@devyrpauli/mddocs 0.1.0 → 0.2.0

package/README.md

@@ -49,8 +49,8 @@ server. `mddocs` takes a different approach:
 |---|---|
 | Browser editor (comments, suggestions, provenance) | `mddocs open <file>` (single-user) or `mddocs serve <file>` (multiplayer) |
 | Real-time multiplayer with presence | `mddocs serve <file>`: everyone on the URL co-edits live; edits persist to the file plus git |
-| Role-based share links (editor / commenter / viewer) | `serve` prints a link per role; viewers are read-only, enforced server-side |
-| Agent HTTP API | AI tools read state and post comments/suggestions live, attributed to `ai:<model>` |
+| Role-based share links (editor / commenter / viewer) | `serve` prints a link per role; roles enforced server-side (viewers read-only, commenters cannot edit prose) |
+| Agent HTTP API | AI tools read state, post comments/suggestions, or rewrite prose live, attributed to `ai:<model>` |
 | Comments and suggestions from the terminal | `mddocs comment ...`, `mddocs suggest ...`, `mddocs accept`/`reject` |
 | History and diff | `mddocs log <file>`, `mddocs diff <file> [rev]` (plain git underneath) |
 | Async multiplayer and conflict resolution | edit on branches; `mddocs resolve <file>` unions a conflicted PROOF footer |
@@ -129,23 +129,38 @@ grant:
 
 - An absent or unknown token gets the least privilege (viewer), so a leaked bare
   URL cannot edit.
-- Viewers are enforced server-side: a viewer's WebSocket connection is read-only,
-  so a crafted client still cannot write. The commenter-vs-editor split is gated
-  in the editor UI (a comment is itself a write).
+- Roles are enforced server-side, not just in the editor UI. A viewer's WebSocket
+  connection is read-only, so a crafted client cannot write at all. A commenter
+  may write comments (a comment is a write to the marks map) but cannot edit the
+  prose: any prose change from a commenter connection is reverted server-side
+  before it persists or reaches other clients. Editors can do both.
 
 ## Agent HTTP API
 
 A live `serve` session also exposes an HTTP API so AI agents can read the
-document and post comments/suggestions. They appear in every connected editor in
-real time and persist to git, attributed to `ai:<model>`. `serve` prints the base
-URL and an agent token; send it as the `x-share-token` header.
+document, post comments/suggestions, and edit the prose directly. Everything
+appears in every connected editor in real time and persists to git, attributed to
+`ai:<model>`. `serve` prints the base URL and an agent token; send it as the
+`x-share-token` header.
 
 ```
 GET  /api/agent/:slug/state                                              -> { content, marks }
 POST /api/agent/:slug/comment  { quote, text, model? }                   -> { id }
 POST /api/agent/:slug/suggest  { quote, replace|insert|delete, model? }  -> { id, kind }
+POST /api/agent/:slug/rewrite  { markdown, quote?, model? }              -> { chars, by, markId? }
 ```
 
+`suggest` proposes a change a human accepts; `rewrite` edits the prose directly.
+With a `quote`, `rewrite` replaces that span; without one it replaces the whole
+body. The change is applied to the live document and recorded as an authored mark.
+
+By default `serve` issues one shared agent token. Pass `--agent <name>` (repeatable)
+to register named agents, each with its own token; `serve` then prints a token per
+agent. A request that omits `model` is attributed to the token's agent name
+(`ai:<name>`). Per-agent rate limits are available through the engine API
+(`serveShare({ agents: [{ name, rateLimit: { maxRequests, windowMs } }] })`),
+returning HTTP 429 when exceeded.
+
 ```bash
 # Read the live document:
 curl -H "x-share-token: $TOKEN" http://127.0.0.1:<port>/api/agent/notes.md/state
@@ -175,28 +190,30 @@ git add notes.md && git commit
 
 ```
 mddocs open  <file> [--port <n>] [--no-autocommit]          single-user browser editor (loopback)
-mddocs serve <file> [--port <n>] [--host <ip>] [--no-autocommit]
+mddocs serve <file> [--port <n>] [--host <ip>] [--no-autocommit] [--agent <name>]
                                                             live multiplayer, role links, agent API
 mddocs init                                                 mark the repo as mddocs-managed
 mddocs resolve <file>                                       union a git-conflicted PROOF footer
 
 mddocs comment add  <file> --quote <q> --text <t>           add a comment anchored to <q>
 mddocs comment ls   <file> [--open|--resolved|--orphaned]
-mddocs comment reply <id> --text <t> --file <f>             reply in a comment thread
-mddocs comment resolve <id> --file <f>                      resolve a comment thread
+mddocs comment reply <id> --text <t> [--file <f>]          reply in a comment thread
+mddocs comment resolve <id> [--file <f>]                   resolve a comment thread
 
 mddocs suggest <file> --quote <q> (--replace <c> | --insert <c> | --delete)
-mddocs accept  <id> --file <f>                              mark a suggestion accepted
-mddocs reject  <id> --file <f>                              mark a suggestion rejected
+mddocs accept  <id> [--file <f>]                            apply a suggestion to the prose
+mddocs reject  <id> [--file <f>]                            mark a suggestion rejected
 
 mddocs log  <file>                                          commit history for a document
 mddocs diff <file> [rev]                                    changes vs working tree or a revision
 ```
 
-Notes. Id-only commands (`reply`, `resolve`, `accept`, `reject`) take an explicit
-`--file`; a global mark-to-file index is a later milestone. `accept` and `reject`
-record the decision on the mark (`status`); the prose rewrite for an accepted
-suggestion is applied in the editor.
+Notes. Id-only commands (`reply`, `resolve`, `accept`, `reject`) find their
+document automatically by scanning the managed `.md` files for the mark; pass
+`--file <path>` to skip the scan or disambiguate. `accept` applies the suggested
+change to the prose (replace, insert, or delete, anchored by the suggestion's
+quote) and consumes the suggestion; `reject` records the decision on the mark and
+leaves the prose unchanged.
