ocean-brain 0.2.1 → 0.3.0

package/server/client/dist/assets/placeholder-4P_GK7fV.js

@@ -0,0 +1,34 @@
+import{j as e}from"./note-vendor-BofYbzmZ.js";import{p as O,g as y,z as $,A as H,q as x,al as I,u as q,H as P,P as Z,B as f,Y as k,am as F,an as v,ao as Q,M as p,V as g,W as j,F as T,f as K,e as B,a8 as U}from"./index-40Y2UsVr.js";import{a as t}from"./graph-vendor-CUxe67Lr.js";import{C as z}from"./Callout-B2kPcDrq.js";import{n as X,M as Y}from"./ModalActionRow-CES9L_Gy.js";import{S as C}from"./SurfaceCard-yzVU4Qkx.js";import"./note-core-BCgMq5QA.js";const G=new Map([["bold",t.createElement(t.Fragment,null,t.createElement("path",{d:"M216.49,168.49a12,12,0,0,1-17,0L128,97,56.49,168.49a12,12,0,0,1-17-17l80-80a12,12,0,0,1,17,0l80,80A12,12,0,0,1,216.49,168.49Z"}))],["duotone",t.createElement(t.Fragment,null,t.createElement("path",{d:"M208,160H48l80-80Z",opacity:"0.2"}),t.createElement("path",{d:"M213.66,154.34l-80-80a8,8,0,0,0-11.32,0l-80,80A8,8,0,0,0,48,168H208a8,8,0,0,0,5.66-13.66ZM67.31,152,128,91.31,188.69,152Z"}))],["fill",t.createElement(t.Fragment,null,t.createElement("path",{d:"M215.39,163.06A8,8,0,0,1,208,168H48a8,8,0,0,1-5.66-13.66l80-80a8,8,0,0,1,11.32,0l80,80A8,8,0,0,1,215.39,163.06Z"}))],["light",t.createElement(t.Fragment,null,t.createElement("path",{d:"M212.24,164.24a6,6,0,0,1-8.48,0L128,88.49,52.24,164.24a6,6,0,0,1-8.48-8.48l80-80a6,6,0,0,1,8.48,0l80,80A6,6,0,0,1,212.24,164.24Z"}))],["regular",t.createElement(t.Fragment,null,t.createElement("path",{d:"M213.66,165.66a8,8,0,0,1-11.32,0L128,91.31,53.66,165.66a8,8,0,0,1-11.32-11.32l80-80a8,8,0,0,1,11.32,0l80,80A8,8,0,0,1,213.66,165.66Z"}))],["thin",t.createElement(t.Fragment,null,t.createElement("path",{d:"M210.83,162.83a4,4,0,0,1-5.66,0L128,85.66,50.83,162.83a4,4,0,0,1-5.66-5.66l80-80a4,4,0,0,1,5.66,0l80,80A4,4,0,0,1,210.83,162.83Z"}))]]),S=t.forwardRef((l,r)=>t.createElement(O,{ref:r,...l,weights:G}));S.displayName="CaretUpIcon";const V=S,b=["id","name","template","replacement","createdAt","updatedAt"],W=new Set(b),J=`query FetchPlaceholders(
+            $searchFilter: SearchFilterInput,
+            $pagination: PaginationInput
+        ) {
+            allPlaceholders(
+                searchFilter: $searchFilter,
+                pagination: $pagination
+            ) {
+                totalCount
+                placeholders {
+__PLACEHOLDER_FIELDS__                }
+            }
+        }`,ee=l=>{const r=l&&l.length>0?l.filter(n=>W.has(n)):b;return Array.from(new Set(r)).map(n=>"                    "+n).join(`
+`)+`
+`},te=async({limit:l=25,offset:r=0,query:d="",fields:n}={})=>{const h=ee(n),c=J.replace("__PLACEHOLDER_FIELDS__",h);return y(c,{searchFilter:{query:d},pagination:{limit:l,offset:r}})},ae=l=>y(`mutation CreatePlaceholder(
+            $name: String!,
+            $template: String!,
+            $replacement: String!
+        ) {
+            createPlaceholder(
+                name: $name,
+                template: $template,
+                replacement: $replacement
+            ) {
+                id
+                name
+                template
+                replacement
+                createdAt
+                updatedAt
+            }
+        }`,l),le=l=>y(`mutation DeletePlaceholder($id: ID!) {
+            deletePlaceholder(id: $id)
+        }`,{id:l}),L="p-4",A=B(U),me=()=>{const l=$(),r=H(),d=A.useNavigate(),{page:n}=A.useSearch(),[h,c]=t.useState(!1),[u,N]=t.useState(!1),[s,m]=t.useState({name:"",template:"",replacement:""}),i=25,_=x.placeholders.list({limit:i,offset:(n-1)*i}),[w]=t.useState(I),{data:o,isLoading:M}=q({queryKey:_,queryFn:async()=>{const a=await te({offset:(n-1)*i,limit:i});if(a.type==="error")throw a;return a.allPlaceholders}}),E=P({mutationFn:ae,onSuccess:async()=>{l("Placeholder added successfully"),c(!1),m({name:"",template:"",replacement:""}),await r.invalidateQueries({queryKey:x.placeholders.listAll(),exact:!1})}}),R=P({mutationFn:le,onSuccess:async()=>{l("Placeholder deleted successfully"),await r.invalidateQueries({queryKey:x.placeholders.listAll(),exact:!1})}});return e.jsxs(Z,{title:"Placeholders",variant:"subtle",description:"Manage template variables for note cloning",children:[e.jsx(z,{className:"mb-4",children:e.jsxs("div",{className:"flex items-center justify-between gap-2",children:[e.jsx("span",{children:"Placeholders will be replaced with new note data during cloning."}),e.jsx(f,{variant:"subtle",size:"icon-sm",onClick:()=>c(!0),children:e.jsx(X,{width:20,height:20})})]})}),e.jsxs("div",{className:"mt-3 flex flex-col gap-3",children:[e.jsxs("button",{type:"button",onClick:()=>N(!u),className:"focus-ring-soft surface-base flex items-center justify-between gap-2 rounded-[18px] px-4 py-3 text-left text-sm font-semibold text-fg-default transition-colors hover:bg-hover-subtle",children:[e.jsx("div",{children:"System Placeholders"}),e.jsx("div",{className:"flex h-6 w-6 items-center justify-center text-fg-tertiary",children:u?e.jsx(V,{}):e.jsx(k,{})})]}),u&&e.jsx("div",{className:"grid grid-cols-1 gap-3 md:grid-cols-2 lg:grid-cols-3",children:w.map(a=>e.jsxs(C,{className:L,children:[e.jsx("div",{className:"text-sm font-semibold text-fg-default",children:a.name}),e.jsxs("div",{className:"text-xs font-medium text-fg-tertiary",children:[F,a.template,v," = '",a.replacement,"'"]})]},a.name))}),!M&&o?.placeholders&&o.placeholders.length>0&&e.jsx("div",{className:"grid grid-cols-1 gap-3 md:grid-cols-2 lg:grid-cols-3",children:o.placeholders.map(a=>e.jsxs(C,{className:`${L} relative`,children:[e.jsxs("div",{className:"flex items-center justify-between",children:[e.jsx("div",{className:"text-sm font-semibold text-fg-default",children:a.name}),e.jsx("button",{type:"button",className:"focus-ring-soft inline-flex h-8 w-8 items-center justify-center rounded-[10px] text-fg-tertiary transition-colors hover:bg-hover-subtle hover:text-fg-default",onClick:()=>R.mutate(a.id.toString()),children:e.jsx(Q,{})})]}),e.jsxs("div",{className:"text-xs font-medium text-fg-tertiary",children:[F,a.template,v," = '",a.replacement,"'"]})]},a.id))})]}),e.jsxs(p,{isOpen:h,onClose:()=>c(!1),children:[e.jsx(p.Header,{title:"Add Placeholder",onClose:()=>c(!1)}),e.jsx(p.Body,{children:e.jsxs("div",{className:"flex flex-col gap-3",children:[e.jsx(g,{htmlFor:"name",children:"Name:"}),e.jsx(j,{id:"name",type:"text",value:s.name,onChange:a=>m({...s,name:a.target.value}),placeholder:"Description of this placeholder"}),e.jsx(g,{htmlFor:"template",children:"Placeholder:"}),e.jsx(j,{id:"template",type:"text",value:s.template,onChange:a=>m({...s,template:a.target.value}),placeholder:"note_app"}),e.jsx(g,{htmlFor:"replacement",children:"Replacement:"}),e.jsx(j,{id:"replacement",type:"text",value:s.replacement,onChange:a=>m({...s,replacement:a.target.value}),placeholder:"Ocean Brain"})]})}),e.jsx(p.Footer,{children:e.jsxs(Y,{children:[e.jsx(f,{variant:"ghost",onClick:()=>c(!1),children:"Cancel"}),e.jsx(f,{variant:"primary",isLoading:E.isPending,onClick:()=>{if(!s.name||!s.template||!s.replacement){l("All fields are required");return}E.mutate({name:s.name,template:s.template,replacement:s.replacement})},children:"Add"})]})})]}),e.jsx(T,{fallback:null,children:o?.totalCount&&i<o.totalCount&&e.jsx(K,{page:n,last:Math.ceil(o.totalCount/i),onChange:a=>{d({search:D=>({...D,page:a})})}})})]})};export{me as default};

