ocean-brain 0.14.0 → 0.15.0

package/server/client/dist/assets/{trash-Cepvi7G8.js → trash-Di2BWyUO.js}

@@ -1 +1 @@
-import{j as e,r as E}from"./floating-ui.react-dom-BWTnA00G.js";import{u as M,b as k,i as L,m as _,N as I,d as Q,a as q}from"./useNoteMutate-D-mZKXjl.js";import{Q as B,h as O,u as H,i as K,j as W,q as y,r as Y,p as $,P as w,E as z,T as o,B as j,k as G,l as i,e as U,m as V,n as Z,M as x}from"./time-BwwQGbK-.js";import{S as C}from"./SurfaceCard-jL2qzrzF.js";import{a as J,N as X}from"./url-Bp8sXMb4.js";import"./NotePropertiesPanel-os22Ppnu.js";import"./AuxiliaryPanelHeader-BN_2axQu.js";import"./LinkSimple.es-BD4aGTc3.js";import"./Plus.es-Cl8zOOZa.js";const m=25,v=O(J),S=30,R=`Deleted notes stay here for ${S} days before permanent removal`,g={title:"Permanently delete note?",description:"This note is referenced by the notes below. If you permanently delete it, those links will stay broken. Other notes will not be edited automatically.",confirmLabel:"Delete now",confirmVariant:"danger"},P=s=>Q(s).format("YYYY-MM-DD HH:mm"),ee=({note:s,onClose:n})=>{const h=s?.id??"",l=s?.title||"Untitled note",a=q({queryKey:y.notes.trashDetail(h),enabled:!!s,queryFn:async()=>{const d=await Z(h);if(d.type==="error")throw d;if(!d.trashedNote)throw new Error("Trashed note not found");return d.trashedNote}}),u=a.data?.contentAsMarkdown.trim()??"";return e.jsxs(x,{isOpen:!!s,onClose:n,variant:"inspect",children:[e.jsx(x.Header,{title:l,onClose:n}),e.jsx(x.Body,{children:e.jsxs("div",{className:"flex flex-col gap-3",children:[s&&e.jsxs(o,{as:"p",variant:"meta",tone:"secondary",children:["Deleted ",P(s.deletedAt)]}),a.isLoading&&e.jsx(o,{as:"p",variant:"meta",tone:"secondary",children:"Loading deleted note content..."}),a.isError&&e.jsx(o,{as:"p",variant:"meta",tone:"error",children:"Failed to load deleted note content."}),!a.isLoading&&!a.isError&&u&&e.jsx("pre",{className:"max-h-[60vh] overflow-auto whitespace-pre-wrap break-words rounded-[14px] border border-border-subtle bg-hover-subtle/50 px-4 py-3 text-sm leading-6 text-fg-secondary",children:u}),!a.isLoading&&!a.isError&&!u&&e.jsx(o,{as:"p",variant:"meta",tone:"secondary",className:"rounded-[14px] border border-border-subtle bg-hover-subtle/50 px-4 py-3",children:"No readable content was found for this deleted note."})]})}),e.jsx(x.Footer,{children:e.jsx(j,{variant:"ghost",size:"sm",onClick:n,children:"Close"})})]})},te=()=>e.jsx(w,{title:"Trash",variant:"default",heading:e.jsx(i,{width:118,height:24,className:"rounded-full"}),description:e.jsx(i,{width:352,height:16,className:"rounded-full"}),children:e.jsx("div",{className:"grid gap-3",children:Array.from({length:3},(s,n)=>e.jsx(C,{padding:"compact",children:e.jsxs("div",{className:"flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between",children:[e.jsxs("div",{className:"min-w-0 flex-1 space-y-2",children:[e.jsx(i,{width:"40%",height:18,className:"rounded-full"}),e.jsxs("div",{className:"flex flex-wrap gap-2",children:[e.jsx(i,{width:168,height:14,className:"rounded-full"}),e.jsx(i,{width:176,height:14,className:"rounded-full"})]}),e.jsxs("div",{className:"flex flex-wrap gap-2",children:[e.jsx(i,{width:56,height:24,className:"rounded-full"}),e.jsx(i,{width:72,height:24,className:"rounded-full"})]})]}),e.jsx(i,{width:92,height:32,className:"rounded-[12px]"})]})},n))})}),se=()=>{const{page:s}=v.useSearch(),n=v.useNavigate(),h=H(),l=U(),a=M(),[u,d]=E.useState(null),[f,b]=E.useState(null),{data:c}=K({queryKey:y.notes.trash({limit:m,offset:(s-1)*m}),queryFn:async()=>{const t=await W({limit:m,offset:(s-1)*m});if(t.type==="error")throw t;return t.trashedNotes}}),N=k({mutationFn:Y,onSuccess:async t=>{if(t.type==="error")throw t;await L(h),l("The note has been restored."),n({to:X,params:{id:t.restoreTrashedNote.id}})},onError:()=>{l("Failed to restore the note.")}}),p=k({mutationFn:$,onSuccess:async t=>{if(t.type==="error")throw t;await h.invalidateQueries({queryKey:y.notes.trashAll(),exact:!1}),l("The note has been permanently deleted.")},onError:()=>{l("Failed to permanently delete the note.")}}),D=()=>{if(!f)return;const{id:t}=f;b(null),p.mutate(t)},A=async t=>{const r=await V(t);if(r.type==="error"){l("Failed to check linked notes before permanently deleting this note.");return}if(h.setQueryData(y.notes.backReferences(t),r.backReferences),r.backReferences.length>0){b({id:t,backReferences:r.backReferences});return}await a("Permanently delete this note? This cannot be undone.")&&p.mutate(t)},T=c.totalCount>0?`Trash (${c.totalCount})`:void 0,F=c.notes.find(t=>t.id===u)??null;return c.notes.length===0?e.jsx(w,{title:"Trash",variant:"default",heading:T,description:R,children:e.jsx(z,{title:"Trash is empty",description:`Delete a note and you can restore it here for ${S} days before permanent removal`})}):e.jsxs(w,{title:"Trash",variant:"default",heading:T,description:R,children:[e.jsxs("div",{className:"flex flex-col gap-4",children:[e.jsx("div",{className:"grid gap-3",children:c.notes.map(t=>e.jsx(C,{padding:"compact",children:e.jsxs("div",{className:"flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between",children:[e.jsxs("div",{className:"min-w-0 flex-1",children:[e.jsxs("div",{className:"flex min-w-0 items-start gap-1.5",children:[e.jsx(o,{as:"h2",variant:"body",weight:"medium",className:"min-w-0 flex-1 break-words leading-[1.25]",children:t.title||"Untitled note"}),t.pinned&&e.jsx("span",{title:"Pinned",className:"inline-flex h-5 w-5 shrink-0 items-center justify-center text-fg-tertiary",children:e.jsx(_,{className:"h-3.5 w-3.5"})})]}),e.jsx("div",{className:"mt-1 flex flex-wrap items-center gap-x-3 gap-y-1",children:e.jsxs(o,{as:"div",variant:"meta",weight:"medium",tone:"secondary",children:["Deleted ",P(t.deletedAt)]})}),t.tagNames.length>0&&e.jsx("div",{className:"mt-2 flex flex-wrap gap-1.5",children:t.tagNames.map(r=>e.jsx(o,{as:"span",variant:"label",weight:"medium",tone:"tertiary",className:"rounded-full border border-border-subtle bg-hover-subtle px-2 py-0.5",children:r},`${t.id}-${r}`))}),t.contentPreview&&e.jsx("div",{className:"mt-3 rounded-[14px] border border-border-subtle bg-hover-subtle/50 px-3 py-2",children:e.jsx(o,{as:"p",variant:"meta",tone:"secondary",className:"line-clamp-3 whitespace-pre-wrap break-words",children:t.contentPreview})})]}),e.jsxs("div",{className:"flex shrink-0 flex-wrap gap-2 sm:justify-end",children:[e.jsx(j,{variant:"subtle",size:"sm",onClick:()=>d(t.id),children:"View content"}),e.jsx(j,{variant:"subtle",size:"sm",isLoading:N.isPending&&N.variables===t.id,onClick:()=>N.mutate(t.id),children:"Restore"}),e.jsx(j,{variant:"soft-danger",size:"sm",isLoading:p.isPending&&p.variables===t.id,onClick:()=>A(t.id),children:"Delete now"})]})]})},t.id))}),c.totalCount>m&&e.jsx(G,{page:s,last:Math.ceil(c.totalCount/m),onChange:t=>{n({search:r=>({...r,page:t})})}})]}),e.jsx(ee,{note:F,onClose:()=>d(null)}),e.jsx(I,{isOpen:!!f,title:g.title,description:g.description,references:f?.backReferences??[],confirmLabel:g.confirmLabel,confirmVariant:g.confirmVariant,onClose:()=>b(null),onConfirm:D})]})},me=()=>{const{page:s}=v.useSearch();return e.jsx(B,{fallback:e.jsx(te,{}),errorTitle:"Failed to load trash",errorDescription:"Retry loading deleted notes",resetKeys:[s],children:e.jsx(se,{})})};export{me as default};