 
 ## Architecture
 
@@ -259,24 +276,17 @@ browser-interactive path is verified manually.
 
 - M1: local-first editor and CLI (comments, suggestions, provenance, git history). Done.
 - M2: live collaboration server (real-time multiplayer, file plus git canonical). Done.
-- M2.5: share links and roles (editor/commenter/viewer, server-side viewer enforcement). Done.
-- M3: agent HTTP API (read state, post comments/suggestions live). Done.
+- M2.5: share links and roles (editor/commenter/viewer, server-side role
+  enforcement: viewers read-only, commenters cannot edit prose). Done.
+- M3: agent HTTP API (read state, comment, suggest, and rewrite prose live). Done.
 
 ## Upcoming updates
 
 Contributions welcome. Next on the list:
 
-- Agent direct-rewrite endpoint: let agents edit prose directly, not just propose
-  (v1 is propose-only; humans accept).
-- Per-agent identity tokens and rate limiting, instead of one shared agent token.
-- Commenter-granularity enforcement: viewers are enforced server-side; enforce the
-  comment-vs-edit split on the wire too.
-- CLI `accept` applies the prose rewrite (today it records the decision; applying
-  the edit to the body is editor-only).
-- Global mark-to-file index, so id-only commands no longer need an explicit `--file`.
 - Presence and events for agents.
-- Publish as an installable `mddocs` binary on npm, with a real project name.
-- CI to run both test suites on every push.
+- Publish under a real, unscoped npm project name (currently the `@devyrpauli`
+  scope while the name is settled).
 - Upstream the `@proof/core` TS2308 fix
   ([proof-sdk#57](https://github.com/EveryInc/proof-sdk/pull/57)) and drop the
   local fork patch once merged.

package/cli.mjs

@@ -4166,8 +4166,8 @@ var require_lib = __commonJS({
       if (typeof cb !== "function") {
         opts = cb;
         cb = null;
-        deferred2 = new this.Promise(function(resolve3, reject) {
-          deferredResolve = resolve3;
+        deferred2 = new this.Promise(function(resolve4, reject) {
+          deferredResolve = resolve4;
           deferredReject = reject;
         });
       }
@@ -4315,17 +4315,17 @@ var require_lib = __commonJS({
       if (typeof cb === "function") {
         fnx(cb);
       } else {
-        return new this.Promise(function(resolve3, reject) {
+        return new this.Promise(function(resolve4, reject) {
           if (fnx.length === 1) {
             fnx(function(err, ret) {
               if (err) {
                 reject(err);
               } else {
-                resolve3(ret);
+                resolve4(ret);
               }
             });
           } else {
-            resolve3(fnx());
+            resolve4(fnx());
           }
         });
       }
@@ -11708,7 +11708,7 @@ function canAppendWithSubstitutedLinebreaks(a, b2) {
 function joinable2(a, b2) {
   return !!(a && b2 && !a.isLeaf && canAppendWithSubstitutedLinebreaks(a, b2));
 }
-function join2(tr, pos, depth) {
+function join3(tr, pos, depth) {
   let convertNewlines = null;
   let { linebreakReplacement } = tr.doc.type.schema;
   let $before = tr.doc.resolve(pos - depth), beforeType = $before.node().type;
@@ -13095,7 +13095,7 @@ var init_dist3 = __esm({
       last and first siblings are also joined, and so on.
       */
       join(pos, depth = 1) {
-        join2(this, pos, depth);
+        join3(this, pos, depth);
         return this;
       }
       /**
@@ -19733,14 +19733,14 @@ var init_lib2 = __esm({
         this.#listener = null;
         this.#status = "pending";
         this.start = () => {
-          this.#promise ??= new Promise((resolve3, reject) => {
+          this.#promise ??= new Promise((resolve4, reject) => {
             this.#listener = (e) => {
               if (!(e instanceof CustomEvent)) return;
               if (e.detail.id === this.#eventUniqId) {
                 this.#status = "resolved";
                 this.#removeListener();
                 e.stopImmediatePropagation();
-                resolve3();
+                resolve4();
               }
             };
             this.#waitTimeout(() => {
@@ -22430,10 +22430,10 @@ function resolveAll(constructs2, events, context) {
   const called = [];
   let index2 = -1;
   while (++index2 < constructs2.length) {
-    const resolve3 = constructs2[index2].resolveAll;
-    if (resolve3 && !called.includes(resolve3)) {
-      events = resolve3(events, context);
-      called.push(resolve3);
+    const resolve4 = constructs2[index2].resolveAll;
+    if (resolve4 && !called.includes(resolve4)) {
+      events = resolve4(events, context);
+      called.push(resolve4);
     }
   }
   return events;
@@ -28608,12 +28608,12 @@ function joinDefaults(left, right, parent, state) {
     return parent.spread ? 1 : 0;
   }
 }
-var join3;
+var join4;
 var init_join = __esm({
   "node_modules/mdast-util-to-markdown/lib/join.js"() {
     init_format_code_as_indented();
     init_format_heading_as_setext();
-    join3 = [joinDefaults];
+    join4 = [joinDefaults];
   }
 });
 
@@ -29060,7 +29060,7 @@ function toMarkdown(tree, options) {
     handle: void 0,
     indentLines,
     indexStack: [],
-    join: [...join3],
+    join: [...join4],
     options: {},
     safe: safeBound,
     stack: [],
@@ -30357,7 +30357,7 @@ var init_lib16 = __esm({
         assertParser("process", this.parser || this.Parser);
         assertCompiler("process", this.compiler || this.Compiler);
         return done ? executor(void 0, done) : new Promise(executor);
-        function executor(resolve3, reject) {
+        function executor(resolve4, reject) {
           const realFile = vfile(file);
           const parseTree = (
             /** @type {HeadTree extends undefined ? Node : HeadTree} */
@@ -30388,8 +30388,8 @@ var init_lib16 = __esm({
           function realDone(error, file2) {
