ocean-brain 0.7.4 → 0.8.0

package/server/dist/features/note/services/write.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/features/note/services/write.ts"],"sourcesContent":["import models, { type NoteLayout, Prisma } from '~/models.js';\nimport { buildNoteSearchProjection } from './search.js';\nimport { captureNoteBaseline } from './snapshot.js';\nimport { createNoteVersionConflictError, MissingNoteVersionError, parseNoteVersion } from './write-conflict.js';\n\nexport interface NoteWriteRecord {\n    id: number;\n    title: string;\n    content: string;\n    layout: NoteLayout;\n    createdAt: Date;\n    updatedAt: Date;\n    pinned: boolean;\n    order: number;\n}\n\ntype NoteWriteData = {\n    title?: string;\n    content?: string;\n    layout?: NoteLayout;\n    tagIds?: number[];\n};\n\ninterface UpdateNoteWithVersionGuardInput {\n    id: number;\n    data: NoteWriteData;\n    editSessionId?: string;\n    expectedUpdatedAt?: string;\n    snapshotMeta?: string;\n    force?: boolean;\n}\n\nexport interface GuardedNoteWriteResult {\n    note: NoteWriteRecord;\n    snapshot: unknown;\n}\n\ninterface NoteWriteDeps {\n    findNoteForWrite: (\n        id: number,\n    ) => Promise<Pick<NoteWriteRecord, 'title' | 'content' | 'updatedAt' | 'pinned' | 'order' | 'layout'> | null>;\n    findNoteVersion: (id: number) => Promise<Pick<NoteWriteRecord, 'updatedAt'> | null>;\n    captureBaseline: (input: {\n        noteId: number;\n        editSessionId?: string;\n        meta?: string;\n        baseline: Pick<NoteWriteRecord, 'id' | 'title' | 'content' | 'pinned' | 'order' | 'layout'>;\n        force?: boolean;\n    }) => Promise<unknown>;\n    updateNote: (input: {\n        where: {\n            id: number;\n            updatedAt?: Date;\n        };\n        data: {\n            title?: string;\n            content?: string;\n            layout?: NoteLayout;\n            searchableText: string;\n            searchableTextVersion: number;\n            tags?: {\n                set: Array<{ id: number }>;\n            };\n        };\n    }) => Promise<NoteWriteRecord>;\n    isRecordNotFoundError: (error: unknown) => boolean;\n}\n\nconst isRecordNotFoundError = (error: unknown) => {\n    return error instanceof Prisma.PrismaClientKnownRequestError && error.code === 'P2025';\n};\n\nexport const createNoteWriteService = (deps: NoteWriteDeps) => {\n    const updateNoteWithVersionGuardAndSnapshot = async ({\n        id,\n        data,\n        editSessionId,\n        expectedUpdatedAt,\n        snapshotMeta,\n        force = false,\n    }: UpdateNoteWithVersionGuardInput): Promise<GuardedNoteWriteResult | null> => {\n        const existingNote = await deps.findNoteForWrite(id);\n\n        if (!existingNote) {\n            return null;\n        }\n\n        const expectedTimestamp = parseNoteVersion(expectedUpdatedAt);\n\n        if (expectedTimestamp === null && !force) {\n            throw new MissingNoteVersionError();\n        }\n\n        const nextTitle = data.title ?? existingNote.title;\n        const nextContent = data.content ?? existingNote.content;\n        const where = force\n            ? { id }\n            : { id, updatedAt: new Date(expectedTimestamp ?? existingNote.updatedAt.getTime()) };\n\n        try {\n            const updatedNote = await deps.updateNote({\n                where,\n                data: {\n                    ...(data.title !== undefined ? { title: data.title } : {}),\n                    ...(data.content !== undefined ? { content: data.content } : {}),\n                    ...(data.layout !== undefined ? { layout: data.layout } : {}),\n                    ...buildNoteSearchProjection({\n                        title: nextTitle,\n                        content: nextContent,\n                    }),\n                    ...(data.tagIds ? { tags: { set: data.tagIds.map((tagId) => ({ id: tagId })) } } : {}),\n                },\n            });\n\n            const snapshot = await deps.captureBaseline({\n                noteId: id,\n                baseline: {\n                    id,\n                    title: existingNote.title,\n                    content: existingNote.content,\n                    pinned: existingNote.pinned,\n                    order: existingNote.order,\n                    layout: existingNote.layout,\n                },\n                ...(editSessionId && !force ? { editSessionId } : {}),\n                ...(snapshotMeta ? { meta: snapshotMeta } : {}),\n                ...(force ? { force: true } : {}),\n            });\n\n            return {\n                note: updatedNote,\n                snapshot,\n            };\n        } catch (error) {\n            if (deps.isRecordNotFoundError(error)) {\n                const currentNote = await deps.findNoteVersion(id);\n\n                if (!currentNote) {\n                    return null;\n                }\n\n                if (expectedTimestamp === null || currentNote.updatedAt.getTime() === expectedTimestamp) {\n                    throw error;\n                }\n\n                throw createNoteVersionConflictError({\n                    expectedUpdatedAt: expectedTimestamp,\n                    currentUpdatedAt: currentNote.updatedAt.getTime(),\n                });\n            }\n\n            throw error;\n        }\n    };\n\n    return {\n        updateNoteWithVersionGuard: async (input: UpdateNoteWithVersionGuardInput): Promise<NoteWriteRecord | null> => {\n            const result = await updateNoteWithVersionGuardAndSnapshot(input);\n            return result?.note ?? null;\n        },\n        updateNoteWithVersionGuardAndSnapshot,\n    };\n};\n\nconst defaultNoteWriteService = createNoteWriteService({\n    findNoteForWrite: (id) =>\n        models.note.findUnique({\n            where: { id },\n            select: {\n                title: true,\n                content: true,\n                updatedAt: true,\n                pinned: true,\n                order: true,\n                layout: true,\n            },\n        }),\n    findNoteVersion: (id) =>\n        models.note.findUnique({\n            where: { id },\n            select: {\n                updatedAt: true,\n            },\n        }),\n    captureBaseline: captureNoteBaseline,\n    updateNote: ({ where, data }) =>\n        models.note.update({\n            where,\n            data,\n        }),\n    isRecordNotFoundError,\n});\n\nexport const updateNoteWithVersionGuard = async (input: UpdateNoteWithVersionGuardInput) => {\n    return defaultNoteWriteService.updateNoteWithVersionGuard(input);\n};\n\nexport const updateNoteWithVersionGuardAndSnapshot = async (input: UpdateNoteWithVersionGuardInput) => {\n    return defaultNoteWriteService.updateNoteWithVersionGuardAndSnapshot(input);\n};\n"],"mappings":"AAAA,OAAO,UAA2B,cAAc;AAChD,SAAS,iCAAiC;AAC1C,SAAS,2BAA2B;AACpC,SAAS,gCAAgC,yBAAyB,wBAAwB;AAiE1F,MAAM,wBAAwB,CAAC,UAAmB;AAC9C,SAAO,iBAAiB,OAAO,iCAAiC,MAAM,SAAS;AACnF;AAEO,MAAM,yBAAyB,CAAC,SAAwB;AAC3D,QAAMA,yCAAwC,OAAO;AAAA,IACjD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACZ,MAA+E;AAC3E,UAAM,eAAe,MAAM,KAAK,iBAAiB,EAAE;AAEnD,QAAI,CAAC,cAAc;AACf,aAAO;AAAA,IACX;AAEA,UAAM,oBAAoB,iBAAiB,iBAAiB;AAE5D,QAAI,sBAAsB,QAAQ,CAAC,OAAO;AACtC,YAAM,IAAI,wBAAwB;AAAA,IACtC;AAEA,UAAM,YAAY,KAAK,SAAS,aAAa;AAC7C,UAAM,cAAc,KAAK,WAAW,aAAa;AACjD,UAAM,QAAQ,QACR,EAAE,GAAG,IACL,EAAE,IAAI,WAAW,IAAI,KAAK,qBAAqB,aAAa,UAAU,QAAQ,CAAC,EAAE;AAEvF,QAAI;AACA,YAAM,cAAc,MAAM,KAAK,WAAW;AAAA,QACtC;AAAA,QACA,MAAM;AAAA,UACF,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,UACxD,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,UAC9D,GAAI,KAAK,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,UAC3D,GAAG,0BAA0B;AAAA,YACzB,OAAO;AAAA,YACP,SAAS;AAAA,UACb,CAAC;AAAA,UACD,GAAI,KAAK,SAAS,EAAE,MAAM,EAAE,KAAK,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC;AAAA,QACxF;AAAA,MACJ,CAAC;AAED,YAAM,WAAW,MAAM,KAAK,gBAAgB;AAAA,QACxC,QAAQ;AAAA,QACR,UAAU;AAAA,UACN;AAAA,UACA,OAAO,aAAa;AAAA,UACpB,SAAS,aAAa;AAAA,UACtB,QAAQ,aAAa;AAAA,UACrB,OAAO,aAAa;AAAA,UACpB,QAAQ,aAAa;AAAA,QACzB;AAAA,QACA,GAAI,iBAAiB,CAAC,QAAQ,EAAE,cAAc,IAAI,CAAC;AAAA,QACnD,GAAI,eAAe,EAAE,MAAM,aAAa,IAAI,CAAC;AAAA,QAC7C,GAAI,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;AAAA,MACnC,CAAC;AAED,aAAO;AAAA,QACH,MAAM;AAAA,QACN;AAAA,MACJ;AAAA,IACJ,SAAS,OAAO;AACZ,UAAI,KAAK,sBAAsB,KAAK,GAAG;AACnC,cAAM,cAAc,MAAM,KAAK,gBAAgB,EAAE;AAEjD,YAAI,CAAC,aAAa;AACd,iBAAO;AAAA,QACX;AAEA,YAAI,sBAAsB,QAAQ,YAAY,UAAU,QAAQ,MAAM,mBAAmB;AACrF,gBAAM;AAAA,QACV;AAEA,cAAM,+BAA+B;AAAA,UACjC,mBAAmB;AAAA,UACnB,kBAAkB,YAAY,UAAU,QAAQ;AAAA,QACpD,CAAC;AAAA,MACL;AAEA,YAAM;AAAA,IACV;AAAA,EACJ;AAEA,SAAO;AAAA,IACH,4BAA4B,OAAO,UAA4E;AAC3G,YAAM,SAAS,MAAMA,uCAAsC,KAAK;AAChE,aAAO,QAAQ,QAAQ;AAAA,IAC3B;AAAA,IACA,uCAAAA;AAAA,EACJ;AACJ;AAEA,MAAM,0BAA0B,uBAAuB;AAAA,EACnD,kBAAkB,CAAC,OACf,OAAO,KAAK,WAAW;AAAA,IACnB,OAAO,EAAE,GAAG;AAAA,IACZ,QAAQ;AAAA,MACJ,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,IACZ;AAAA,EACJ,CAAC;AAAA,EACL,iBAAiB,CAAC,OACd,OAAO,KAAK,WAAW;AAAA,IACnB,OAAO,EAAE,GAAG;AAAA,IACZ,QAAQ;AAAA,MACJ,WAAW;AAAA,IACf;AAAA,EACJ,CAAC;AAAA,EACL,iBAAiB;AAAA,EACjB,YAAY,CAAC,EAAE,OAAO,KAAK,MACvB,OAAO,KAAK,OAAO;AAAA,IACf;AAAA,IACA;AAAA,EACJ,CAAC;AAAA,EACL;AACJ,CAAC;AAEM,MAAM,6BAA6B,OAAO,UAA2C;AACxF,SAAO,wBAAwB,2BAA2B,KAAK;AACnE;AAEO,MAAM,wCAAwC,OAAO,UAA2C;AACnG,SAAO,wBAAwB,sCAAsC,KAAK;AAC9E;","names":["updateNoteWithVersionGuardAndSnapshot"]}
+{"version":3,"sources":["../../../../src/features/note/services/write.ts"],"sourcesContent":["import models, { type NoteLayout, Prisma } from '~/models.js';\nimport { buildNoteSearchProjection } from './search.js';\nimport { captureNoteBaseline } from './snapshot.js';\nimport { createNoteVersionConflictError, MissingNoteVersionError, parseNoteVersion } from './write-conflict.js';\n\nexport interface NoteWriteRecord {\n    id: number;\n    title: string;\n    content: string;\n    layout: NoteLayout;\n    createdAt: Date;\n    updatedAt: Date;\n    pinned: boolean;\n    order: number;\n}\n\ntype NoteWriteData = {\n    title?: string;\n    content?: string;\n    layout?: NoteLayout;\n    tagIds?: number[];\n};\n\ninterface UpdateNoteWithVersionGuardInput {\n    id: number;\n    data: NoteWriteData;\n    editSessionId?: string;\n    expectedUpdatedAt?: string;\n    snapshotMeta?: string;\n    force?: boolean;\n}\n\nexport interface GuardedNoteWriteResult {\n    note: NoteWriteRecord;\n    snapshot: unknown;\n}\n\ninterface NoteWriteDeps {\n    findNoteForWrite: (\n        id: number,\n    ) => Promise<Pick<NoteWriteRecord, 'title' | 'content' | 'updatedAt' | 'pinned' | 'order' | 'layout'> | null>;\n    findNoteVersion: (id: number) => Promise<Pick<NoteWriteRecord, 'updatedAt'> | null>;\n    captureBaseline: (input: {\n        noteId: number;\n        editSessionId?: string;\n        meta?: string;\n        baseline: Pick<NoteWriteRecord, 'id' | 'title' | 'content' | 'pinned' | 'order' | 'layout'>;\n        force?: boolean;\n    }) => Promise<unknown>;\n    updateNote: (input: {\n        where: {\n            id: number;\n            updatedAt?: Date;\n        };\n        data: {\n            title?: string;\n            content?: string;\n            layout?: NoteLayout;\n            searchableText: string;\n            searchableTextVersion: number;\n            tags?: {\n                set: Array<{ id: number }>;\n            };\n        };\n    }) => Promise<NoteWriteRecord>;\n    isRecordNotFoundError: (error: unknown) => boolean;\n}\n\nconst isRecordNotFoundError = (error: unknown) => {\n    return error instanceof Prisma.PrismaClientKnownRequestError && error.code === 'P2025';\n};\n\nexport const createNoteWriteService = (deps: NoteWriteDeps) => {\n    const updateNoteWithVersionGuardAndSnapshot = async ({\n        id,\n        data,\n        editSessionId,\n        expectedUpdatedAt,\n        snapshotMeta,\n        force = false,\n    }: UpdateNoteWithVersionGuardInput): Promise<GuardedNoteWriteResult | null> => {\n        const existingNote = await deps.findNoteForWrite(id);\n\n        if (!existingNote) {\n            return null;\n        }\n\n        const expectedTimestamp = parseNoteVersion(expectedUpdatedAt);\n\n        if (expectedTimestamp === null && !force) {\n            throw new MissingNoteVersionError();\n        }\n\n        const nextTitle = data.title ?? existingNote.title;\n        const nextContent = data.content ?? existingNote.content;\n        const where = force\n            ? { id }\n            : { id, updatedAt: new Date(expectedTimestamp ?? existingNote.updatedAt.getTime()) };\n\n        try {\n            const snapshot = await deps.captureBaseline({\n                noteId: id,\n                baseline: {\n                    id,\n                    title: existingNote.title,\n                    content: existingNote.content,\n                    pinned: existingNote.pinned,\n                    order: existingNote.order,\n                    layout: existingNote.layout,\n                },\n                ...(editSessionId && !force ? { editSessionId } : {}),\n                ...(snapshotMeta ? { meta: snapshotMeta } : {}),\n                ...(force ? { force: true } : {}),\n            });\n\n            const updatedNote = await deps.updateNote({\n                where,\n                data: {\n                    ...(data.title !== undefined ? { title: data.title } : {}),\n                    ...(data.content !== undefined ? { content: data.content } : {}),\n                    ...(data.layout !== undefined ? { layout: data.layout } : {}),\n                    ...buildNoteSearchProjection({\n                        title: nextTitle,\n                        content: nextContent,\n                    }),\n                    ...(data.tagIds ? { tags: { set: data.tagIds.map((tagId) => ({ id: tagId })) } } : {}),\n                },\n            });\n\n            return {\n                note: updatedNote,\n                snapshot,\n            };\n        } catch (error) {\n            if (deps.isRecordNotFoundError(error)) {\n                const currentNote = await deps.findNoteVersion(id);\n\n                if (!currentNote) {\n                    return null;\n                }\n\n                if (expectedTimestamp === null || currentNote.updatedAt.getTime() === expectedTimestamp) {\n                    throw error;\n                }\n\n                throw createNoteVersionConflictError({\n                    expectedUpdatedAt: expectedTimestamp,\n                    currentUpdatedAt: currentNote.updatedAt.getTime(),\n                });\n            }\n\n            throw error;\n        }\n    };\n\n    return {\n        updateNoteWithVersionGuard: async (input: UpdateNoteWithVersionGuardInput): Promise<NoteWriteRecord | null> => {\n            const result = await updateNoteWithVersionGuardAndSnapshot(input);\n            return result?.note ?? null;\n        },\n        updateNoteWithVersionGuardAndSnapshot,\n    };\n};\n\nconst defaultNoteWriteService = createNoteWriteService({\n    findNoteForWrite: (id) =>\n        models.note.findUnique({\n            where: { id },\n            select: {\n                title: true,\n                content: true,\n                updatedAt: true,\n                pinned: true,\n                order: true,\n                layout: true,\n            },\n        }),\n    findNoteVersion: (id) =>\n        models.note.findUnique({\n            where: { id },\n            select: {\n                updatedAt: true,\n            },\n        }),\n    captureBaseline: captureNoteBaseline,\n    updateNote: ({ where, data }) =>\n        models.note.update({\n            where,\n            data,\n        }),\n    isRecordNotFoundError,\n});\n\nexport const updateNoteWithVersionGuard = async (input: UpdateNoteWithVersionGuardInput) => {\n    return defaultNoteWriteService.updateNoteWithVersionGuard(input);\n};\n\nexport const updateNoteWithVersionGuardAndSnapshot = async (input: UpdateNoteWithVersionGuardInput) => {\n    return defaultNoteWriteService.updateNoteWithVersionGuardAndSnapshot(input);\n};\n"],"mappings":"AAAA,OAAO,UAA2B,cAAc;AAChD,SAAS,iCAAiC;AAC1C,SAAS,2BAA2B;AACpC,SAAS,gCAAgC,yBAAyB,wBAAwB;AAiE1F,MAAM,wBAAwB,CAAC,UAAmB;AAC9C,SAAO,iBAAiB,OAAO,iCAAiC,MAAM,SAAS;AACnF;AAEO,MAAM,yBAAyB,CAAC,SAAwB;AAC3D,QAAMA,yCAAwC,OAAO;AAAA,IACjD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACZ,MAA+E;AAC3E,UAAM,eAAe,MAAM,KAAK,iBAAiB,EAAE;AAEnD,QAAI,CAAC,cAAc;AACf,aAAO;AAAA,IACX;AAEA,UAAM,oBAAoB,iBAAiB,iBAAiB;AAE5D,QAAI,sBAAsB,QAAQ,CAAC,OAAO;AACtC,YAAM,IAAI,wBAAwB;AAAA,IACtC;AAEA,UAAM,YAAY,KAAK,SAAS,aAAa;AAC7C,UAAM,cAAc,KAAK,WAAW,aAAa;AACjD,UAAM,QAAQ,QACR,EAAE,GAAG,IACL,EAAE,IAAI,WAAW,IAAI,KAAK,qBAAqB,aAAa,UAAU,QAAQ,CAAC,EAAE;AAEvF,QAAI;AACA,YAAM,WAAW,MAAM,KAAK,gBAAgB;AAAA,QACxC,QAAQ;AAAA,QACR,UAAU;AAAA,UACN;AAAA,UACA,OAAO,aAAa;AAAA,UACpB,SAAS,aAAa;AAAA,UACtB,QAAQ,aAAa;AAAA,UACrB,OAAO,aAAa;AAAA,UACpB,QAAQ,aAAa;AAAA,QACzB;AAAA,QACA,GAAI,iBAAiB,CAAC,QAAQ,EAAE,cAAc,IAAI,CAAC;AAAA,QACnD,GAAI,eAAe,EAAE,MAAM,aAAa,IAAI,CAAC;AAAA,QAC7C,GAAI,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;AAAA,MACnC,CAAC;AAED,YAAM,cAAc,MAAM,KAAK,WAAW;AAAA,QACtC;AAAA,QACA,MAAM;AAAA,UACF,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,UACxD,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,UAC9D,GAAI,KAAK,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,UAC3D,GAAG,0BAA0B;AAAA,YACzB,OAAO;AAAA,YACP,SAAS;AAAA,UACb,CAAC;AAAA,UACD,GAAI,KAAK,SAAS,EAAE,MAAM,EAAE,KAAK,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC;AAAA,QACxF;AAAA,MACJ,CAAC;AAED,aAAO;AAAA,QACH,MAAM;AAAA,QACN;AAAA,MACJ;AAAA,IACJ,SAAS,OAAO;AACZ,UAAI,KAAK,sBAAsB,KAAK,GAAG;AACnC,cAAM,cAAc,MAAM,KAAK,gBAAgB,EAAE;AAEjD,YAAI,CAAC,aAAa;AACd,iBAAO;AAAA,QACX;AAEA,YAAI,sBAAsB,QAAQ,YAAY,UAAU,QAAQ,MAAM,mBAAmB;AACrF,gBAAM;AAAA,QACV;AAEA,cAAM,+BAA+B;AAAA,UACjC,mBAAmB;AAAA,UACnB,kBAAkB,YAAY,UAAU,QAAQ;AAAA,QACpD,CAAC;AAAA,MACL;AAEA,YAAM;AAAA,IACV;AAAA,EACJ;AAEA,SAAO;AAAA,IACH,4BAA4B,OAAO,UAA4E;AAC3G,YAAM,SAAS,MAAMA,uCAAsC,KAAK;AAChE,aAAO,QAAQ,QAAQ;AAAA,IAC3B;AAAA,IACA,uCAAAA;AAAA,EACJ;AACJ;AAEA,MAAM,0BAA0B,uBAAuB;AAAA,EACnD,kBAAkB,CAAC,OACf,OAAO,KAAK,WAAW;AAAA,IACnB,OAAO,EAAE,GAAG;AAAA,IACZ,QAAQ;AAAA,MACJ,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,IACZ;AAAA,EACJ,CAAC;AAAA,EACL,iBAAiB,CAAC,OACd,OAAO,KAAK,WAAW;AAAA,IACnB,OAAO,EAAE,GAAG;AAAA,IACZ,QAAQ;AAAA,MACJ,WAAW;AAAA,IACf;AAAA,EACJ,CAAC;AAAA,EACL,iBAAiB;AAAA,EACjB,YAAY,CAAC,EAAE,OAAO,KAAK,MACvB,OAAO,KAAK,OAAO;AAAA,IACf;AAAA,IACA;AAAA,EACJ,CAAC;AAAA,EACL;AACJ,CAAC;AAEM,MAAM,6BAA6B,OAAO,UAA2C;AACxF,SAAO,wBAAwB,2BAA2B,KAAK;AACnE;AAEO,MAAM,wCAAwC,OAAO,UAA2C;AACnG,SAAO,wBAAwB,sCAAsC,KAAK;AAC9E;","names":["updateNoteWithVersionGuardAndSnapshot"]}

