@creator-notes/cnotes 0.25.1 → 0.26.0

package/dist/lib/api-client.js

@@ -8,6 +8,43 @@ function isRetryable(status) {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+/**
+ * Resolve the agent-run to attach to writes against `serverUrl`, in precedence
+ * order:
+ *
+ *   1. `CNOTES_AGENT_RUN_ID` env var (explicit override, wins everything).
+ *      `canvas agent-run wrap` sets this for its subprocess, so a wrapped run
+ *      correctly beats any outer persisted run.
+ *   2. The active run persisted on this server's config, written by
+ *      `cnotes operations begin` / `cnotes canvas agent-run begin` and cleared
+ *      by their matching `end`.
+ *
+ * The run id and its before-snapshot resolve together, from ONE source. They
+ * are a pair — the snapshot is the state of the canvas at that run's begin — so
+ * mixing them across sources would hand a wrapped run the *outer* run's
+ * before-snapshot. The server drops a snapshot that belongs to another canvas,
+ * so the run would quietly lose its revert point rather than fail loudly.
+ *
+ * Exported so the bracketing commands resolve the run the same way the client
+ * attaches it — `canvas agent-run end` closing a run the client would not have
+ * attached to is exactly the desync that let agent edits record as human ones.
+ */
+export function resolveActiveAgentRun(serverUrl) {
+    const envRunId = process.env.CNOTES_AGENT_RUN_ID;
+    if (envRunId) {
+        return {
+            agentRunId: envRunId,
+            beforeSnapshotId: process.env.CNOTES_AGENT_BEFORE_SNAPSHOT_ID,
+        };
+    }
+    const active = getActiveAgentRunId(loadConfig(), serverUrl);
+    if (!active)
+        return undefined;
+    return {
+        agentRunId: active.agentRunId,
+        beforeSnapshotId: active.beforeSnapshotId,
+    };
+}
 export class ApiClient {
     serverUrl;
     token;
@@ -17,12 +54,7 @@ export class ApiClient {
     }
     /**
      * Build request headers, attaching the active agent-run when one is
-     * open. Resolution order:
-     *
-     *   1. `CNOTES_AGENT_RUN_ID` env var (explicit override, wins everything).
-     *   2. The `activeAgentRunId` persisted on the current server's config
-     *      (written by `cnotes operations begin`, cleared by `cnotes operations
-     *      end`).
+     * open (see {@link resolveActiveAgentRun} for the resolution order).
      *
      * The config fallback exists because env vars don't survive across
      * separate shell processes (or stateless tool calls — e.g. an agent
@@ -32,27 +64,31 @@ export class ApiClient {
      *
      * X-Agent-Before-Snapshot-Id carries the begin-checkpoint's snapshot
      * ID so the first mutation under the run can back-link
-     * operation.checkpointBeforeId at open time. The server validates the
-     * snapshot belongs to the target canvas before stamping it.
+     * operation.checkpointBeforeId at open time — no header, no revert point.
+     * The server validates the snapshot belongs to the target canvas before
+     * stamping it, and ignores it entirely without a run id.
      *
      * Prompt + rationale are deliberately NOT carried per-request — they
      * were already persisted on the operation row at begin time, and
      * resending them on every mutation would create a spoofing surface (a
      * leaked runId could overwrite stored intent metadata).
+     *
+     * @internal exposed (not private) so tests can assert the run actually
+     * rides on the request — the header being silently absent is the bug.
      */
-    headers() {
+    buildHeaders() {
         const base = {