             if (error || !file2) {
               reject(error);
-            } else if (resolve3) {
-              resolve3(file2);
+            } else if (resolve4) {
+              resolve4(file2);
             } else {
               ok2(done, "`done` is defined if `resolve` is not");
               done(void 0, file2);
@@ -30491,7 +30491,7 @@ var init_lib16 = __esm({
           file = void 0;
         }
         return done ? executor(void 0, done) : new Promise(executor);
-        function executor(resolve3, reject) {
+        function executor(resolve4, reject) {
           ok2(
             typeof file !== "function",
             "`file` can\u2019t be a `done` anymore, we checked"
@@ -30505,8 +30505,8 @@ var init_lib16 = __esm({
             );
             if (error) {
               reject(error);
-            } else if (resolve3) {
-              resolve3(resultingTree);
+            } else if (resolve4) {
+              resolve4(resultingTree);
             } else {
               ok2(done, "`done` is defined if `resolve` is not");
               done(void 0, resultingTree, file2);
@@ -32846,9 +32846,9 @@ var init_lib19 = __esm({
         this.remove = async (plugins3) => {
           if (this.#status === EditorStatus.OnCreate) {
             console.warn("[Milkdown]: You are trying to remove plugins when the editor is creating, this is not recommended, please check your code.");
-            return new Promise((resolve3) => {
+            return new Promise((resolve4) => {
               setTimeout(() => {
-                resolve3(this.remove(plugins3));
+                resolve4(this.remove(plugins3));
               }, 50);
             });
           }
@@ -32867,9 +32867,9 @@ var init_lib19 = __esm({
         };
         this.destroy = async (clearPlugins = false) => {
           if (this.#status === EditorStatus.Destroyed || this.#status === EditorStatus.OnDestroy) return this;
-          if (this.#status === EditorStatus.OnCreate) return new Promise((resolve3) => {
+          if (this.#status === EditorStatus.OnCreate) return new Promise((resolve4) => {
             setTimeout(() => {
-              resolve3(this.destroy(clearPlugins));
+              resolve4(this.destroy(clearPlugins));
             }, 50);
           });
           if (clearPlugins) this.#configureList = [];
@@ -42630,6 +42630,28 @@ function reanchorMarks(content3, marks) {
   return { marks: out, orphaned };
 }
 
+// packages/mddocs-local/src/apply.ts
+function applySuggestion(content3, mark) {
+  const kind = mark.kind;
+  if (kind !== "insert" && kind !== "delete" && kind !== "replace") {
+    throw new Error(`mark ${mark.id} is a ${kind}, not a suggestion`);
+  }
+  const span = resolveQuote(content3, mark.quote);
+  if (!span) {
+    throw new Error(`cannot apply suggestion ${mark.id}: quoted text not found`);
+  }
+  const { from: from3, to } = span;
+  const replacement = mark.data?.content ?? "";
+  switch (kind) {
+    case "replace":
+      return content3.slice(0, from3) + replacement + content3.slice(to);
+    case "delete":
+      return content3.slice(0, from3) + content3.slice(to);
+    case "insert":
+      return content3.slice(0, to) + replacement + content3.slice(to);
+  }
+}
+
 // packages/mddocs-local/src/footer.ts
 var CONFLICT_RE = /^<{7} .*$[\s\S]*?^>{7} .*$/m;
 var OURS_MARKER = /^<{7} .*$\n?/m;
@@ -47658,11 +47680,58 @@ async function diff(path2, rev) {
   return g.diff(args2);
 }
 
+// packages/mddocs-local/src/markindex.ts
+import { readdir } from "node:fs/promises";
+import { join, resolve } from "node:path";
+async function listManagedDocs(cwd) {
+  if (await isGitRepo(cwd)) {
+    const root2 = (await esm_default(cwd).revparse(["--show-toplevel"])).trim();
+    const out = await esm_default(root2).raw([
+      "ls-files",
+      "--cached",
+      "--others",
+      "--exclude-standard",
+      "--",
+      "*.md"
+    ]);
+    return out.split("\n").filter(Boolean).map((p2) => resolve(root2, p2));
+  }
+  return walkMd(cwd);
+}
+async function walkMd(dir) {
+  const out = [];
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    if (entry.name === ".git" || entry.name === "node_modules") continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...await walkMd(full));
+    else if (entry.isFile() && entry.name.endsWith(".md")) out.push(full);
+  }
+  return out;
+}
+async function buildMarkIndex(cwd) {
+  const index2 = /* @__PURE__ */ new Map();
+  for (const file of await listManagedDocs(cwd)) {
+    let marks;
+    try {
+      marks = (await loadDoc(file)).marks;
+    } catch {
+      continue;
+    }
+    for (const id3 of Object.keys(marks)) {
+      if (!index2.has(id3)) index2.set(id3, file);
+    }
+  }
+  return index2;
+}
+async function findFileForMark(id3, cwd) {
+  return (await buildMarkIndex(cwd)).get(id3);
+}
+
 // packages/mddocs-local/src/serve.ts
 import { createServer } from "node:http";
 import { readFile as readFile2 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
-import { basename, dirname as dirname2, join, normalize as normalize2, resolve } from "node:path";
+import { basename, dirname as dirname2, join as join2, normalize as normalize2, resolve as resolve2 } from "node:path";
 import { existsSync } from "node:fs";
 async function readRaw(path2) {
   try {
@@ -47698,7 +47767,7 @@ async function createSession(path2, opts = {}) {
     }
   };
 }
-var DEFAULT_DIST = process.env.MDDOCS_DIST ?? resolve(dirname2(fileURLToPath(import.meta.url)), "../../../dist");
+var DEFAULT_DIST = process.env.MDDOCS_DIST ?? resolve2(dirname2(fileURLToPath(import.meta.url)), "../../../dist");
 var CONTENT_TYPES = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
@@ -47731,10 +47800,10 @@ function sendJson(res, status, body) {
 async function serve(path2, opts = {}) {