package/server/dist/features/tag/graphql/tag.query.resolver.js

@@ -1,4 +1,17 @@
 import models from "../../../models.js";
+const TAG_SORT_FIELDS = /* @__PURE__ */ new Set(["referenceCount", "name"]);
+const normalizeSortBy = (sortBy) => {
+  return TAG_SORT_FIELDS.has(sortBy) ? sortBy : "referenceCount";
+};
+const normalizeSortOrder = (sortOrder) => {
+  return sortOrder === "asc" ? "asc" : "desc";
+};
+const getTagOrderBy = (sortBy, sortOrder) => {
+  if (sortBy === "referenceCount") {
+    return { notes: { _count: sortOrder } };
+  }
+  return { [sortBy]: sortOrder };
+};
 const tagQueryResolvers = {
   allTags: async (_, {
     searchFilter,
@@ -8,11 +21,13 @@ const tagQueryResolvers = {
       name: { contains: searchFilter.query },
       NOT: { notes: { none: {} } }
     };
+    const sortBy = normalizeSortBy(searchFilter.sortBy);
+    const sortOrder = normalizeSortOrder(searchFilter.sortOrder);
     const tags = models.tag.findMany({
       skip: pagination.offset,
       take: pagination.limit,
       where,
-      orderBy: { notes: { _count: "desc" } }
+      orderBy: getTagOrderBy(sortBy, sortOrder)
     });
     return {
       totalCount: await models.tag.count({ where }),