+import{j as e,r as E}from"./floating-ui.react-dom-BWTnA00G.js";import{u as M,b as k,i as L,m as _,N as I,d as Q,a as q}from"./useNoteMutate-BQj6jHhV.js";import{Q as B,k as O,u as H,l as K,m as W,q as y,r as Y,p as $,P as w,E as z,T as o,B as j,n as G,o as i,e as U,t as V,v as Z,M as x}from"./time-Kh6oav5R.js";import{S as C}from"./SurfaceCard-zdJ8k1o0.js";import{a as J,N as X}from"./url-Bp8sXMb4.js";import"./NotePropertiesPanel-BFWjxL_w.js";import"./AuxiliaryPanelHeader-Bys98BJJ.js";import"./LinkSimple.es-iJvLf-MB.js";import"./Plus.es-Dmb3oijD.js";const m=25,v=O(J),S=30,R=`Deleted notes stay here for ${S} days before permanent removal`,g={title:"Permanently delete note?",description:"This note is referenced by the notes below. If you permanently delete it, those links will stay broken. Other notes will not be edited automatically.",confirmLabel:"Delete now",confirmVariant:"danger"},P=s=>Q(s).format("YYYY-MM-DD HH:mm"),ee=({note:s,onClose:n})=>{const h=s?.id??"",l=s?.title||"Untitled note",a=q({queryKey:y.notes.trashDetail(h),enabled:!!s,queryFn:async()=>{const d=await Z(h);if(d.type==="error")throw d;if(!d.trashedNote)throw new Error("Trashed note not found");return d.trashedNote}}),u=a.data?.contentAsMarkdown.trim()??"";return e.jsxs(x,{isOpen:!!s,onClose:n,variant:"inspect",children:[e.jsx(x.Header,{title:l,onClose:n}),e.jsx(x.Body,{children:e.jsxs("div",{className:"flex flex-col gap-3",children:[s&&e.jsxs(o,{as:"p",variant:"meta",tone:"secondary",children:["Deleted ",P(s.deletedAt)]}),a.isLoading&&e.jsx(o,{as:"p",variant:"meta",tone:"secondary",children:"Loading deleted note content..."}),a.isError&&e.jsx(o,{as:"p",variant:"meta",tone:"error",children:"Failed to load deleted note content."}),!a.isLoading&&!a.isError&&u&&e.jsx("pre",{className:"max-h-[60vh] overflow-auto whitespace-pre-wrap break-words rounded-[14px] border border-border-subtle bg-hover-subtle/50 px-4 py-3 text-sm leading-6 text-fg-secondary",children:u}),!a.isLoading&&!a.isError&&!u&&e.jsx(o,{as:"p",variant:"meta",tone:"secondary",className:"rounded-[14px] border border-border-subtle bg-hover-subtle/50 px-4 py-3",children:"No readable content was found for this deleted note."})]})}),e.jsx(x.Footer,{children:e.jsx(j,{variant:"ghost",size:"sm",onClick:n,children:"Close"})})]})},te=()=>e.jsx(w,{title:"Trash",variant:"default",heading:e.jsx(i,{width:118,height:24,className:"rounded-full"}),description:e.jsx(i,{width:352,height:16,className:"rounded-full"}),children:e.jsx("div",{className:"grid gap-3",children:Array.from({length:3},(s,n)=>e.jsx(C,{padding:"compact",children:e.jsxs("div",{className:"flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between",children:[e.jsxs("div",{className:"min-w-0 flex-1 space-y-2",children:[e.jsx(i,{width:"40%",height:18,className:"rounded-full"}),e.jsxs("div",{className:"flex flex-wrap gap-2",children:[e.jsx(i,{width:168,height:14,className:"rounded-full"}),e.jsx(i,{width:176,height:14,className:"rounded-full"})]}),e.jsxs("div",{className:"flex flex-wrap gap-2",children:[e.jsx(i,{width:56,height:24,className:"rounded-full"}),e.jsx(i,{width:72,height:24,className:"rounded-full"})]})]}),e.jsx(i,{width:92,height:32,className:"rounded-[12px]"})]})},n))})}),se=()=>{const{page:s}=v.useSearch(),n=v.useNavigate(),h=H(),l=U(),a=M(),[u,d]=E.useState(null),[f,b]=E.useState(null),{data:c}=K({queryKey:y.notes.trash({limit:m,offset:(s-1)*m}),queryFn:async()=>{const t=await W({limit:m,offset:(s-1)*m});if(t.type==="error")throw t;return t.trashedNotes}}),N=k({mutationFn:Y,onSuccess:async t=>{if(t.type==="error")throw t;await L(h),l("The note has been restored."),n({to:X,params:{id:t.restoreTrashedNote.id}})},onError:()=>{l("Failed to restore the note.")}}),p=k({mutationFn:$,onSuccess:async t=>{if(t.type==="error")throw t;await h.invalidateQueries({queryKey:y.notes.trashAll(),exact:!1}),l("The note has been permanently deleted.")},onError:()=>{l("Failed to permanently delete the note.")}}),D=()=>{if(!f)return;const{id:t}=f;b(null),p.mutate(t)},A=async t=>{const r=await V(t);if(r.type==="error"){l("Failed to check linked notes before permanently deleting this note.");return}if(h.setQueryData(y.notes.backReferences(t),r.backReferences),r.backReferences.length>0){b({id:t,backReferences:r.backReferences});return}await a("Permanently delete this note? This cannot be undone.")&&p.mutate(t)},T=c.totalCount>0?`Trash (${c.totalCount})`:void 0,F=c.notes.find(t=>t.id===u)??null;return c.notes.length===0?e.jsx(w,{title:"Trash",variant:"default",heading:T,description:R,children:e.jsx(z,{title:"Trash is empty",description:`Delete a note and you can restore it here for ${S} days before permanent removal`})}):e.jsxs(w,{title:"Trash",variant:"default",heading:T,description:R,children:[e.jsxs("div",{className:"flex flex-col gap-4",children:[e.jsx("div",{className:"grid gap-3",children:c.notes.map(t=>e.jsx(C,{padding:"compact",children:e.jsxs("div",{className:"flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between",children:[e.jsxs("div",{className:"min-w-0 flex-1",children:[e.jsxs("div",{className:"flex min-w-0 items-start gap-1.5",children:[e.jsx(o,{as:"h2",variant:"body",weight:"medium",className:"min-w-0 flex-1 break-words leading-[1.25]",children:t.title||"Untitled note"}),t.pinned&&e.jsx("span",{title:"Pinned",className:"inline-flex h-5 w-5 shrink-0 items-center justify-center text-fg-tertiary",children:e.jsx(_,{className:"h-3.5 w-3.5"})})]}),e.jsx("div",{className:"mt-1 flex flex-wrap items-center gap-x-3 gap-y-1",children:e.jsxs(o,{as:"div",variant:"meta",weight:"medium",tone:"secondary",children:["Deleted ",P(t.deletedAt)]})}),t.tagNames.length>0&&e.jsx("div",{className:"mt-2 flex flex-wrap gap-1.5",children:t.tagNames.map(r=>e.jsx(o,{as:"span",variant:"label",weight:"medium",tone:"tertiary",className:"rounded-full border border-border-subtle bg-hover-subtle px-2 py-0.5",children:r},`${t.id}-${r}`))}),t.contentPreview&&e.jsx("div",{className:"mt-3 rounded-[14px] border border-border-subtle bg-hover-subtle/50 px-3 py-2",children:e.jsx(o,{as:"p",variant:"meta",tone:"secondary",className:"line-clamp-3 whitespace-pre-wrap break-words",children:t.contentPreview})})]}),e.jsxs("div",{className:"flex shrink-0 flex-wrap gap-2 sm:justify-end",children:[e.jsx(j,{variant:"subtle",size:"sm",onClick:()=>d(t.id),children:"View content"}),e.jsx(j,{variant:"subtle",size:"sm",isLoading:N.isPending&&N.variables===t.id,onClick:()=>N.mutate(t.id),children:"Restore"}),e.jsx(j,{variant:"soft-danger",size:"sm",isLoading:p.isPending&&p.variables===t.id,onClick:()=>A(t.id),children:"Delete now"})]})]})},t.id))}),c.totalCount>m&&e.jsx(G,{page:s,last:Math.ceil(c.totalCount/m),onChange:t=>{n({search:r=>({...r,page:t})})}})]}),e.jsx(ee,{note:F,onClose:()=>d(null)}),e.jsx(I,{isOpen:!!f,title:g.title,description:g.description,references:f?.backReferences??[],confirmLabel:g.confirmLabel,confirmVariant:g.confirmVariant,onClose:()=>b(null),onConfirm:D})]})},me=()=>{const{page:s}=v.useSearch();return e.jsx(B,{fallback:e.jsx(te,{}),errorTitle:"Failed to load trash",errorDescription:"Retry loading deleted notes",resetKeys:[s],children:e.jsx(se,{})})};export{me as default};