   const session = await createSession(path2, opts);
   const distDir = opts.distDir ?? DEFAULT_DIST;
-  const absPath = resolve(path2);
+  const absPath = resolve2(path2);
   async function serveStatic(urlPath, res) {
     const rel = urlPath === "/" ? "index.html" : urlPath.replace(/^\/+/, "");
-    const target = normalize2(join(distDir, rel));
+    const target = normalize2(join2(distDir, rel));
     if (target !== distDir && !target.startsWith(distDir + "/")) {
       res.writeHead(403).end("Forbidden");
       return;
@@ -47967,6 +48036,14 @@ var appendTo = (dest, src) => {
   }
 };
 var from = Array.from;
+var some = (arr, f) => {
+  for (let i2 = 0; i2 < arr.length; i2++) {
+    if (f(arr[i2], i2, arr)) {
+      return true;
+    }
+  }
+  return false;
+};
 var isArray = Array.isArray;
 
 // node_modules/lib0/observable.js
@@ -49245,17 +49322,17 @@ var Doc = class _Doc extends ObservableV2 {
     this.isLoaded = false;
     this.isSynced = false;
     this.isDestroyed = false;
-    this.whenLoaded = create5((resolve3) => {
+    this.whenLoaded = create5((resolve4) => {
       this.on("load", () => {
         this.isLoaded = true;
-        resolve3(this);
+        resolve4(this);
       });
     });
-    const provideSyncedPromise = () => create5((resolve3) => {
+    const provideSyncedPromise = () => create5((resolve4) => {
       const eventHandler = (isSynced) => {
         if (isSynced === void 0 || isSynced === true) {
           this.off("sync", eventHandler);
-          resolve3();
+          resolve4();
         }
       };
       this.on("sync", eventHandler);
@@ -50327,6 +50404,16 @@ var findRootTypeKey = (type2) => {
   }
   throw unexpectedCase();
 };
+var isParentOf = (parent, child) => {
+  while (child !== null) {
+    if (child.parent === parent) {
+      return true;
+    }
+    child = /** @type {AbstractType<any>} */
+    child.parent._item;
+  }
+  return false;
+};
 var Snapshot = class {
   /**
    * @param {DeleteSet} ds
@@ -50726,6 +50813,310 @@ var transact = (doc4, f, origin = null, local = true) => {
   }
   return result;
 };
+var StackItem = class {
+  /**
+   * @param {DeleteSet} deletions
+   * @param {DeleteSet} insertions
+   */
+  constructor(deletions, insertions) {
+    this.insertions = insertions;
+    this.deletions = deletions;
+    this.meta = /* @__PURE__ */ new Map();
+  }
+};
+var clearUndoManagerStackItem = (tr, um, stackItem) => {
+  iterateDeletedStructs(tr, stackItem.deletions, (item) => {
+    if (item instanceof Item && um.scope.some((type2) => type2 === tr.doc || isParentOf(
+      /** @type {AbstractType<any>} */
+      type2,
+      item
+    ))) {
+      keepItem(item, false);
+    }
+  });
+};
+var popStackItem = (undoManager, stack, eventType) => {
+  let _tr = null;
+  const doc4 = undoManager.doc;
+  const scope = undoManager.scope;
+  transact(doc4, (transaction) => {
+    while (stack.length > 0 && undoManager.currStackItem === null) {
+      const store = doc4.store;
+      const stackItem = (
+        /** @type {StackItem} */
+        stack.pop()
+      );
+      const itemsToRedo = /* @__PURE__ */ new Set();
+      const itemsToDelete = [];
+      let performedChange = false;
+      iterateDeletedStructs(transaction, stackItem.insertions, (struct) => {
+        if (struct instanceof Item) {
+          if (struct.redone !== null) {
+            let { item, diff: diff2 } = followRedone(store, struct.id);
+            if (diff2 > 0) {
+              item = getItemCleanStart(transaction, createID(item.id.client, item.id.clock + diff2));
+            }
+            struct = item;
+          }
+          if (!struct.deleted && scope.some((type2) => type2 === transaction.doc || isParentOf(
+            /** @type {AbstractType<any>} */
+            type2,
+            /** @type {Item} */
+            struct
+          ))) {
+            itemsToDelete.push(struct);
+          }
+        }
+      });
+      iterateDeletedStructs(transaction, stackItem.deletions, (struct) => {
+        if (struct instanceof Item && scope.some((type2) => type2 === transaction.doc || isParentOf(
+          /** @type {AbstractType<any>} */
+          type2,
+          struct
+        )) && // Never redo structs in stackItem.insertions because they were created and deleted in the same capture interval.
+        !isDeleted(stackItem.insertions, struct.id)) {
+          itemsToRedo.add(struct);
+        }
+      });
+      itemsToRedo.forEach((struct) => {
+        performedChange = redoItem(transaction, struct, itemsToRedo, stackItem.insertions, undoManager.ignoreRemoteMapChanges, undoManager) !== null || performedChange;
+      });
+      for (let i2 = itemsToDelete.length - 1; i2 >= 0; i2--) {
+        const item = itemsToDelete[i2];
+        if (undoManager.deleteFilter(item)) {
+          item.delete(transaction);
+          performedChange = true;
+        }
+      }
+      undoManager.currStackItem = performedChange ? stackItem : null;
+    }
+    transaction.changed.forEach((subProps, type2) => {
+      if (subProps.has(null) && type2._searchMarker) {
+        type2._searchMarker.length = 0;
+      }
+    });
+    _tr = transaction;
+  }, undoManager);
+  const res = undoManager.currStackItem;
+  if (res != null) {
+    const changedParentTypes = _tr.changedParentTypes;
+    undoManager.emit("stack-item-popped", [{ stackItem: res, type: eventType, changedParentTypes, origin: undoManager }, undoManager]);
+    undoManager.currStackItem = null;
+  }
+  return res;
+};
+var UndoManager = class extends ObservableV2 {
+  /**
+   * @param {Doc|AbstractType<any>|Array<AbstractType<any>>} typeScope Limits the scope of the UndoManager. If this is set to a ydoc instance, all changes on that ydoc will be undone. If set to a specific type, only changes on that type or its children will be undone. Also accepts an array of types.