package/server/dist/features/tag/graphql/tag.query.resolver.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/features/tag/graphql/tag.query.resolver.ts"],"sourcesContent":["import type { IResolvers } from '@graphql-tools/utils';\nimport type { Prisma } from '~/models.js';\nimport models from '~/models.js';\nimport type { Pagination, SearchFilter } from '~/types/index.js';\n\ntype TagQueryResolvers = NonNullable<IResolvers['Query']>;\n\nexport const tagQueryResolvers: TagQueryResolvers = {\n    allTags: async (\n        _,\n        {\n            searchFilter,\n            pagination,\n        }: {\n            searchFilter: SearchFilter;\n            pagination: Pagination;\n        },\n    ) => {\n        const where: Prisma.TagWhereInput = {\n            name: { contains: searchFilter.query },\n            NOT: { notes: { none: {} } },\n        };\n        const tags = models.tag.findMany({\n            skip: pagination.offset,\n            take: pagination.limit,\n            where,\n            orderBy: { notes: { _count: 'desc' } },\n        });\n\n        return {\n            totalCount: await models.tag.count({ where }),\n            tags: await tags,\n        };\n    },\n};\n"],"mappings":"AAEA,OAAO,YAAY;AAKZ,MAAM,oBAAuC;AAAA,EAChD,SAAS,OACL,GACA;AAAA,IACI;AAAA,IACA;AAAA,EACJ,MAIC;AACD,UAAM,QAA8B;AAAA,MAChC,MAAM,EAAE,UAAU,aAAa,MAAM;AAAA,MACrC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE;AAAA,IAC/B;AACA,UAAM,OAAO,OAAO,IAAI,SAAS;AAAA,MAC7B,MAAM,WAAW;AAAA,MACjB,MAAM,WAAW;AAAA,MACjB;AAAA,MACA,SAAS,EAAE,OAAO,EAAE,QAAQ,OAAO,EAAE;AAAA,IACzC,CAAC;AAED,WAAO;AAAA,MACH,YAAY,MAAM,OAAO,IAAI,MAAM,EAAE,MAAM,CAAC;AAAA,MAC5C,MAAM,MAAM;AAAA,IAChB;AAAA,EACJ;AACJ;","names":[]}
+{"version":3,"sources":["../../../../src/features/tag/graphql/tag.query.resolver.ts"],"sourcesContent":["import type { IResolvers } from '@graphql-tools/utils';\nimport type { Prisma } from '~/models.js';\nimport models from '~/models.js';\nimport type { Pagination, SearchFilter } from '~/types/index.js';\n\ntype TagQueryResolvers = NonNullable<IResolvers['Query']>;\ntype TagSortBy = 'referenceCount' | 'name';\ntype TagSortOrder = 'asc' | 'desc';\n\nconst TAG_SORT_FIELDS = new Set<TagSortBy>(['referenceCount', 'name']);\n\nconst normalizeSortBy = (sortBy?: string): TagSortBy => {\n    return TAG_SORT_FIELDS.has(sortBy as TagSortBy) ? (sortBy as TagSortBy) : 'referenceCount';\n};\n\nconst normalizeSortOrder = (sortOrder?: string): TagSortOrder => {\n    return sortOrder === 'asc' ? 'asc' : 'desc';\n};\n\nconst getTagOrderBy = (sortBy: TagSortBy, sortOrder: TagSortOrder): Prisma.TagOrderByWithRelationInput => {\n    if (sortBy === 'referenceCount') {\n        return { notes: { _count: sortOrder } };\n    }\n\n    return { [sortBy]: sortOrder };\n};\n\nexport const tagQueryResolvers: TagQueryResolvers = {\n    allTags: async (\n        _,\n        {\n            searchFilter,\n            pagination,\n        }: {\n            searchFilter: SearchFilter;\n            pagination: Pagination;\n        },\n    ) => {\n        const where: Prisma.TagWhereInput = {\n            name: { contains: searchFilter.query },\n            NOT: { notes: { none: {} } },\n        };\n        const sortBy = normalizeSortBy(searchFilter.sortBy);\n        const sortOrder = normalizeSortOrder(searchFilter.sortOrder);\n        const tags = models.tag.findMany({\n            skip: pagination.offset,\n            take: pagination.limit,\n            where,\n            orderBy: getTagOrderBy(sortBy, sortOrder),\n        });\n\n        return {\n            totalCount: await models.tag.count({ where }),\n            tags: await tags,\n        };\n    },\n};\n"],"mappings":"AAEA,OAAO,YAAY;AAOnB,MAAM,kBAAkB,oBAAI,IAAe,CAAC,kBAAkB,MAAM,CAAC;AAErE,MAAM,kBAAkB,CAAC,WAA+B;AACpD,SAAO,gBAAgB,IAAI,MAAmB,IAAK,SAAuB;AAC9E;AAEA,MAAM,qBAAqB,CAAC,cAAqC;AAC7D,SAAO,cAAc,QAAQ,QAAQ;AACzC;AAEA,MAAM,gBAAgB,CAAC,QAAmB,cAAgE;AACtG,MAAI,WAAW,kBAAkB;AAC7B,WAAO,EAAE,OAAO,EAAE,QAAQ,UAAU,EAAE;AAAA,EAC1C;AAEA,SAAO,EAAE,CAAC,MAAM,GAAG,UAAU;AACjC;AAEO,MAAM,oBAAuC;AAAA,EAChD,SAAS,OACL,GACA;AAAA,IACI;AAAA,IACA;AAAA,EACJ,MAIC;AACD,UAAM,QAA8B;AAAA,MAChC,MAAM,EAAE,UAAU,aAAa,MAAM;AAAA,MACrC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE;AAAA,IAC/B;AACA,UAAM,SAAS,gBAAgB,aAAa,MAAM;AAClD,UAAM,YAAY,mBAAmB,aAAa,SAAS;AAC3D,UAAM,OAAO,OAAO,IAAI,SAAS;AAAA,MAC7B,MAAM,WAAW;AAAA,MACjB,MAAM,WAAW;AAAA,MACjB;AAAA,MACA,SAAS,cAAc,QAAQ,SAAS;AAAA,IAC5C,CAAC;AAED,WAAO;AAAA,MACH,YAAY,MAAM,OAAO,IAAI,MAAM,EAAE,MAAM,CAAC;AAAA,MAC5C,MAAM,MAAM;AAAA,IAChB;AAAA,EACJ;AACJ;","names":[]}

package/server/dist/features/tag/graphql/tag.type-defs.js

@@ -7,6 +7,8 @@ const tagType = gql`
 
     input SearchFilterInput {
         query: String!
+        sortBy: String
+        sortOrder: String
     }
 
     type Tag {

package/server/dist/features/tag/graphql/tag.type-defs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/features/tag/graphql/tag.type-defs.ts"],"sourcesContent":["import { gql } from '~/modules/graphql.js';\n\nexport const tagType = gql`\n    input PaginationInput {\n        limit: Int!\n        offset: Int!\n    }\n\n    input SearchFilterInput {\n        query: String!\n    }\n\n    type Tag {\n        id: ID!\n        name: String!\n        createdAt: String!\n        updatedAt: String!\n        referenceCount: Int!\n    }\n\n    type Tags {\n        totalCount: Int!\n        tags: [Tag!]!\n    }\n`;\n\nexport const tagQuery = gql`\n    type Query {\n        allTags(searchFilter: SearchFilterInput, pagination: PaginationInput): Tags!\n    }\n`;\n\nexport const tagMutation = gql`\n    type Mutation {\n        createTag(name: String!): Tag!\n    }\n`;\n\nexport const tagTypeDefs = `\n    ${tagType}\n    ${tagQuery}\n    ${tagMutation}\n`;\n"],"mappings":"AAAA,SAAS,WAAW;AAEb,MAAM,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwBhB,MAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAMjB,MAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAMpB,MAAM,cAAc;AAAA,MACrB,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,WAAW;AAAA;","names":[]}
+{"version":3,"sources":["../../../../src/features/tag/graphql/tag.type-defs.ts"],"sourcesContent":["import { gql } from '~/modules/graphql.js';\n\nexport const tagType = gql`\n    input PaginationInput {\n        limit: Int!\n        offset: Int!\n    }\n\n    input SearchFilterInput {\n        query: String!\n        sortBy: String\n        sortOrder: String\n    }\n\n    type Tag {\n        id: ID!\n        name: String!\n        createdAt: String!\n        updatedAt: String!\n        referenceCount: Int!\n    }\n\n    type Tags {\n        totalCount: Int!\n        tags: [Tag!]!\n    }\n`;\n\nexport const tagQuery = gql`\n    type Query {\n        allTags(searchFilter: SearchFilterInput, pagination: PaginationInput): Tags!\n    }\n`;\n\nexport const tagMutation = gql`\n    type Mutation {\n        createTag(name: String!): Tag!\n    }\n`;\n\nexport const tagTypeDefs = `\n    ${tagType}\n    ${tagQuery}\n    ${tagMutation}\n`;\n"],"mappings":"AAAA,SAAS,WAAW;AAEb,MAAM,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0BhB,MAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAMjB,MAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAMpB,MAAM,cAAc;AAAA,MACrB,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,WAAW;AAAA;","names":[]}

package/server/dist/modules/app-version.js

@@ -0,0 +1,105 @@
+import fs from "fs";
+import path from "path";
+import { paths } from "../paths.js";
+const OCEAN_BRAIN_RELEASES_URL = "https://github.com/baealex/ocean-brain/releases";
+const OCEAN_BRAIN_MCP_COMPATIBILITY_VERSION_HEADER = "X-Ocean-Brain-MCP-Compatibility-Version";
+const OCEAN_BRAIN_MCP_CLIENT_VERSION_HEADER = "X-Ocean-Brain-MCP-Client-Version";
+const normalizeVersion = (version) => version.trim().replace(/^v/i, "");
+const parseMajorMinorVersion = (version) => {
+  const match = normalizeVersion(version).match(/^(\d+)\.(\d+)(?:\.\d+)?(?:[-+].*)?$/);
+  if (!match) {
+    return null;
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2])
+  };
+};
+const formatMcpVersionRequirement = (mcpCompatibilityVersion) => {
+  const parsed = parseMajorMinorVersion(mcpCompatibilityVersion);
+  return parsed ? `${parsed.major}.${parsed.minor}.x` : "unknown";
+};
+const readPackageMetadata = (packageJsonPath) => {
+  try {
+    return JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+  } catch {
+    return void 0;
+  }
+};
+const readPackageVersion = (packageJsonPath) => {
+  const packageJson = readPackageMetadata(packageJsonPath);
+  return typeof packageJson?.version === "string" ? packageJson.version : void 0;
+};
+const readPackageMcpCompatibilityVersion = (packageJsonPath) => {
+  const packageJson = readPackageMetadata(packageJsonPath);
+  const version = packageJson?.oceanBrain?.mcpCompatibilityVersion;
+  return typeof version === "string" ? version : void 0;
+};
+const createMissingMcpCompatibilityVersionError = () => new Error("Ocean Brain MCP compatibility version is required in package metadata.");
+const getVersionCandidatePaths = () => {
+  return Array.from(
+    /* @__PURE__ */ new Set([
+      path.resolve(paths.packageRoot, "..", "package.json"),
+      path.resolve(paths.packageRoot, "..", "cli", "package.json"),
+      path.resolve(process.cwd(), "packages", "cli", "package.json"),
+      path.resolve(process.cwd(), "..", "cli", "package.json")
+    ])
+  );
+};
+const resolveOceanBrainVersion = () => {
+  for (const candidatePath of getVersionCandidatePaths()) {
+    const version = readPackageVersion(candidatePath);
+    if (version) {
+      return normalizeVersion(version);
+    }
+  }
+  if (process.env.OCEAN_BRAIN_VERSION) {
+    return normalizeVersion(process.env.OCEAN_BRAIN_VERSION);
+  }
+  return "0.0.0";
+};
+const resolveMcpCompatibilityVersionFromPaths = (candidatePaths) => {
+  for (const candidatePath of candidatePaths) {
+    const version = readPackageMcpCompatibilityVersion(candidatePath);
+    if (version) {
+      return normalizeVersion(version);
+    }
+  }
+  throw createMissingMcpCompatibilityVersionError();
+};
+const resolveMcpCompatibilityVersion = () => resolveMcpCompatibilityVersionFromPaths(getVersionCandidatePaths());
+const buildOceanBrainVersionInfo = ({
+  mcpCompatibilityVersion,
+  version
+}) => {
+  const compatibilityVersion = normalizeVersion(mcpCompatibilityVersion);
+  const compatibilityRequirement = formatMcpVersionRequirement(compatibilityVersion);
+  return {
+    version: normalizeVersion(version),
+    releaseUrl: OCEAN_BRAIN_RELEASES_URL,
+    mcpVersionRequirement: compatibilityRequirement,
+    mcp: {
+      compatibilityVersion,
+      compatibilityRequirement,
+      compatibilityVersionHeader: OCEAN_BRAIN_MCP_COMPATIBILITY_VERSION_HEADER,
+      clientVersionHeader: OCEAN_BRAIN_MCP_CLIENT_VERSION_HEADER
+    }
+  };
+};
+const getOceanBrainVersionInfo = () => buildOceanBrainVersionInfo({
+  version: resolveOceanBrainVersion(),
+  mcpCompatibilityVersion: resolveMcpCompatibilityVersion()
+});
+export {
+  OCEAN_BRAIN_MCP_CLIENT_VERSION_HEADER,
+  OCEAN_BRAIN_MCP_COMPATIBILITY_VERSION_HEADER,
+  OCEAN_BRAIN_RELEASES_URL,
+  buildOceanBrainVersionInfo,
+  formatMcpVersionRequirement,
+  getOceanBrainVersionInfo,
+  parseMajorMinorVersion,
+  resolveMcpCompatibilityVersion,
+  resolveMcpCompatibilityVersionFromPaths,
+  resolveOceanBrainVersion
+};
+//# sourceMappingURL=app-version.js.map