package/server/client/dist/assets/{useNoteMutate-D-mZKXjl.js → useNoteMutate-BQj6jHhV.js}

@@ -1,4 +1,4 @@
-import{t as o3,v as v3,g as O4,r,j as vl}from"./floating-ui.react-dom-BWTnA00G.js";import{ah as r3,ai as g3,aj as b4,ak as S3,al as H4,ae as b3,aa as A3,u as U4,am as M3,an as E3,A as Ja,ao as z3,q as hl,z as T3,M as zu,T as sc,B as mc,D as p3,ap as D3,m as O3,aq as H3,ar as U3,e as _3,as as N3}from"./time-BwwQGbK-.js";import{N as _4}from"./url-Bp8sXMb4.js";var hc={exports:{}},Tu={},dc={exports:{}},yc={};var A4;function Z3(){return A4||(A4=1,(function(d){function T(m,A){var z=m.length;m.push(A);l:for(;0<z;){var D=z-1>>>1,O=m[D];if(0<G(O,A))m[D]=A,m[z]=O,z=D;else break l}}function R(m){return m.length===0?null:m[0]}function v(m){if(m.length===0)return null;var A=m[0],z=m.pop();if(z!==A){m[0]=z;l:for(var D=0,O=m.length,L=O>>>1;D<L;){var B=2*(D+1)-1,C=m[B],J=B+1,ol=m[J];if(0>G(C,z))J<O&&0>G(ol,C)?(m[D]=ol,m[J]=z,D=J):(m[D]=C,m[B]=z,D=B);else if(J<O&&0>G(ol,z))m[D]=ol,m[J]=z,D=J;else break l}}return A}function G(m,A){var z=m.sortIndex-A.sortIndex;return z!==0?z:m.id-A.id}if(d.unstable_now=void 0,typeof performance=="object"&&typeof performance.now=="function"){var nl=performance;d.unstable_now=function(){return nl.now()}}else{var Sl=Date,_l=Sl.now();d.unstable_now=function(){return Sl.now()-_l}}var cl=[],il=[],mt=1,U=null,$=3,I=!1,dl=!1,Nl=!1,kl=!1,It=typeof setTimeout=="function"?setTimeout:null,Ta=typeof clearTimeout=="function"?clearTimeout:null,Rl=typeof setImmediate<"u"?setImmediate:null;function Ot(m){for(var A=R(il);A!==null;){if(A.callback===null)v(il);else if(A.startTime<=m)v(il),A.sortIndex=A.expirationTime,T(cl,A);else break;A=R(il)}}function Il(m){if(Nl=!1,Ot(m),!dl)if(R(cl)!==null)dl=!0,Dl||(Dl=!0,Zl());else{var A=R(il);A!==null&&p(Il,A.startTime-m)}}var Dl=!1,ht=-1,Ql=5,zt=-1;function yl(){return kl?!0:!(d.unstable_now()-zt<Ql)}function K(){if(kl=!1,Dl){var m=d.unstable_now();zt=m;var A=!0;try{l:{dl=!1,Nl&&(Nl=!1,Ta(ht),ht=-1),I=!0;var z=$;try{t:{for(Ot(m),U=R(cl);U!==null&&!(U.expirationTime>m&&yl());){var D=U.callback;if(typeof D=="function"){U.callback=null,$=U.priorityLevel;var O=D(U.expirationTime<=m);if(m=d.unstable_now(),typeof O=="function"){U.callback=O,Ot(m),A=!0;break t}U===R(cl)&&v(cl),Ot(m)}else v(cl);U=R(cl)}if(U!==null)A=!0;else{var L=R(il);L!==null&&p(Il,L.startTime-m),A=!1}}break l}finally{U=null,$=z,I=!1}A=void 0}}finally{A?Zl():Dl=!1}}}var Zl;if(typeof Rl=="function")Zl=function(){Rl(K)};else if(typeof MessageChannel<"u"){var pa=new MessageChannel,q=pa.port2;pa.port1.onmessage=K,Zl=function(){q.postMessage(null)}}else Zl=function(){It(K,0)};function p(m,A){ht=It(function(){m(d.unstable_now())},A)}d.unstable_IdlePriority=5,d.unstable_ImmediatePriority=1,d.unstable_LowPriority=4,d.unstable_NormalPriority=3,d.unstable_Profiling=null,d.unstable_UserBlockingPriority=2,d.unstable_cancelCallback=function(m){m.callback=null},d.unstable_forceFrameRate=function(m){0>m||125<m?console.error("forceFrameRate takes a positive int between 0 and 125, forcing frame rates higher than 125 fps is not supported"):Ql=0<m?Math.floor(1e3/m):5},d.unstable_getCurrentPriorityLevel=function(){return $},d.unstable_next=function(m){switch($){case 1:case 2:case 3:var A=3;break;default:A=$}var z=$;$=A;try{return m()}finally{$=z}},d.unstable_requestPaint=function(){kl=!0},d.unstable_runWithPriority=function(m,A){switch(m){case 1:case 2:case 3:case 4:case 5:break;default:m=3}var z=$;$=m;try{return A()}finally{$=z}},d.unstable_scheduleCallback=function(m,A,z){var D=d.unstable_now();switch(typeof z=="object"&&z!==null?(z=z.delay,z=typeof z=="number"&&0<z?D+z:D):z=D,m){case 1:var O=-1;break;case 2:O=250;break;case 5:O=1073741823;break;case 4:O=1e4;break;default:O=5e3}return O=z+O,m={id:mt++,callback:A,priorityLevel:m,startTime:z,expirationTime:O,sortIndex:-1},z>D?(m.sortIndex=z,T(il,m),R(cl)===null&&m===R(il)&&(Nl?(Ta(ht),ht=-1):Nl=!0,p(Il,z-D))):(m.sortIndex=O,T(cl,m),dl||I||(dl=!0,Dl||(Dl=!0,Zl()))),m},d.unstable_shouldYield=yl,d.unstable_wrapCallback=function(m){var A=$;return function(){var z=$;$=A;try{return m.apply(this,arguments)}finally{$=z}}}})(yc)),yc}var M4;function q3(){return M4||(M4=1,dc.exports=Z3()),dc.exports}var E4;function C3(){if(E4)return Tu;E4=1;var d=q3(),T=o3(),R=v3();function v(l){var t="https://react.dev/errors/"+l;if(1<arguments.length){t+="?args[]="+encodeURIComponent(arguments[1]);for(var a=2;a<arguments.length;a++)t+="&args[]="+encodeURIComponent(arguments[a])}return"Minified React error #"+l+"; visit "+t+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}function G(l){return!(!l||l.nodeType!==1&&l.nodeType!==9&&l.nodeType!==11)}function nl(l){var t=l,a=l;if(l.alternate)for(;t.return;)t=t.return;else{l=t;do t=l,(t.flags&4098)!==0&&(a=t.return),l=t.return;while(l)}return t.tag===3?a:null}function Sl(l){if(l.tag===13){var t=l.memoizedState;if(t===null&&(l=l.alternate,l!==null&&(t=l.memoizedState)),t!==null)return t.dehydrated}return null}function _l(l){if(l.tag===31){var t=l.memoizedState;if(t===null&&(l=l.alternate,l!==null&&(t=l.memoizedState)),t!==null)return t.dehydrated}return null}function cl(l){if(nl(l)!==l)throw Error(v(188))}function il(l){var t=l.alternate;if(!t){if(t=nl(l),t===null)throw Error(v(188));return t!==l?null:l}for(var a=l,e=t;;){var u=a.return;if(u===null)break;var n=u.alternate;if(n===null){if(e=u.return,e!==null){a=e;continue}break}if(u.child===n.child){for(n=u.child;n;){if(n===a)return cl(u),l;if(n===e)return cl(u),t;n=n.sibling}throw Error(v(188))}if(a.return!==e.return)a=u,e=n;else{for(var c=!1,i=u.child;i;){if(i===a){c=!0,a=u,e=n;break}if(i===e){c=!0,e=u,a=n;break}i=i.sibling}if(!c){for(i=n.child;i;){if(i===a){c=!0,a=n,e=u;break}if(i===e){c=!0,e=n,a=u;break}i=i.sibling}if(!c)throw Error(v(189))}}if(a.alternate!==e)throw Error(v(190))}if(a.tag!==3)throw Error(v(188));return a.stateNode.current===a?l:t}function mt(l){var t=l.tag;if(t===5||t===26||t===27||t===6)return l;for(l=l.child;l!==null;){if(t=mt(l),t!