+   * @param {UndoManagerOptions} options
+   */
+  constructor(typeScope, {
+    captureTimeout = 500,
+    captureTransaction = (_tr) => true,
+    deleteFilter = () => true,
+    trackedOrigins = /* @__PURE__ */ new Set([null]),
+    ignoreRemoteMapChanges = false,
+    doc: doc4 = (
+      /** @type {Doc} */
+      isArray(typeScope) ? typeScope[0].doc : typeScope instanceof Doc ? typeScope : typeScope.doc
+    )
+  } = {}) {
+    super();
+    this.scope = [];
+    this.doc = doc4;
+    this.addToScope(typeScope);
+    this.deleteFilter = deleteFilter;
+    trackedOrigins.add(this);
+    this.trackedOrigins = trackedOrigins;
+    this.captureTransaction = captureTransaction;
+    this.undoStack = [];
+    this.redoStack = [];
+    this.undoing = false;
+    this.redoing = false;
+    this.currStackItem = null;
+    this.lastChange = 0;
+    this.ignoreRemoteMapChanges = ignoreRemoteMapChanges;
+    this.captureTimeout = captureTimeout;
+    this.afterTransactionHandler = (transaction) => {
+      if (!this.captureTransaction(transaction) || !this.scope.some((type2) => transaction.changedParentTypes.has(
+        /** @type {AbstractType<any>} */
+        type2
+      ) || type2 === this.doc) || !this.trackedOrigins.has(transaction.origin) && (!transaction.origin || !this.trackedOrigins.has(transaction.origin.constructor))) {
+        return;
+      }
+      const undoing = this.undoing;
+      const redoing = this.redoing;
+      const stack = undoing ? this.redoStack : this.undoStack;
+      if (undoing) {
+        this.stopCapturing();
+      } else if (!redoing) {
+        this.clear(false, true);
+      }
+      const insertions = new DeleteSet();
+      transaction.afterState.forEach((endClock, client) => {
+        const startClock = transaction.beforeState.get(client) || 0;
+        const len = endClock - startClock;
+        if (len > 0) {
+          addToDeleteSet(insertions, client, startClock, len);
+        }
+      });
+      const now = getUnixTime();
+      let didAdd = false;
+      if (this.lastChange > 0 && now - this.lastChange < this.captureTimeout && stack.length > 0 && !undoing && !redoing) {
+        const lastOp = stack[stack.length - 1];
+        lastOp.deletions = mergeDeleteSets([lastOp.deletions, transaction.deleteSet]);
+        lastOp.insertions = mergeDeleteSets([lastOp.insertions, insertions]);
+      } else {
+        stack.push(new StackItem(transaction.deleteSet, insertions));
+        didAdd = true;
+      }
+      if (!undoing && !redoing) {
+        this.lastChange = now;
+      }
+      iterateDeletedStructs(
+        transaction,
+        transaction.deleteSet,
+        /** @param {Item|GC} item */
+        (item) => {
+          if (item instanceof Item && this.scope.some((type2) => type2 === transaction.doc || isParentOf(
+            /** @type {AbstractType<any>} */
+            type2,
+            item
+          ))) {
+            keepItem(item, true);
+          }
+        }
+      );
+      const changeEvent = [{ stackItem: stack[stack.length - 1], origin: transaction.origin, type: undoing ? "redo" : "undo", changedParentTypes: transaction.changedParentTypes }, this];
+      if (didAdd) {
+        this.emit("stack-item-added", changeEvent);
+      } else {
+        this.emit("stack-item-updated", changeEvent);
+      }
+    };
+    this.doc.on("afterTransaction", this.afterTransactionHandler);
+    this.doc.on("destroy", () => {
+      this.destroy();
+    });
+  }
+  /**
+   * Extend the scope.
+   *
+   * @param {Array<AbstractType<any> | Doc> | AbstractType<any> | Doc} ytypes
+   */
+  addToScope(ytypes) {
+    const tmpSet = new Set(this.scope);
+    ytypes = isArray(ytypes) ? ytypes : [ytypes];
+    ytypes.forEach((ytype) => {
+      if (!tmpSet.has(ytype)) {
+        tmpSet.add(ytype);
+        if (ytype instanceof AbstractType ? ytype.doc !== this.doc : ytype !== this.doc) warn("[yjs#509] Not same Y.Doc");
+        this.scope.push(ytype);
+      }
+    });
+  }
+  /**
+   * @param {any} origin
+   */
+  addTrackedOrigin(origin) {
+    this.trackedOrigins.add(origin);
+  }
+  /**
+   * @param {any} origin
+   */
+  removeTrackedOrigin(origin) {
+    this.trackedOrigins.delete(origin);
+  }
+  clear(clearUndoStack = true, clearRedoStack = true) {
+    if (clearUndoStack && this.canUndo() || clearRedoStack && this.canRedo()) {
+      this.doc.transact((tr) => {
+        if (clearUndoStack) {
+          this.undoStack.forEach((item) => clearUndoManagerStackItem(tr, this, item));
+          this.undoStack = [];
+        }
+        if (clearRedoStack) {
+          this.redoStack.forEach((item) => clearUndoManagerStackItem(tr, this, item));
+          this.redoStack = [];
+        }
+        this.emit("stack-cleared", [{ undoStackCleared: clearUndoStack, redoStackCleared: clearRedoStack }]);
+      });
+    }
+  }
+  /**
+   * UndoManager merges Undo-StackItem if they are created within time-gap
+   * smaller than `options.captureTimeout`. Call `um.stopCapturing()` so that the next
+   * StackItem won't be merged.
