-    const requireMcpAuth = createMcpAuthMiddleware(authConfig, mcpAdminService);
-    app.post("/notes/create", { preHandler: requireMcpAuth }, createMcpCreateNoteHandler());
-    app.post("/notes/baseline", { preHandler: requireMcpAuth }, createMcpNoteWriteBaselineHandler());
+    const requireMcpAuth = (permission) => createMcpAuthMiddleware(authConfig, mcpAdminService, permission);
+    app.post(
+      "/notes/create",
+      { preHandler: requireMcpAuth("notes:create") },
+      createMcpCreateNoteHandler()
+    );
+    app.post(
+      "/notes/baseline",
+      { preHandler: requireMcpAuth("notes:read") },
+      createMcpNoteWriteBaselineHandler()
+    );
     app.post(
       "/notes/patch-markdown",
-      { preHandler: requireMcpAuth },
+      { preHandler: requireMcpAuth("notes:update") },
       createMcpPatchNoteMarkdownHandler()
     );
     app.post(
       "/notes/append-markdown",
-      { preHandler: requireMcpAuth },
+      { preHandler: requireMcpAuth("notes:update") },
       createMcpAppendNoteMarkdownHandler()
     );
-    app.post("/notes/metadata", { preHandler: requireMcpAuth }, createMcpUpdateNoteMetadataHandler());
+    app.post(
+      "/notes/metadata",
+      { preHandler: requireMcpAuth("notes:update") },
+      createMcpUpdateNoteMetadataHandler()
+    );
     app.post(
       "/notes/replace-markdown",
-      { preHandler: requireMcpAuth },
+      { preHandler: requireMcpAuth("notes:update") },
       createMcpReplaceNoteMarkdownHandler()
     );
-    app.post("/notes/delete", { preHandler: requireMcpAuth }, createMcpDeleteNoteHandler());
-    app.post("/tags/create", { preHandler: requireMcpAuth }, createMcpCreateTagHandler());
+    app.post(
+      "/notes/delete",
+      { preHandler: requireMcpAuth("notes:delete") },
+      createMcpDeleteNoteHandler()
+    );
+    app.post(
+      "/tags/create",
+      { preHandler: requireMcpAuth("notes:update") },
+      createMcpCreateTagHandler()
+    );
   };
 };
 export {

package/server/prisma/migrations/20260917120000_0020_plugin_installations/migration.sql

@@ -0,0 +1,39 @@
+CREATE TABLE "PluginInstallation" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "pluginId" TEXT NOT NULL,
+    "native" BOOLEAN NOT NULL DEFAULT false,
+    "manifest" TEXT NOT NULL,
+    "grantedPermissions" TEXT NOT NULL DEFAULT '[]',
+    "enabled" BOOLEAN NOT NULL DEFAULT false,
+    "pinned" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL
+);
+
+CREATE INDEX "PluginInstallation_pluginId_idx" ON "PluginInstallation"("pluginId");
+
+CREATE TABLE "PluginCredential" (
+    "installationId" TEXT NOT NULL PRIMARY KEY,
+    "id" TEXT NOT NULL,
+    "tokenHash" TEXT NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "lastUsedAt" DATETIME,
+    CONSTRAINT "PluginCredential_installationId_fkey" FOREIGN KEY ("installationId") REFERENCES "PluginInstallation" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+CREATE UNIQUE INDEX "PluginCredential_id_key" ON "PluginCredential"("id");
+CREATE UNIQUE INDEX "PluginCredential_tokenHash_key" ON "PluginCredential"("tokenHash");
+
+-- Keep legacy tables intact. Only the latest active token was accepted by MCP.
+INSERT INTO "PluginInstallation" ("id", "pluginId", "native", "manifest", "grantedPermissions", "enabled", "updatedAt")
+VALUES (
+    'mcp', 'ocean-brain.mcp', true,
+    '{"schemaVersion":1,"apiVersion":1,"id":"ocean-brain.mcp","name":"MCP","version":"1.0.0","description":"Connect AI clients to Ocean Brain.","permissions":["notes:read","notes:create","notes:update","notes:delete"]}',
+    '["notes:read","notes:create","notes:update","notes:delete"]',
+    COALESCE((SELECT "value" = 'true' FROM "Cache" WHERE "key" = 'MCP_ENABLED'), false),
+    CURRENT_TIMESTAMP
+);
+
+INSERT INTO "PluginCredential" ("installationId", "id", "tokenHash", "createdAt", "lastUsedAt")
+SELECT 'mcp', CAST("id" AS TEXT), "tokenHash", "createdAt", "lastUsedAt"
+FROM "McpToken" WHERE "revokedAt" IS NULL ORDER BY "createdAt" DESC, "id" DESC LIMIT 1;

package/server/prisma/migrations/20260917150000_0021_integration_connections/migration.sql