==null)return t;l=l.sibling}return null}var U=Object.assign,$=Symbol.for("react.element"),I=Symbol.for("react.transitional.element"),dl=Symbol.for("react.portal"),Nl=Symbol.for("react.fragment"),kl=Symbol.for("react.strict_mode"),It=Symbol.for("react.profiler"),Ta=Symbol.for("react.consumer"),Rl=Symbol.for("react.context"),Ot=Symbol.for("react.forward_ref"),Il=Symbol.for("react.suspense"),Dl=Symbol.for("react.suspense_list"),ht=Symbol.for("react.memo"),Ql=Symbol.for("react.lazy"),zt=Symbol.for("react.activity"),yl=Symbol.for("react.memo_cache_sentinel"),K=Symbol.iterator;function Zl(l){return l===null||typeof l!="object"?null:(l=K&&l[K]||l["@@iterator"],typeof l=="function"?l:null)}var pa=Symbol.for("react.client.reference");function q(l){if(l==null)return null;if(typeof l=="function")return l.$$typeof===pa?null:l.displayName||l.name||null;if(typeof l=="string")return l;switch(l){case Nl:return"Fragment";case It:return"Profiler";case kl:return"StrictMode";case Il:return"Suspense";case Dl:return"SuspenseList";case zt:return"Activity"}if(typeof l=="object")switch(l.$$typeof){case dl:return"Portal";case Rl:return l.displayName||"Context";case Ta:return(l._context.displayName||"Context")+".Consumer";case Ot:var t=l.render;return l=l.displayName,l||(l=t.displayName||t.name||"",l=l!==""?"ForwardRef("+l+")":"ForwardRef"),l;case ht:return t=l.displayName||null,t!==null?t:q(l.type)||"Memo";case Ql:t=l._payload,l=l._init;try{return q(l(t))}catch{}}return null}var p=Array.isArray,m=T.__CLIENT_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE,A=R.__DOM_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE,z={pending:!1,data:null,method:null,action:null},D=[],O=-1;function L(l){return{current:l}}function B(l){0>O||(l.current=D[O],D[O]=null,O--)}function C(l,t){O++,D[O]=l.current,l.current=t}var J=L(null),ol=L(null),jl=L(null),dt=L(null);function Ht(l,t){switch(C(jl,t),C(ol,l),C(J,null),t.nodeType){case 9:case 11:l=(l=t.documentElement)&&(l=l.namespaceURI)?G2(l):0;break;default:if(l=t.tagName,t=t.namespaceURI)t=G2(t),l=X2(t,l);else switch(l){case"svg":l=1;break;case"math":l=2;break;default:l=0}}B(J),C(J,l)}function Gl(){B(J),B(ol),B(jl)}function Ol(l){l.memoizedState!==null&&C(dt,l);var t=J.current,a=X2(t,l.type);t!==a&&(C(ol,l),C(J,a))}function Pl(l){ol.current===l&&(B(J),B(ol)),dt.current===l&&(B(dt),bu._currentValue=z)}var qt,Da;function Oa(l){if(qt===void 0)try{throw Error()}catch(a){var t=a.stack.trim().match(/\n( *(at )?)/);qt=t&&t[1]||"",Da=-1<a.stack.indexOf(`
+import{t as o3,v as v3,g as O4,r,j as vl}from"./floating-ui.react-dom-BWTnA00G.js";import{ak as r3,al as g3,am as b4,an as S3,ao as H4,ah as b3,ad as A3,u as U4,ap as M3,aq as E3,C as Ja,ar as z3,q as hl,A as T3,M as zu,T as sc,B as mc,F as p3,Y as D3,t as O3,as as H3,at as U3,e as _3,au as N3}from"./time-Kh6oav5R.js";import{N as _4}from"./url-Bp8sXMb4.js";var hc={exports:{}},Tu={},dc={exports:{}},yc={};var A4;function Z3(){return A4||(A4=1,(function(d){function T(m,A){var z=m.length;m.push(A);l:for(;0<z;){var D=z-1>>>1,O=m[D];if(0<G(O,A))m[D]=A,m[z]=O,z=D;else break l}}function R(m){return m.length===0?null:m[0]}function v(m){if(m.length===0)return null;var A=m[0],z=m.pop();if(z!==A){m[0]=z;l:for(var D=0,O=m.length,L=O>>>1;D<L;){var B=2*(D+1)-1,C=m[B],J=B+1,ol=m[J];if(0>G(C,z))J<O&&0>G(ol,C)?(m[D]=ol,m[J]=z,D=J):(m[D]=C,m[B]=z,D=B);else if(J<O&&0>G(ol,z))m[D]=ol,m[J]=z,D=J;else break l}}return A}function G(m,A){var z=m.sortIndex-A.sortIndex;return z!==0?z:m.id-A.id}if(d.unstable_now=void 0,typeof performance=="object"&&typeof performance.now=="function"){var nl=performance;d.unstable_now=function(){return nl.now()}}else{var Sl=Date,_l=Sl.now();d.unstable_now=function(){return Sl.now()-_l}}var cl=[],il=[],mt=1,U=null,$=3,I=!1,dl=!1,Nl=!1,kl=!1,It=typeof setTimeout=="function"?setTimeout:null,Ta=typeof clearTimeout=="function"?clearTimeout:null,Rl=typeof setImmediate<"u"?setImmediate:null;function Ot(m){for(var A=R(il);A!==null;){if(A.callback===null)v(il);else if(A.startTime<=m)v(il),A.sortIndex=A.expirationTime,T(cl,A);else break;A=R(il)}}function Il(m){if(Nl=!1,Ot(m),!dl)if(R(cl)!==null)dl=!0,Dl||(Dl=!0,Zl());else{var A=R(il);A!==null&&p(Il,A.startTime-m)}}var Dl=!1,ht=-1,Ql=5,zt=-1;function yl(){return kl?!0:!(d.unstable_now()-zt<Ql)}function K(){if(kl=!1,Dl){var m=d.unstable_now();zt=m;var A=!0;try{l:{dl=!1,Nl&&(Nl=!1,Ta(ht),ht=-1),I=!0;var z=$;try{t:{for(Ot(m),U=R(cl);U!==null&&!(U.expirationTime>m&&yl());){var D=U.callback;if(typeof D=="function"){U.callback=null,$=U.priorityLevel;var O=D(U.expirationTime<=m);if(m=d.unstable_now(),typeof O=="function"){U.callback=O,Ot(m),A=!0;break t}U===R(cl)&&v(cl),Ot(m)}else v(cl);U=R(cl)}if(U!==null)A=!0;else{var L=R(il);L!==null&&p(Il,L.startTime-m),A=!1}}break l}finally{U=null,$=z,I=!1}A=void 0}}finally{A?Zl():Dl=!1}}}var Zl;if(typeof Rl=="function")Zl=function(){Rl(K)};else if(typeof MessageChannel<"u"){var pa=new MessageChannel,q=pa.port2;pa.port1.onmessage=K,Zl=function(){q.postMessage(null)}}else Zl=function(){It(K,0)};function p(m,A){ht=It(function(){m(d.unstable_now())},A)}d.unstable_IdlePriority=5,d.unstable_ImmediatePriority=1,d.unstable_LowPriority=4,d.unstable_NormalPriority=3,d.unstable_Profiling=null,d.unstable_UserBlockingPriority=2,d.unstable_cancelCallback=function(m){m.callback=null},d.unstable_forceFrameRate=function(m){0>m||125<m?console.error("forceFrameRate takes a positive int between 0 and 125, forcing frame rates higher than 125 fps is not supported"):Ql=0<m?Math.floor(1e3/m):5},d.unstable_getCurrentPriorityLevel=function(){return $},d.unstable_next=function(m){switch($){case 1:case 2:case 3:var A=3;break;default:A=$}var z=$;$=A;try{return m()}finally{$=z}},d.unstable_requestPaint=function(){kl=!0},d.unstable_runWithPriority=function(m,A){switch(m){case 1:case 2:case 3:case 4:case 5:break;default:m=3}var z=$;$=m;try{return A()}finally{$=z}},d.unstable_scheduleCallback=function(m,A,z){var D=d.unstable_now();switch(typeof z=="object"&&z!==null?