package/server/dist/modules/app-version.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/modules/app-version.ts"],"sourcesContent":["import fs from 'fs';\nimport path from 'path';\n\nimport { paths } from '~/paths.js';\n\nexport const OCEAN_BRAIN_RELEASES_URL = 'https://github.com/baealex/ocean-brain/releases';\nexport const OCEAN_BRAIN_MCP_COMPATIBILITY_VERSION_HEADER = 'X-Ocean-Brain-MCP-Compatibility-Version';\nexport const OCEAN_BRAIN_MCP_CLIENT_VERSION_HEADER = 'X-Ocean-Brain-MCP-Client-Version';\n\ninterface MajorMinorVersion {\n    major: number;\n    minor: number;\n}\n\ninterface PackageMetadata {\n    oceanBrain?: {\n        mcpCompatibilityVersion?: unknown;\n    };\n    version?: unknown;\n}\n\nexport interface OceanBrainVersionInfo {\n    version: string;\n    releaseUrl: string;\n    mcpVersionRequirement: string;\n    mcp: {\n        compatibilityVersion: string;\n        compatibilityRequirement: string;\n        compatibilityVersionHeader: string;\n        clientVersionHeader: string;\n    };\n}\n\nconst normalizeVersion = (version: string) => version.trim().replace(/^v/i, '');\n\nexport const parseMajorMinorVersion = (version: string): MajorMinorVersion | null => {\n    const match = normalizeVersion(version).match(/^(\\d+)\\.(\\d+)(?:\\.\\d+)?(?:[-+].*)?$/);\n\n    if (!match) {\n        return null;\n    }\n\n    return {\n        major: Number(match[1]),\n        minor: Number(match[2]),\n    };\n};\n\nexport const formatMcpVersionRequirement = (mcpCompatibilityVersion: string) => {\n    const parsed = parseMajorMinorVersion(mcpCompatibilityVersion);\n    return parsed ? `${parsed.major}.${parsed.minor}.x` : 'unknown';\n};\n\nconst readPackageMetadata = (packageJsonPath: string): PackageMetadata | undefined => {\n    try {\n        return JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8')) as PackageMetadata;\n    } catch {\n        return undefined;\n    }\n};\n\nconst readPackageVersion = (packageJsonPath: string) => {\n    const packageJson = readPackageMetadata(packageJsonPath);\n    return typeof packageJson?.version === 'string' ? packageJson.version : undefined;\n};\n\nconst readPackageMcpCompatibilityVersion = (packageJsonPath: string) => {\n    const packageJson = readPackageMetadata(packageJsonPath);\n    const version = packageJson?.oceanBrain?.mcpCompatibilityVersion;\n    return typeof version === 'string' ? version : undefined;\n};\n\nconst createMissingMcpCompatibilityVersionError = () =>\n    new Error('Ocean Brain MCP compatibility version is required in package metadata.');\n\nconst getVersionCandidatePaths = () => {\n    return Array.from(\n        new Set([\n            path.resolve(paths.packageRoot, '..', 'package.json'),\n            path.resolve(paths.packageRoot, '..', 'cli', 'package.json'),\n            path.resolve(process.cwd(), 'packages', 'cli', 'package.json'),\n            path.resolve(process.cwd(), '..', 'cli', 'package.json'),\n        ]),\n    );\n};\n\nexport const resolveOceanBrainVersion = () => {\n    for (const candidatePath of getVersionCandidatePaths()) {\n        const version = readPackageVersion(candidatePath);\n        if (version) {\n            return normalizeVersion(version);\n        }\n    }\n\n    if (process.env.OCEAN_BRAIN_VERSION) {\n        return normalizeVersion(process.env.OCEAN_BRAIN_VERSION);\n    }\n\n    return '0.0.0';\n};\n\nexport const resolveMcpCompatibilityVersionFromPaths = (candidatePaths: string[]) => {\n    for (const candidatePath of candidatePaths) {\n        const version = readPackageMcpCompatibilityVersion(candidatePath);\n        if (version) {\n            return normalizeVersion(version);\n        }\n    }\n\n    throw createMissingMcpCompatibilityVersionError();\n};\n\nexport const resolveMcpCompatibilityVersion = () => resolveMcpCompatibilityVersionFromPaths(getVersionCandidatePaths());\n\nexport const buildOceanBrainVersionInfo = ({\n    mcpCompatibilityVersion,\n    version,\n}: {\n    mcpCompatibilityVersion: string;\n    version: string;\n}): OceanBrainVersionInfo => {\n    const compatibilityVersion = normalizeVersion(mcpCompatibilityVersion);\n    const compatibilityRequirement = formatMcpVersionRequirement(compatibilityVersion);\n\n    return {\n        version: normalizeVersion(version),\n        releaseUrl: OCEAN_BRAIN_RELEASES_URL,\n        mcpVersionRequirement: compatibilityRequirement,\n        mcp: {\n            compatibilityVersion,\n            compatibilityRequirement,\n            compatibilityVersionHeader: OCEAN_BRAIN_MCP_COMPATIBILITY_VERSION_HEADER,\n            clientVersionHeader: OCEAN_BRAIN_MCP_CLIENT_VERSION_HEADER,\n        },\n    };\n};\n\nexport const getOceanBrainVersionInfo = () =>\n    buildOceanBrainVersionInfo({\n        version: resolveOceanBrainVersion(),\n        mcpCompatibilityVersion: resolveMcpCompatibilityVersion(),\n    });\n"],"mappings":"AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AAEjB,SAAS,aAAa;AAEf,MAAM,2BAA2B;AACjC,MAAM,+CAA+C;AACrD,MAAM,wCAAwC;AA0BrD,MAAM,mBAAmB,CAAC,YAAoB,QAAQ,KAAK,EAAE,QAAQ,OAAO,EAAE;AAEvE,MAAM,yBAAyB,CAAC,YAA8C;AACjF,QAAM,QAAQ,iBAAiB,OAAO,EAAE,MAAM,qCAAqC;AAEnF,MAAI,CAAC,OAAO;AACR,WAAO;AAAA,EACX;AAEA,SAAO;AAAA,IACH,OAAO,OAAO,MAAM,CAAC,CAAC;AAAA,IACtB,OAAO,OAAO,MAAM,CAAC,CAAC;AAAA,EAC1B;AACJ;AAEO,MAAM,8BAA8B,CAAC,4BAAoC;AAC5E,QAAM,SAAS,uBAAuB,uBAAuB;AAC7D,SAAO,SAAS,GAAG,OAAO,KAAK,IAAI,OAAO,KAAK,OAAO;AAC1D;AAEA,MAAM,sBAAsB,CAAC,oBAAyD;AAClF,MAAI;AACA,WAAO,KAAK,MAAM,GAAG,aAAa,iBAAiB,OAAO,CAAC;AAAA,EAC/D,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;AAEA,MAAM,qBAAqB,CAAC,oBAA4B;AACpD,QAAM,cAAc,oBAAoB,eAAe;AACvD,SAAO,OAAO,aAAa,YAAY,WAAW,YAAY,UAAU;AAC5E;AAEA,MAAM,qCAAqC,CAAC,oBAA4B;AACpE,QAAM,cAAc,oBAAoB,eAAe;AACvD,QAAM,UAAU,aAAa,YAAY;AACzC,SAAO,OAAO,YAAY,WAAW,UAAU;AACnD;AAEA,MAAM,4CAA4C,MAC9C,IAAI,MAAM,wEAAwE;AAEtF,MAAM,2BAA2B,MAAM;AACnC,SAAO,MAAM;AAAA,IACT,oBAAI,IAAI;AAAA,MACJ,KAAK,QAAQ,MAAM,aAAa,MAAM,cAAc;AAAA,MACpD,KAAK,QAAQ,MAAM,aAAa,MAAM,OAAO,cAAc;AAAA,MAC3D,KAAK,QAAQ,QAAQ,IAAI,GAAG,YAAY,OAAO,cAAc;AAAA,MAC7D,KAAK,QAAQ,QAAQ,IAAI,GAAG,MAAM,OAAO,cAAc;AAAA,IAC3D,CAAC;AAAA,EACL;AACJ;AAEO,MAAM,2BAA2B,MAAM;AAC1C,aAAW,iBAAiB,yBAAyB,GAAG;AACpD,UAAM,UAAU,mBAAmB,aAAa;AAChD,QAAI,SAAS;AACT,aAAO,iBAAiB,OAAO;AAAA,IACnC;AAAA,EACJ;AAEA,MAAI,QAAQ,IAAI,qBAAqB;AACjC,WAAO,iBAAiB,QAAQ,IAAI,mBAAmB;AAAA,EAC3D;AAEA,SAAO;AACX;AAEO,MAAM,0CAA0C,CAAC,mBAA6B;AACjF,aAAW,iBAAiB,gBAAgB;AACxC,UAAM,UAAU,mCAAmC,aAAa;AAChE,QAAI,SAAS;AACT,aAAO,iBAAiB,OAAO;AAAA,IACnC;AAAA,EACJ;AAEA,QAAM,0CAA0C;AACpD;AAEO,MAAM,iCAAiC,MAAM,wCAAwC,yBAAyB,CAAC;AAE/G,MAAM,6BAA6B,CAAC;AAAA,EACvC;AAAA,EACA;AACJ,MAG6B;AACzB,QAAM,uBAAuB,iBAAiB,uBAAuB;AACrE,QAAM,2BAA2B,4BAA4B,oBAAoB;AAEjF,SAAO;AAAA,IACH,SAAS,iBAAiB,OAAO;AAAA,IACjC,YAAY;AAAA,IACZ,uBAAuB;AAAA,IACvB,KAAK;AAAA,MACD;AAAA,MACA;AAAA,MACA,4BAA4B;AAAA,MAC5B,qBAAqB;AAAA,IACzB;AAAA,EACJ;AACJ;AAEO,MAAM,2BAA2B,MACpC,2BAA2B;AAAA,EACvB,SAAS,yBAAyB;AAAA,EAClC,yBAAyB,+BAA+B;AAC5D,CAAC;","names":[]}

package/server/dist/modules/auth-guard.js

@@ -2,6 +2,8 @@ import { buildUnauthorizedGraphqlPayload, buildUnauthorizedPayload } from "@baej
 import session from "express-session";
 import { GraphQLError } from "graphql";
 import lusca from "lusca";
+import { sanitizeRedirectPath } from "./auth-redirect.js";
+import { AUTH_SESSION_IDLE_TIMEOUT_MS, createSessionStore } from "./session-store.js";
 const JSON_HEADERS = { "Content-Type": "application/json" };
 const isAuthenticatedRequest = (req) => Boolean(req.session?.authenticated);
 const createSessionMiddleware = (authConfig) => {
@@ -11,9 +13,12 @@ const createSessionMiddleware = (authConfig) => {
   return session({
     secret: authConfig.sessionSecret,
     name: authConfig.cookieName,
+    store: createSessionStore(),
     resave: false,
     saveUninitialized: false,
+    rolling: true,
     cookie: {
+      maxAge: AUTH_SESSION_IDLE_TIMEOUT_MS,
       httpOnly: true,
       sameSite: "lax",
       secure: process.env.NODE_ENV === "production",
@@ -33,10 +38,23 @@ const createCsrfProtection = (authConfig) => {
         sameSite: "lax",
         secure: process.env.NODE_ENV === "production"
       }
-    },
-    blocklist: ["/api/mcp", "/graphql/mcp"]
+    }
   });
 };
+const isCsrfTokenError = (error) => error instanceof Error && error.message.startsWith("CSRF token ");
+const buildLoginRedirectPath = (req) => {
+  const nextPath = sanitizeRedirectPath(req.body?.next);
+  return `/login?next=${encodeURIComponent(nextPath)}`;
+};
+const createLoginCsrfFailureHandler = (authConfig) => {
+  return (error, req, res, next) => {
+    if (authConfig.mode !== "password" || !isCsrfTokenError(error) || req.method !== "POST" || req.path !== "/login" || isAuthenticatedRequest(req)) {
+      next(error);
+      return;
+    }
+    res.redirect(303, buildLoginRedirectPath(req));
+  };
+};
 const requireSessionForWrite = (authConfig) => {
   return (req, res, next) => {
     if (authConfig.mode === "open" || isAuthenticatedRequest(req)) {
@@ -77,6 +95,7 @@ const createMutationAuthValidationRule = () => {
 };
 export {
   createCsrfProtection,
+  createLoginCsrfFailureHandler,
   createMutationAuthValidationRule,
   createSessionMiddleware,
   isAuthenticatedRequest,