@@ -0,0 +1,29 @@
+-- Rename the existing platform in place: preserve connection IDs, grants,
+-- credential hashes and timestamps, including MCP credentials migrated by 0020.
+BEGIN IMMEDIATE;
+
+ALTER TABLE "PluginInstallation" RENAME TO "IntegrationConnection";
+ALTER TABLE "IntegrationConnection" RENAME COLUMN "pluginId" TO "integrationId";
+
+-- SQLite cannot rename a foreign-key constraint; copy the credential rows
+-- unchanged so the resulting table also matches Prisma's canonical schema.
+CREATE TABLE "IntegrationCredential" (
+    "connectionId" TEXT NOT NULL PRIMARY KEY,
+    "id" TEXT NOT NULL,
+    "tokenHash" TEXT NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "lastUsedAt" DATETIME,
+    CONSTRAINT "IntegrationCredential_connectionId_fkey" FOREIGN KEY ("connectionId") REFERENCES "IntegrationConnection" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+INSERT INTO "IntegrationCredential" ("connectionId", "id", "tokenHash", "createdAt", "lastUsedAt")
+SELECT "installationId", "id", "tokenHash", "createdAt", "lastUsedAt" FROM "PluginCredential";
+DROP TABLE "PluginCredential";
+
+DROP INDEX "PluginInstallation_pluginId_idx";
+CREATE INDEX "IntegrationConnection_integrationId_idx" ON "IntegrationConnection"("integrationId");
+
+CREATE UNIQUE INDEX "IntegrationCredential_id_key" ON "IntegrationCredential"("id");
+CREATE UNIQUE INDEX "IntegrationCredential_tokenHash_key" ON "IntegrationCredential"("tokenHash");
+
+COMMIT;

package/server/prisma/migrations/20260919090000_0022_integration_proxy_url/migration.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "IntegrationConnection" ADD COLUMN "proxyUrl" TEXT;
+ALTER TABLE "IntegrationCredential" ADD COLUMN "statusReport" TEXT;

package/server/prisma/schema.prisma

@@ -25,19 +25,45 @@ model McpToken {
   @@index([revokedAt, createdAt])
 }
 
+model IntegrationConnection {
+  id                 String                 @id @default(cuid())
+  integrationId      String
+  native             Boolean                @default(false)
+  manifest           String
+  proxyUrl           String?
+  grantedPermissions String                 @default("[]")
+  enabled            Boolean                @default(false)
+  pinned             Boolean                @default(false)
+  createdAt          DateTime               @default(now())
+  updatedAt          DateTime               @updatedAt
+  credential         IntegrationCredential?
+
+  @@index([integrationId])
+}
+
+model IntegrationCredential {
+  connectionId String                @id
+  connection   IntegrationConnection @relation(fields: [connectionId], references: [id], onDelete: Cascade)
+  id           String                @unique @default(cuid())
+  tokenHash    String                @unique
+  createdAt    DateTime              @default(now())
+  lastUsedAt   DateTime?
+  statusReport String?
+}
+
 model Note {
-  id                    Int            @id @default(autoincrement())
+  id                    Int             @id @default(autoincrement())
   title                 String
   content               String
-  searchableText        String         @default("")
-  searchableTextVersion Int            @default(0)
-  createdAt             DateTime       @default(now())
-  updatedAt             DateTime       @updatedAt
-  pinned                Boolean        @default(false)
-  order                 Int            @default(0)
-  layout                NoteLayout     @default(wide)
-  tags                  Tag[]          @relation("NoteToTag")
-  reminders             Reminder[]     @relation("NoteToReminder")
+  searchableText        String          @default("")
+  searchableTextVersion Int             @default(0)
+  createdAt             DateTime        @default(now())
+  updatedAt             DateTime        @updatedAt
+  pinned                Boolean         @default(false)
+  order                 Int             @default(0)
+  layout                NoteLayout      @default(wide)
+  tags                  Tag[]           @relation("NoteToTag")
+  reminders             Reminder[]      @relation("NoteToReminder")
   snapshots             NoteSnapshot[]
   properties            NoteProperty[]
   outgoingReferences    NoteReference[] @relation("NoteReferenceSource")