             Authorization: `Bearer ${this.token}`,
             "Content-Type": "application/json",
             "X-Source": "cli",
         };
-        const agentRunId = process.env.CNOTES_AGENT_RUN_ID ??
-            getActiveAgentRunId(loadConfig(), this.serverUrl)?.agentRunId;
-        if (agentRunId)
-            base["X-Agent-Run-Id"] = agentRunId;
-        const beforeId = process.env.CNOTES_AGENT_BEFORE_SNAPSHOT_ID;
-        if (beforeId)
-            base["X-Agent-Before-Snapshot-Id"] = beforeId;
+        const run = resolveActiveAgentRun(this.serverUrl);
+        if (run) {
+            base["X-Agent-Run-Id"] = run.agentRunId;
+            if (run.beforeSnapshotId) {
+                base["X-Agent-Before-Snapshot-Id"] = run.beforeSnapshotId;
+            }
+        }
         return base;
     }
     /**
@@ -129,7 +165,7 @@ export class ApiClient {
         }
         const res = await this.fetchWithRetry(url.toString(), {
             method: "GET",
-            headers: this.headers(),
+            headers: this.buildHeaders(),
         });
         if (!res.ok) {
             const body = await this.errorBody(res);
@@ -141,7 +177,7 @@ export class ApiClient {
         const url = new URL(path, this.serverUrl);
         const res = await this.fetchWithRetry(url.toString(), {
             method: "POST",
-            headers: this.headers(),
+            headers: this.buildHeaders(),
             body: body ? JSON.stringify(body) : undefined,
         });
         if (!res.ok) {
@@ -173,7 +209,7 @@ export class ApiClient {
         const url = new URL(path, this.serverUrl);
         const res = await this.fetchWithRetry(url.toString(), {
             method: "PUT",
-            headers: this.headers(),
+            headers: this.buildHeaders(),
             body: body ? JSON.stringify(body) : undefined,
         });
         if (!res.ok) {
@@ -192,7 +228,7 @@ export class ApiClient {
         }
         const res = await this.fetchWithRetry(url.toString(), {
             method: "PATCH",
-            headers: this.headers(),
+            headers: this.buildHeaders(),
             body: body ? JSON.stringify(body) : undefined,
         });
         if (!res.ok) {
@@ -205,7 +241,7 @@ export class ApiClient {
         const url = new URL(path, this.serverUrl);
         const res = await this.fetchWithRetry(url.toString(), {
             method: "DELETE",
-            headers: this.headers(),
+            headers: this.buildHeaders(),
         });
         if (!res.ok) {
             const body = await this.errorBody(res);
@@ -228,7 +264,7 @@ export class ApiClient {
         try {
             res = await fetch(url.toString(), {
                 method: "GET",
-                headers: this.headers(),
+                headers: this.buildHeaders(),
                 redirect: "manual",
             });
         }
@@ -247,7 +283,7 @@ export class ApiClient {
         if (res.status === 0 || (!location && res.status < 400)) {
             const followed = await this.fetchWithRetry(url.toString(), {
                 method: "GET",
-                headers: this.headers(),
+                headers: this.buildHeaders(),
             });
             if (!followed.ok) {
                 const body = await this.errorBody(followed);
@@ -270,7 +306,7 @@ export class ApiClient {
         const url = new URL(path, this.serverUrl);
         const res = await this.fetchWithRetry(url.toString(), {
             method: "GET",
-            headers: this.headers(),
+            headers: this.buildHeaders(),
         });
         if (!res.ok) {
             const body = await this.errorBody(res);