package/server/client/dist/assets/trash-CPBwY07S.js

@@ -0,0 +1 @@
+import{j as e}from"./note-vendor-BofYbzmZ.js";import{P as h,Q as p,S as d,e as f,a1 as y,A as g,z as j,k as b,ac as v,q as i,H as N,ad as T,N as S,F as q,a2 as E,B as R,f as Q,E as w,d as C}from"./index-40Y2UsVr.js";import"./graph-vendor-CUxe67Lr.js";import{S as K}from"./SurfaceCard-yzVU4Qkx.js";import"./note-core-BCgMq5QA.js";const a=25,c=f(y),x=t=>C(t).format("YYYY-MM-DD HH:mm"),k=()=>{const{page:t}=c.useSearch(),u=c.useNavigate(),r=g(),m=j(),{data:l}=b({queryKey:i.notes.trash({limit:a,offset:(t-1)*a}),queryFn:async()=>{const s=await v({limit:a,offset:(t-1)*a});if(s.type==="error")throw s;return s.trashedNotes}}),o=N({mutationFn:T,onSuccess:async s=>{if(s.type==="error")throw s;await Promise.all([r.invalidateQueries({queryKey:i.notes.all(),exact:!1}),r.invalidateQueries({queryKey:i.tags.all(),exact:!1}),r.invalidateQueries({queryKey:i.reminders.all(),exact:!1}),r.invalidateQueries({queryKey:i.images.all(),exact:!1}),r.invalidateQueries({queryKey:["calendar"],exact:!1})]),m("The note has been restored."),u({to:S,params:{id:s.restoreTrashedNote.id}})},onError:()=>{m("Failed to restore the note.")}});return e.jsx(q,{fallback:e.jsx(w,{title:"Trash is empty",description:"Deleted notes stay here until you restore them or retention cleanup removes them."}),children:l.notes.length>0&&e.jsxs(e.Fragment,{children:[e.jsx("div",{className:"grid gap-4",children:l.notes.map(s=>e.jsx(K,{className:"p-4",children:e.jsxs("div",{className:"flex items-start justify-between gap-4",children:[e.jsxs("div",{className:"space-y-2",children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("h2",{className:"text-base font-semibold text-fg-default",children:s.title}),s.pinned&&e.jsxs("span",{className:"inline-flex items-center gap-1 rounded-full border border-border-subtle bg-hover-subtle px-2 py-0.5 text-xs font-medium text-fg-secondary",children:[e.jsx(E,{className:"h-3.5 w-3.5"}),"Pinned"]})]}),e.jsxs("div",{className:"text-sm text-fg-secondary",children:["Deleted ",x(s.deletedAt)]}),e.jsxs("div",{className:"text-xs text-fg-tertiary",children:["Last edited ",x(s.updatedAt)]}),s.tagNames.length>0&&e.jsx("div",{className:"flex flex-wrap gap-2",children:s.tagNames.map(n=>e.jsx("span",{className:"rounded-full border border-border-subtle bg-hover-subtle px-2 py-0.5 text-xs font-medium text-fg-secondary",children:n},`${s.id}-${n}`))})]}),e.jsx(R,{variant:"subtle",isLoading:o.isPending&&o.variables===s.id,onClick:()=>o.mutate(s.id),children:"Restore"})]})},s.id))}),l.totalCount>a&&e.jsx(Q,{page:t,last:Math.ceil(l.totalCount/a),onChange:s=>{u({search:n=>({...n,page:s})})}})]})})},H=()=>{const{page:t}=c.useSearch();return e.jsx(h,{title:"Trash",variant:"subtle",description:"Restore notes removed from your active workspace before retention cleanup clears them",children:e.jsx(p,{fallback:e.jsxs("div",{className:"grid gap-4",children:[e.jsx(d,{height:"128px"}),e.jsx(d,{height:"128px"}),e.jsx(d,{height:"128px"})]}),errorTitle:"Failed to load trash",errorDescription:"Retry loading deleted notes.",resetKeys:[t],children:e.jsx(k,{})})})};export{H as default};

package/server/client/dist/assets/useReminderMutate-1YVndM2T.js

@@ -0,0 +1,82 @@
+import{j as y}from"./note-vendor-BofYbzmZ.js";import{g as u,k as f,q as n,z as R,A as $}from"./index-40Y2UsVr.js";import{a as l}from"./graph-vendor-CUxe67Lr.js";const g=(e={})=>({limit:e.limit??10,offset:e.offset??0}),D=async(e,t)=>u(`
+        query FetchNoteReminders($noteId: ID!, $pagination: PaginationInput) {
+            noteReminders(noteId: $noteId, pagination: $pagination) {
+                totalCount
+                reminders {
+                    id
+                    noteId
+                    reminderDate
+                    priority
+                    content
+                    completed
+                    createdAt
+                    updatedAt
+                }
+            }
+        }
+    `,{noteId:e,pagination:g(t)}),A=async e=>u(`
+        query FetchUpcomingReminders($pagination: PaginationInput) {
+            upcomingReminders(pagination: $pagination) {
+                totalCount
+                reminders {
+                    id
+                    noteId
+                    reminderDate
+                    priority
+                    content
+                    completed
+                    createdAt
+                    updatedAt
+                    note {
+                        id
+                        title
+                    }
+                }
+            }
+        }
+    `,{pagination:g(e)}),q=async e=>{const{noteId:t,reminderDate:a,priority:o="medium",content:i}=e;return u(`
+        mutation CreateReminder($noteId: ID!, $reminderDate: String!, $priority: ReminderPriority, $content: String) {
+            createReminder(
+                noteId: $noteId,
+                reminderDate: $reminderDate,
+                priority: $priority,
+                content: $content
+            ) {
+                id
+                noteId
+                reminderDate
+                completed
+                priority
+                createdAt
+                updatedAt
+            }
+        }
+    `,{noteId:t,reminderDate:a.toISOString(),priority:o,content:i})},I=async({id:e,reminderDate:t,completed:a,priority:o,content:i})=>{const r={id:e};return t&&(r.reminderDate=t.toISOString()),a!==void 0&&(r.completed=a),o&&(r.priority=o),i!==void 0&&(r.content=i),u(`
+        mutation UpdateReminder(
+            $id: ID!, 
+            $reminderDate: String, 
+            $completed: Boolean, 
+            $priority: ReminderPriority,
+            $content: String
+        ) {
+            updateReminder(
+                id: $id,
+                reminderDate: $reminderDate,
+                completed: $completed,
+                priority: $priority,
+                content: $content
+            ) {
+                id
+                noteId
+                reminderDate
+                completed
+                priority
+                createdAt
+                updatedAt
+            }
+        }
+    `,r)},x=async e=>u(`
+        mutation DeleteReminder($id: ID!) {
+            deleteReminder(id: $id)
+        }
+    `,{id:e});function P({noteId:e,searchParams:t,render:a}){const{data:o}=f({queryKey:e?n.reminders.note(e,t):n.reminders.upcoming(t),queryFn:async()=>{if(e){const r=await D(e,t);if(r.type==="error")throw r;return r.noteReminders}const i=await A(t);if(i.type==="error")throw i;return i.upcomingReminders}});return y.jsx(y.Fragment,{children:a(o)})}function w(){const e=R(),t=$(),a=l.useCallback(async(r,m,d="medium",s,c)=>{const p=await q({noteId:r,reminderDate:m,priority:d,content:c});if(p.type==="error"){e(p.errors[0].message);return}await Promise.all([t.invalidateQueries({queryKey:n.reminders.noteAllPages(r),exact:!1}),t.invalidateQueries({queryKey:n.reminders.upcomingAllPages(),exact:!1}),t.invalidateQueries({queryKey:n.reminders.inDateRangeAll(),exact:!1})]),s&&s()},[t,e]),o=l.useCallback(async(r,m,d,s)=>{const c=await I({id:r,...d});if(c.type==="error"){e(c.errors[0].message);return}await Promise.all([t.invalidateQueries({queryKey:n.reminders.noteAllPages(m),exact:!1}),t.invalidateQueries({queryKey:n.reminders.upcomingAllPages(),exact:!1}),t.invalidateQueries({queryKey:n.reminders.inDateRangeAll(),exact:!1})]),s&&s()},[t,e]),i=l.useCallback(async(r,m,d)=>{const s=await x(r);if(s.type==="error"){e(s.errors[0].message);return}await Promise.all([t.invalidateQueries({queryKey:n.reminders.noteAllPages(m),exact:!1}),t.invalidateQueries({queryKey:n.reminders.upcomingAllPages(),exact:!1}),t.invalidateQueries({queryKey:n.reminders.inDateRangeAll(),exact:!1})]),d&&d()},[t,e]);return{onCreate:a,onUpdate:o,onDelete:i}}export{P as R,w as u};

package/server/client/dist/index.html

@@ -6,10 +6,11 @@
     <link rel="icon" type="image/png" href="/icon.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Ocean Brain</title>
-  <script type="module" crossorigin src="/assets/index-DvNRv9YC.js"></script>
-  <link rel="modulepreload" crossorigin href="/assets/note-core-DTIu0anW.js">
-  <link rel="modulepreload" crossorigin href="/assets/note-vendor-CUVHa9LU.js">
-  <link rel="stylesheet" crossorigin href="/assets/index-BJgBFWwL.css">
+  <script type="module" crossorigin src="/assets/index-40Y2UsVr.js"></script>
+  <link rel="modulepreload" crossorigin href="/assets/graph-vendor-CUxe67Lr.js">
+  <link rel="modulepreload" crossorigin href="/assets/note-core-BCgMq5QA.js">
+  <link rel="modulepreload" crossorigin href="/assets/note-vendor-BofYbzmZ.js">
+  <link rel="stylesheet" crossorigin href="/assets/index-BnxpTwtL.css">
 </head>
 