+   *
+   *
+   * @example
+   *     // without stopCapturing
+   *     ytext.insert(0, 'a')
+   *     ytext.insert(1, 'b')
+   *     um.undo()
+   *     ytext.toString() // => '' (note that 'ab' was removed)
+   *     // with stopCapturing
+   *     ytext.insert(0, 'a')
+   *     um.stopCapturing()
+   *     ytext.insert(0, 'b')
+   *     um.undo()
+   *     ytext.toString() // => 'a' (note that only 'b' was removed)
+   *
+   */
+  stopCapturing() {
+    this.lastChange = 0;
+  }
+  /**
+   * Undo last changes on type.
+   *
+   * @return {StackItem?} Returns StackItem if a change was applied
+   */
+  undo() {
+    this.undoing = true;
+    let res;
+    try {
+      res = popStackItem(this, this.undoStack, "undo");
+    } finally {
+      this.undoing = false;
+    }
+    return res;
+  }
+  /**
+   * Redo last undo operation.
+   *
+   * @return {StackItem?} Returns StackItem if a change was applied
+   */
+  redo() {
+    this.redoing = true;
+    let res;
+    try {
+      res = popStackItem(this, this.redoStack, "redo");
+    } finally {
+      this.redoing = false;
+    }
+    return res;
+  }
+  /**
+   * Are undo steps available?
+   *
+   * @return {boolean} `true` if undo is possible
+   */
+  canUndo() {
+    return this.undoStack.length > 0;
+  }
+  /**
+   * Are redo steps available?
+   *
+   * @return {boolean} `true` if redo is possible
+   */
+  canRedo() {
+    return this.redoStack.length > 0;
+  }
+  destroy() {
+    this.trackedOrigins.delete(this);
+    this.doc.off("afterTransaction", this.afterTransactionHandler);
+    super.destroy();
+  }
+};
 function* lazyStructReaderGenerator(decoder) {
   const numOfStateUpdates = readVarUint(decoder.restDecoder);
   for (let i2 = 0; i2 < numOfStateUpdates; i2++) {
@@ -54998,6 +55389,30 @@ var ContentType = class _ContentType {
   }
 };
 var readContentType = (decoder) => new ContentType(typeRefs[decoder.readTypeRef()](decoder));
+var followRedone = (store, id3) => {
+  let nextID = id3;
+  let diff2 = 0;
+  let item;
+  do {
+    if (diff2 > 0) {
+      nextID = createID(nextID.client, nextID.clock + diff2);
+    }
+    item = getItem(store, nextID);
+    diff2 = nextID.clock - item.id.clock;
+    nextID = item.redone;
+  } while (nextID !== null && item instanceof Item);
+  return {
+    item,
+    diff: diff2
+  };
+};
+var keepItem = (item, keep) => {
+  while (item !== null && item.keep !== keep) {
+    item.keep = keep;
+    item = /** @type {AbstractType<any>} */
+    item.parent._item;
+  }
+};
 var splitItem = (transaction, leftItem, diff2) => {
   const { client, clock } = leftItem.id;
   const rightItem = new Item(
@@ -55030,6 +55445,105 @@ var splitItem = (transaction, leftItem, diff2) => {
   leftItem.length = diff2;
   return rightItem;
 };
+var isDeletedByUndoStack = (stack, id3) => some(
+  stack,
+  /** @param {StackItem} s */
+  (s) => isDeleted(s.deletions, id3)
+);
+var redoItem = (transaction, item, redoitems, itemsToDelete, ignoreRemoteMapChanges, um) => {
+  const doc4 = transaction.doc;
+  const store = doc4.store;
+  const ownClientID = doc4.clientID;
+  const redone = item.redone;
+  if (redone !== null) {
+    return getItemCleanStart(transaction, redone);
+  }
+  let parentItem = (
+    /** @type {AbstractType<any>} */
+    item.parent._item
+  );
+  let left = null;
+  let right;
+  if (parentItem !== null && parentItem.deleted === true) {
+    if (parentItem.redone === null && (!redoitems.has(parentItem) || redoItem(transaction, parentItem, redoitems, itemsToDelete, ignoreRemoteMapChanges, um) === null)) {
+      return null;
+    }
+    while (parentItem.redone !== null) {
+      parentItem = getItemCleanStart(transaction, parentItem.redone);
+    }
+  }
+  const parentType = parentItem === null ? (
+    /** @type {AbstractType<any>} */
+    item.parent
+  ) : (
+    /** @type {ContentType} */
+    parentItem.content.type
+  );
+  if (item.parentSub === null) {
+    left = item.left;
+    right = item;
+    while (left !== null) {
+      let leftTrace = left;
+      while (leftTrace !== null && /** @type {AbstractType<any>} */
+      leftTrace.parent._item !== parentItem) {
+        leftTrace = leftTrace.redone === null ? null : getItemCleanStart(transaction, leftTrace.redone);
+      }
+      if (leftTrace !== null && /** @type {AbstractType<any>} */
+      leftTrace.parent._item === parentItem) {
+        left = leftTrace;
+        break;
+      }
+      left = left.left;
+    }
+    while (right !== null) {
+      let rightTrace = right;
+      while (rightTrace !== null && /** @type {AbstractType<any>} */
+      rightTrace.parent._item !== parentItem) {
+        rightTrace = rightTrace.redone === null ? null : getItemCleanStart(transaction, rightTrace.redone);
+      }
+      if (rightTrace !== null && /** @type {AbstractType<any>} */
+      rightTrace.parent._item === parentItem) {
+        right = rightTrace;
+        break;
+      }
+      right = right.right;
+    }
+  } else {
+    right = null;
+    if (item.right && !ignoreRemoteMapChanges) {
+      left = item;
+      while (left !== null && left.right !== null && (left.right.redone || isDeleted(itemsToDelete, left.right.id) || isDeletedByUndoStack(um.undoStack, left.right.id) || isDeletedByUndoStack(um.redoStack, left.right.id))) {
+        left = left.right;
+        while (left.redone) left = getItemCleanStart(transaction, left.redone);
+      }
+      if (left && left.right !== null) {