package/dist/lib/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAElE,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,OAAO,SAAS;IAEV;IACA;IAFV,YACU,SAAiB,EACjB,KAAa;QADb,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAAQ;IACpB,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,OAAO;QACb,MAAM,IAAI,GAA2B;YACnC,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;YACrC,cAAc,EAAE,kBAAkB;YAClC,UAAU,EAAE,KAAK;SAClB,CAAC;QACF,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC/B,mBAAmB,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;QAChE,IAAI,UAAU;YAAE,IAAI,CAAC,gBAAgB,CAAC,GAAG,UAAU,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAC7D,IAAI,QAAQ;YAAE,IAAI,CAAC,4BAA4B,CAAC,GAAG,QAAQ,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,cAAc,CAC1B,GAAW,EACX,IAAiB,EACjB,WAA4B;QAE5B,IAAI,SAA4B,CAAC;QAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,6DAA6D;gBAC7D,IAAI,OAAO,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;oBAC/B,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;gBAC1C,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAEnC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,OAAO,GAAG,CAAC;gBACb,CAAC;gBAED,0CAA0C;gBAC1C,IAAI,OAAO,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBAClD,MAAM,OAAO,GAAG,UAAU;wBACxB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;wBACnD,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACzC,MAAM,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,CAAC;oBACtC,SAAS;gBACX,CAAC;gBAED,OAAO,GAAG,CAAC,CAAC,8BAA8B;YAC5C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,2DAA2D;gBAC3D,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtE,IAAI,OAAO,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,OAAO,GAAG,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACrD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,UAAU,CACd,IAAI,CAAC,SAAS,EACd,SAAS,IAAI,IAAI,KAAK,CAAC,8BAA8B,CAAC,CACvD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,SAAS,CAAC,GAAa;QACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBACzC,CAAC,CAAE,MAAkC;gBACrC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,EAAE,KAAK,EAAE,kCAAkC,OAAO,EAAE,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CACP,IAAY,EACZ,MAA2C;QAE3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,SAAS;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,IAAI,CACR,IAAY,EACZ,IAA8B;QAE9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,aAA6B;QAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG;YACd,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;YACrC,UAAU,EAAE,KAAK;YACjB,+DAA+D;SAChE,CAAC;QAEF,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,aAAa,EAAE;SACtB,EAAE,aAAa,CAAC,CAAC;QAElB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,GAAG,CACP,IAAY,EACZ,IAA8B;QAE9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK,CACT,IAAY,EACZ,IAA8B,EAC9B,MAA2C;QAE3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,SAAS;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAc,IAAY;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,kBAAkB,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAChC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;gBACvB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,2EAA2E;YAC3E,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,mEAAmE;QACnE,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBACzD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC5C,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,CAAC;QACtB,CAAC;QAED,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,IAAY;QAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,aAAa,CAAI,GAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,EAAO,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/D,MAAM,IAAI,QAAQ,CAChB,uCAAuC,GAAG,CAAC,GAAG,UAAU,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,EACjF,UAAU,CAAC,OAAO,EAClB,mKAAmK,CACpK,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAElE,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,UAAU,EAAE,QAAQ;YACpB,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B;SAC9D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,SAAS;IAEV;IACA;IAFV,YACU,SAAiB,EACjB,KAAa;QADb,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAAQ;IACpB,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,YAAY;QACV,MAAM,IAAI,GAA2B;YACnC,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;YACrC,cAAc,EAAE,kBAAkB;YAClC,UAAU,EAAE,KAAK;SAClB,CAAC;QACF,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC;YACxC,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBACzB,IAAI,CAAC,4BAA4B,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,cAAc,CAC1B,GAAW,EACX,IAAiB,EACjB,WAA4B;QAE5B,IAAI,SAA4B,CAAC;QAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,6DAA6D;gBAC7D,IAAI,OAAO,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;oBAC/B,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;gBAC1C,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAEnC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,OAAO,GAAG,CAAC;gBACb,CAAC;gBAED,0CAA0C;gBAC1C,IAAI,OAAO,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBAClD,MAAM,OAAO,GAAG,UAAU;wBACxB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;wBACnD,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACzC,MAAM,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,CAAC;oBACtC,SAAS;gBACX,CAAC;gBAED,OAAO,GAAG,CAAC,CAAC,8BAA8B;YAC5C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,2DAA2D;gBAC3D,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtE,IAAI,OAAO,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,OAAO,GAAG,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACrD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,UAAU,CACd,IAAI,CAAC,SAAS,EACd,SAAS,IAAI,IAAI,KAAK,CAAC,8BAA8B,CAAC,CACvD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,SAAS,CAAC,GAAa;QACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBACzC,CAAC,CAAE,MAAkC;gBACrC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,EAAE,KAAK,EAAE,kCAAkC,OAAO,EAAE,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CACP,IAAY,EACZ,MAA2C;QAE3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,SAAS;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,IAAI,CACR,IAAY,EACZ,IAA8B;QAE9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,aAA6B;QAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG;YACd,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;YACrC,UAAU,EAAE,KAAK;YACjB,+DAA+D;SAChE,CAAC;QAEF,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,aAAa,EAAE;SACtB,EAAE,aAAa,CAAC,CAAC;QAElB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,GAAG,CACP,IAAY,EACZ,IAA8B;QAE9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK,CACT,IAAY,EACZ,IAA8B,EAC9B,MAA2C;QAE3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,SAAS;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAc,IAAY;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,kBAAkB,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAChC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,2EAA2E;YAC3E,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,mEAAmE;QACnE,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBACzD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC5C,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,CAAC;QACtB,CAAC;QAED,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,IAAY;QAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,aAAa,CAAI,GAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,EAAO,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/D,MAAM,IAAI,QAAQ,CAChB,uCAAuC,GAAG,CAAC,GAAG,UAAU,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,EACjF,UAAU,CAAC,OAAO,EAClB,mKAAmK,CACpK,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/lib/auth-store.d.ts