(z=z.delay,z=typeof z=="number"&&0<z?D+z:D):z=D,m){case 1:var O=-1;break;case 2:O=250;break;case 5:O=1073741823;break;case 4:O=1e4;break;default:O=5e3}return O=z+O,m={id:mt++,callback:A,priorityLevel:m,startTime:z,expirationTime:O,sortIndex:-1},z>D?(m.sortIndex=z,T(il,m),R(cl)===null&&m===R(il)&&(Nl?(Ta(ht),ht=-1):Nl=!0,p(Il,z-D))):(m.sortIndex=O,T(cl,m),dl||I||(dl=!0,Dl||(Dl=!0,Zl()))),m},d.unstable_shouldYield=yl,d.unstable_wrapCallback=function(m){var A=$;return function(){var z=$;$=A;try{return m.apply(this,arguments)}finally{$=z}}}})(yc)),yc}var M4;function q3(){return M4||(M4=1,dc.exports=Z3()),dc.exports}var E4;function C3(){if(E4)return Tu;E4=1;var d=q3(),T=o3(),R=v3();function v(l){var t="https://react.dev/errors/"+l;if(1<arguments.length){t+="?args[]="+encodeURIComponent(arguments[1]);for(var a=2;a<arguments.length;a++)t+="&args[]="+encodeURIComponent(arguments[a])}return"Minified React error #"+l+"; visit "+t+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}function G(l){return!(!l||l.nodeType!==1&&l.nodeType!==9&&l.nodeType!==11)}function nl(l){var t=l,a=l;if(l.alternate)for(;t.return;)t=t.return;else{l=t;do t=l,(t.flags&4098)!==0&&(a=t.return),l=t.return;while(l)}return t.tag===3?a:null}function Sl(l){if(l.tag===13){var t=l.memoizedState;if(t===null&&(l=l.alternate,l!==null&&(t=l.memoizedState)),t!==null)return t.dehydrated}return null}function _l(l){if(l.tag===31){var t=l.memoizedState;if(t===null&&(l=l.alternate,l!==null&&(t=l.memoizedState)),t!==null)return t.dehydrated}return null}function cl(l){if(nl(l)!==l)throw Error(v(188))}function il(l){var t=l.alternate;if(!t){if(t=nl(l),t===null)throw Error(v(188));return t!==l?null:l}for(var a=l,e=t;;){var u=a.return;if(u===null)break;var n=u.alternate;if(n===null){if(e=u.return,e!==null){a=e;continue}break}if(u.child===n.child){for(n=u.child;n;){if(n===a)return cl(u),l;if(n===e)return cl(u),t;n=n.sibling}throw Error(v(188))}if(a.return!==e.return)a=u,e=n;else{for(var c=!1,i=u.child;i;){if(i===a){c=!0,a=u,e=n;break}if(i===e){c=!0,e=u,a=n;break}i=i.sibling}if(!c){for(i=n.child;i;){if(i===a){c=!0,a=n,e=u;break}if(i===e){c=!0,e=n,a=u;break}i=i.sibling}if(!c)throw Error(v(189))}}if(a.alternate!==e)throw Error(v(190))}if(a.tag!==3)throw Error(v(188));return a.stateNode.current===a?l:t}function mt(l){var t=l.tag;if(t===5||t===26||t===27||t===6)return l;for(l=l.child;l!==null;){if(t=mt(l),t!==null)return t;l=l.sibling}return null}var U=Object.assign,$=Symbol.for("react.element"),I=Symbol.for("react.transitional.element"),dl=Symbol.for("react.portal"),Nl=Symbol.for("react.fragment"),kl=Symbol.for("react.strict_mode"),It=Symbol.for("react.profiler"),Ta=Symbol.for("react.consumer"),Rl=Symbol.for("react.context"),Ot=Symbol.for("react.forward_ref"),Il=Symbol.for("react.suspense"),Dl=Symbol.for("react.suspense_list"),ht=Symbol.for("react.memo"),Ql=Symbol.for("react.lazy"),zt=Symbol.for("react.activity"),yl=Symbol.for("react.memo_cache_sentinel"),K=Symbol.iterator;function Zl(l){return l===null||typeof l!="object"?null:(l=K&&l[K]||l["@@iterator"],typeof l=="function"?l:null)}var pa=Symbol.for("react.client.reference");function q(l){if(l==null)return null;if(typeof l=="function")return l.$$typeof===pa?null:l.displayName||l.name||null;if(typeof l=="string")return l;switch(l){case Nl:return"Fragment";case It:return"Profiler";case kl:return"StrictMode";case Il:return"Suspense";case Dl:return"SuspenseList";case zt:return"Activity"}if(typeof l=="object")switch(l.$$typeof){case dl:return"Portal";case Rl:return l.displayName||"Context";case Ta:return(l._context.displayName||"Context")+".Consumer";case Ot:var t=l.render;return l=l.displayName,l||(l=t.displayName||t.name||"",l=l!==""?"ForwardRef("+l+")":"ForwardRef"),l;case ht:return t=l.displayName||null,t!==null?t:q(l.type)||"Memo";case Ql:t=l._payload,l=l._init;try{return q(l(t))}catch{}}return null}var p=Array.isArray,m=T.__CLIENT_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE,A=R.__DOM_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE,z={pending:!1,data:null,method:null,action:null},D=[],O=-1;function L(l){return{current:l}}function B(l){0>O||(l.current=D[O],D[O]=null,O--)}function C(l,t){O++,D[O]=l.current,l.current=t}var J=L(null),ol=L(null),jl=L(null),dt=L(null);function Ht(l,t){switch(C(jl,t),C(ol,l),C(J,null),t.nodeType){case 9:case 11:l=(l=t.documentElement)&&(l=l.namespaceURI)?G2(l):0;break;default:if(l=t.tagName,t=t.namespaceURI)t=G2(t),l=X2(t,l);else switch(l){case"svg":l=1;break;case"math":l=2;break;default:l=0}}B(J),C(J,l)}function Gl(){B(J),B(ol),B(jl)}function Ol(l){l.memoizedState!==null&&C(dt,l);var t=J.current,a=X2(t,l.type);t!==a&&(C(ol,l),C(J,a))}function Pl(l){ol.current===l&&(B(J),B(ol)),dt.current===l&&(B(dt),bu._currentValue=z)}var qt,Da;function Oa(l){if(qt===void 0)try{throw Error()}catch(a){var t=a.stack.trim().match(/\n( *(at )?)/);qt=t&&t[1]||"",Da=-1<a.stack.indexOf(`
     at`)?" (<anonymous>)":-1<a.stack.indexOf("@")?"@unknown:0:0":""}return`
 `+qt+l+Da}var Jn=!1;function wn(l,t){if(!l||Jn)return"";Jn=!0;var a=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{var e={DetermineComponentFrameRoot:function(){try{if(t){var E=function(){throw Error()};if(Object.defineProperty(E.prototype,"props",{set:function(){throw Error()}}),typeof Reflect=="object"&&Reflect.construct){try{Reflect.construct(E,[])}catch(S){var g=S}Reflect.construct(l,[],E)}else{try{E.call()}catch(S){g=S}l.call(E.prototype)}}else{try{throw Error()}catch(S){g=S}(E=l())&&typeof E.catch=="function"&&E.catch(function(){})}}catch(S){if(S&&g&&typeof S.stack=="string")return[S.stack,g.stack]}return[null,null]}};e.DetermineComponentFrameRoot.displayName="DetermineComponentFrameRoot";var u=Object.getOwnPropertyDescriptor(e.DetermineComponentFrameRoot,"name");u&&u.configurable&&Object.defineProperty(e.DetermineComponentFrameRoot,"name",{value:"DetermineComponentFrameRoot"});var n=e.DetermineComponentFrameRoot(),c=n[0],i=n[1];if(c&&i){var f=c.split(`
 `),o=i.split(`