+        return null;
+      }
+    } else {
+      left = parentType._map.get(item.parentSub) || null;
+    }
+    if (left !== null && /** @type {AbstractType<any>} */
+    left.parent._item !== parentItem) {
+      left = parentType._map.get(item.parentSub) || null;
+    }
+  }
+  const nextClock = getState(store, ownClientID);
+  const nextId = createID(ownClientID, nextClock);
+  const redoneItem = new Item(
+    nextId,
+    left,
+    left && left.lastId,
+    right,
+    right && right.id,
+    parentType,
+    item.parentSub,
+    item.content.copy()
+  );
+  item.redone = nextId;
+  keepItem(redoneItem, true);
+  redoneItem.integrate(transaction, 0);
+  return redoneItem;
+};
 var Item = class _Item extends AbstractStruct {
   /**
    * @param {ID} id
@@ -57401,7 +57915,7 @@ var Hocuspocus = class {
       process.on("SIGQUIT", signalHandler);
       process.on("SIGTERM", signalHandler);
     }
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       var _a2;
       (_a2 = this.server) === null || _a2 === void 0 ? void 0 : _a2.httpServer.listen({
         port: this.configuration.port,
@@ -57417,7 +57931,7 @@ var Hocuspocus = class {
         };
         try {
           await this.hooks("onListen", onListenPayload);
-          resolve3(this);
+          resolve4(this);
         } catch (e) {
           reject(e);
         }
@@ -57501,19 +58015,19 @@ var Hocuspocus = class {
    * Destroy the server
    */
   async destroy() {
-    await new Promise(async (resolve3) => {
+    await new Promise(async (resolve4) => {
       var _a2, _b, _c, _d;
       (_b = (_a2 = this.server) === null || _a2 === void 0 ? void 0 : _a2.httpServer) === null || _b === void 0 ? void 0 : _b.close();
       try {
         this.configuration.extensions.push({
           async afterUnloadDocument({ instance }) {
             if (instance.getDocumentsCount() === 0)
-              resolve3("");
+              resolve4("");
           }
         });
         (_d = (_c = this.server) === null || _c === void 0 ? void 0 : _c.webSocketServer) === null || _d === void 0 ? void 0 : _d.close();
         if (this.getDocumentsCount() === 0)
-          resolve3("");
+          resolve4("");
         this.closeConnections();
       } catch (error) {
         console.error(error);
@@ -58214,11 +58728,38 @@ async function seedFragmentFromMarkdown(markdown, fragment) {
   const node2 = parser5.parseMarkdown(markdown);
   prosemirrorToYXmlFragment(node2, fragment);
 }
+async function parseMarkdownNode(markdown) {
+  const parser5 = await getParser();
+  return parser5.parseMarkdown(markdown);
+}
+function setFragmentFromNode(fragment, node2) {
+  fragment.delete(0, fragment.length);
+  prosemirrorToYXmlFragment(node2, fragment);
+}
 
 // packages/mddocs-local/src/collab.ts
 async function configureCollab(file, opts = {}) {
   const slug = opts.slug ?? basename2(file);
   const session = await createSession(file, opts);
+  const enforced = /* @__PURE__ */ new WeakSet();
+  function enforceCommenterProse(doc4) {
+    if (enforced.has(doc4)) return;
+    enforced.add(doc4);
+    const trackedOrigins = {
+      has: (o2) => !!o2 && typeof o2 === "object" && o2.context?.role === "commenter",
+      add: () => void 0,
+      delete: () => void 0
+    };
+    const undo = new UndoManager(doc4.getXmlFragment("prosemirror"), {
+      trackedOrigins,
+      captureTimeout: 0
+    });
+    undo.on("stack-item-added", () => {
+      queueMicrotask(() => {
+        if (undo.undoStack.length > 0) undo.undo();
+      });
+    });
+  }
   const hocuspocus = new Hocuspocus().configure({
     port: opts.port ?? 0,
     debounce: opts.storeDebounceMs ?? 150,
@@ -58237,6 +58778,7 @@ async function configureCollab(file, opts = {}) {
       for (const [id3, mark] of Object.entries(marks)) {
         if (!ymarks.has(id3)) ymarks.set(id3, mark);
       }
+      if (opts.authenticate) enforceCommenterProse(data.document);
       return data.document;
     },
     // Persist the settled doc back to the file (+ optional autocommit). The
@@ -58259,7 +58801,7 @@ async function configureCollab(file, opts = {}) {
         const verdict = opts.authenticate(data.token);
         if (!verdict) throw new Error("Unauthorized");
         data.connection.readOnly = verdict.readOnly;
-        return { readOnly: verdict.readOnly };
+        return { readOnly: verdict.readOnly, role: verdict.role };
       }
     } : {}
   });
@@ -58271,7 +58813,7 @@ import { createServer as createServer3 } from "node:http";
 import { readFile as readFile3 } from "node:fs/promises";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { dirname as dirname3, join as join4, normalize as normalize4, resolve as resolve2 } from "node:path";
+import { dirname as dirname3, join as join5, normalize as normalize4, resolve as resolve3 } from "node:path";
 
 // packages/mddocs-local/src/agent.ts
 function createAgentApi(hocuspocus, slug, opts = {}) {
@@ -58307,6 +58849,38 @@ function createAgentApi(hocuspocus, slug, opts = {}) {
       await inject(mark);
       return { id: mark.id, kind: mark.kind };
     },
+    // Edit the prose directly (not a proposal): replace a quoted span, or the
+    // whole body when no quote is given. The new markdown is applied to the live
+    // `prosemirror` fragment so it syncs to every editor and persists to the file
+    // (+ git) via onStoreDocument. Authorship is recorded as an `ai:<model>`
+    // authored mark over the new text.