 <body>

package/server/dist/app.js

@@ -1,18 +1,106 @@
 import express from "express";
-import session from "express-session";
+import path from "path";
 import { createHandler } from "graphql-http/lib/use/express";
 import logger from "./modules/logger.js";
 import { paths } from "./paths.js";
 import schema from "./schema/index.js";
-import router from "./urls.js";
-var app_default = express().use(logger).use(express.static(paths.clientDist, { extensions: ["html"] })).use("/assets/images/", express.static(paths.imageDir)).use(session({
-  secret: "my-secret",
-  resave: false,
-  saveUninitialized: false
-})).use(express.json({ limit: "50mb" })).use("/api", router).use("/graphql", createHandler({ schema })).get(/.*/, (req, res) => {
-  res.sendFile(paths.clientIndex);
-});
+import { createApiRouter } from "./urls.js";
+import { createSessionMiddleware, isAuthenticatedRequest, requireSessionForGraphql } from "./modules/auth-guard.js";
+import {
+  createMcpAuthMiddleware,
+  createReadOnlyMcpValidationRule
+} from "./modules/mcp-auth.js";
+import { createMcpAdminService } from "./modules/mcp-admin.js";
+import {
+  createLoginPageHandler,
+  createLoginPageSubmitHandler,
+  createLogoutPageHandler
+} from "./views/auth.js";
+import useAsync from "./modules/use-async.js";
+import { createErrorHandler } from "./modules/error-handler.js";
+import {
+  createMcpCreateNoteHandler,
+  createMcpDeleteNoteHandler,
+  createMcpUpdateNoteHandler
+} from "./views/note.js";
+import { createMcpCreateTagHandler } from "./views/tag.js";
+import { purgeExpiredNoteSnapshots } from "./modules/note-snapshot.js";
+import { purgeExpiredTrashedNotes } from "./modules/note-trash.js";
+const shouldBlockClientRoute = (authConfig, requestPath, authenticated) => {
+  if (authConfig.mode !== "password" || authenticated) {
+    return false;
+  }
+  if (requestPath.startsWith("/api") || requestPath.startsWith("/graphql") || requestPath.startsWith("/auth")) {
+    return false;
+  }
+  return path.extname(requestPath) === "";
+};
+const createApp = (authConfig) => {
+  const mcpAdminService = createMcpAdminService();
+  return createAppWithMcpAuth(authConfig, mcpAdminService);
+};
+const createAppWithMcpAuth = (authConfig, mcpAdminService) => {
+  const app = express();
+  app.locals.authConfig = authConfig;
+  void Promise.all([
+    purgeExpiredNoteSnapshots(),
+    purgeExpiredTrashedNotes()
+  ]).catch((error) => {
+    const message = error instanceof Error ? error.message : "Unknown recovery cleanup error";
+    process.stderr.write(`[recovery] Startup cleanup failed: ${message}
+`);
+  });
+  app.use(logger).use(createSessionMiddleware(authConfig)).use(express.urlencoded({ extended: false })).use(express.json({ limit: "50mb" })).use("/assets/images/", express.static(paths.imageDir)).post(
+    "/api/mcp/notes/create",
+    createMcpAuthMiddleware(authConfig, mcpAdminService),
+    useAsync(createMcpCreateNoteHandler())
+  ).post(
+    "/api/mcp/notes/update",
+    createMcpAuthMiddleware(authConfig, mcpAdminService),
+    useAsync(createMcpUpdateNoteHandler())
+  ).post(
+    "/api/mcp/tags/create",
+    createMcpAuthMiddleware(authConfig, mcpAdminService),
+    useAsync(createMcpCreateTagHandler())
+  ).post(
+    "/api/mcp/notes/delete",
+    createMcpAuthMiddleware(authConfig, mcpAdminService),
+    useAsync(createMcpDeleteNoteHandler())
+  ).use("/api", createApiRouter(authConfig, mcpAdminService)).get("/auth/login", createLoginPageHandler(authConfig)).post("/auth/login", createLoginPageSubmitHandler(authConfig)).post("/auth/logout", createLogoutPageHandler(authConfig)).use("/graphql/mcp", createMcpAuthMiddleware(authConfig, mcpAdminService), createHandler({
+    schema,
+    context: (req) => ({
+      authMode: authConfig.mode,
+      isAuthenticated: isAuthenticatedRequest(req.raw),
+      req: req.raw,
+      res: req.context.res
+    }),
+    validationRules: (_req, _args, specifiedRules) => {
+      return [...specifiedRules, createReadOnlyMcpValidationRule()];
+    }
+  })).use("/graphql", requireSessionForGraphql(authConfig), createHandler({
+    schema,
+    context: (req) => ({
+      authMode: authConfig.mode,
+      isAuthenticated: isAuthenticatedRequest(req.raw),
+      req: req.raw,
+      res: req.context.res
+    })
+  })).use((req, res, next) => {
+    if (shouldBlockClientRoute(authConfig, req.path, isAuthenticatedRequest(req))) {
+      const redirectPath = encodeURIComponent(req.originalUrl || "/");
+      res.redirect(303, `/auth/login?next=${redirectPath}`);
+      return;
+    }
+    next();
+  }).use(express.static(paths.clientDist, { extensions: ["html"] })).get(/.*/, (_req, res) => {
+    res.sendFile(paths.clientIndex);
+  }).use(createErrorHandler());
+  return app;
+};
+var app_default = createApp;
 export {
+  createApp,
+  createAppWithMcpAuth,
   app_default as default
 };
 //# sourceMappingURL=app.js.map