package/server/dist/modules/auth-guard.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/modules/auth-guard.ts"],"sourcesContent":["import { buildUnauthorizedGraphqlPayload, buildUnauthorizedPayload } from '@baejino/auth';\nimport type { NextFunction, Request, RequestHandler, Response } from 'express';\nimport session from 'express-session';\nimport type { ValidationRule } from 'graphql';\nimport { GraphQLError } from 'graphql';\nimport lusca from 'lusca';\n\nimport type { AuthConfig } from './auth-mode.js';\n\nconst JSON_HEADERS = { 'Content-Type': 'application/json' };\n\nexport const isAuthenticatedRequest = (req: Request) => Boolean(req.session?.authenticated);\n\nexport const createSessionMiddleware = (authConfig: AuthConfig): RequestHandler => {\n    if (authConfig.mode !== 'password') {\n        return (_req, _res, next) => next();\n    }\n\n    return session({\n        secret: authConfig.sessionSecret,\n        name: authConfig.cookieName,\n        resave: false,\n        saveUninitialized: false,\n        cookie: {\n            httpOnly: true,\n            sameSite: 'lax',\n            secure: process.env.NODE_ENV === 'production',\n            path: '/',\n        },\n    });\n};\n\nexport const createCsrfProtection = (authConfig: AuthConfig): RequestHandler => {\n    if (authConfig.mode !== 'password') {\n        return (_req, _res, next) => next();\n    }\n\n    return lusca.csrf({\n        angular: true,\n        cookie: {\n            options: {\n                path: '/',\n                sameSite: 'lax',\n                secure: process.env.NODE_ENV === 'production',\n            },\n        },\n        blocklist: ['/api/mcp', '/graphql/mcp'],\n    });\n};\n\nexport const requireSessionForWrite = (authConfig: AuthConfig): RequestHandler => {\n    return (req: Request, res: Response, next: NextFunction) => {\n        if (authConfig.mode === 'open' || isAuthenticatedRequest(req)) {\n            next();\n            return;\n        }\n\n        res.status(401).set(JSON_HEADERS).json(buildUnauthorizedPayload()).end();\n    };\n};\n\nexport const requireSessionForGraphql = (authConfig: AuthConfig): RequestHandler => {\n    return (req: Request, res: Response, next: NextFunction) => {\n        if (authConfig.mode === 'open' || isAuthenticatedRequest(req)) {\n            next();\n            return;\n        }\n\n        res.status(401).set(JSON_HEADERS).json(buildUnauthorizedGraphqlPayload()).end();\n    };\n};\n\nexport const createMutationAuthValidationRule = (): ValidationRule => {\n    return (context) => {\n        return {\n            OperationDefinition(node) {\n                if (node.operation !== 'mutation') {\n                    return;\n                }\n\n                const unauthorizedError = buildUnauthorizedGraphqlPayload().errors[0];\n\n                context.reportError(\n                    new GraphQLError(unauthorizedError.message, {\n                        nodes: [node],\n                        extensions: {\n                            code: unauthorizedError.extensions.code,\n                        },\n                    }),\n                );\n            },\n        };\n    };\n};\n"],"mappings":"AAAA,SAAS,iCAAiC,gCAAgC;AAE1E,OAAO,aAAa;AAEpB,SAAS,oBAAoB;AAC7B,OAAO,WAAW;AAIlB,MAAM,eAAe,EAAE,gBAAgB,mBAAmB;AAEnD,MAAM,yBAAyB,CAAC,QAAiB,QAAQ,IAAI,SAAS,aAAa;AAEnF,MAAM,0BAA0B,CAAC,eAA2C;AAC/E,MAAI,WAAW,SAAS,YAAY;AAChC,WAAO,CAAC,MAAM,MAAM,SAAS,KAAK;AAAA,EACtC;AAEA,SAAO,QAAQ;AAAA,IACX,QAAQ,WAAW;AAAA,IACnB,MAAM,WAAW;AAAA,IACjB,QAAQ;AAAA,IACR,mBAAmB;AAAA,IACnB,QAAQ;AAAA,MACJ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,MAAM;AAAA,IACV;AAAA,EACJ,CAAC;AACL;AAEO,MAAM,uBAAuB,CAAC,eAA2C;AAC5E,MAAI,WAAW,SAAS,YAAY;AAChC,WAAO,CAAC,MAAM,MAAM,SAAS,KAAK;AAAA,EACtC;AAEA,SAAO,MAAM,KAAK;AAAA,IACd,SAAS;AAAA,IACT,QAAQ;AAAA,MACJ,SAAS;AAAA,QACL,MAAM;AAAA,QACN,UAAU;AAAA,QACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACrC;AAAA,IACJ;AAAA,IACA,WAAW,CAAC,YAAY,cAAc;AAAA,EAC1C,CAAC;AACL;AAEO,MAAM,yBAAyB,CAAC,eAA2C;AAC9E,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,QAAI,WAAW,SAAS,UAAU,uBAAuB,GAAG,GAAG;AAC3D,WAAK;AACL;AAAA,IACJ;AAEA,QAAI,OAAO,GAAG,EAAE,IAAI,YAAY,EAAE,KAAK,yBAAyB,CAAC,EAAE,IAAI;AAAA,EAC3E;AACJ;AAEO,MAAM,2BAA2B,CAAC,eAA2C;AAChF,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,QAAI,WAAW,SAAS,UAAU,uBAAuB,GAAG,GAAG;AAC3D,WAAK;AACL;AAAA,IACJ;AAEA,QAAI,OAAO,GAAG,EAAE,IAAI,YAAY,EAAE,KAAK,gCAAgC,CAAC,EAAE,IAAI;AAAA,EAClF;AACJ;AAEO,MAAM,mCAAmC,MAAsB;AAClE,SAAO,CAAC,YAAY;AAChB,WAAO;AAAA,MACH,oBAAoB,MAAM;AACtB,YAAI,KAAK,cAAc,YAAY;AAC/B;AAAA,QACJ;AAEA,cAAM,oBAAoB,gCAAgC,EAAE,OAAO,CAAC;AAEpE,gBAAQ;AAAA,UACJ,IAAI,aAAa,kBAAkB,SAAS;AAAA,YACxC,OAAO,CAAC,IAAI;AAAA,YACZ,YAAY;AAAA,cACR,MAAM,kBAAkB,WAAW;AAAA,YACvC;AAAA,UACJ,CAAC;AAAA,QACL;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACJ;","names":[]}
+{"version":3,"sources":["../../src/modules/auth-guard.ts"],"sourcesContent":["import { buildUnauthorizedGraphqlPayload, buildUnauthorizedPayload } from '@baejino/auth';\nimport type { ErrorRequestHandler, NextFunction, Request, RequestHandler, Response } from 'express';\nimport session from 'express-session';\nimport type { ValidationRule } from 'graphql';\nimport { GraphQLError } from 'graphql';\nimport lusca from 'lusca';\nimport type { AuthConfig } from './auth-mode.js';\nimport { sanitizeRedirectPath } from './auth-redirect.js';\nimport { AUTH_SESSION_IDLE_TIMEOUT_MS, createSessionStore } from './session-store.js';\n\nconst JSON_HEADERS = { 'Content-Type': 'application/json' };\n\nexport const isAuthenticatedRequest = (req: Request) => Boolean(req.session?.authenticated);\n\nexport const createSessionMiddleware = (authConfig: AuthConfig): RequestHandler => {\n    if (authConfig.mode !== 'password') {\n        return (_req, _res, next) => next();\n    }\n\n    return session({\n        secret: authConfig.sessionSecret,\n        name: authConfig.cookieName,\n        store: createSessionStore(),\n        resave: false,\n        saveUninitialized: false,\n        rolling: true,\n        cookie: {\n            maxAge: AUTH_SESSION_IDLE_TIMEOUT_MS,\n            httpOnly: true,\n            sameSite: 'lax',\n            secure: process.env.NODE_ENV === 'production',\n            path: '/',\n        },\n    });\n};\n\nexport const createCsrfProtection = (authConfig: AuthConfig): RequestHandler => {\n    if (authConfig.mode !== 'password') {\n        return (_req, _res, next) => next();\n    }\n\n    return lusca.csrf({\n        angular: true,\n        cookie: {\n            options: {\n                path: '/',\n                sameSite: 'lax',\n                secure: process.env.NODE_ENV === 'production',\n            },\n        },\n    });\n};\n\nconst isCsrfTokenError = (error: unknown) => error instanceof Error && error.message.startsWith('CSRF token ');\n\nconst buildLoginRedirectPath = (req: Request) => {\n    const nextPath = sanitizeRedirectPath(req.body?.next);\n    return `/login?next=${encodeURIComponent(nextPath)}`;\n};\n\nexport const createLoginCsrfFailureHandler = (authConfig: AuthConfig): ErrorRequestHandler => {\n    return (error, req, res, next) => {\n        if (\n            authConfig.mode !== 'password' ||\n            !isCsrfTokenError(error) ||\n            req.method !== 'POST' ||\n            req.path !== '/login' ||\n            isAuthenticatedRequest(req)\n        ) {\n            next(error);\n            return;\n        }\n\n        res.redirect(303, buildLoginRedirectPath(req));\n    };\n};\n\nexport const requireSessionForWrite = (authConfig: AuthConfig): RequestHandler => {\n    return (req: Request, res: Response, next: NextFunction) => {\n        if (authConfig.mode === 'open' || isAuthenticatedRequest(req)) {\n            next();\n            return;\n        }\n\n        res.status(401).set(JSON_HEADERS).json(buildUnauthorizedPayload()).end();\n    };\n};\n\nexport const requireSessionForGraphql = (authConfig: AuthConfig): RequestHandler => {\n    return (req: Request, res: Response, next: NextFunction) => {\n        if (authConfig.mode === 'open' || isAuthenticatedRequest(req)) {\n            next();\n            return;\n        }\n\n        res.status(401).set(JSON_HEADERS).json(buildUnauthorizedGraphqlPayload()).end();\n    };\n};\n\nexport const createMutationAuthValidationRule = (): ValidationRule => {\n    return (context) => {\n        return {\n            OperationDefinition(node) {\n                if (node.operation !== 'mutation') {\n                    return;\n                }\n\n                const unauthorizedError = buildUnauthorizedGraphqlPayload().errors[0];\n\n                context.reportError(\n                    new GraphQLError(unauthorizedError.message, {\n                        nodes: [node],\n                        extensions: {\n                            code: unauthorizedError.extensions.code,\n                        },\n                    }),\n                );\n            },\n        };\n    };\n};\n"],"mappings":"AAAA,SAAS,iCAAiC,gCAAgC;AAE1E,OAAO,aAAa;AAEpB,SAAS,oBAAoB;AAC7B,OAAO,WAAW;AAElB,SAAS,4BAA4B;AACrC,SAAS,8BAA8B,0BAA0B;AAEjE,MAAM,eAAe,EAAE,gBAAgB,mBAAmB;AAEnD,MAAM,yBAAyB,CAAC,QAAiB,QAAQ,IAAI,SAAS,aAAa;AAEnF,MAAM,0BAA0B,CAAC,eAA2C;AAC/E,MAAI,WAAW,SAAS,YAAY;AAChC,WAAO,CAAC,MAAM,MAAM,SAAS,KAAK;AAAA,EACtC;AAEA,SAAO,QAAQ;AAAA,IACX,QAAQ,WAAW;AAAA,IACnB,MAAM,WAAW;AAAA,IACjB,OAAO,mBAAmB;AAAA,IAC1B,QAAQ;AAAA,IACR,mBAAmB;AAAA,IACnB,SAAS;AAAA,IACT,QAAQ;AAAA,MACJ,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,MAAM;AAAA,IACV;AAAA,EACJ,CAAC;AACL;AAEO,MAAM,uBAAuB,CAAC,eAA2C;AAC5E,MAAI,WAAW,SAAS,YAAY;AAChC,WAAO,CAAC,MAAM,MAAM,SAAS,KAAK;AAAA,EACtC;AAEA,SAAO,MAAM,KAAK;AAAA,IACd,SAAS;AAAA,IACT,QAAQ;AAAA,MACJ,SAAS;AAAA,QACL,MAAM;AAAA,QACN,UAAU;AAAA,QACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACrC;AAAA,IACJ;AAAA,EACJ,CAAC;AACL;AAEA,MAAM,mBAAmB,CAAC,UAAmB,iBAAiB,SAAS,MAAM,QAAQ,WAAW,aAAa;AAE7G,MAAM,yBAAyB,CAAC,QAAiB;AAC7C,QAAM,WAAW,qBAAqB,IAAI,MAAM,IAAI;AACpD,SAAO,eAAe,mBAAmB,QAAQ,CAAC;AACtD;AAEO,MAAM,gCAAgC,CAAC,eAAgD;AAC1F,SAAO,CAAC,OAAO,KAAK,KAAK,SAAS;AAC9B,QACI,WAAW,SAAS,cACpB,CAAC,iBAAiB,KAAK,KACvB,IAAI,WAAW,UACf,IAAI,SAAS,YACb,uBAAuB,GAAG,GAC5B;AACE,WAAK,KAAK;AACV;AAAA,IACJ;AAEA,QAAI,SAAS,KAAK,uBAAuB,GAAG,CAAC;AAAA,EACjD;AACJ;AAEO,MAAM,yBAAyB,CAAC,eAA2C;AAC9E,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,QAAI,WAAW,SAAS,UAAU,uBAAuB,GAAG,GAAG;AAC3D,WAAK;AACL;AAAA,IACJ;AAEA,QAAI,OAAO,GAAG,EAAE,IAAI,YAAY,EAAE,KAAK,yBAAyB,CAAC,EAAE,IAAI;AAAA,EAC3E;AACJ;AAEO,MAAM,2BAA2B,CAAC,eAA2C;AAChF,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,QAAI,WAAW,SAAS,UAAU,uBAAuB,GAAG,GAAG;AAC3D,WAAK;AACL;AAAA,IACJ;AAEA,QAAI,OAAO,GAAG,EAAE,IAAI,YAAY,EAAE,KAAK,gCAAgC,CAAC,EAAE,IAAI;AAAA,EAClF;AACJ;AAEO,MAAM,mCAAmC,MAAsB;AAClE,SAAO,CAAC,YAAY;AAChB,WAAO;AAAA,MACH,oBAAoB,MAAM;AACtB,YAAI,KAAK,cAAc,YAAY;AAC/B;AAAA,QACJ;AAEA,cAAM,oBAAoB,gCAAgC,EAAE,OAAO,CAAC;AAEpE,gBAAQ;AAAA,UACJ,IAAI,aAAa,kBAAkB,SAAS;AAAA,YACxC,OAAO,CAAC,IAAI;AAAA,YACZ,YAAY;AAAA,cACR,MAAM,kBAAkB,WAAW;AAAA,YACvC;AAAA,UACJ,CAAC;AAAA,QACL;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACJ;","names":[]}