package/server/client/dist/assets/{useReminderMutate-Cexk1ydX.js → useReminderMutate-jubqwSD9.js}

@@ -1,4 +1,4 @@
-import{r as u,j as r}from"./floating-ui.react-dom-BWTnA00G.js";import{d as C,M as F}from"./useNoteMutate-D-mZKXjl.js";import{g as p,M as f,L as h,I as w,d as N,a as S,b as v,T as $,B as R,u as q,q as b,e as A}from"./time-BwwQGbK-.js";const I=(e={})=>({limit:e.limit??10,offset:e.offset??0}),y=`
+import{r as u,j as r}from"./floating-ui.react-dom-BWTnA00G.js";import{d as C,M as F}from"./useNoteMutate-BQj6jHhV.js";import{g as p,M as f,L as h,I as w,d as N,a as S,b as v,T as $,B as R,u as q,q as b,e as A}from"./time-Kh6oav5R.js";const I=(e={})=>({limit:e.limit??10,offset:e.offset??0}),y=`
     totalCount
     reminders {
         id

package/server/client/dist/index.html

@@ -8,14 +8,14 @@
     <link rel="icon" type="image/png" href="/icon.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Ocean Brain</title>
-  <script type="module" crossorigin src="/assets/app-DzChh-V0.js"></script>
+  <script type="module" crossorigin src="/assets/app-OGsLwSqJ.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/floating-ui.react-dom-BWTnA00G.js">
   <link rel="modulepreload" crossorigin href="/assets/url-Bp8sXMb4.js">
-  <link rel="modulepreload" crossorigin href="/assets/time-BwwQGbK-.js">
-  <link rel="modulepreload" crossorigin href="/assets/useNoteMutate-D-mZKXjl.js">
+  <link rel="modulepreload" crossorigin href="/assets/time-Kh6oav5R.js">
+  <link rel="modulepreload" crossorigin href="/assets/useNoteMutate-BQj6jHhV.js">
   <link rel="modulepreload" crossorigin href="/assets/preload-helper-BXl3LOEh.js">
-  <link rel="modulepreload" crossorigin href="/assets/Graph-BNoSRJP3.js">
-  <link rel="stylesheet" crossorigin href="/assets/app-Bcl0U7r9.css">
+  <link rel="modulepreload" crossorigin href="/assets/Graph-BaqGi3M7.js">
+  <link rel="stylesheet" crossorigin href="/assets/app-yYMsgUrz.css">
 </head>
 
 <body>

package/server/dist/app.js

@@ -4,6 +4,7 @@ import fastifyFormbody from "@fastify/formbody";
 import fastifyRateLimit from "@fastify/rate-limit";
 import fastifySession from "@fastify/session";
 import Fastify from "fastify";
+import { createDatabaseAppGatewayOptions } from "./features/app-gateway/database.js";
 import { createIntegrationService } from "./features/integration/service.js";
 import { createMcpAdminService } from "./features/mcp-admin/service.js";
 import { purgeExpiredNoteSnapshots } from "./features/note/services/snapshot.js";
@@ -11,7 +12,13 @@ import { purgeExpiredTrashedNotes } from "./features/note/services/trash.js";
 import { closeDefaultSemanticSearchManager } from "./features/search/search-manager.js";
 import { createAppError, createErrorHandler } from "./modules/error-handler.js";
 import { AUTH_SESSION_IDLE_TIMEOUT_MS, createSessionStore } from "./modules/session-store.js";
-import { createApiRouter, createAuthPagesRouter, createClientRouter, createGraphqlRouter } from "./routes/index.js";
+import {
+  createApiRouter,
+  createAppGatewayRouter,
+  createAuthPagesRouter,
+  createClientRouter,
+  createGraphqlRouter
+} from "./routes/index.js";
 const MAX_REQUEST_BODY_BYTES = 50 * 1024 * 1024;
 const isHttpLoggerEnabled = (loggerOption) => loggerOption ?? process.env.OCEAN_BRAIN_HTTP_LOG?.toLowerCase() !== "false";
 const createLoggerOptions = () => ({
@@ -99,6 +106,7 @@ const createAppWithMcpAuth = (authConfig, mcpAdminService, options = {}) => {
   });
   registerRequestInfrastructure(app, authConfig);
   app.setErrorHandler(createErrorHandler(authConfig));
+  app.register(createAppGatewayRouter(authConfig, options.appGateway ?? createDatabaseAppGatewayOptions()));
   app.register(createApiRouter(authConfig, mcpAdminService), { prefix: "/api" });
   app.register(createAuthPagesRouter(authConfig));
   app.register(createGraphqlRouter(authConfig, mcpAdminService));