@@ -4,15 +4,36 @@ export interface ServerConfig {
     workspaceId?: string;
     /**
      * Currently-open agent-run on this server, written by `cnotes operations
-     * begin` and cleared by `cnotes operations end`. The api-client falls back
-     * to this when CNOTES_AGENT_RUN_ID env is unset, so cnotes writes across
-     * separate shell processes (or stateless tool calls) auto-attach to the
-     * active run. Env wins when set, for explicit overrides.
+     * begin` / `cnotes canvas agent-run begin` and cleared by their matching
+     * `end`. The api-client falls back to this when CNOTES_AGENT_RUN_ID env is
+     * unset, so cnotes writes across separate shell processes (or stateless tool
+     * calls) auto-attach to the active run. Env wins when set, for explicit
+     * overrides.
+     *
+     * Both bracketing commands share this one slot on purpose: a request carries
+     * exactly one X-Agent-Run-Id, so two concurrent "active" runs would be
+     * ambiguous. `begin` refuses when this is already set (unless --force).
      */
     activeAgentRunId?: string;
     /** When activeAgentRunId was opened — used to surface helpful "started
      *  Xm ago" context on the "already-active" warning at begin time. */
     activeAgentRunStartedAt?: number;
+    /**
+     * The `auto.before_agent` snapshot captured when a *canvas* agent-run was
+     * opened. Rides on every subsequent write as X-Agent-Before-Snapshot-Id so
+     * the run's first canvas mutation can back-link `checkpointBeforeId` onto its
+     * operation row.
+     *
+     * Load-bearing, not decorative: the server only back-links this at the first
+     * mutation (at begin time the operation row doesn't exist yet), and
+     * getRevertContext returns null without it — so a run that never carries this
+     * header cannot be reverted. Persisting it beside the run id is what makes
+     * "Revert this run" work for callers that don't inherit an env var.
+     *
+     * Unset for `operations begin` runs: those are workspace-scoped and have no
+     * canvas snapshot to carry.
+     */
+    activeAgentBeforeSnapshotId?: string;
 }
 export interface CliConfig {
     version: 1;
@@ -35,20 +56,31 @@ export declare function setCurrentServer(config: CliConfig, serverUrl: string):
 export declare function setWorkspaceId(config: CliConfig, serverUrl: string, workspaceId: string): boolean;
 /**
  * Mark a given agent-run as the active one for a server. Subsequent cnotes
- * writes against this server will carry X-Agent-Run-Id automatically.
+ * writes against this server will carry X-Agent-Run-Id automatically —
+ * plus X-Agent-Before-Snapshot-Id when `beforeSnapshotId` is given (canvas
+ * runs), which is what makes the run revertable.
+ *
+ * Returns false (a no-op) when there is no stored config entry for `serverUrl`
+ * — i.e. the token came from a flag or env var against a server never logged
+ * into with `cnotes auth login`, so there is nowhere on disk to record the run.
+ * Callers MUST surface this instead of claiming the run is active: silently
+ * persisting nothing is exactly how bracketed agent writes end up recorded as
+ * unattributed human edits. Same contract as setWorkspaceId above.
  */
-export declare function setActiveAgentRunId(config: CliConfig, serverUrl: string, agentRunId: string, startedAt: number): void;
+export declare function setActiveAgentRunId(config: CliConfig, serverUrl: string, agentRunId: string, startedAt: number, beforeSnapshotId?: string): boolean;
 /**
- * Clear the active agent-run for a server. Called by `cnotes operations end`
- * after a successful close, so the next cnotes write reverts to "unattached"
- * unless the user opens a new run.
+ * Clear the active agent-run for a server. Called by `cnotes operations end` /
+ * `cnotes canvas agent-run end` after a successful close, so the next cnotes
+ * write reverts to "unattached" unless the user opens a new run.
  */
 export declare function clearActiveAgentRunId(config: CliConfig, serverUrl: string): void;
 /**
- * Read the active agent-run for a server (if any).
+ * Read the active agent-run for a server (if any). `beforeSnapshotId` is
+ * present only for canvas runs (see the field docs on ServerConfig).
  */
 export declare function getActiveAgentRunId(config: CliConfig, serverUrl: string): {
     agentRunId: string;
     startedAt: number;
+    beforeSnapshotId?: string;
 } | null;
 //# sourceMappingURL=auth-store.d.ts.map