package/server/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/app.ts"],"sourcesContent":["import express from 'express';\nimport session from 'express-session';\nimport { createHandler } from 'graphql-http/lib/use/express';\n\nimport logger from './modules/logger.js';\nimport { paths } from './paths.js';\nimport schema from './schema/index.js';\nimport router from './urls.js';\n\nexport default express()\n    .use(logger)\n    .use(express.static(paths.clientDist, { extensions: ['html'] }))\n    .use('/assets/images/', express.static(paths.imageDir))\n    .use(session({\n        secret: 'my-secret',\n        resave: false,\n        saveUninitialized: false\n    }))\n    .use(express.json({ limit: '50mb' }))\n    .use('/api', router)\n    .use('/graphql', createHandler({ schema }))\n    .get(/.*/, (req, res) => {\n        res.sendFile(paths.clientIndex);\n    });\n"],"mappings":"AAAA,OAAO,aAAa;AACpB,OAAO,aAAa;AACpB,SAAS,qBAAqB;AAE9B,OAAO,YAAY;AACnB,SAAS,aAAa;AACtB,OAAO,YAAY;AACnB,OAAO,YAAY;AAEnB,IAAO,cAAQ,QAAQ,EAClB,IAAI,MAAM,EACV,IAAI,QAAQ,OAAO,MAAM,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,EAC9D,IAAI,mBAAmB,QAAQ,OAAO,MAAM,QAAQ,CAAC,EACrD,IAAI,QAAQ;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,mBAAmB;AACvB,CAAC,CAAC,EACD,IAAI,QAAQ,KAAK,EAAE,OAAO,OAAO,CAAC,CAAC,EACnC,IAAI,QAAQ,MAAM,EAClB,IAAI,YAAY,cAAc,EAAE,OAAO,CAAC,CAAC,EACzC,IAAI,MAAM,CAAC,KAAK,QAAQ;AACrB,MAAI,SAAS,MAAM,WAAW;AAClC,CAAC;","names":[]}
+{"version":3,"sources":["../src/app.ts"],"sourcesContent":["import express from 'express';\nimport path from 'path';\nimport { createHandler } from 'graphql-http/lib/use/express';\n\nimport logger from './modules/logger.js';\nimport { paths } from './paths.js';\nimport schema from './schema/index.js';\nimport { createApiRouter } from './urls.js';\nimport { createSessionMiddleware, isAuthenticatedRequest, requireSessionForGraphql } from './modules/auth-guard.js';\nimport type { AuthConfig } from './modules/auth-mode.js';\nimport {\n    createMcpAuthMiddleware,\n    createReadOnlyMcpValidationRule\n} from './modules/mcp-auth.js';\nimport { createMcpAdminService, type McpAdminService } from './modules/mcp-admin.js';\nimport {\n    createLoginPageHandler,\n    createLoginPageSubmitHandler,\n    createLogoutPageHandler\n} from './views/auth.js';\nimport useAsync from './modules/use-async.js';\nimport { createErrorHandler } from './modules/error-handler.js';\nimport {\n    createMcpCreateNoteHandler,\n    createMcpDeleteNoteHandler,\n    createMcpUpdateNoteHandler\n} from './views/note.js';\nimport { createMcpCreateTagHandler } from './views/tag.js';\nimport { purgeExpiredNoteSnapshots } from './modules/note-snapshot.js';\nimport { purgeExpiredTrashedNotes } from './modules/note-trash.js';\n\nconst shouldBlockClientRoute = (authConfig: AuthConfig, requestPath: string, authenticated: boolean) => {\n    if (authConfig.mode !== 'password' || authenticated) {\n        return false;\n    }\n\n    if (requestPath.startsWith('/api') || requestPath.startsWith('/graphql') || requestPath.startsWith('/auth')) {\n        return false;\n    }\n\n    return path.extname(requestPath) === '';\n};\n\nexport const createApp = (authConfig: AuthConfig) => {\n    const mcpAdminService = createMcpAdminService();\n    return createAppWithMcpAuth(authConfig, mcpAdminService);\n};\n\nexport const createAppWithMcpAuth = (authConfig: AuthConfig, mcpAdminService: McpAdminService) => {\n    const app = express();\n    app.locals.authConfig = authConfig;\n\n    void Promise.all([\n        purgeExpiredNoteSnapshots(),\n        purgeExpiredTrashedNotes()\n    ]).catch((error) => {\n        const message = error instanceof Error ? error.message : 'Unknown recovery cleanup error';\n        process.stderr.write(`[recovery] Startup cleanup failed: ${message}\\n`);\n    });\n\n    app.use(logger)\n        .use(createSessionMiddleware(authConfig))\n        .use(express.urlencoded({ extended: false }))\n        .use(express.json({ limit: '50mb' }))\n        .use('/assets/images/', express.static(paths.imageDir))\n        .post(\n            '/api/mcp/notes/create',\n            createMcpAuthMiddleware(authConfig, mcpAdminService),\n            useAsync(createMcpCreateNoteHandler())\n        )\n        .post(\n            '/api/mcp/notes/update',\n            createMcpAuthMiddleware(authConfig, mcpAdminService),\n            useAsync(createMcpUpdateNoteHandler())\n        )\n        .post(\n            '/api/mcp/tags/create',\n            createMcpAuthMiddleware(authConfig, mcpAdminService),\n            useAsync(createMcpCreateTagHandler())\n        )\n        .post(\n            '/api/mcp/notes/delete',\n            createMcpAuthMiddleware(authConfig, mcpAdminService),\n            useAsync(createMcpDeleteNoteHandler())\n        )\n        .use('/api', createApiRouter(authConfig, mcpAdminService))\n        .get('/auth/login', createLoginPageHandler(authConfig))\n        .post('/auth/login', createLoginPageSubmitHandler(authConfig))\n        .post('/auth/logout', createLogoutPageHandler(authConfig))\n        .use('/graphql/mcp', createMcpAuthMiddleware(authConfig, mcpAdminService), createHandler({\n            schema,\n            context: (req) => ({\n                authMode: authConfig.mode,\n                isAuthenticated: isAuthenticatedRequest(req.raw),\n                req: req.raw,\n                res: req.context.res\n            }),\n            validationRules: (_req, _args, specifiedRules) => {\n                return [...specifiedRules, createReadOnlyMcpValidationRule()];\n            }\n        }))\n        .use('/graphql', requireSessionForGraphql(authConfig), createHandler({\n            schema,\n            context: (req) => ({\n                authMode: authConfig.mode,\n                isAuthenticated: isAuthenticatedRequest(req.raw),\n                req: req.raw,\n                res: req.context.res\n            })\n        }))\n        .use((req, res, next) => {\n            if (shouldBlockClientRoute(authConfig, req.path, isAuthenticatedRequest(req))) {\n                const redirectPath = encodeURIComponent(req.originalUrl || '/');\n                res.redirect(303, `/auth/login?next=${redirectPath}`);\n                return;\n            }\n\n            next();\n        })\n        .use(express.static(paths.clientDist, { extensions: ['html'] }))\n        .get(/.*/, (_req, res) => {\n            res.sendFile(paths.clientIndex);\n        })\n        .use(createErrorHandler());\n\n    return app;\n};\n\nexport default createApp;\n"],"mappings":"AAAA,OAAO,aAAa;AACpB,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAE9B,OAAO,YAAY;AACnB,SAAS,aAAa;AACtB,OAAO,YAAY;AACnB,SAAS,uBAAuB;AAChC,SAAS,yBAAyB,wBAAwB,gCAAgC;AAE1F;AAAA,EACI;AAAA,EACA;AAAA,OACG;AACP,SAAS,6BAAmD;AAC5D;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,OACG;AACP,OAAO,cAAc;AACrB,SAAS,0BAA0B;AACnC;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,OACG;AACP,SAAS,iCAAiC;AAC1C,SAAS,iCAAiC;AAC1C,SAAS,gCAAgC;AAEzC,MAAM,yBAAyB,CAAC,YAAwB,aAAqB,kBAA2B;AACpG,MAAI,WAAW,SAAS,cAAc,eAAe;AACjD,WAAO;AAAA,EACX;AAEA,MAAI,YAAY,WAAW,MAAM,KAAK,YAAY,WAAW,UAAU,KAAK,YAAY,WAAW,OAAO,GAAG;AACzG,WAAO;AAAA,EACX;AAEA,SAAO,KAAK,QAAQ,WAAW,MAAM;AACzC;AAEO,MAAM,YAAY,CAAC,eAA2B;AACjD,QAAM,kBAAkB,sBAAsB;AAC9C,SAAO,qBAAqB,YAAY,eAAe;AAC3D;AAEO,MAAM,uBAAuB,CAAC,YAAwB,oBAAqC;AAC9F,QAAM,MAAM,QAAQ;AACpB,MAAI,OAAO,aAAa;AAExB,OAAK,QAAQ,IAAI;AAAA,IACb,0BAA0B;AAAA,IAC1B,yBAAyB;AAAA,EAC7B,CAAC,EAAE,MAAM,CAAC,UAAU;AAChB,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAQ,OAAO,MAAM,sCAAsC,OAAO;AAAA,CAAI;AAAA,EAC1E,CAAC;AAED,MAAI,IAAI,MAAM,EACT,IAAI,wBAAwB,UAAU,CAAC,EACvC,IAAI,QAAQ,WAAW,EAAE,UAAU,MAAM,CAAC,CAAC,EAC3C,IAAI,QAAQ,KAAK,EAAE,OAAO,OAAO,CAAC,CAAC,EACnC,IAAI,mBAAmB,QAAQ,OAAO,MAAM,QAAQ,CAAC,EACrD;AAAA,IACG;AAAA,IACA,wBAAwB,YAAY,eAAe;AAAA,IACnD,SAAS,2BAA2B,CAAC;AAAA,EACzC,EACC;AAAA,IACG;AAAA,IACA,wBAAwB,YAAY,eAAe;AAAA,IACnD,SAAS,2BAA2B,CAAC;AAAA,EACzC,EACC;AAAA,IACG;AAAA,IACA,wBAAwB,YAAY,eAAe;AAAA,IACnD,SAAS,0BAA0B,CAAC;AAAA,EACxC,EACC;AAAA,IACG;AAAA,IACA,wBAAwB,YAAY,eAAe;AAAA,IACnD,SAAS,2BAA2B,CAAC;AAAA,EACzC,EACC,IAAI,QAAQ,gBAAgB,YAAY,eAAe,CAAC,EACxD,IAAI,eAAe,uBAAuB,UAAU,CAAC,EACrD,KAAK,eAAe,6BAA6B,UAAU,CAAC,EAC5D,KAAK,gBAAgB,wBAAwB,UAAU,CAAC,EACxD,IAAI,gBAAgB,wBAAwB,YAAY,eAAe,GAAG,cAAc;AAAA,IACrF;AAAA,IACA,SAAS,CAAC,SAAS;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,iBAAiB,uBAAuB,IAAI,GAAG;AAAA,MAC/C,KAAK,IAAI;AAAA,MACT,KAAK,IAAI,QAAQ;AAAA,IACrB;AAAA,IACA,iBAAiB,CAAC,MAAM,OAAO,mBAAmB;AAC9C,aAAO,CAAC,GAAG,gBAAgB,gCAAgC,CAAC;AAAA,IAChE;AAAA,EACJ,CAAC,CAAC,EACD,IAAI,YAAY,yBAAyB,UAAU,GAAG,cAAc;AAAA,IACjE;AAAA,IACA,SAAS,CAAC,SAAS;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,iBAAiB,uBAAuB,IAAI,GAAG;AAAA,MAC/C,KAAK,IAAI;AAAA,MACT,KAAK,IAAI,QAAQ;AAAA,IACrB;AAAA,EACJ,CAAC,CAAC,EACD,IAAI,CAAC,KAAK,KAAK,SAAS;AACrB,QAAI,uBAAuB,YAAY,IAAI,MAAM,uBAAuB,GAAG,CAAC,GAAG;AAC3E,YAAM,eAAe,mBAAmB,IAAI,eAAe,GAAG;AAC9D,UAAI,SAAS,KAAK,oBAAoB,YAAY,EAAE;AACpD;AAAA,IACJ;AAEA,SAAK;AAAA,EACT,CAAC,EACA,IAAI,QAAQ,OAAO,MAAM,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,EAC9D,IAAI,MAAM,CAAC,MAAM,QAAQ;AACtB,QAAI,SAAS,MAAM,WAAW;AAAA,EAClC,CAAC,EACA,IAAI,mBAAmB,CAAC;AAE7B,SAAO;AACX;AAEA,IAAO,cAAQ;","names":[]}