package/server/client/dist/assets/Calendar-DwQBllfw.js

@@ -1,25 +0,0 @@
-import{j as e,r as j}from"./floating-ui.react-dom-BWTnA00G.js";import{T as p,x as H,y as E,M as C,q as S,g as Y,P as Q,h as V}from"./time-PxWila4-.js";import{d as b,s as F,a as $}from"./useNoteMutate-BjvZUmtX.js";import{C as U}from"./url-DKUMNVCI.js";import{C as z,a as P,b as B,c as J,g as G,s as W,d as X}from"./calendar-data-wB0ifXdo.js";import{d as K}from"./app-NgiBDISG.js";import{s as Z}from"./FileText.es-DPIwDCEe.js";import{C as ee}from"./Callout-CcYyvHQP.js";import"./preload-helper-BXl3LOEh.js";import"./Graph-hVj6vAYJ.js";import"./Info.es-CYxg-Vku.js";const D=2,te=({year:t,month:a,day:n,isCurrentMonth:r,isSunday:l,isToday:m,isSelected:d,isPast:c,notes:h,reminders:g,onSelect:s})=>{const f=h.slice(0,D).map(y=>({key:`note-${y.id}`,type:"note",title:y.title})),N=g.slice(0,D).map(y=>({key:`reminder-${y.id}`,type:"reminder",title:y.content||y.note?.title||"No title",isCompleted:y.completed})),M=(c?[...f,...N]:[...N,...f]).slice(0,D),R=()=>r?d?"bg-elevated shadow-[inset_0_0_0_1px_var(--border-secondary)] hover:bg-surface":"bg-surface hover:bg-muted":"cursor-default bg-[var(--page-bg)] text-fg-disabled",k=()=>m?"bg-cta font-semibold text-fg-on-filled":r?l?"font-semibold text-fg-weekend":"font-semibold text-fg-secondary":"font-medium text-fg-tertiary";return e.jsx(z,{day:n,dateLabel:b(new Date(t,a-1,n)).format("dddd, MMMM D, YYYY"),cellClassName:R(),dayNumberClassName:k(),isCurrentMonth:r,isToday:m,isSelected:d,noteCount:h.length,reminderCount:g.length,previewItems:M,overflowCount:Math.max(0,h.length+g.length-D),onSelect:s})},ae=te,ne=({note:t,type:a})=>e.jsx(P,{params:{id:t.id},header:e.jsx(Z,{size:12}),title:t.title,meta:b(Number(a==="create"?t.createdAt:t.updatedAt)).format("HH:mm")}),se=({reminder:t})=>e.jsx(P,{params:{id:String(t.note?.id??t.noteId)},header:e.jsx(F,{size:12}),title:t.content||t.note?.title||"No title",titleClassName:t.completed?"line-through":"",meta:b(Number(t.reminderDate)).format("HH:mm")}),re=(t,a)=>t.map(n=>n.type==="note"?e.jsx(ne,{note:n.item,type:a},`note-${n.item.id}`):e.jsx(se,{reminder:n.item},`reminder-${n.item.id}`)),I=(t,a)=>`${t} ${t===1?a:`${a}s`}`,oe="mt-3 flex min-h-0 flex-1 flex-col gap-1 overflow-y-auto overscroll-y-contain pr-2 [scrollbar-color:var(--border-secondary)_transparent] [scrollbar-width:thin] [&::-webkit-scrollbar-thumb]:rounded-full [&::-webkit-scrollbar-thumb]:bg-border-secondary [&::-webkit-scrollbar-track]:bg-transparent [&::-webkit-scrollbar]:w-1.5",L=t=>b(new Date(t.year,t.month-1,t.day)).format("dddd, MMMM D"),T=({day:t,type:a,isLoading:n,presentation:r="rail"})=>{const l=j.useMemo(()=>{if(!t)return[];const h=t.notes.map(s=>({type:"note",item:s})),g=t.reminders.map(s=>({type:"reminder",item:s}));return t.isPast?[...h,...g]:[...g,...h]},[t]);if(!t)return e.jsx("section",{"aria-label":"Day details",className:"flex h-full min-h-40 items-center justify-center text-center",children:e.jsx(p,{as:"p",variant:"meta",weight:"medium",tone:"secondary",children:"Select a day to see its activity."})});const m=L(t),d=n?"Loading activity...":[I(t.notes.length,"note"),I(t.reminders.length,"reminder")].join(" · "),c=n?null:e.jsx("div",{className:r==="rail"?oe:"flex flex-col gap-1",children:l.length>0?re(l,a):e.jsx(p,{as:"p",variant:"meta",weight:"medium",tone:"secondary",className:"py-8 text-center",children:"No activity on this day."