package/dist/lib/auth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../src/lib/auth-store.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;yEACqE;IACrE,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,aAAa,EAAE,MAAM,CAAC;CACvB;AA2CD,wBAAgB,UAAU,IAAI,SAAS,CAmBtC;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAQlD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAGvF;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,YAAY,GACzB,IAAI,CAGN;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAG7E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAG3E;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAQT;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,IAAI,CAON;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,GAChB,IAAI,CAON;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,GAChB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASlD"}
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../src/lib/auth-store.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;yEACqE;IACrE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,aAAa,EAAE,MAAM,CAAC;CACvB;AA8CD,wBAAgB,UAAU,IAAI,SAAS,CAmBtC;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAQlD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAGvF;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,YAAY,GACzB,IAAI,CAGN;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAG7E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAG3E;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAQT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAeT;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,GAChB,IAAI,CAWN;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,GAChB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAU7E"}

package/dist/lib/auth-store.js

@@ -2,7 +2,10 @@ import { readFileSync, writeFileSync, mkdirSync, chmodSync, existsSync, renameSy
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { BRAND } from "./brand.js";
-const CONFIG_DIR = join(homedir(), BRAND.configDir);
+// CNOTES_CONFIG_DIR redirects the whole config store (used by tests to work
+// against a temp dir instead of the real ~/.cnotes, and handy for sandboxed or
+// multi-profile setups). Unset in normal use, which is the homedir default.
+const CONFIG_DIR = process.env.CNOTES_CONFIG_DIR || join(homedir(), BRAND.configDir);
 const CONFIG_FILE = join(CONFIG_DIR, "config.json");
 /**
  * One-time migration of the pre-rename config dir (`~/.creatornotes`) to the
@@ -98,31 +101,53 @@ export function setWorkspaceId(config, serverUrl, workspaceId) {
 }
 /**
  * Mark a given agent-run as the active one for a server. Subsequent cnotes
- * writes against this server will carry X-Agent-Run-Id automatically.
+ * writes against this server will carry X-Agent-Run-Id automatically —
+ * plus X-Agent-Before-Snapshot-Id when `beforeSnapshotId` is given (canvas
+ * runs), which is what makes the run revertable.
+ *
+ * Returns false (a no-op) when there is no stored config entry for `serverUrl`
+ * — i.e. the token came from a flag or env var against a server never logged
+ * into with `cnotes auth login`, so there is nowhere on disk to record the run.
+ * Callers MUST surface this instead of claiming the run is active: silently
+ * persisting nothing is exactly how bracketed agent writes end up recorded as
+ * unattributed human edits. Same contract as setWorkspaceId above.
  */
-export function setActiveAgentRunId(config, serverUrl, agentRunId, startedAt) {
+export function setActiveAgentRunId(config, serverUrl, agentRunId, startedAt, beforeSnapshotId) {
     const sc = config.servers[serverUrl];
-    if (sc) {
-        sc.activeAgentRunId = agentRunId;
-        sc.activeAgentRunStartedAt = startedAt;
-        saveConfig(config);
+    if (!sc)
+        return false;
+    sc.activeAgentRunId = agentRunId;
+    sc.activeAgentRunStartedAt = startedAt;
+    // Always write the slot, so a canvas run never inherits the stale
+    // before-snapshot of a previous run (which belongs to a different canvas and
+    // would be dropped server-side anyway, silently costing revertability).
+    if (beforeSnapshotId) {
+        sc.activeAgentBeforeSnapshotId = beforeSnapshotId;
     }
+    else {
+        delete sc.activeAgentBeforeSnapshotId;
+    }
+    saveConfig(config);
+    return true;
 }
 /**
- * Clear the active agent-run for a server. Called by `cnotes operations end`
- * after a successful close, so the next cnotes write reverts to "unattached"
- * unless the user opens a new run.
+ * Clear the active agent-run for a server. Called by `cnotes operations end` /
+ * `cnotes canvas agent-run end` after a successful close, so the next cnotes
+ * write reverts to "unattached" unless the user opens a new run.
  */
 export function clearActiveAgentRunId(config, serverUrl) {
     const sc = config.servers[serverUrl];
-    if (sc && (sc.activeAgentRunId || sc.activeAgentRunStartedAt)) {
+    if (sc &&
+        (sc.activeAgentRunId || sc.activeAgentRunStartedAt || sc.activeAgentBeforeSnapshotId)) {
         delete sc.activeAgentRunId;
         delete sc.activeAgentRunStartedAt;
+        delete sc.activeAgentBeforeSnapshotId;
         saveConfig(config);
     }
 }
 /**
- * Read the active agent-run for a server (if any).
+ * Read the active agent-run for a server (if any). `beforeSnapshotId` is
+ * present only for canvas runs (see the field docs on ServerConfig).
  */
 export function getActiveAgentRunId(config, serverUrl) {
     const sc = config.servers[serverUrl];
@@ -130,6 +155,7 @@ export function getActiveAgentRunId(config, serverUrl) {
         return {
             agentRunId: sc.activeAgentRunId,
             startedAt: sc.activeAgentRunStartedAt,
+            beforeSnapshotId: sc.activeAgentBeforeSnapshotId,
         };
     }
     return null;