package/server/dist/main.js

@@ -1,5 +1,19 @@
-import app from "./app.js";
+import { createApp } from "./app.js";
+import { logAuthConfig, resolveAuthConfig } from "./modules/auth-mode.js";
 const PORT = Number(process.env.PORT || 6683);
 const HOST = process.env.HOST || "0.0.0.0";
-app.listen(PORT, HOST, () => console.log(`http server listen on ${HOST}:${PORT}`));
+try {
+  const authConfig = resolveAuthConfig(process.env);
+  logAuthConfig(authConfig);
+  const app = createApp(authConfig);
+  app.listen(PORT, HOST, () => {
+    process.stdout.write(`http server listen on ${HOST}:${PORT} (auth: ${authConfig.mode})
+`);
+  });
+} catch (error) {
+  const message = error instanceof Error ? error.message : "Unknown auth configuration error";
+  process.stderr.write(`[auth] Startup failed: ${message}
+`);
+  process.exit(1);
+}
 //# sourceMappingURL=main.js.map

package/server/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/main.ts"],"sourcesContent":["import app from './app.js';\n\nconst PORT = Number(process.env.PORT || 6683);\nconst HOST = process.env.HOST || '0.0.0.0';\n\napp.listen(PORT, HOST, () => console.log(`http server listen on ${HOST}:${PORT}`));\n"],"mappings":"AAAA,OAAO,SAAS;AAEhB,MAAM,OAAO,OAAO,QAAQ,IAAI,QAAQ,IAAI;AAC5C,MAAM,OAAO,QAAQ,IAAI,QAAQ;AAEjC,IAAI,OAAO,MAAM,MAAM,MAAM,QAAQ,IAAI,yBAAyB,IAAI,IAAI,IAAI,EAAE,CAAC;","names":[]}
+{"version":3,"sources":["../src/main.ts"],"sourcesContent":["import { createApp } from './app.js';\nimport { logAuthConfig, resolveAuthConfig } from './modules/auth-mode.js';\n\nconst PORT = Number(process.env.PORT || 6683);\nconst HOST = process.env.HOST || '0.0.0.0';\n\ntry {\n    const authConfig = resolveAuthConfig(process.env);\n\n    logAuthConfig(authConfig);\n\n    const app = createApp(authConfig);\n\n    app.listen(PORT, HOST, () => {\n        process.stdout.write(`http server listen on ${HOST}:${PORT} (auth: ${authConfig.mode})\\n`);\n    });\n} catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown auth configuration error';\n    process.stderr.write(`[auth] Startup failed: ${message}\\n`);\n    process.exit(1);\n}\n"],"mappings":"AAAA,SAAS,iBAAiB;AAC1B,SAAS,eAAe,yBAAyB;AAEjD,MAAM,OAAO,OAAO,QAAQ,IAAI,QAAQ,IAAI;AAC5C,MAAM,OAAO,QAAQ,IAAI,QAAQ;AAEjC,IAAI;AACA,QAAM,aAAa,kBAAkB,QAAQ,GAAG;AAEhD,gBAAc,UAAU;AAExB,QAAM,MAAM,UAAU,UAAU;AAEhC,MAAI,OAAO,MAAM,MAAM,MAAM;AACzB,YAAQ,OAAO,MAAM,yBAAyB,IAAI,IAAI,IAAI,WAAW,WAAW,IAAI;AAAA,CAAK;AAAA,EAC7F,CAAC;AACL,SAAS,OAAO;AACZ,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,UAAQ,OAAO,MAAM,0BAA0B,OAAO;AAAA,CAAI;AAC1D,UAAQ,KAAK,CAAC;AAClB;","names":[]}

package/server/dist/modules/auth-guard.js

@@ -0,0 +1,73 @@
+import session from "express-session";
+import { GraphQLError } from "graphql";
+const JSON_HEADERS = { "Content-Type": "application/json" };
+const buildUnauthorizedPayload = () => ({
+  code: "UNAUTHORIZED",
+  message: "Authentication required"
+});
+const buildUnauthorizedGraphqlPayload = () => ({
+  errors: [{
+    message: "Authentication required",
+    extensions: { code: "UNAUTHORIZED" }
+  }]
+});
+const isAuthenticatedRequest = (req) => Boolean(req.session?.authenticated);
+const createSessionMiddleware = (authConfig) => {
+  if (authConfig.mode !== "password" || !authConfig.sessionSecret) {
+    return (_req, _res, next) => next();
+  }
+  return session({
+    secret: authConfig.sessionSecret,
+    name: "ocean-brain.sid",
+    resave: false,
+    saveUninitialized: false,
+    cookie: {
+      httpOnly: true,
+      sameSite: "lax"
+    }
+  });
+};
+const requireSessionForWrite = (authConfig) => {
+  return (req, res, next) => {
+    if (authConfig.mode === "disabled" || isAuthenticatedRequest(req)) {
+      next();
+      return;
+    }
+    res.status(401).set(JSON_HEADERS).json(buildUnauthorizedPayload()).end();
+  };
+};
+const requireSessionForGraphql = (authConfig) => {
+  return (req, res, next) => {
+    if (authConfig.mode === "disabled" || isAuthenticatedRequest(req)) {
+      next();
+      return;
+    }
+    res.status(401).set(JSON_HEADERS).json(buildUnauthorizedGraphqlPayload()).end();
+  };
+};
+const createMutationAuthValidationRule = () => {
+  return (context) => {
+    return {
+      OperationDefinition(node) {
+        if (node.operation !== "mutation") {
+          return;
+        }
+        context.reportError(new GraphQLError(
+          "Authentication required",
+          {
+            nodes: [node],
+            extensions: { code: "UNAUTHORIZED" }
+          }
+        ));
+      }
+    };
+  };
+};
+export {
+  createMutationAuthValidationRule,
+  createSessionMiddleware,
+  isAuthenticatedRequest,
+  requireSessionForGraphql,
+  requireSessionForWrite
+};
+//# sourceMappingURL=auth-guard.js.map