package/server/dist/features/app-gateway/access.js

@@ -0,0 +1,73 @@
+import { createHash, randomBytes } from "node:crypto";
+const APP_GATEWAY_ACCESS_PROTOCOL_PREFIX = "ocean-brain.access.";
+const APP_GATEWAY_ACCESS_COOKIE_NAME = "ocean-brain.app-access";
+const APP_GATEWAY_ACCESS_HEADER = "x-ocean-brain-app-access";
+const APP_GATEWAY_PROTOCOL = "ocean-brain.app";
+const APP_GATEWAY_ACCESS_TTL_MS = 5 * 60 * 1e3;
+const MAX_ACTIVE_ACCESS_TOKENS = 1024;
+const hashToken = (token) => createHash("sha256").update(token, "utf8").digest("hex");
+const extractAppGatewayAccessToken = (protocolHeader) => {
+  const protocols = (Array.isArray(protocolHeader) ? protocolHeader.join(",") : protocolHeader ?? "").split(",").map((protocol) => protocol.trim());
+  const accessProtocol = protocols.find((protocol) => protocol.startsWith(APP_GATEWAY_ACCESS_PROTOCOL_PREFIX));
+  const token = accessProtocol?.slice(APP_GATEWAY_ACCESS_PROTOCOL_PREFIX.length);
+  return token || void 0;
+};
+const extractAppGatewayAccessCookie = (cookieHeader) => {
+  const cookie = cookieHeader?.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${APP_GATEWAY_ACCESS_COOKIE_NAME}=`));
+  return cookie?.slice(APP_GATEWAY_ACCESS_COOKIE_NAME.length + 1) || void 0;
+};
+const selectAppGatewayProtocol = (protocols) => {
+  for (const protocol of protocols) {
+    if (!protocol.startsWith(APP_GATEWAY_ACCESS_PROTOCOL_PREFIX)) return protocol;
+  }
+  return false;
+};
+const createAppGatewayAccessService = () => {
+  const grants = /* @__PURE__ */ new Map();
+  const prune = (now) => {
+    for (const [tokenHash, grant] of grants) {
+      if (grant.expiresAt <= now) grants.delete(tokenHash);
+    }
+    while (grants.size >= MAX_ACTIVE_ACCESS_TOKENS) {
+      const oldestTokenHash = grants.keys().next().value;
+      if (!oldestTokenHash) break;
+      grants.delete(oldestTokenHash);
+    }
+  };
+  const resolve = (connectionId, token) => {
+    if (!token) return void 0;
+    const now = Date.now();
+    const tokenHash = hashToken(token);
+    const grant = grants.get(tokenHash);
+    if (!grant || grant.expiresAt <= now) {
+      grants.delete(tokenHash);
+      return void 0;
+    }
+    return grant.connectionId === connectionId ? grant : void 0;
+  };
+  return {
+    issue(connectionId, publicProtocol = "http") {
+      const now = Date.now();
+      prune(now);
+      const token = randomBytes(32).toString("base64url");
+      const expiresAt = now + APP_GATEWAY_ACCESS_TTL_MS;
+      grants.set(hashToken(token), { connectionId, expiresAt, publicProtocol });
+      return { token, expiresAt: new Date(expiresAt).toISOString() };
+    },
+    resolve,
+    verify(connectionId, token) {
+      return Boolean(resolve(connectionId, token));
+    }
+  };
+};
+export {
+  APP_GATEWAY_ACCESS_COOKIE_NAME,
+  APP_GATEWAY_ACCESS_HEADER,
+  APP_GATEWAY_ACCESS_PROTOCOL_PREFIX,
+  APP_GATEWAY_ACCESS_TTL_MS,
+  APP_GATEWAY_PROTOCOL,
+  createAppGatewayAccessService,
+  extractAppGatewayAccessCookie,
+  extractAppGatewayAccessToken,
+  selectAppGatewayProtocol
+};

package/server/dist/features/app-gateway/database.js

@@ -0,0 +1,20 @@
+import models from "../../models.js";
+import { parseManifest } from "../integration/manifest.js";
+const findConnection = (connectionId) => models.integrationConnection.findUnique({ where: { id: connectionId } });
+const createDatabaseAppGatewayOptions = (lookup = findConnection) => ({
+  resolveConnection: async (connectionId) => {
+    const connection = await lookup(connectionId);
+    if (!connection) return null;
+    const manifest = parseManifest(JSON.parse(connection.manifest));
+    if (manifest.launch?.mode !== "proxied") return null;
+    return {
+      id: connection.id,
+      integrationId: connection.integrationId,
+      enabled: connection.enabled,
+      proxyUrl: connection.proxyUrl
+    };
+  }
+});
+export {
+  createDatabaseAppGatewayOptions
+};