})});return r==="modal"?e.jsxs("div",{"aria-label":`${m} activity`,children:[e.jsx(p,{as:"p",variant:"label",weight:"medium",tone:"secondary",className:"mb-3",children:d}),c]}):e.jsxs("section",{"aria-label":`${m} details`,className:"flex h-full min-h-0 flex-col",children:[e.jsxs("div",{className:"flex shrink-0 items-start gap-2 border-b border-border-subtle/80 pb-3",children:[e.jsx(K,{"aria-hidden":"true",className:"mt-0.5 shrink-0 text-fg-tertiary",size:15}),e.jsxs("div",{className:"min-w-0",children:[e.jsx(p,{as:"h2",variant:"subheading",weight:"semibold",tracking:"tight",children:m}),e.jsx(p,{as:"p",variant:"label",weight:"medium",tone:"secondary",className:"mt-0.5",children:d})]})]}),c]})},ie=["January","February","March","April","May","June","July","August","September","October","November","December"],le=({month:t,year:a,type:n,onPrevMonth:r,onNextMonth:l,onToday:m,onTypeChange:d})=>e.jsxs("div",{className:"flex flex-col gap-4 lg:flex-row lg:items-end lg:justify-between",children:[e.jsxs("div",{className:"space-y-1.5",children:[e.jsxs("div",{className:"flex flex-wrap items-end gap-x-2.5 gap-y-1",children:[e.jsx(p,{as:"h1",variant:"display",weight:"bold",tracking:"tighter",className:"text-2xl leading-none sm:text-[2.15rem]",children:ie[t-1]}),e.jsx(p,{as:"span",variant:"subheading",weight:"medium",tone:"secondary",tracking:"tight",className:"pb-0.5",children:a})]}),e.jsx(p,{as:"p",variant:"meta",weight:"medium",tone:"secondary",className:"hidden sm:block",children:"Track note activity and reminders across the month"})]}),e.jsx("div",{className:"flex lg:justify-end",children:e.jsxs("div",{className:"flex w-full flex-col gap-2 sm:inline-flex sm:w-auto sm:flex-row sm:items-center sm:gap-3",children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx(K,{className:"h-4 w-4 shrink-0 text-fg-tertiary"}),e.jsx(p,{id:"calendar-note-date-label",as:"span",variant:"label",weight:"medium",tone:"secondary",children:"Note date"}),e.jsxs(H,{value:n,"aria-labelledby":"calendar-note-date-label",onValueChange:h=>d(h),variant:"ghost",size:"sm",children:[e.jsx(E,{value:"create",children:"Created"}),e.jsx(E,{value:"update",children:"Updated"})]})]}),e.jsx("div",{className:"hidden h-5 w-px bg-divider sm:block"}),e.jsx(B,{onPrevMonth:r,onNextMonth:l,onToday:m})]})})]}),_="(min-width: 1280px)",de=({days:t,type:a,isLoading:n,selectedDayKey:r,onSelectedDayChange:l})=>{const[m,d]=j.useState(!1),c=j.useMemo(()=>t.find(s=>s.key===r),[t,r]);j.useEffect(()=>{const s=window.matchMedia(_),f=N=>{N.matches&&d(!1)};return s.addEventListener("change",f),()=>s.removeEventListener("change",f)},[]);const h=s=>{l(s),window.matchMedia(_).matches||d(!0)},g=c?L(c):"Day details";return e.jsxs(e.Fragment,{children:[e.jsxs("div",{className:"min-w-0 xl:grid xl:grid-cols-[minmax(0,1fr)_20rem] 2xl:grid-cols-[minmax(0,1fr)_22rem]",children:[e.jsx(J,{isLoading:n,className:"xl:pr-5",children:t.map(s=>e.jsx(ae,{year:s.year,month:s.month,day:s.day,isCurrentMonth:s.isCurrentMonth,isSunday:s.isSunday,isToday:s.isToday,isSelected:s.key===r,isPast:s.isPast,notes:s.notes,reminders:s.reminders,onSelect:()=>h(s.key)},s.key))}),e.jsx("aside",{className:"relative