package/dist/lib/auth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../../src/lib/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAyBnC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AACpD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,eAAe,CAAC,CAAC;AAC3D,SAAS,sBAAsB;IAC7B,IAAI,CAAC;QACH,IACE,UAAU,KAAK,iBAAiB;YAChC,UAAU,CAAC,iBAAiB,CAAC;YAC7B,CAAC,UAAU,CAAC,UAAU,CAAC,EACvB,CAAC;YACD,UAAU,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;AACH,CAAC;AACD,sBAAsB,EAAE,CAAC;AAEzB,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC,GAAG,CAAC;AAE7C,SAAS,aAAa;IACpB,OAAO;QACL,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,EAAE;QACX,aAAa,EAAE,cAAc;KAC9B,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,IAAI,sBAAsB,GAAG,KAAK,CAAC;AAEnC,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,IAAI,GAAI,CAAkC,EAAE,IAAI,CAAC;QACvD,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjD,sBAAsB,GAAG,IAAI,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,KAAK,CACX,yCAAyC,WAAW,KAAK,MAAM,yFAAyF,CACzJ,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAiB;IAC1C,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QACjE,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,kDAAkD;IAClD,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAiB,EAAE,MAAe;IAChE,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,CAAC,aAAa,CAAC;IACjD,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,MAAiB,EACjB,SAAiB,EACjB,YAA0B;IAE1B,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,YAAY,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,SAAiB;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,SAAiB;IACnE,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAiB,EACjB,SAAiB,EACjB,WAAmB;IAEnB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,EAAE,EAAE,CAAC;QACP,EAAE,CAAC,WAAW,GAAG,WAAW,CAAC;QAC7B,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,SAAiB,EACjB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,EAAE,EAAE,CAAC;QACP,EAAE,CAAC,gBAAgB,GAAG,UAAU,CAAC;QACjC,EAAE,CAAC,uBAAuB,GAAG,SAAS,CAAC;QACvC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAiB,EACjB,SAAiB;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,OAAO,EAAE,CAAC,uBAAuB,CAAC;QAClC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,SAAiB;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,EAAE,EAAE,gBAAgB,IAAI,EAAE,CAAC,uBAAuB,EAAE,CAAC;QACvD,OAAO;YACL,UAAU,EAAE,EAAE,CAAC,gBAAgB;YAC/B,SAAS,EAAE,EAAE,CAAC,uBAAuB;SACtC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../../src/lib/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AA8CnC,4EAA4E;AAC5E,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AACrF,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,eAAe,CAAC,CAAC;AAC3D,SAAS,sBAAsB;IAC7B,IAAI,CAAC;QACH,IACE,UAAU,KAAK,iBAAiB;YAChC,UAAU,CAAC,iBAAiB,CAAC;YAC7B,CAAC,UAAU,CAAC,UAAU,CAAC,EACvB,CAAC;YACD,UAAU,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;AACH,CAAC;AACD,sBAAsB,EAAE,CAAC;AAEzB,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC,GAAG,CAAC;AAE7C,SAAS,aAAa;IACpB,OAAO;QACL,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,EAAE;QACX,aAAa,EAAE,cAAc;KAC9B,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,IAAI,sBAAsB,GAAG,KAAK,CAAC;AAEnC,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,IAAI,GAAI,CAAkC,EAAE,IAAI,CAAC;QACvD,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjD,sBAAsB,GAAG,IAAI,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,KAAK,CACX,yCAAyC,WAAW,KAAK,MAAM,yFAAyF,CACzJ,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAiB;IAC1C,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QACjE,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,kDAAkD;IAClD,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAiB,EAAE,MAAe;IAChE,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,CAAC,aAAa,CAAC;IACjD,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,MAAiB,EACjB,SAAiB,EACjB,YAA0B;IAE1B,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,YAAY,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,SAAiB;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,SAAiB;IACnE,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAiB,EACjB,SAAiB,EACjB,WAAmB;IAEnB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,EAAE,EAAE,CAAC;QACP,EAAE,CAAC,WAAW,GAAG,WAAW,CAAC;QAC7B,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,SAAiB,EACjB,UAAkB,EAClB,SAAiB,EACjB,gBAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,EAAE,CAAC,gBAAgB,GAAG,UAAU,CAAC;IACjC,EAAE,CAAC,uBAAuB,GAAG,SAAS,CAAC;IACvC,kEAAkE;IAClE,6EAA6E;IAC7E,wEAAwE;IACxE,IAAI,gBAAgB,EAAE,CAAC;QACrB,EAAE,CAAC,2BAA2B,GAAG,gBAAgB,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,CAAC,2BAA2B,CAAC;IACxC,CAAC;IACD,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAiB,EACjB,SAAiB;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,IACE,EAAE;QACF,CAAC,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,uBAAuB,IAAI,EAAE,CAAC,2BAA2B,CAAC,EACrF,CAAC;QACD,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,OAAO,EAAE,CAAC,uBAAuB,CAAC;QAClC,OAAO,EAAE,CAAC,2BAA2B,CAAC;QACtC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,SAAiB;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,EAAE,EAAE,gBAAgB,IAAI,EAAE,CAAC,uBAAuB,EAAE,CAAC;QACvD,OAAO;YACL,UAAU,EAAE,EAAE,CAAC,gBAAgB;YAC/B,SAAS,EAAE,EAAE,CAAC,uBAAuB;YACrC,gBAAgB,EAAE,EAAE,CAAC,2BAA2B;SACjD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/mcp-local-file.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Throws when `absPath` is outside the permitted local-read scope.
+ */
+export declare function assertMcpLocalFileReadable(absPath: string): void;
+/**
+ * Return canonical effective roots. `/` and the user's home are intentionally
+ * excluded as implicit cwd roots: MCP clients commonly start there, which
+ * would otherwise make the containment check cover all or nearly all files.
+ */
+export declare function getMcpLocalFileRoots(): string[];
+//# sourceMappingURL=mcp-local-file.d.ts.map