package/server/dist/features/app-gateway/gateway.js

@@ -0,0 +1,208 @@
+import { createAppError } from "../../modules/error-handler.js";
+const APP_GATEWAY_PUBLIC_PREFIX = "/apps";
+const APP_IDENTIFIER_PATTERN = /^[a-z0-9](?:[a-z0-9._-]{0,126}[a-z0-9])?$/;
+const DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+const BLOCKED_REQUEST_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "connection",
+  "cookie",
+  "forwarded",
+  "host",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "x-csrf-token",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-port",
+  "x-forwarded-prefix",
+  "x-forwarded-proto",
+  "x-real-ip",
+  "x-xsrf-token"
+]);
+const WEBSOCKET_REQUEST_HEADERS = ["accept-language", "origin", "user-agent"];
+const isAppIdentifier = (value) => APP_IDENTIFIER_PATTERN.test(value);
+const resolveAppGatewayOptions = (options) => {
+  if (typeof options.resolveConnection !== "function") {
+    throw new Error("The app gateway requires a connection resolver.");
+  }
+  const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  if (!Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 1e3 || requestTimeoutMs > 12e4) {
+    throw new Error("The app gateway request timeout must be between 1000 and 120000 milliseconds.");
+  }
+  return { ...options, requestTimeoutMs };
+};
+const normalizeProxyUrl = (value) => {
+  if (!value) return null;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    return null;
+  }
+  return url.origin;
+};
+const resolveAppGatewayConnection = async (options, connectionId) => {
+  if (!isAppIdentifier(connectionId)) {
+    throw createAppError(400, "INVALID_APP_CONNECTION_ID", "The app connection id is invalid.");
+  }
+  const connection = await options.resolveConnection(connectionId);
+  if (!connection) {
+    throw createAppError(404, "APP_CONNECTION_NOT_FOUND", "The proxied app connection was not found.");
+  }
+  if (connection.id !== connectionId || !isAppIdentifier(connection.integrationId)) {
+    throw createAppError(502, "INVALID_APP_PROXY_STATE", "The proxied app connection is invalid.");
+  }
+  if (!connection.enabled) {
+    throw createAppError(503, "APP_CONNECTION_DISABLED", "The proxied app connection is disabled.");
+  }
+  const proxyUrl = normalizeProxyUrl(connection.proxyUrl);
+  if (!proxyUrl) {
+    throw createAppError(503, "APP_PROXY_NOT_CONFIGURED", "The proxied app URL is not configured.");
+  }
+  return { ...connection, proxyUrl };
+};
+const validateAppGatewayRequestPath = (requestUrl) => {
+  let path = requestUrl.split("?", 1)[0];
+  for (let index = 0; index < 3; index += 1) {
+    const normalized = path.replaceAll("\\", "/");
+    if (/^[a-z][a-z\d+.-]*:/i.test(normalized) || normalized.startsWith("//")) {
+      throw createAppError(400, "INVALID_APP_PROXY_PATH", "The app request path is invalid.");
+    }
+    let decoded;
+    try {
+      decoded = decodeURIComponent(normalized);
+    } catch {
+      throw createAppError(400, "INVALID_APP_PROXY_PATH", "The app request path is invalid.");
+    }
+    if (decoded === ".." || decoded.includes("/..") || decoded.includes("../")) {
+      throw createAppError(400, "INVALID_APP_PROXY_PATH", "The app request path is invalid.");
+    }
+    if (decoded === path) break;
+    path = decoded;
+  }
+};
+const withoutBlockedHeaders = (headers) => {
+  const forwarded = {};
+  for (const [name, value] of Object.entries(headers)) {
+    const normalizedName = name.toLowerCase();
+    if (BLOCKED_REQUEST_HEADERS.has(normalizedName) || normalizedName.startsWith("x-forwarded-") || normalizedName.startsWith("x-ocean-brain-")) {
+      continue;
+    }
+    forwarded[normalizedName] = value;
+  }
+  return forwarded;
+};
+const addGatewayHeaders = (request, headers) => {
+  const connection = request.appGatewayConnection;
+  if (!connection) {
+    throw createAppError(502, "APP_GATEWAY_CONTEXT_MISSING", "The app gateway request context is missing.");
+  }
+  return {
+    ...headers,
+    "x-forwarded-host": request.headers.host,
+    "x-forwarded-prefix": `${APP_GATEWAY_PUBLIC_PREFIX}/${connection.id}`,
+    "x-forwarded-proto": request.appGatewayPublicProtocol ?? request.protocol,
+    "x-ocean-brain-connection-id": connection.id,
+    "x-ocean-brain-integration-id": connection.integrationId
+  };
+};
+const createProxyRequestHeaders = (request, headers) => addGatewayHeaders(request, withoutBlockedHeaders(headers));
+const createProxyWebSocketHeaders = (request) => {
+  const headers = {};
+  for (const name of WEBSOCKET_REQUEST_HEADERS) {
+    const value = request.headers[name];
+    if (value !== void 0) headers[name] = value;
+  }
+  return addGatewayHeaders(request, headers);
+};
+const getAppGatewayUpstream = (request) => {
+  const connection = request.appGatewayConnection;
+  if (!connection) {
+    throw createAppError(502, "APP_GATEWAY_CONTEXT_MISSING", "The app gateway request context is missing.");
+  }
+  return connection.proxyUrl;
+};
+const getHeader = (headers, name) => {
+  const value = headers[name];
+  return Array.isArray(value) ? value[0] : value;
+};
+const isWithinPath = (path, prefix) => path === prefix || path.startsWith(`${prefix}/`);
+const rewriteProxyLocation = (location, request) => {
+  const connection = request.appGatewayConnection;
+  if (!connection) return void 0;
+  const publicPrefix = `${APP_GATEWAY_PUBLIC_PREFIX}/${connection.id}`;
+  const requestUrl = new URL(request.url, "http://ocean-brain.invalid");
+  const requestSuffix = isWithinPath(requestUrl.pathname, publicPrefix) ? requestUrl.pathname.slice(publicPrefix.length) || "/" : "/";
+  const upstreamRequestUrl = new URL(`${requestSuffix}${requestUrl.search}`, `${connection.proxyUrl}/`);
+  let destination;
+  try {
+    destination = new URL(location, upstreamRequestUrl);
+  } catch {
+    return void 0;
+  }
+  if (destination.origin !== connection.proxyUrl) return void 0;
+  if (isWithinPath(destination.pathname, publicPrefix)) {
+    return `${destination.pathname}${destination.search}${destination.hash}`;
+  }
+  return `${publicPrefix}${destination.pathname}${destination.search}${destination.hash}`;
+};
+const appendVary = (current, value) => {
+  const values = new Set(
+    (Array.isArray(current) ? current : current?.split(",") ?? []).map((item) => item.trim()).filter(Boolean)
+  );
+  values.add(value);
+  return Array.from(values).join(", ");
+};
+const APP_SANDBOX_POLICY = "sandbox allow-downloads allow-forms allow-modals allow-scripts; frame-ancestors 'self'; object-src 'none'";
+const createGatewayResponseHeaders = (source, request) => {
+  const headers = { ...source };
+  delete headers["set-cookie"];
+  delete headers["set-cookie2"];
+  delete headers["x-frame-options"];
+  delete headers["content-security-policy-report-only"];
+  delete headers["clear-site-data"];
+  delete headers.nel;
+  delete headers["report-to"];
+  delete headers.refresh;
+  delete headers["access-control-allow-origin"];
+  delete headers["access-control-allow-credentials"];
+  delete headers["proxy-authenticate"];
+  delete headers["www-authenticate"];
+  const location = getHeader(headers, "location");
+  if (location) {
+    const rewrittenLocation = rewriteProxyLocation(location, request);
+    if (rewrittenLocation) headers.location = rewrittenLocation;
+    else delete headers.location;
+  }
+  const upstreamPolicy = headers["content-security-policy"];
+  headers["content-security-policy"] = upstreamPolicy ? [...Array.isArray(upstreamPolicy) ? upstreamPolicy : [upstreamPolicy], APP_SANDBOX_POLICY] : APP_SANDBOX_POLICY;
+  headers["permissions-policy"] = "camera=(), geolocation=(), microphone=(), payment=(), usb=()";
+  headers["referrer-policy"] = "no-referrer";
+  headers["x-content-type-options"] = "nosniff";
+  headers["cache-control"] ??= "private, no-store";
+  if (request.appGatewayCorsAllowed) {
+    headers["access-control-allow-origin"] = "null";
+    headers["access-control-allow-credentials"] = "true";
+    headers.vary = appendVary(headers.vary, "Origin");
+  }
+  return headers;
+};
+export {
+  APP_GATEWAY_PUBLIC_PREFIX,
+  createGatewayResponseHeaders,
+  createProxyRequestHeaders,
+  createProxyWebSocketHeaders,
+  getAppGatewayUpstream,
+  isAppIdentifier,
+  resolveAppGatewayConnection,
+  resolveAppGatewayOptions,
+  validateAppGatewayRequestPath
+};

package/server/dist/features/integration/access-events.js

@@ -0,0 +1,17 @@
+import { EventEmitter } from "node:events";
+const INTEGRATION_ACCESS_CHANGE_CHANNEL = "integration-access-change";
+const integrationAccessEmitter = new EventEmitter();
+integrationAccessEmitter.setMaxListeners(0);
+const emitIntegrationAccessChanged = (connectionId) => {
+  integrationAccessEmitter.emit(INTEGRATION_ACCESS_CHANGE_CHANNEL, connectionId);
+};
+const subscribeIntegrationAccessChanges = (listener) => {
+  integrationAccessEmitter.on(INTEGRATION_ACCESS_CHANGE_CHANNEL, listener);
+  return () => {
+    integrationAccessEmitter.off(INTEGRATION_ACCESS_CHANGE_CHANNEL, listener);
+  };
+};
+export {
+  emitIntegrationAccessChanged,
+  subscribeIntegrationAccessChanges
+};

package/server/dist/features/integration/manifest.js

@@ -48,8 +48,13 @@ const parseManifest = (value) => {
     return invalid("An integration requesting write access must also request notes:read.");
   }
   if (value.launch !== void 0) {
-    if (!isRecord(value.launch) || !["external", "iframe"].includes(String(value.launch.mode))) {
-      return invalid("launch requires a url and mode (external or iframe).");
+    if (!isRecord(value.launch) || !["external", "iframe", "proxied"].includes(String(value.launch.mode))) {
+      return invalid("launch requires proxied mode or a url with external or iframe mode.");
+    }
+    if (value.launch.mode === "proxied") {
+      if (value.launch.url !== void 0) return invalid("A proxied launch cannot provide a url.");
+      manifest.launch = { mode: "proxied" };
+      return manifest;
     }
     let url;
     try {
@@ -65,6 +70,29 @@ const parseManifest = (value) => {
   }
   return manifest;
 };
+const parseIntegrationProxyUrl = (value) => {
+  if (typeof value !== "string" || !value.trim() || value.length > 2e3) {
+    throw createAppError(
+      400,
+      "INVALID_INTEGRATION_PROXY_URL",
+      "The private app URL must be a nonempty string of at most 2000 characters."
+    );
+  }
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    throw createAppError(400, "INVALID_INTEGRATION_PROXY_URL", "The private app URL must be an absolute URL.");
+  }
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw createAppError(
+      400,
+      "INVALID_INTEGRATION_PROXY_URL",
+      "The private app URL must be an HTTP(S) origin without credentials, a path, query, or fragment."
+    );
+  }
+  return url.origin;
+};
 const validateGrants = (value, manifest) => {
   const permissions = parsePermissions(value);
   if (permissions.some((permission) => !manifest.permissions.includes(permission))) {
@@ -81,6 +109,7 @@ export {
   MCP_INTEGRATION_MANIFEST,
   NATIVE_INTEGRATIONS,
   isRecord,
+  parseIntegrationProxyUrl,
   parseManifest,
   parsePermissions,
   validateGrants