package/server/dist/modules/auth-redirect.js

@@ -0,0 +1,10 @@
+import { sanitizeRedirectPath as sanitizeCommonRedirectPath } from "@baejino/auth";
+const sanitizeRedirectPath = (value) => sanitizeCommonRedirectPath(value, {
+  fallbackPath: "/",
+  loginPath: "/login",
+  allowedAbsoluteHosts: ["localhost", "127.0.0.1", "::1"]
+});
+export {
+  sanitizeRedirectPath
+};
+//# sourceMappingURL=auth-redirect.js.map

package/server/dist/modules/auth-redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/modules/auth-redirect.ts"],"sourcesContent":["import { sanitizeRedirectPath as sanitizeCommonRedirectPath } from '@baejino/auth';\n\nexport const sanitizeRedirectPath = (value: unknown) =>\n    sanitizeCommonRedirectPath(value, {\n        fallbackPath: '/',\n        loginPath: '/login',\n        allowedAbsoluteHosts: ['localhost', '127.0.0.1', '::1'],\n    });\n"],"mappings":"AAAA,SAAS,wBAAwB,kCAAkC;AAE5D,MAAM,uBAAuB,CAAC,UACjC,2BAA2B,OAAO;AAAA,EAC9B,cAAc;AAAA,EACd,WAAW;AAAA,EACX,sBAAsB,CAAC,aAAa,aAAa,KAAK;AAC1D,CAAC;","names":[]}

package/server/dist/modules/mcp-auth.js

@@ -1,5 +1,42 @@
 import { GraphQLError } from "graphql";
+import {
+  getOceanBrainVersionInfo,
+  OCEAN_BRAIN_MCP_CLIENT_VERSION_HEADER,
+  OCEAN_BRAIN_MCP_COMPATIBILITY_VERSION_HEADER,
+  parseMajorMinorVersion
+} from "./app-version.js";
 const JSON_HEADERS = { "Content-Type": "application/json" };
+const OCEAN_BRAIN_MCP_VERSION_HEADER = "X-Ocean-Brain-MCP-Version";
+const readHeaderValue = (req, headerName) => {
+  const value = req.headers[headerName.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+};
+const readMcpCompatibilityVersion = (req) => readHeaderValue(req, OCEAN_BRAIN_MCP_COMPATIBILITY_VERSION_HEADER) ?? readHeaderValue(req, OCEAN_BRAIN_MCP_VERSION_HEADER);
+const readMcpClientVersion = (req) => readHeaderValue(req, OCEAN_BRAIN_MCP_CLIENT_VERSION_HEADER) ?? readHeaderValue(req, OCEAN_BRAIN_MCP_VERSION_HEADER);
+const isMcpVersionCompatible = (requiredMcpCompatibilityVersion, mcpCompatibilityVersion) => {
+  const required = parseMajorMinorVersion(requiredMcpCompatibilityVersion);
+  const mcp = parseMajorMinorVersion(mcpCompatibilityVersion);
+  return Boolean(required && mcp && required.major === mcp.major && required.minor === mcp.minor);
+};
+const createMcpVersionCompatibilityMessage = ({
+  mcpClientVersion,
+  mcpCompatibilityVersion,
+  requiredMcpCompatibilityVersion,
+  serverVersion
+}) => {
+  const mcpCompatibilityVersionText = mcpCompatibilityVersion ? `v${mcpCompatibilityVersion}` : "not provided";
+  const mcpClientVersionText = mcpClientVersion ? `v${mcpClientVersion}` : "not provided";
+  return [
+    "Ocean Brain MCP compatibility versions are incompatible.",
+    `Server: v${serverVersion}`,
+    `Required MCP compatibility: ${requiredMcpCompatibilityVersion}`,
+    `MCP compatibility: ${mcpCompatibilityVersionText}`,
+    `MCP client: ${mcpClientVersionText}`,
+    "",
+    "Please update Ocean Brain MCP to a compatible release.",
+    getOceanBrainVersionInfo().releaseUrl
+  ].join("\n");
+};
 const readBearerToken = (authorizationHeader) => {
   if (!authorizationHeader?.startsWith("Bearer ")) {
     return void 0;
@@ -40,6 +77,28 @@ const createMcpAuthMiddleware = (_authConfig, mcpAdminAuth) => {
         }).end();
         return;
       }
+      const versionInfo = getOceanBrainVersionInfo();
+      const mcpCompatibilityVersion = readMcpCompatibilityVersion(req);
+      const mcpClientVersion = readMcpClientVersion(req);
+      if (!mcpCompatibilityVersion || !isMcpVersionCompatible(versionInfo.mcp.compatibilityVersion, mcpCompatibilityVersion)) {
+        res.status(426).set(JSON_HEADERS).json({
+          code: "MCP_VERSION_INCOMPATIBLE",
+          message: createMcpVersionCompatibilityMessage({
+            serverVersion: versionInfo.version,
+            requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,
+            mcpCompatibilityVersion,
+            mcpClientVersion
+          }),
+          serverVersion: versionInfo.version,
+          mcpVersion: mcpClientVersion ?? mcpCompatibilityVersion ?? null,
+          mcpClientVersion: mcpClientVersion ?? null,
+          mcpCompatibilityVersion: mcpCompatibilityVersion ?? null,
+          requiredMcpVersion: versionInfo.mcpVersionRequirement,
+          requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,
+          releaseUrl: versionInfo.releaseUrl
+        }).end();
+        return;
+      }
       next();
     } catch (error) {
       next(error);
@@ -64,7 +123,9 @@ const createReadOnlyMcpValidationRule = () => {
   };
 };
 export {
+  OCEAN_BRAIN_MCP_VERSION_HEADER,
   createMcpAuthMiddleware,
-  createReadOnlyMcpValidationRule
+  createReadOnlyMcpValidationRule,
+  isMcpVersionCompatible
 };
 //# sourceMappingURL=mcp-auth.js.map