package/server/dist/modules/auth-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/modules/auth-guard.ts"],"sourcesContent":["import session from 'express-session';\nimport type { NextFunction, Request, Response, RequestHandler } from 'express';\nimport type { ValidationRule } from 'graphql';\nimport { GraphQLError } from 'graphql';\n\nimport type { AuthConfig } from './auth-mode.js';\n\nconst JSON_HEADERS = { 'Content-Type': 'application/json' };\n\nconst buildUnauthorizedPayload = () => ({\n    code: 'UNAUTHORIZED',\n    message: 'Authentication required'\n});\n\nconst buildUnauthorizedGraphqlPayload = () => ({\n    errors: [{\n        message: 'Authentication required',\n        extensions: { code: 'UNAUTHORIZED' }\n    }]\n});\n\nexport const isAuthenticatedRequest = (req: Request) => Boolean(req.session?.authenticated);\n\nexport const createSessionMiddleware = (authConfig: AuthConfig): RequestHandler => {\n    if (authConfig.mode !== 'password' || !authConfig.sessionSecret) {\n        return (_req, _res, next) => next();\n    }\n\n    return session({\n        secret: authConfig.sessionSecret,\n        name: 'ocean-brain.sid',\n        resave: false,\n        saveUninitialized: false,\n        cookie: {\n            httpOnly: true,\n            sameSite: 'lax'\n        }\n    });\n};\n\nexport const requireSessionForWrite = (authConfig: AuthConfig): RequestHandler => {\n    return (req: Request, res: Response, next: NextFunction) => {\n        if (authConfig.mode === 'disabled' || isAuthenticatedRequest(req)) {\n            next();\n            return;\n        }\n\n        res\n            .status(401)\n            .set(JSON_HEADERS)\n            .json(buildUnauthorizedPayload())\n            .end();\n    };\n};\n\nexport const requireSessionForGraphql = (authConfig: AuthConfig): RequestHandler => {\n    return (req: Request, res: Response, next: NextFunction) => {\n        if (authConfig.mode === 'disabled' || isAuthenticatedRequest(req)) {\n            next();\n            return;\n        }\n\n        res\n            .status(401)\n            .set(JSON_HEADERS)\n            .json(buildUnauthorizedGraphqlPayload())\n            .end();\n    };\n};\n\nexport const createMutationAuthValidationRule = (): ValidationRule => {\n    return (context) => {\n        return {\n            OperationDefinition(node) {\n                if (node.operation !== 'mutation') {\n                    return;\n                }\n\n                context.reportError(new GraphQLError(\n                    'Authentication required',\n                    {\n                        nodes: [node],\n                        extensions: { code: 'UNAUTHORIZED' }\n                    }\n                ));\n            }\n        };\n    };\n};\n"],"mappings":"AAAA,OAAO,aAAa;AAGpB,SAAS,oBAAoB;AAI7B,MAAM,eAAe,EAAE,gBAAgB,mBAAmB;AAE1D,MAAM,2BAA2B,OAAO;AAAA,EACpC,MAAM;AAAA,EACN,SAAS;AACb;AAEA,MAAM,kCAAkC,OAAO;AAAA,EAC3C,QAAQ,CAAC;AAAA,IACL,SAAS;AAAA,IACT,YAAY,EAAE,MAAM,eAAe;AAAA,EACvC,CAAC;AACL;AAEO,MAAM,yBAAyB,CAAC,QAAiB,QAAQ,IAAI,SAAS,aAAa;AAEnF,MAAM,0BAA0B,CAAC,eAA2C;AAC/E,MAAI,WAAW,SAAS,cAAc,CAAC,WAAW,eAAe;AAC7D,WAAO,CAAC,MAAM,MAAM,SAAS,KAAK;AAAA,EACtC;AAEA,SAAO,QAAQ;AAAA,IACX,QAAQ,WAAW;AAAA,IACnB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,mBAAmB;AAAA,IACnB,QAAQ;AAAA,MACJ,UAAU;AAAA,MACV,UAAU;AAAA,IACd;AAAA,EACJ,CAAC;AACL;AAEO,MAAM,yBAAyB,CAAC,eAA2C;AAC9E,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,QAAI,WAAW,SAAS,cAAc,uBAAuB,GAAG,GAAG;AAC/D,WAAK;AACL;AAAA,IACJ;AAEA,QACK,OAAO,GAAG,EACV,IAAI,YAAY,EAChB,KAAK,yBAAyB,CAAC,EAC/B,IAAI;AAAA,EACb;AACJ;AAEO,MAAM,2BAA2B,CAAC,eAA2C;AAChF,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,QAAI,WAAW,SAAS,cAAc,uBAAuB,GAAG,GAAG;AAC/D,WAAK;AACL;AAAA,IACJ;AAEA,QACK,OAAO,GAAG,EACV,IAAI,YAAY,EAChB,KAAK,gCAAgC,CAAC,EACtC,IAAI;AAAA,EACb;AACJ;AAEO,MAAM,mCAAmC,MAAsB;AAClE,SAAO,CAAC,YAAY;AAChB,WAAO;AAAA,MACH,oBAAoB,MAAM;AACtB,YAAI,KAAK,cAAc,YAAY;AAC/B;AAAA,QACJ;AAEA,gBAAQ,YAAY,IAAI;AAAA,UACpB;AAAA,UACA;AAAA,YACI,OAAO,CAAC,IAAI;AAAA,YACZ,YAAY,EAAE,MAAM,eAAe;AAAA,UACvC;AAAA,QACJ,CAAC;AAAA,MACL;AAAA,IACJ;AAAA,EACJ;AACJ;","names":[]}

package/server/dist/modules/auth-mode.js

@@ -0,0 +1,51 @@
+const isTruthy = (value) => {
+  if (!value) {
+    return false;
+  }
+  return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+};
+const ensurePasswordModeRequirements = (env) => {
+  if (!env.OCEAN_BRAIN_PASSWORD) {
+    throw new Error(
+      "Missing OCEAN_BRAIN_PASSWORD. Set OCEAN_BRAIN_PASSWORD to enable password auth mode."
+    );
+  }
+  if (!env.OCEAN_BRAIN_SESSION_SECRET) {
+    throw new Error(
+      "Missing OCEAN_BRAIN_SESSION_SECRET. Set OCEAN_BRAIN_SESSION_SECRET when password auth mode is enabled."
+    );
+  }
+};
+const resolveAuthConfig = (env) => {
+  const allowInsecureNoAuth = isTruthy(env.OCEAN_BRAIN_ALLOW_INSECURE_NO_AUTH);
+  if (allowInsecureNoAuth) {
+    return {
+      mode: "disabled",
+      source: "auto"
+    };
+  }
+  if (env.OCEAN_BRAIN_PASSWORD) {
+    ensurePasswordModeRequirements(env);
+    return {
+      mode: "password",
+      password: env.OCEAN_BRAIN_PASSWORD,
+      sessionSecret: env.OCEAN_BRAIN_SESSION_SECRET,
+      source: "auto"
+    };
+  }
+  throw new Error(
+    "Unable to resolve auth mode. Set OCEAN_BRAIN_PASSWORD and OCEAN_BRAIN_SESSION_SECRET for password mode, or set OCEAN_BRAIN_ALLOW_INSECURE_NO_AUTH=true for disabled mode."
+  );
+};
+const logAuthConfig = (authConfig) => {
+  if (authConfig.mode === "disabled") {
+    process.stderr.write("[auth] Running in disabled mode. Authentication is not required for write access.\n");
+    return;
+  }
+  process.stdout.write("[auth] Running in password mode. Write access requires an authenticated session.\n");
+};
+export {
+  logAuthConfig,
+  resolveAuthConfig
+};
+//# sourceMappingURL=auth-mode.js.map

package/server/dist/modules/auth-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/modules/auth-mode.ts"],"sourcesContent":["export type AuthMode = 'password' | 'disabled';\n\nexport interface AuthConfig {\n    mode: AuthMode;\n    password?: string;\n    sessionSecret?: string;\n    source: 'auto' | 'override';\n}\n\nexport interface AuthModeEnvironment {\n    [key: string]: string | undefined;\n    OCEAN_BRAIN_ALLOW_INSECURE_NO_AUTH?: string;\n    OCEAN_BRAIN_PASSWORD?: string;\n    OCEAN_BRAIN_SESSION_SECRET?: string;\n}\n\nconst isTruthy = (value?: string) => {\n    if (!value) {\n        return false;\n    }\n\n    return ['1', 'true', 'yes', 'on'].includes(value.trim().toLowerCase());\n};\n\nconst ensurePasswordModeRequirements = (env: AuthModeEnvironment) => {\n    if (!env.OCEAN_BRAIN_PASSWORD) {\n        throw new Error(\n            'Missing OCEAN_BRAIN_PASSWORD. Set OCEAN_BRAIN_PASSWORD to enable password auth mode.'\n        );\n    }\n\n    if (!env.OCEAN_BRAIN_SESSION_SECRET) {\n        throw new Error(\n            'Missing OCEAN_BRAIN_SESSION_SECRET. Set OCEAN_BRAIN_SESSION_SECRET when password auth mode is enabled.'\n        );\n    }\n};\n\nexport const resolveAuthConfig = (env: AuthModeEnvironment): AuthConfig => {\n    const allowInsecureNoAuth = isTruthy(env.OCEAN_BRAIN_ALLOW_INSECURE_NO_AUTH);\n\n    if (allowInsecureNoAuth) {\n        return {\n            mode: 'disabled',\n            source: 'auto'\n        };\n    }\n\n    if (env.OCEAN_BRAIN_PASSWORD) {\n        ensurePasswordModeRequirements(env);\n\n        return {\n            mode: 'password',\n            password: env.OCEAN_BRAIN_PASSWORD,\n            sessionSecret: env.OCEAN_BRAIN_SESSION_SECRET,\n            source: 'auto'\n        };\n    }\n\n    throw new Error(\n        'Unable to resolve auth mode. Set OCEAN_BRAIN_PASSWORD and OCEAN_BRAIN_SESSION_SECRET for password mode, or set OCEAN_BRAIN_ALLOW_INSECURE_NO_AUTH=true for disabled mode.'\n    );\n};\n\nexport const logAuthConfig = (authConfig: AuthConfig) => {\n    if (authConfig.mode === 'disabled') {\n        process.stderr.write('[auth] Running in disabled mode. Authentication is not required for write access.\\n');\n        return;\n    }\n\n    process.stdout.write('[auth] Running in password mode. Write access requires an authenticated session.\\n');\n};\n"],"mappings":"AAgBA,MAAM,WAAW,CAAC,UAAmB;AACjC,MAAI,CAAC,OAAO;AACR,WAAO;AAAA,EACX;AAEA,SAAO,CAAC,KAAK,QAAQ,OAAO,IAAI,EAAE,SAAS,MAAM,KAAK,EAAE,YAAY,CAAC;AACzE;AAEA,MAAM,iCAAiC,CAAC,QAA6B;AACjE,MAAI,CAAC,IAAI,sBAAsB;AAC3B,UAAM,IAAI;AAAA,MACN;AAAA,IACJ;AAAA,EACJ;AAEA,MAAI,CAAC,IAAI,4BAA4B;AACjC,UAAM,IAAI;AAAA,MACN;AAAA,IACJ;AAAA,EACJ;AACJ;AAEO,MAAM,oBAAoB,CAAC,QAAyC;AACvE,QAAM,sBAAsB,SAAS,IAAI,kCAAkC;AAE3E,MAAI,qBAAqB;AACrB,WAAO;AAAA,MACH,MAAM;AAAA,MACN,QAAQ;AAAA,IACZ;AAAA,EACJ;AAEA,MAAI,IAAI,sBAAsB;AAC1B,mCAA+B,GAAG;AAElC,WAAO;AAAA,MACH,MAAM;AAAA,MACN,UAAU,IAAI;AAAA,MACd,eAAe,IAAI;AAAA,MACnB,QAAQ;AAAA,IACZ;AAAA,EACJ;AAEA,QAAM,IAAI;AAAA,IACN;AAAA,EACJ;AACJ;AAEO,MAAM,gBAAgB,CAAC,eAA2B;AACrD,MAAI,WAAW,SAAS,YAAY;AAChC,YAAQ,OAAO,MAAM,qFAAqF;AAC1G;AAAA,EACJ;AAEA,UAAQ,OAAO,MAAM,oFAAoF;AAC7G;","names":[]}