package/dist/lib/mcp-local-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-local-file.d.ts","sourceRoot":"","sources":["../../src/lib/mcp-local-file.ts"],"names":[],"mappings":"AAkCA;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAahE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAU/C"}

package/dist/lib/mcp-local-file.js

@@ -0,0 +1,62 @@
+import { realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+/**
+ * Guardrails for MCP `cnotes_files_upload` local reads (SOC2 pen-test MEDIUM-3).
+ *
+ * By default only files under the process cwd or explicit allowlist dirs may be
+ * read. Set CNOTES_MCP_ALLOW_ANY_LOCAL_FILE=1 to disable (not recommended).
+ */
+function canonicalPath(value) {
+    try {
+        return realpathSync(value);
+    }
+    catch {
+        throw new Error(`MCP local-read scope does not exist or is unreadable: "${value}"`);
+    }
+}
+function parseAllowedDirs() {
+    const raw = process.env.CNOTES_MCP_ALLOWED_DIRS;
+    if (!raw)
+        return [];
+    return raw
+        .split(path.delimiter)
+        .map((d) => d.trim())
+        .filter(Boolean)
+        .map((d) => canonicalPath(path.resolve(d)));
+}
+function isUnderRoot(filePath, root) {
+    const rel = path.relative(root, filePath);
+    return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+/**
+ * Throws when `absPath` is outside the permitted local-read scope.
+ */
+export function assertMcpLocalFileReadable(absPath) {
+    if (process.env.CNOTES_MCP_ALLOW_ANY_LOCAL_FILE === "1")
+        return;
+    const resolved = canonicalPath(path.resolve(absPath));
+    const roots = getMcpLocalFileRoots();
+    if (roots.some((root) => isUnderRoot(resolved, root)))
+        return;
+    throw new Error(`Refusing to read "${resolved}" — outside the MCP local-read scope (cwd: ${process.cwd()}). ` +
+        `Set CNOTES_MCP_ALLOWED_DIRS to add directories (colon-separated), or ` +
+        `CNOTES_MCP_ALLOW_ANY_LOCAL_FILE=1 to disable this guard (not recommended).`);
+}
+/**
+ * Return canonical effective roots. `/` and the user's home are intentionally
+ * excluded as implicit cwd roots: MCP clients commonly start there, which
+ * would otherwise make the containment check cover all or nearly all files.
+ */
+export function getMcpLocalFileRoots() {
+    if (process.env.CNOTES_MCP_ALLOW_ANY_LOCAL_FILE === "1")
+        return [];
+    const cwd = canonicalPath(path.resolve(process.cwd()));
+    const unsafeImplicitRoots = new Set([
+        canonicalPath(path.parse(cwd).root),
+        canonicalPath(homedir()),
+    ]);
+    const implicitRoots = unsafeImplicitRoots.has(cwd) ? [] : [cwd];
+    return [...new Set([...implicitRoots, ...parseAllowedDirs()])];
+}
+//# sourceMappingURL=mcp-local-file.js.map

package/dist/lib/mcp-local-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-local-file.js","sourceRoot":"","sources":["../../src/lib/mcp-local-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;GAKG;AAEH,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0DAA0D,KAAK,GAAG,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAY;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG;QAAE,OAAO;IAEhE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;IAErC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO;IAE9D,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,8CAA8C,OAAO,CAAC,GAAG,EAAE,KAAK;QAC3F,uEAAuE;QACvE,4EAA4E,CAC/E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAEnE,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;QAClC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnC,aAAa,CAAC,OAAO,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/lib/output.d.ts

@@ -22,6 +22,13 @@ export declare function outputTable(headers: string[], rows: string[][]): void;
  * Format a timestamp as relative time (e.g., "2h ago", "3d ago").
  */
 export declare function timeAgo(timestamp: number | string): string;
+/**
+ * Like timeAgo, but keeps second-level precision instead of collapsing the
+ * first minute to "just now". Used by the agent-run conflict messages, where
+ * "started 8s ago" vs "started 3h ago" is the whole signal: it tells you
+ * whether you just opened this run in another shell or left one stranded.
+ */
+export declare function formatAgo(startedAtMs: number): string;
 /**
  * Truncate a string to a max length with ellipsis.
  */

package/dist/lib/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAYvE;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAEjE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE/C;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,EAAE,MAAM,EAAE,EAAE,GACf,IAAI,CAeN;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAa1D;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGzD"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAYvE;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAEjE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE/C;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,EAAE,MAAM,EAAE,EAAE,GACf,IAAI,CAeN;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAa1D;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGzD"}