hidden min-h-0 border-l border-border-subtle xl:block","aria-label":"Selected day",children:e.jsx("div",{className:"absolute inset-y-0 right-0 left-5",children:e.jsx(T,{day:c,type:a,isLoading:n})})})]}),e.jsxs(C,{isOpen:m&&!!c,onClose:()=>d(!1),variant:"inspect",className:"xl:hidden",children:[e.jsx(C.Header,{title:g,onClose:()=>d(!1)}),e.jsxs(C.Body,{children:[e.jsxs(C.Description,{className:"sr-only",children:["View notes and reminders for ",g,"."]}),e.jsx(T,{day:c,type:a,isLoading:n,presentation:"modal"})]})]})]})},ce=`
-    query NotesInDateRange($dateRange: DateRangeInput) {
-        notesInDateRange(dateRange: $dateRange) {
-            id
-            title
-            createdAt
-            updatedAt
-        }
-    }
-`,me=`
-    query RemindersInDateRange($dateRange: DateRangeInput) {
-        remindersInDateRange(dateRange: $dateRange) {
-            id
-            noteId
-            reminderDate
-            completed
-            priority
-            content
-            note {
-                id
-                title
-            }
-        }
-    }
-`,he=async t=>{const a=await Y(ce,{dateRange:t});if(a.type==="error")throw a;return a.notesInDateRange},ue=async t=>{const a=await Y(me,{dateRange:t});if(a.type==="error")throw a;return a.remindersInDateRange},ge=({year:t,month:a})=>{const n=G(t,a),r=$({queryKey:S.calendar.notesInDateRange(t,a),queryFn:()=>he(n)}),l=$({queryKey:S.reminders.inDateRange(t,a),queryFn:()=>ue(n)});return{notes:r.data??[],reminders:l.data??[],isLoading:r.isLoading||l.isLoading,isError:r.isError||l.isError}},xe=[],ye=[],A=V(U);function ke(){const t=A.useNavigate(),{year:a,month:n,type:r}=A.useSearch(),l=`${a}-${n}`,[m,d]=j.useState(()=>({monthKey:l})),{notes:c,reminders:h,isLoading:g,isError:s}=ge({year:a,month:n}),f=j.useMemo(()=>{const o=new Map;for(const i of c){const x=r==="create"?b(Number(i.createdAt)):b(Number(i.updatedAt)),v=`${x.year()}-${x.month()+1}-${x.date()}`,w=o.get(v)||[];w.push(i),o.set(v,w)}for(const[i,x]of o)o.set(i,W(x,r));const u=new Map;for(const i of h){const x=b(Number(i.reminderDate)),v=`${x.year()}-${x.month()+1}-${x.date()}`,w=u.get(v)||[];w.push(i),u.set(v,w)}return X(a,n).map(i=>({...i,notes:o.get(i.key)||xe,reminders:u.get(i.key)||ye}))},[a,n,c,h,r]),N=f.find(o=>o.isCurrentMonth&&o.isToday)?.key,M=m.monthKey===l?m.dayKey??N:N,R=()=>{const o=n===1?12:n-1,u=n===1?a-1:a;t({search:i=>({...i,month:o,year:u})})},k=()=>{const o=n===12?1:n+1,u=n===12?a+1:a;t({search:i=>({...i,month:o,year:u})})},y=()=>{const o=b(),u=o.month()+1,i=o.year();d({monthKey:`${i}-${u}`,dayKey:`${i}-${u}-${o.date()}`}),t({search:x=>({...x,month:u,year:i})})},O=o=>{o&&t({search:u=>({...u,type:o})})},q=o=>{d({monthKey:l,dayKey:o})};return e.jsx(Q,{title:"Calendar",variant:"none",children:s?e.jsx(ee,{children:"Failed to load calendar data. Please try again later."}):e.jsxs("div",{className:"sm:-mr-4",children:[e.jsx("div",{className:"border-b border-border-subtle/80 pb-4",children:e.jsx(le,{month:n,year:a,type:r,onPrevMonth:R,onNextMonth:k,onToday:y,onTypeChange:O})}),e.jsx("div",{className:"pt-4",children:e.jsx(de,{days:f,type:r,isLoading:g,selectedDayKey:M,onSelectedDayChange:q})})]})})}export{ke as default};