package/server/dist/modules/auth.js

@@ -9,8 +9,17 @@ const comparePassword = async (password, storedHash) => {
   const newHash = crypto.pbkdf2Sync(password, salt, 1e3, 64, "sha512").toString("hex");
   return hash === newHash;
 };
+const compareSharedSecret = (expected, received) => {
+  const expectedBuffer = Buffer.from(expected, "utf8");
+  const receivedBuffer = Buffer.from(received, "utf8");
+  if (expectedBuffer.length !== receivedBuffer.length) {
+    return false;
+  }
+  return crypto.timingSafeEqual(expectedBuffer, receivedBuffer);
+};
 export {
   comparePassword,
+  compareSharedSecret,
   createPasswordHash
 };
 //# sourceMappingURL=auth.js.map

package/server/dist/modules/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/modules/auth.ts"],"sourcesContent":["import crypto from 'crypto';\n\nexport const createPasswordHash = async (password: string) => {\n    const salt = crypto.randomBytes(16).toString('hex');\n    const hash = crypto.pbkdf2Sync(password, salt, 1000, 64, 'sha512').toString('hex');\n    return `${salt}:${hash}`;\n};\n\nexport const comparePassword = async (password: string, storedHash: string) => {\n    const [salt, hash] = storedHash.split(':');\n    const newHash = crypto.pbkdf2Sync(password, salt, 1000, 64, 'sha512').toString('hex');\n    return hash === newHash;\n};\n"],"mappings":"AAAA,OAAO,YAAY;AAEZ,MAAM,qBAAqB,OAAO,aAAqB;AAC1D,QAAM,OAAO,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAClD,QAAM,OAAO,OAAO,WAAW,UAAU,MAAM,KAAM,IAAI,QAAQ,EAAE,SAAS,KAAK;AACjF,SAAO,GAAG,IAAI,IAAI,IAAI;AAC1B;AAEO,MAAM,kBAAkB,OAAO,UAAkB,eAAuB;AAC3E,QAAM,CAAC,MAAM,IAAI,IAAI,WAAW,MAAM,GAAG;AACzC,QAAM,UAAU,OAAO,WAAW,UAAU,MAAM,KAAM,IAAI,QAAQ,EAAE,SAAS,KAAK;AACpF,SAAO,SAAS;AACpB;","names":[]}
+{"version":3,"sources":["../../src/modules/auth.ts"],"sourcesContent":["import crypto from 'crypto';\n\nexport const createPasswordHash = async (password: string) => {\n    const salt = crypto.randomBytes(16).toString('hex');\n    const hash = crypto.pbkdf2Sync(password, salt, 1000, 64, 'sha512').toString('hex');\n    return `${salt}:${hash}`;\n};\n\nexport const comparePassword = async (password: string, storedHash: string) => {\n    const [salt, hash] = storedHash.split(':');\n    const newHash = crypto.pbkdf2Sync(password, salt, 1000, 64, 'sha512').toString('hex');\n    return hash === newHash;\n};\n\nexport const compareSharedSecret = (expected: string, received: string) => {\n    const expectedBuffer = Buffer.from(expected, 'utf8');\n    const receivedBuffer = Buffer.from(received, 'utf8');\n\n    if (expectedBuffer.length !== receivedBuffer.length) {\n        return false;\n    }\n\n    return crypto.timingSafeEqual(expectedBuffer, receivedBuffer);\n};\n"],"mappings":"AAAA,OAAO,YAAY;AAEZ,MAAM,qBAAqB,OAAO,aAAqB;AAC1D,QAAM,OAAO,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAClD,QAAM,OAAO,OAAO,WAAW,UAAU,MAAM,KAAM,IAAI,QAAQ,EAAE,SAAS,KAAK;AACjF,SAAO,GAAG,IAAI,IAAI,IAAI;AAC1B;AAEO,MAAM,kBAAkB,OAAO,UAAkB,eAAuB;AAC3E,QAAM,CAAC,MAAM,IAAI,IAAI,WAAW,MAAM,GAAG;AACzC,QAAM,UAAU,OAAO,WAAW,UAAU,MAAM,KAAM,IAAI,QAAQ,EAAE,SAAS,KAAK;AACpF,SAAO,SAAS;AACpB;AAEO,MAAM,sBAAsB,CAAC,UAAkB,aAAqB;AACvE,QAAM,iBAAiB,OAAO,KAAK,UAAU,MAAM;AACnD,QAAM,iBAAiB,OAAO,KAAK,UAAU,MAAM;AAEnD,MAAI,eAAe,WAAW,eAAe,QAAQ;AACjD,WAAO;AAAA,EACX;AAEA,SAAO,OAAO,gBAAgB,gBAAgB,cAAc;AAChE;","names":[]}

package/server/dist/modules/blocknote.js

@@ -40,7 +40,13 @@ async function blocksToMarkdown(contentJson) {
     return "";
   }
 }
+async function markdownToBlocksJson(markdown) {
+  const editor = getEditor();
+  const blocks = await editor.tryParseMarkdownToBlocks(markdown);
+  return JSON.stringify(blocks);
+}
 export {
-  blocksToMarkdown
+  blocksToMarkdown,
+  markdownToBlocksJson
 };
 //# sourceMappingURL=blocknote.js.map