package/dist/lib/output.js

@@ -67,6 +67,22 @@ export function timeAgo(timestamp) {
         return `${minutes}m ago`;
     return "just now";
 }
+/**
+ * Like timeAgo, but keeps second-level precision instead of collapsing the
+ * first minute to "just now". Used by the agent-run conflict messages, where
+ * "started 8s ago" vs "started 3h ago" is the whole signal: it tells you
+ * whether you just opened this run in another shell or left one stranded.
+ */
+export function formatAgo(startedAtMs) {
+    const sec = Math.max(0, Math.round((Date.now() - startedAtMs) / 1000));
+    if (sec < 60)
+        return `${sec}s ago`;
+    const min = Math.round(sec / 60);
+    if (min < 60)
+        return `${min}m ago`;
+    const hr = Math.round(min / 60);
+    return `${hr}h ago`;
+}
 /**
  * Truncate a string to a max length with ellipsis.
  */

package/dist/lib/output.js.map

@@ -1 +1 @@
-{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,MAAiB;IAC5D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,GAAY,EAAW,EAAE;QACrC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACtE,MAAM,GAAG,GAAG,GAA8B,CAAC;QAC3C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,GAAG;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAa,EAAE,MAAiB;IACzD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,OAAiB,EACjB,IAAgB;IAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAClC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAC5D,CAAC;IAEF,MAAM,UAAU,GAAG,OAAO;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;SAClC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9D,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,SAA0B;IAChD,MAAM,EAAE,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAEpC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,IAAI,OAAO,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,OAAO,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,OAAO,CAAC;IAC1C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,GAAW;IAC/C,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAClC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,MAAiB;IAC5D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,GAAY,EAAW,EAAE;QACrC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACtE,MAAM,GAAG,GAAG,GAA8B,CAAC;QAC3C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,GAAG;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAa,EAAE,MAAiB;IACzD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,OAAiB,EACjB,IAAgB;IAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAClC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAC5D,CAAC;IAEF,MAAM,UAAU,GAAG,OAAO;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;SAClC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9D,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,SAA0B;IAChD,MAAM,EAAE,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAEpC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,IAAI,OAAO,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,OAAO,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,OAAO,CAAC;IAC1C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,WAAmB;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,GAAG,GAAG,OAAO,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IACjC,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,GAAG,GAAG,OAAO,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAChC,OAAO,GAAG,EAAE,OAAO,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,GAAW;IAC/C,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAClC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;AAC1C,CAAC"}

package/dist/mcp-server.js

@@ -28,6 +28,7 @@ import { ApiError, CliError, NotFoundError } from "./lib/errors.js";
 import { resolveNoteId } from "./lib/resolve-note.js";
 import { readCanvasMarkdown } from "./lib/canvas-read.js";
 import { buildSchema } from "./lib/build-schema.js";
+import { assertMcpLocalFileReadable, getMcpLocalFileRoots, } from "./lib/mcp-local-file.js";
 // ---------------------------------------------------------------------------
 // Environment
 // ---------------------------------------------------------------------------
@@ -739,7 +740,7 @@ server.tool("cnotes_types_create", "Create a new note type (supertag).", {
     displayName: z.string().optional().describe("Display name (can have spaces)"),
     prefix: z.string().optional().describe("ID prefix, uppercase (e.g. PAINPOINT, USERSTORY)"),
     description: z.string().optional().describe("Description"),
-    color: z.string().optional().describe("Color hex code (e.g. #FF5733)"),
+    color: z.string().optional().describe("Color hex code (6-digit, e.g. #RRGGBB)"),
 }, async ({ name, displayName, prefix, description, color }) => withErrorHandling(() => api.post("/api/supertags", {
     workspaceId,
     name,
@@ -848,6 +849,7 @@ server.tool("cnotes_files_upload", "Upload an image file to the workspace. Retur
     filePath: z.string().describe("Absolute path to the image file on disk"),
 }, async ({ filePath }) => withErrorHandling(async () => {
     const absPath = path.resolve(filePath);
+    assertMcpLocalFileReadable(absPath);
     let stat;
     try {
         stat = statSync(absPath);
@@ -888,6 +890,10 @@ server.tool("cnotes_schema", "Describe this workspace in one call: valid note ty
 async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
+    const localReadScope = process.env.CNOTES_MCP_ALLOW_ANY_LOCAL_FILE === "1"
+        ? "unrestricted (CNOTES_MCP_ALLOW_ANY_LOCAL_FILE=1)"
+        : getMcpLocalFileRoots().join(path.delimiter) || "none (set CNOTES_MCP_ALLOWED_DIRS)";
+    process.stderr.write(`cnotes-mcp local file scope: ${localReadScope}\n`);
     process.stderr.write("cnotes-mcp server running on stdio\n");
 }
 main().catch((e) => {