package/server/client/dist/assets/Callout-CcYyvHQP.js

@@ -1 +0,0 @@
-import{r as e,j as n}from"./floating-ui.react-dom-BWTnA00G.js";import{A as d,T as Z}from"./time-PxWila4-.js";import{c as i}from"./Info.es-CYxg-Vku.js";const p=new Map([["bold",e.createElement(e.Fragment,null,e.createElement("path",{d:"M128,20A108,108,0,1,0,236,128,108.12,108.12,0,0,0,128,20Zm0,192a84,84,0,1,1,84-84A84.09,84.09,0,0,1,128,212Zm-12-80V80a12,12,0,0,1,24,0v52a12,12,0,0,1-24,0Zm28,40a16,16,0,1,1-16-16A16,16,0,0,1,144,172Z"}))],["duotone",e.createElement(e.Fragment,null,e.createElement("path",{d:"M224,128a96,96,0,1,1-96-96A96,96,0,0,1,224,128Z",opacity:"0.2"}),e.createElement("path",{d:"M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm-8-80V80a8,8,0,0,1,16,0v56a8,8,0,0,1-16,0Zm20,36a12,12,0,1,1-12-12A12,12,0,0,1,140,172Z"}))],["fill",e.createElement(e.Fragment,null,e.createElement("path",{d:"M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm-8,56a8,8,0,0,1,16,0v56a8,8,0,0,1-16,0Zm8,104a12,12,0,1,1,12-12A12,12,0,0,1,128,184Z"}))],["light",e.createElement(e.Fragment,null,e.createElement("path",{d:"M128,26A102,102,0,1,0,230,128,102.12,102.12,0,0,0,128,26Zm0,192a90,90,0,1,1,90-90A90.1,90.1,0,0,1,128,218Zm-6-82V80a6,6,0,0,1,12,0v56a6,6,0,0,1-12,0Zm16,36a10,10,0,1,1-10-10A10,10,0,0,1,138,172Z"}))],["regular",e.createElement(e.Fragment,null,e.createElement("path",{d:"M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm-8-80V80a8,8,0,0,1,16,0v56a8,8,0,0,1-16,0Zm20,36a12,12,0,1,1-12-12A12,12,0,0,1,140,172Z"}))],["thin",e.createElement(e.Fragment,null,e.createElement("path",{d:"M128,28A100,100,0,1,0,228,128,100.11,100.11,0,0,0,128,28Zm0,192a92,92,0,1,1,92-92A92.1,92.1,0,0,1,128,220Zm-4-84V80a4,4,0,0,1,8,0v56a4,4,0,0,1-8,0Zm12,36a8,8,0,1,1-8-8A8,8,0,0,1,136,172Z"}))]]),m=e.forwardRef((t,r)=>e.createElement(d,{ref:r,...t,weights:p}));m.displayName="WarningCircleIcon";const g=m,u=({children:t,className:r="",tone:a="info"})=>{const l=a==="danger"?g:i,o=a==="danger"?"border-border-error/70 bg-accent-soft-danger/60":"border-border-subtle bg-hover-subtle/50",s=a==="danger"?"text-fg-error":"text-fg-tertiary",c=a==="danger"?"error":"secondary";return n.jsxs("div",{className:`flex items-center gap-2.5 rounded-[12px] border px-4 py-3 ${o} ${r}`,children:[n.jsx(l,{className:`h-4 w-4 shrink-0 ${s}`}),n.jsx(Z,{as:"div",variant:"meta",weight:"medium",tone:c,children:t})]})};export{u as C,g as m};