package/server/dist/modules/blocknote.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/modules/blocknote.ts"],"sourcesContent":["import { ServerBlockNoteEditor } from '@blocknote/server-util';\n\ninterface BlockNote {\n    id?: string;\n    type: string;\n    props?: Record<string, unknown>;\n    content?: BlockNote[];\n    children?: BlockNote[];\n    text?: string;\n    styles?: Record<string, unknown>;\n}\n\nfunction preprocessCustomInlineContent(blocks: BlockNote[]): BlockNote[] {\n    return blocks.map((block) => ({\n        ...block,\n        content: block.content?.map((inline) => {\n            if (inline.type === 'reference') {\n                return {\n                    type: 'text',\n                    text: `[[${inline.props?.title || inline.props?.id || ''}]]`,\n                    styles: {}\n                };\n            }\n            if (inline.type === 'tag') {\n                const tag = (inline.props?.tag as string)?.replace(/^@/, '') || '';\n                return {\n                    type: 'text',\n                    text: `#${tag}`,\n                    styles: {}\n                };\n            }\n            return inline;\n        }),\n        children: block.children?.length\n            ? preprocessCustomInlineContent(block.children)\n            : []\n    }));\n}\n\nlet editorInstance: ServerBlockNoteEditor | null = null;\n\nfunction getEditor(): ServerBlockNoteEditor {\n    if (!editorInstance) {\n        editorInstance = ServerBlockNoteEditor.create();\n    }\n    return editorInstance;\n}\n\nexport async function blocksToMarkdown(contentJson: string): Promise<string> {\n    try {\n        const blocks = JSON.parse(contentJson);\n        const processed = preprocessCustomInlineContent(blocks);\n        const editor = getEditor();\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        return await editor.blocksToMarkdownLossy(processed as any);\n    } catch {\n        return '';\n    }\n}\n"],"mappings":"AAAA,SAAS,6BAA6B;AAYtC,SAAS,8BAA8B,QAAkC;AACrE,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC1B,GAAG;AAAA,IACH,SAAS,MAAM,SAAS,IAAI,CAAC,WAAW;AACpC,UAAI,OAAO,SAAS,aAAa;AAC7B,eAAO;AAAA,UACH,MAAM;AAAA,UACN,MAAM,KAAK,OAAO,OAAO,SAAS,OAAO,OAAO,MAAM,EAAE;AAAA,UACxD,QAAQ,CAAC;AAAA,QACb;AAAA,MACJ;AACA,UAAI,OAAO,SAAS,OAAO;AACvB,cAAM,MAAO,OAAO,OAAO,KAAgB,QAAQ,MAAM,EAAE,KAAK;AAChE,eAAO;AAAA,UACH,MAAM;AAAA,UACN,MAAM,IAAI,GAAG;AAAA,UACb,QAAQ,CAAC;AAAA,QACb;AAAA,MACJ;AACA,aAAO;AAAA,IACX,CAAC;AAAA,IACD,UAAU,MAAM,UAAU,SACpB,8BAA8B,MAAM,QAAQ,IAC5C,CAAC;AAAA,EACX,EAAE;AACN;AAEA,IAAI,iBAA+C;AAEnD,SAAS,YAAmC;AACxC,MAAI,CAAC,gBAAgB;AACjB,qBAAiB,sBAAsB,OAAO;AAAA,EAClD;AACA,SAAO;AACX;AAEA,eAAsB,iBAAiB,aAAsC;AACzE,MAAI;AACA,UAAM,SAAS,KAAK,MAAM,WAAW;AACrC,UAAM,YAAY,8BAA8B,MAAM;AACtD,UAAM,SAAS,UAAU;AAEzB,WAAO,MAAM,OAAO,sBAAsB,SAAgB;AAAA,EAC9D,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;","names":[]}
+{"version":3,"sources":["../../src/modules/blocknote.ts"],"sourcesContent":["import { ServerBlockNoteEditor } from '@blocknote/server-util';\n\ninterface BlockNote {\n    id?: string;\n    type: string;\n    props?: Record<string, unknown>;\n    content?: BlockNote[];\n    children?: BlockNote[];\n    text?: string;\n    styles?: Record<string, unknown>;\n}\n\nfunction preprocessCustomInlineContent(blocks: BlockNote[]): BlockNote[] {\n    return blocks.map((block) => ({\n        ...block,\n        content: block.content?.map((inline) => {\n            if (inline.type === 'reference') {\n                return {\n                    type: 'text',\n                    text: `[[${inline.props?.title || inline.props?.id || ''}]]`,\n                    styles: {}\n                };\n            }\n            if (inline.type === 'tag') {\n                const tag = (inline.props?.tag as string)?.replace(/^@/, '') || '';\n                return {\n                    type: 'text',\n                    text: `#${tag}`,\n                    styles: {}\n                };\n            }\n            return inline;\n        }),\n        children: block.children?.length\n            ? preprocessCustomInlineContent(block.children)\n            : []\n    }));\n}\n\nlet editorInstance: ServerBlockNoteEditor | null = null;\n\nfunction getEditor(): ServerBlockNoteEditor {\n    if (!editorInstance) {\n        editorInstance = ServerBlockNoteEditor.create();\n    }\n    return editorInstance;\n}\n\nexport async function blocksToMarkdown(contentJson: string): Promise<string> {\n    try {\n        const blocks = JSON.parse(contentJson);\n        const processed = preprocessCustomInlineContent(blocks);\n        const editor = getEditor();\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        return await editor.blocksToMarkdownLossy(processed as any);\n    } catch {\n        return '';\n    }\n}\n\nexport async function markdownToBlocksJson(markdown: string): Promise<string> {\n    const editor = getEditor();\n    const blocks = await editor.tryParseMarkdownToBlocks(markdown);\n    return JSON.stringify(blocks);\n}\n"],"mappings":"AAAA,SAAS,6BAA6B;AAYtC,SAAS,8BAA8B,QAAkC;AACrE,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC1B,GAAG;AAAA,IACH,SAAS,MAAM,SAAS,IAAI,CAAC,WAAW;AACpC,UAAI,OAAO,SAAS,aAAa;AAC7B,eAAO;AAAA,UACH,MAAM;AAAA,UACN,MAAM,KAAK,OAAO,OAAO,SAAS,OAAO,OAAO,MAAM,EAAE;AAAA,UACxD,QAAQ,CAAC;AAAA,QACb;AAAA,MACJ;AACA,UAAI,OAAO,SAAS,OAAO;AACvB,cAAM,MAAO,OAAO,OAAO,KAAgB,QAAQ,MAAM,EAAE,KAAK;AAChE,eAAO;AAAA,UACH,MAAM;AAAA,UACN,MAAM,IAAI,GAAG;AAAA,UACb,QAAQ,CAAC;AAAA,QACb;AAAA,MACJ;AACA,aAAO;AAAA,IACX,CAAC;AAAA,IACD,UAAU,MAAM,UAAU,SACpB,8BAA8B,MAAM,QAAQ,IAC5C,CAAC;AAAA,EACX,EAAE;AACN;AAEA,IAAI,iBAA+C;AAEnD,SAAS,YAAmC;AACxC,MAAI,CAAC,gBAAgB;AACjB,qBAAiB,sBAAsB,OAAO;AAAA,EAClD;AACA,SAAO;AACX;AAEA,eAAsB,iBAAiB,aAAsC;AACzE,MAAI;AACA,UAAM,SAAS,KAAK,MAAM,WAAW;AACrC,UAAM,YAAY,8BAA8B,MAAM;AACtD,UAAM,SAAS,UAAU;AAEzB,WAAO,MAAM,OAAO,sBAAsB,SAAgB;AAAA,EAC9D,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;AAEA,eAAsB,qBAAqB,UAAmC;AAC1E,QAAM,SAAS,UAAU;AACzB,QAAM,SAAS,MAAM,OAAO,yBAAyB,QAAQ;AAC7D,SAAO,KAAK,UAAU,MAAM;AAChC;","names":[]}

package/server/dist/modules/error-handler.js

@@ -0,0 +1,41 @@
+class AppError extends Error {
+  code;
+  status;
+  constructor(status, code, message) {
+    super(message);
+    this.name = "AppError";
+    this.status = status;
+    this.code = code;
+  }
+}
+const createAppError = (status, code, message) => {
+  return new AppError(status, code, message);
+};
+const createErrorHandler = () => {
+  return (error, _req, res, next) => {
+    if (res.headersSent) {
+      next(error);
+      return;
+    }
+    if (error instanceof AppError) {
+      res.status(error.status).json({
+        code: error.code,
+        message: error.message
+      }).end();
+      return;
+    }
+    const message = error instanceof Error ? error.stack || error.message : String(error);
+    process.stderr.write(`[error] ${message}
+`);
+    res.status(500).json({
+      code: "INTERNAL_SERVER_ERROR",
+      message: "Internal Server Error"
+    }).end();
+  };
+};
+export {
+  AppError,
+  createAppError,
+  createErrorHandler
+};
+//# sourceMappingURL=error-handler.js.map

package/server/dist/modules/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/modules/error-handler.ts"],"sourcesContent":["import type { ErrorRequestHandler } from 'express';\n\nexport class AppError extends Error {\n    code: string;\n    status: number;\n\n    constructor(status: number, code: string, message: string) {\n        super(message);\n        this.name = 'AppError';\n        this.status = status;\n        this.code = code;\n    }\n}\n\nexport const createAppError = (status: number, code: string, message: string) => {\n    return new AppError(status, code, message);\n};\n\nexport const createErrorHandler = (): ErrorRequestHandler => {\n    return (error, _req, res, next) => {\n        if (res.headersSent) {\n            next(error);\n            return;\n        }\n\n        if (error instanceof AppError) {\n            res.status(error.status).json({\n                code: error.code,\n                message: error.message\n            }).end();\n            return;\n        }\n\n        const message = error instanceof Error ? error.stack || error.message : String(error);\n        process.stderr.write(`[error] ${message}\\n`);\n\n        res.status(500).json({\n            code: 'INTERNAL_SERVER_ERROR',\n            message: 'Internal Server Error'\n        }).end();\n    };\n};\n"],"mappings":"AAEO,MAAM,iBAAiB,MAAM;AAAA,EAChC;AAAA,EACA;AAAA,EAEA,YAAY,QAAgB,MAAc,SAAiB;AACvD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EAChB;AACJ;AAEO,MAAM,iBAAiB,CAAC,QAAgB,MAAc,YAAoB;AAC7E,SAAO,IAAI,SAAS,QAAQ,MAAM,OAAO;AAC7C;AAEO,MAAM,qBAAqB,MAA2B;AACzD,SAAO,CAAC,OAAO,MAAM,KAAK,SAAS;AAC/B,QAAI,IAAI,aAAa;AACjB,WAAK,KAAK;AACV;AAAA,IACJ;AAEA,QAAI,iBAAiB,UAAU;AAC3B,UAAI,OAAO,MAAM,MAAM,EAAE,KAAK;AAAA,QAC1B,MAAM,MAAM;AAAA,QACZ,SAAS,MAAM;AAAA,MACnB,CAAC,EAAE,IAAI;AACP;AAAA,IACJ;AAEA,UAAM,UAAU,iBAAiB,QAAQ,MAAM,SAAS,MAAM,UAAU,OAAO,KAAK;AACpF,YAAQ,OAAO,MAAM,WAAW,OAAO;AAAA,CAAI;AAE3C,QAAI,OAAO,GAAG,EAAE,KAAK;AAAA,MACjB,MAAM;AAAA,MACN,SAAS;AAAA,IACb,CAAC,EAAE,IAAI;AAAA,EACX;AACJ;","names":[]}