package/server/dist/modules/mcp-auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/modules/mcp-auth.ts"],"sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from 'express';\nimport type { ValidationRule } from 'graphql';\nimport { GraphQLError } from 'graphql';\n\nimport type { AuthConfig } from './auth-mode.js';\n\nexport interface McpTokenValidationResult {\n    ok: boolean;\n    reason?: 'not_configured' | 'forbidden';\n}\n\nexport interface McpAdminAuthPort {\n    getStatus: () => Promise<{ enabled: boolean }>;\n    validatePresentedToken: (token: string) => Promise<McpTokenValidationResult>;\n}\n\nconst JSON_HEADERS = { 'Content-Type': 'application/json' };\n\nconst readBearerToken = (authorizationHeader?: string) => {\n    if (!authorizationHeader?.startsWith('Bearer ')) {\n        return undefined;\n    }\n\n    return authorizationHeader.slice('Bearer '.length).trim() || undefined;\n};\n\nexport const createMcpAuthMiddleware = (_authConfig: AuthConfig, mcpAdminAuth: McpAdminAuthPort): RequestHandler => {\n    return async (req: Request, res: Response, next: NextFunction) => {\n        try {\n            const status = await mcpAdminAuth.getStatus();\n            if (!status.enabled) {\n                res.status(403)\n                    .set(JSON_HEADERS)\n                    .json({\n                        code: 'MCP_DISABLED',\n                        message: 'MCP access is disabled by admin.',\n                    })\n                    .end();\n                return;\n            }\n\n            const bearerToken = readBearerToken(req.headers.authorization);\n\n            if (!bearerToken) {\n                res.status(401)\n                    .set(JSON_HEADERS)\n                    .json({\n                        code: 'UNAUTHORIZED',\n                        message: 'A valid MCP bearer token is required.',\n                    })\n                    .end();\n                return;\n            }\n\n            const validation = await mcpAdminAuth.validatePresentedToken(bearerToken);\n\n            if (!validation.ok && validation.reason === 'not_configured') {\n                res.status(503)\n                    .set(JSON_HEADERS)\n                    .json({\n                        code: 'MCP_AUTH_NOT_CONFIGURED',\n                        message: 'MCP bearer auth is not configured.',\n                    })\n                    .end();\n                return;\n            }\n\n            if (!validation.ok) {\n                res.status(403)\n                    .set(JSON_HEADERS)\n                    .json({\n                        code: 'FORBIDDEN',\n                        message: 'Invalid MCP bearer token.',\n                    })\n                    .end();\n                return;\n            }\n\n            next();\n        } catch (error) {\n            next(error);\n        }\n    };\n};\n\nexport const createReadOnlyMcpValidationRule = (): ValidationRule => {\n    return (context) => {\n        return {\n            OperationDefinition(node) {\n                if (node.operation === 'query') {\n                    return;\n                }\n\n                context.reportError(\n                    new GraphQLError('MCP endpoint is read-only', {\n                        nodes: [node],\n                        extensions: { code: 'FORBIDDEN' },\n                    }),\n                );\n            },\n        };\n    };\n};\n"],"mappings":"AAEA,SAAS,oBAAoB;AAc7B,MAAM,eAAe,EAAE,gBAAgB,mBAAmB;AAE1D,MAAM,kBAAkB,CAAC,wBAAiC;AACtD,MAAI,CAAC,qBAAqB,WAAW,SAAS,GAAG;AAC7C,WAAO;AAAA,EACX;AAEA,SAAO,oBAAoB,MAAM,UAAU,MAAM,EAAE,KAAK,KAAK;AACjE;AAEO,MAAM,0BAA0B,CAAC,aAAyB,iBAAmD;AAChH,SAAO,OAAO,KAAc,KAAe,SAAuB;AAC9D,QAAI;AACA,YAAM,SAAS,MAAM,aAAa,UAAU;AAC5C,UAAI,CAAC,OAAO,SAAS;AACjB,YAAI,OAAO,GAAG,EACT,IAAI,YAAY,EAChB,KAAK;AAAA,UACF,MAAM;AAAA,UACN,SAAS;AAAA,QACb,CAAC,EACA,IAAI;AACT;AAAA,MACJ;AAEA,YAAM,cAAc,gBAAgB,IAAI,QAAQ,aAAa;AAE7D,UAAI,CAAC,aAAa;AACd,YAAI,OAAO,GAAG,EACT,IAAI,YAAY,EAChB,KAAK;AAAA,UACF,MAAM;AAAA,UACN,SAAS;AAAA,QACb,CAAC,EACA,IAAI;AACT;AAAA,MACJ;AAEA,YAAM,aAAa,MAAM,aAAa,uBAAuB,WAAW;AAExE,UAAI,CAAC,WAAW,MAAM,WAAW,WAAW,kBAAkB;AAC1D,YAAI,OAAO,GAAG,EACT,IAAI,YAAY,EAChB,KAAK;AAAA,UACF,MAAM;AAAA,UACN,SAAS;AAAA,QACb,CAAC,EACA,IAAI;AACT;AAAA,MACJ;AAEA,UAAI,CAAC,WAAW,IAAI;AAChB,YAAI,OAAO,GAAG,EACT,IAAI,YAAY,EAChB,KAAK;AAAA,UACF,MAAM;AAAA,UACN,SAAS;AAAA,QACb,CAAC,EACA,IAAI;AACT;AAAA,MACJ;AAEA,WAAK;AAAA,IACT,SAAS,OAAO;AACZ,WAAK,KAAK;AAAA,IACd;AAAA,EACJ;AACJ;AAEO,MAAM,kCAAkC,MAAsB;AACjE,SAAO,CAAC,YAAY;AAChB,WAAO;AAAA,MACH,oBAAoB,MAAM;AACtB,YAAI,KAAK,cAAc,SAAS;AAC5B;AAAA,QACJ;AAEA,gBAAQ;AAAA,UACJ,IAAI,aAAa,6BAA6B;AAAA,YAC1C,OAAO,CAAC,IAAI;AAAA,YACZ,YAAY,EAAE,MAAM,YAAY;AAAA,UACpC,CAAC;AAAA,QACL;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACJ;","names":[]}
+{"version":3,"sources":["../../src/modules/mcp-auth.ts"],"sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from 'express';\nimport type { ValidationRule } from 'graphql';\nimport { GraphQLError } from 'graphql';\n\nimport {\n    getOceanBrainVersionInfo,\n    OCEAN_BRAIN_MCP_CLIENT_VERSION_HEADER,\n    OCEAN_BRAIN_MCP_COMPATIBILITY_VERSION_HEADER,\n    parseMajorMinorVersion,\n} from './app-version.js';\nimport type { AuthConfig } from './auth-mode.js';\n\nexport interface McpTokenValidationResult {\n    ok: boolean;\n    reason?: 'not_configured' | 'forbidden';\n}\n\nexport interface McpAdminAuthPort {\n    getStatus: () => Promise<{ enabled: boolean }>;\n    validatePresentedToken: (token: string) => Promise<McpTokenValidationResult>;\n}\n\nconst JSON_HEADERS = { 'Content-Type': 'application/json' };\nexport const OCEAN_BRAIN_MCP_VERSION_HEADER = 'X-Ocean-Brain-MCP-Version';\n\nconst readHeaderValue = (req: Request, headerName: string) => {\n    const value = req.headers[headerName.toLowerCase()];\n    return Array.isArray(value) ? value[0] : value;\n};\n\nconst readMcpCompatibilityVersion = (req: Request) =>\n    readHeaderValue(req, OCEAN_BRAIN_MCP_COMPATIBILITY_VERSION_HEADER) ??\n    readHeaderValue(req, OCEAN_BRAIN_MCP_VERSION_HEADER);\n\nconst readMcpClientVersion = (req: Request) =>\n    readHeaderValue(req, OCEAN_BRAIN_MCP_CLIENT_VERSION_HEADER) ?? readHeaderValue(req, OCEAN_BRAIN_MCP_VERSION_HEADER);\n\nexport const isMcpVersionCompatible = (requiredMcpCompatibilityVersion: string, mcpCompatibilityVersion: string) => {\n    const required = parseMajorMinorVersion(requiredMcpCompatibilityVersion);\n    const mcp = parseMajorMinorVersion(mcpCompatibilityVersion);\n\n    return Boolean(required && mcp && required.major === mcp.major && required.minor === mcp.minor);\n};\n\nconst createMcpVersionCompatibilityMessage = ({\n    mcpClientVersion,\n    mcpCompatibilityVersion,\n    requiredMcpCompatibilityVersion,\n    serverVersion,\n}: {\n    mcpClientVersion?: string;\n    mcpCompatibilityVersion?: string;\n    requiredMcpCompatibilityVersion: string;\n    serverVersion: string;\n}) => {\n    const mcpCompatibilityVersionText = mcpCompatibilityVersion ? `v${mcpCompatibilityVersion}` : 'not provided';\n    const mcpClientVersionText = mcpClientVersion ? `v${mcpClientVersion}` : 'not provided';\n\n    return [\n        'Ocean Brain MCP compatibility versions are incompatible.',\n        `Server: v${serverVersion}`,\n        `Required MCP compatibility: ${requiredMcpCompatibilityVersion}`,\n        `MCP compatibility: ${mcpCompatibilityVersionText}`,\n        `MCP client: ${mcpClientVersionText}`,\n        '',\n        'Please update Ocean Brain MCP to a compatible release.',\n        getOceanBrainVersionInfo().releaseUrl,\n    ].join('\\n');\n};\n\nconst readBearerToken = (authorizationHeader?: string) => {\n    if (!authorizationHeader?.startsWith('Bearer ')) {\n        return undefined;\n    }\n\n    return authorizationHeader.slice('Bearer '.length).trim() || undefined;\n};\n\nexport const createMcpAuthMiddleware = (_authConfig: AuthConfig, mcpAdminAuth: McpAdminAuthPort): RequestHandler => {\n    return async (req: Request, res: Response, next: NextFunction) => {\n        try {\n            const status = await mcpAdminAuth.getStatus();\n            if (!status.enabled) {\n                res.status(403)\n                    .set(JSON_HEADERS)\n                    .json({\n                        code: 'MCP_DISABLED',\n                        message: 'MCP access is disabled by admin.',\n                    })\n                    .end();\n                return;\n            }\n\n            const bearerToken = readBearerToken(req.headers.authorization);\n\n            if (!bearerToken) {\n                res.status(401)\n                    .set(JSON_HEADERS)\n                    .json({\n                        code: 'UNAUTHORIZED',\n                        message: 'A valid MCP bearer token is required.',\n                    })\n                    .end();\n                return;\n            }\n\n            const validation = await mcpAdminAuth.validatePresentedToken(bearerToken);\n\n            if (!validation.ok && validation.reason === 'not_configured') {\n                res.status(503)\n                    .set(JSON_HEADERS)\n                    .json({\n                        code: 'MCP_AUTH_NOT_CONFIGURED',\n                        message: 'MCP bearer auth is not configured.',\n                    })\n                    .end();\n                return;\n            }\n\n            if (!validation.ok) {\n                res.status(403)\n                    .set(JSON_HEADERS)\n                    .json({\n                        code: 'FORBIDDEN',\n                        message: 'Invalid MCP bearer token.',\n                    })\n                    .end();\n                return;\n            }\n\n            const versionInfo = getOceanBrainVersionInfo();\n            const mcpCompatibilityVersion = readMcpCompatibilityVersion(req);\n            const mcpClientVersion = readMcpClientVersion(req);\n\n            if (\n                !mcpCompatibilityVersion ||\n                !isMcpVersionCompatible(versionInfo.mcp.compatibilityVersion, mcpCompatibilityVersion)\n            ) {\n                res.status(426)\n                    .set(JSON_HEADERS)\n                    .json({\n                        code: 'MCP_VERSION_INCOMPATIBLE',\n                        message: createMcpVersionCompatibilityMessage({\n                            serverVersion: versionInfo.version,\n                            requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,\n                            mcpCompatibilityVersion,\n                            mcpClientVersion,\n                        }),\n                        serverVersion: versionInfo.version,\n                        mcpVersion: mcpClientVersion ?? mcpCompatibilityVersion ?? null,\n                        mcpClientVersion: mcpClientVersion ?? null,\n                        mcpCompatibilityVersion: mcpCompatibilityVersion ?? null,\n                        requiredMcpVersion: versionInfo.mcpVersionRequirement,\n                        requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,\n                        releaseUrl: versionInfo.releaseUrl,\n                    })\n                    .end();\n                return;\n            }\n\n            next();\n        } catch (error) {\n            next(error);\n        }\n    };\n};\n\nexport const createReadOnlyMcpValidationRule = (): ValidationRule => {\n    return (context) => {\n        return {\n            OperationDefinition(node) {\n                if (node.operation === 'query') {\n                    return;\n                }\n\n                context.reportError(\n                    new GraphQLError('MCP endpoint is read-only', {\n                        nodes: [node],\n                        extensions: { code: 'FORBIDDEN' },\n                    }),\n                );\n            },\n        };\n    };\n};\n"],"mappings":"AAEA,SAAS,oBAAoB;AAE7B;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAaP,MAAM,eAAe,EAAE,gBAAgB,mBAAmB;AACnD,MAAM,iCAAiC;AAE9C,MAAM,kBAAkB,CAAC,KAAc,eAAuB;AAC1D,QAAM,QAAQ,IAAI,QAAQ,WAAW,YAAY,CAAC;AAClD,SAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAC7C;AAEA,MAAM,8BAA8B,CAAC,QACjC,gBAAgB,KAAK,4CAA4C,KACjE,gBAAgB,KAAK,8BAA8B;AAEvD,MAAM,uBAAuB,CAAC,QAC1B,gBAAgB,KAAK,qCAAqC,KAAK,gBAAgB,KAAK,8BAA8B;AAE/G,MAAM,yBAAyB,CAAC,iCAAyC,4BAAoC;AAChH,QAAM,WAAW,uBAAuB,+BAA+B;AACvE,QAAM,MAAM,uBAAuB,uBAAuB;AAE1D,SAAO,QAAQ,YAAY,OAAO,SAAS,UAAU,IAAI,SAAS,SAAS,UAAU,IAAI,KAAK;AAClG;AAEA,MAAM,uCAAuC,CAAC;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,MAKM;AACF,QAAM,8BAA8B,0BAA0B,IAAI,uBAAuB,KAAK;AAC9F,QAAM,uBAAuB,mBAAmB,IAAI,gBAAgB,KAAK;AAEzE,SAAO;AAAA,IACH;AAAA,IACA,YAAY,aAAa;AAAA,IACzB,+BAA+B,+BAA+B;AAAA,IAC9D,sBAAsB,2BAA2B;AAAA,IACjD,eAAe,oBAAoB;AAAA,IACnC;AAAA,IACA;AAAA,IACA,yBAAyB,EAAE;AAAA,EAC/B,EAAE,KAAK,IAAI;AACf;AAEA,MAAM,kBAAkB,CAAC,wBAAiC;AACtD,MAAI,CAAC,qBAAqB,WAAW,SAAS,GAAG;AAC7C,WAAO;AAAA,EACX;AAEA,SAAO,oBAAoB,MAAM,UAAU,MAAM,EAAE,KAAK,KAAK;AACjE;AAEO,MAAM,0BAA0B,CAAC,aAAyB,iBAAmD;AAChH,SAAO,OAAO,KAAc,KAAe,SAAuB;AAC9D,QAAI;AACA,YAAM,SAAS,MAAM,aAAa,UAAU;AAC5C,UAAI,CAAC,OAAO,SAAS;AACjB,YAAI,OAAO,GAAG,EACT,IAAI,YAAY,EAChB,KAAK;AAAA,UACF,MAAM;AAAA,UACN,SAAS;AAAA,QACb,CAAC,EACA,IAAI;AACT;AAAA,MACJ;AAEA,YAAM,cAAc,gBAAgB,IAAI,QAAQ,aAAa;AAE7D,UAAI,CAAC,aAAa;AACd,YAAI,OAAO,GAAG,EACT,IAAI,YAAY,EAChB,KAAK;AAAA,UACF,MAAM;AAAA,UACN,SAAS;AAAA,QACb,CAAC,EACA,IAAI;AACT;AAAA,MACJ;AAEA,YAAM,aAAa,MAAM,aAAa,uBAAuB,WAAW;AAExE,UAAI,CAAC,WAAW,MAAM,WAAW,WAAW,kBAAkB;AAC1D,YAAI,OAAO,GAAG,EACT,IAAI,YAAY,EAChB,KAAK;AAAA,UACF,MAAM;AAAA,UACN,SAAS;AAAA,QACb,CAAC,EACA,IAAI;AACT;AAAA,MACJ;AAEA,UAAI,CAAC,WAAW,IAAI;AAChB,YAAI,OAAO,GAAG,EACT,IAAI,YAAY,EAChB,KAAK;AAAA,UACF,MAAM;AAAA,UACN,SAAS;AAAA,QACb,CAAC,EACA,IAAI;AACT;AAAA,MACJ;AAEA,YAAM,cAAc,yBAAyB;AAC7C,YAAM,0BAA0B,4BAA4B,GAAG;AAC/D,YAAM,mBAAmB,qBAAqB,GAAG;AAEjD,UACI,CAAC,2BACD,CAAC,uBAAuB,YAAY,IAAI,sBAAsB,uBAAuB,GACvF;AACE,YAAI,OAAO,GAAG,EACT,IAAI,YAAY,EAChB,KAAK;AAAA,UACF,MAAM;AAAA,UACN,SAAS,qCAAqC;AAAA,YAC1C,eAAe,YAAY;AAAA,YAC3B,iCAAiC,YAAY,IAAI;AAAA,YACjD;AAAA,YACA;AAAA,UACJ,CAAC;AAAA,UACD,eAAe,YAAY;AAAA,UAC3B,YAAY,oBAAoB,2BAA2B;AAAA,UAC3D,kBAAkB,oBAAoB;AAAA,UACtC,yBAAyB,2BAA2B;AAAA,UACpD,oBAAoB,YAAY;AAAA,UAChC,iCAAiC,YAAY,IAAI;AAAA,UACjD,YAAY,YAAY;AAAA,QAC5B,CAAC,EACA,IAAI;AACT;AAAA,MACJ;AAEA,WAAK;AAAA,IACT,SAAS,OAAO;AACZ,WAAK,KAAK;AAAA,IACd;AAAA,EACJ;AACJ;AAEO,MAAM,kCAAkC,MAAsB;AACjE,SAAO,CAAC,YAAY;AAChB,WAAO;AAAA,MACH,oBAAoB,MAAM;AACtB,YAAI,KAAK,cAAc,SAAS;AAC5B;AAAA,QACJ;AAEA,gBAAQ;AAAA,UACJ,IAAI,aAAa,6BAA6B;AAAA,YAC1C,OAAO,CAAC,IAAI;AAAA,YACZ,YAAY,EAAE,MAAM,YAAY;AAAA,UACpC,CAAC;AAAA,QACL;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACJ;","names":[]}

package/server/dist/modules/rate-limit.js

@@ -1,5 +1,6 @@
 import { rateLimit } from "express-rate-limit";
 const AUTH_RATE_LIMIT_MESSAGE = "Too many authentication attempts. Please try again later.";
+const SESSION_ACCESS_RATE_LIMIT_MESSAGE = "Too many authenticated requests. Please try again later.";
 const createAuthAttemptRateLimit = () => rateLimit({
   windowMs: 15 * 60 * 1e3,
   limit: 10,
@@ -12,7 +13,20 @@ const createAuthAttemptRateLimit = () => rateLimit({
     });
   }
 });
+const createSessionAccessRateLimit = () => rateLimit({
+  windowMs: 60 * 1e3,
+  limit: 300,
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: (_req, res) => {
+    res.status(429).json({
+      code: "SESSION_RATE_LIMITED",
+      message: SESSION_ACCESS_RATE_LIMIT_MESSAGE
+    });
+  }
+});
 export {
-  createAuthAttemptRateLimit
+  createAuthAttemptRateLimit,
+  createSessionAccessRateLimit
 };
 //# sourceMappingURL=rate-limit.js.map

package/server/dist/modules/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/modules/rate-limit.ts"],"sourcesContent":["import { rateLimit } from 'express-rate-limit';\n\nconst AUTH_RATE_LIMIT_MESSAGE = 'Too many authentication attempts. Please try again later.';\n\nexport const createAuthAttemptRateLimit = () =>\n    rateLimit({\n        windowMs: 15 * 60 * 1000,\n        limit: 10,\n        standardHeaders: true,\n        legacyHeaders: false,\n        handler: (_req, res) => {\n            res.status(429).json({\n                code: 'AUTH_RATE_LIMITED',\n                message: AUTH_RATE_LIMIT_MESSAGE,\n            });\n        },\n    });\n"],"mappings":"AAAA,SAAS,iBAAiB;AAE1B,MAAM,0BAA0B;AAEzB,MAAM,6BAA6B,MACtC,UAAU;AAAA,EACN,UAAU,KAAK,KAAK;AAAA,EACpB,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,SAAS,CAAC,MAAM,QAAQ;AACpB,QAAI,OAAO,GAAG,EAAE,KAAK;AAAA,MACjB,MAAM;AAAA,MACN,SAAS;AAAA,IACb,CAAC;AAAA,EACL;AACJ,CAAC;","names":[]}
+{"version":3,"sources":["../../src/modules/rate-limit.ts"],"sourcesContent":["import { rateLimit } from 'express-rate-limit';\n\nconst AUTH_RATE_LIMIT_MESSAGE = 'Too many authentication attempts. Please try again later.';\nconst SESSION_ACCESS_RATE_LIMIT_MESSAGE = 'Too many authenticated requests. Please try again later.';\n\nexport const createAuthAttemptRateLimit = () =>\n    rateLimit({\n        windowMs: 15 * 60 * 1000,\n        limit: 10,\n        standardHeaders: true,\n        legacyHeaders: false,\n        handler: (_req, res) => {\n            res.status(429).json({\n                code: 'AUTH_RATE_LIMITED',\n                message: AUTH_RATE_LIMIT_MESSAGE,\n            });\n        },\n    });\n\nexport const createSessionAccessRateLimit = () =>\n    rateLimit({\n        windowMs: 60 * 1000,\n        limit: 300,\n        standardHeaders: true,\n        legacyHeaders: false,\n        handler: (_req, res) => {\n            res.status(429).json({\n                code: 'SESSION_RATE_LIMITED',\n                message: SESSION_ACCESS_RATE_LIMIT_MESSAGE,\n            });\n        },\n    });\n"],"mappings":"AAAA,SAAS,iBAAiB;AAE1B,MAAM,0BAA0B;AAChC,MAAM,oCAAoC;AAEnC,MAAM,6BAA6B,MACtC,UAAU;AAAA,EACN,UAAU,KAAK,KAAK;AAAA,EACpB,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,SAAS,CAAC,MAAM,QAAQ;AACpB,QAAI,OAAO,GAAG,EAAE,KAAK;AAAA,MACjB,MAAM;AAAA,MACN,SAAS;AAAA,IACb,CAAC;AAAA,EACL;AACJ,CAAC;AAEE,MAAM,+BAA+B,MACxC,UAAU;AAAA,EACN,UAAU,KAAK;AAAA,EACf,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,SAAS,CAAC,MAAM,QAAQ;AACpB,QAAI,OAAO,GAAG,EAAE,KAAK;AAAA,MACjB,MAAM;AAAA,MACN,SAAS;AAAA,IACb,CAAC;AAAA,EACL;AACJ,CAAC;","names":[]}

package/server/dist/modules/server-events-handler.js

@@ -1,5 +1,16 @@
 import { serializeServerEvent, subscribeServerEvents } from "./server-events.js";
+import { AUTH_SESSION_IDLE_TIMEOUT_MS } from "./session-store.js";
 const KEEP_ALIVE_INTERVAL_MS = 3e4;
+const getEventStreamLifetimeMs = (expires) => {
+  if (!expires) {
+    return AUTH_SESSION_IDLE_TIMEOUT_MS;
+  }
+  const expiresAt = expires instanceof Date ? expires : new Date(expires);
+  if (Number.isNaN(expiresAt.getTime())) {
+    return AUTH_SESSION_IDLE_TIMEOUT_MS;
+  }
+  return Math.max(0, Math.min(expiresAt.getTime() - Date.now(), AUTH_SESSION_IDLE_TIMEOUT_MS));
+};
 const createServerEventsHandler = () => {
   return async (req, res) => {
     res.status(200);
@@ -15,6 +26,11 @@ const createServerEventsHandler = () => {
     const keepAliveTimer = setInterval(() => {
       res.write(": keepalive\n\n");
     }, KEEP_ALIVE_INTERVAL_MS);
+    keepAliveTimer.unref?.();
+    const sessionExpiryTimer = setTimeout(() => {
+      res.end();
+    }, getEventStreamLifetimeMs(req.session?.cookie.expires));
+    sessionExpiryTimer.unref?.();
     let cleanedUp = false;
     const cleanup = () => {
       if (cleanedUp) {
@@ -22,6 +38,7 @@ const createServerEventsHandler = () => {
       }
       cleanedUp = true;
       clearInterval(keepAliveTimer);
+      clearTimeout(sessionExpiryTimer);
       unsubscribe();
     };
     req.on("close", cleanup);

package/server/dist/modules/server-events-handler.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/modules/server-events-handler.ts"],"sourcesContent":["import type { Controller } from '~/types/index.js';\nimport { serializeServerEvent, subscribeServerEvents } from './server-events.js';\n\nconst KEEP_ALIVE_INTERVAL_MS = 30_000;\n\nexport const createServerEventsHandler = (): Controller => {\n    return async (req, res) => {\n        res.status(200);\n        res.setHeader('Content-Type', 'text/event-stream; charset=utf-8');\n        res.setHeader('Cache-Control', 'no-cache, no-transform');\n        res.setHeader('Connection', 'keep-alive');\n        res.setHeader('X-Accel-Buffering', 'no');\n        res.flushHeaders?.();\n        res.write(': connected\\n\\n');\n\n        const unsubscribe = subscribeServerEvents((event) => {\n            res.write(serializeServerEvent(event));\n        });\n\n        const keepAliveTimer = setInterval(() => {\n            res.write(': keepalive\\n\\n');\n        }, KEEP_ALIVE_INTERVAL_MS);\n\n        let cleanedUp = false;\n\n        const cleanup = () => {\n            if (cleanedUp) {\n                return;\n            }\n\n            cleanedUp = true;\n            clearInterval(keepAliveTimer);\n            unsubscribe();\n        };\n\n        req.on('close', cleanup);\n        res.on('close', cleanup);\n    };\n};\n"],"mappings":"AACA,SAAS,sBAAsB,6BAA6B;AAE5D,MAAM,yBAAyB;AAExB,MAAM,4BAA4B,MAAkB;AACvD,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI,OAAO,GAAG;AACd,QAAI,UAAU,gBAAgB,kCAAkC;AAChE,QAAI,UAAU,iBAAiB,wBAAwB;AACvD,QAAI,UAAU,cAAc,YAAY;AACxC,QAAI,UAAU,qBAAqB,IAAI;AACvC,QAAI,eAAe;AACnB,QAAI,MAAM,iBAAiB;AAE3B,UAAM,cAAc,sBAAsB,CAAC,UAAU;AACjD,UAAI,MAAM,qBAAqB,KAAK,CAAC;AAAA,IACzC,CAAC;AAED,UAAM,iBAAiB,YAAY,MAAM;AACrC,UAAI,MAAM,iBAAiB;AAAA,IAC/B,GAAG,sBAAsB;AAEzB,QAAI,YAAY;AAEhB,UAAM,UAAU,MAAM;AAClB,UAAI,WAAW;AACX;AAAA,MACJ;AAEA,kBAAY;AACZ,oBAAc,cAAc;AAC5B,kBAAY;AAAA,IAChB;AAEA,QAAI,GAAG,SAAS,OAAO;AACvB,QAAI,GAAG,SAAS,OAAO;AAAA,EAC3B;AACJ;","names":[]}
+{"version":3,"sources":["../../src/modules/server-events-handler.ts"],"sourcesContent":["import type { Controller } from '~/types/index.js';\nimport { serializeServerEvent, subscribeServerEvents } from './server-events.js';\nimport { AUTH_SESSION_IDLE_TIMEOUT_MS } from './session-store.js';\n\nconst KEEP_ALIVE_INTERVAL_MS = 30_000;\n\nconst getEventStreamLifetimeMs = (expires?: Date | string | null) => {\n    if (!expires) {\n        return AUTH_SESSION_IDLE_TIMEOUT_MS;\n    }\n\n    const expiresAt = expires instanceof Date ? expires : new Date(expires);\n\n    if (Number.isNaN(expiresAt.getTime())) {\n        return AUTH_SESSION_IDLE_TIMEOUT_MS;\n    }\n\n    return Math.max(0, Math.min(expiresAt.getTime() - Date.now(), AUTH_SESSION_IDLE_TIMEOUT_MS));\n};\n\nexport const createServerEventsHandler = (): Controller => {\n    return async (req, res) => {\n        res.status(200);\n        res.setHeader('Content-Type', 'text/event-stream; charset=utf-8');\n        res.setHeader('Cache-Control', 'no-cache, no-transform');\n        res.setHeader('Connection', 'keep-alive');\n        res.setHeader('X-Accel-Buffering', 'no');\n        res.flushHeaders?.();\n        res.write(': connected\\n\\n');\n\n        const unsubscribe = subscribeServerEvents((event) => {\n            res.write(serializeServerEvent(event));\n        });\n\n        const keepAliveTimer = setInterval(() => {\n            res.write(': keepalive\\n\\n');\n        }, KEEP_ALIVE_INTERVAL_MS);\n        keepAliveTimer.unref?.();\n\n        const sessionExpiryTimer = setTimeout(() => {\n            res.end();\n        }, getEventStreamLifetimeMs(req.session?.cookie.expires));\n        sessionExpiryTimer.unref?.();\n\n        let cleanedUp = false;\n\n        const cleanup = () => {\n            if (cleanedUp) {\n                return;\n            }\n\n            cleanedUp = true;\n            clearInterval(keepAliveTimer);\n            clearTimeout(sessionExpiryTimer);\n            unsubscribe();\n        };\n\n        req.on('close', cleanup);\n        res.on('close', cleanup);\n    };\n};\n"],"mappings":"AACA,SAAS,sBAAsB,6BAA6B;AAC5D,SAAS,oCAAoC;AAE7C,MAAM,yBAAyB;AAE/B,MAAM,2BAA2B,CAAC,YAAmC;AACjE,MAAI,CAAC,SAAS;AACV,WAAO;AAAA,EACX;AAEA,QAAM,YAAY,mBAAmB,OAAO,UAAU,IAAI,KAAK,OAAO;AAEtE,MAAI,OAAO,MAAM,UAAU,QAAQ,CAAC,GAAG;AACnC,WAAO;AAAA,EACX;AAEA,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG,4BAA4B,CAAC;AAC/F;AAEO,MAAM,4BAA4B,MAAkB;AACvD,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI,OAAO,GAAG;AACd,QAAI,UAAU,gBAAgB,kCAAkC;AAChE,QAAI,UAAU,iBAAiB,wBAAwB;AACvD,QAAI,UAAU,cAAc,YAAY;AACxC,QAAI,UAAU,qBAAqB,IAAI;AACvC,QAAI,eAAe;AACnB,QAAI,MAAM,iBAAiB;AAE3B,UAAM,cAAc,sBAAsB,CAAC,UAAU;AACjD,UAAI,MAAM,qBAAqB,KAAK,CAAC;AAAA,IACzC,CAAC;AAED,UAAM,iBAAiB,YAAY,MAAM;AACrC,UAAI,MAAM,iBAAiB;AAAA,IAC/B,GAAG,sBAAsB;AACzB,mBAAe,QAAQ;AAEvB,UAAM,qBAAqB,WAAW,MAAM;AACxC,UAAI,IAAI;AAAA,IACZ,GAAG,yBAAyB,IAAI,SAAS,OAAO,OAAO,CAAC;AACxD,uBAAmB,QAAQ;AAE3B,QAAI,YAAY;AAEhB,UAAM,UAAU,MAAM;AAClB,UAAI,WAAW;AACX;AAAA,MACJ;AAEA,kBAAY;AACZ,oBAAc,cAAc;AAC5B,mBAAa,kBAAkB;AAC/B,kBAAY;AAAA,IAChB;AAEA,QAAI,GAAG,SAAS,OAAO;AACvB,QAAI,GAAG,SAAS,OAAO;AAAA,EAC3B;AACJ;","names":[]}