+    async rewrite({ quote, markdown, model }) {
+      const conn = await connect();
+      const doc4 = conn.document;
+      if (!doc4) throw new Error("no live document to rewrite");
+      const current = await fragmentToMarkdown(doc4.getXmlFragment("prosemirror")) ?? "";
+      let next;
+      if (quote && quote.length > 0) {
+        const span = resolveQuote(current, quote);
+        if (!span) throw new Error("quoted text not found in the live document");
+        next = current.slice(0, span.from) + markdown + current.slice(span.to);
+      } else {
+        next = markdown;
+      }
+      const node2 = await parseMarkdownNode(next);
+      await conn.transact((d) => {
+        setFragmentFromNode(d.getXmlFragment("prosemirror"), node2);
+      });
+      const by = actor2(model);
+      const snippet = normalizeQuote(markdown).slice(0, 200);
+      let markId;
+      if (snippet.length > 0) {
+        const mark = createAuthored(by, { from: 0, to: 0 }, snippet);
+        await inject(mark);
+        markId = mark.id;
+      }
+      return { chars: next.length, by, markId };
+    },
     async stop() {
       if (connPromise) {
         const conn = await connPromise;
@@ -58323,7 +58897,7 @@ var CAPABILITIES = {
   commenter: { canRead: true, canComment: true, canEdit: false },
   viewer: { canRead: true, canComment: false, canEdit: false }
 };
-var DEFAULT_DIST2 = process.env.MDDOCS_DIST ?? resolve2(dirname3(fileURLToPath3(import.meta.url)), "../../../dist");
+var DEFAULT_DIST2 = process.env.MDDOCS_DIST ?? resolve3(dirname3(fileURLToPath3(import.meta.url)), "../../../dist");
 var CONTENT_TYPES2 = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
@@ -58378,16 +58952,35 @@ async function serveShare(file, opts = {}) {
     const q2 = (req.url ?? "").split("?")[1];
     return q2 ? new URLSearchParams(q2).get("token") ?? void 0 : void 0;
   }
-  const agentToken = randomUUID2();
+  const agentEntries = opts.agents && opts.agents.length > 0 ? opts.agents.map((a2) => ({ name: a2.name, token: randomUUID2(), rateLimit: a2.rateLimit })) : [{ name: "agent", token: randomUUID2() }];
+  const agentToken = agentEntries[0].token;
+  const agentByToken = new Map(agentEntries.map((e) => [e.token, e]));
+  const rateHits = /* @__PURE__ */ new Map();
+  function withinRateLimit(entry) {
+    if (!entry.rateLimit) return true;
+    const { maxRequests, windowMs } = entry.rateLimit;
+    const now = Date.now();
+    const recent = (rateHits.get(entry.token) ?? []).filter((t2) => now - t2 < windowMs);
+    if (recent.length >= maxRequests) {
+      rateHits.set(entry.token, recent);
+      return false;
+    }
+    recent.push(now);
+    rateHits.set(entry.token, recent);
+    return true;
+  }
   const { hocuspocus, session, slug } = await configureCollab(file, {
     ...opts,
-    authenticate: (token) => ({ readOnly: roleForToken(token) === "viewer" })
+    authenticate: (token) => {
+      const role = roleForToken(token);
+      return { readOnly: role === "viewer", role };
+    }
   });
   const agent4 = createAgentApi(hocuspocus, slug);
   async function serveStatic(urlPath, res) {
     const isDocRoute = urlPath === "/" || /^\/d\/[^/]+\/?$/.test(urlPath);
     const rel = isDocRoute ? "index.html" : urlPath.replace(/^\/d\//, "").replace(/^\/+/, "");
-    const target = normalize4(join4(distDir, rel));
+    const target = normalize4(join5(distDir, rel));
     if (target !== distDir && !target.startsWith(distDir + "/")) {
       res.writeHead(403).end("Forbidden");
       return;
@@ -58429,10 +59022,16 @@ async function serveShare(file, opts = {}) {
           return;
         }
         if (urlPath.startsWith(`/api/agent/${slug}/`)) {
-          if (tokenFromRequest(req) !== agentToken) {
+          const entry = agentByToken.get(tokenFromRequest(req) ?? "");
+          if (!entry) {
             sendJson2(res, 403, { error: "invalid or missing agent token" });
             return;
           }
+          if (!withinRateLimit(entry)) {
+            sendJson2(res, 429, { error: "rate limit exceeded", agent: entry.name });
+            return;
+          }
+          const modelFrom = (b2) => b2.model ?? entry.name;
           if (urlPath === `/api/agent/${slug}/state` && req.method === "GET") {
             sendJson2(res, 200, await agent4.getState());
             return;
@@ -58443,7 +59042,7 @@ async function serveShare(file, opts = {}) {
               sendJson2(res, 400, { error: "comment needs { quote, text }" });
               return;
             }
-            sendJson2(res, 200, await agent4.addComment({ quote: b2.quote, text: b2.text, model: b2.model }));
+            sendJson2(res, 200, await agent4.addComment({ quote: b2.quote, text: b2.text, model: modelFrom(b2) }));
             return;
           }
           if (urlPath === `/api/agent/${slug}/suggest` && req.method === "POST") {
@@ -58457,7 +59056,20 @@ async function serveShare(file, opts = {}) {
               replace: b2.replace,
               insert: b2.insert,
               delete: b2.delete,
-              model: b2.model
+              model: modelFrom(b2)
+            }));
+            return;
+          }
+          if (urlPath === `/api/agent/${slug}/rewrite` && req.method === "POST") {
+            const b2 = await readJsonBody(req);
+            if (typeof b2.markdown !== "string") {
+              sendJson2(res, 400, { error: "rewrite needs { markdown, quote? }" });
+              return;
+            }
+            sendJson2(res, 200, await agent4.rewrite({
+              markdown: b2.markdown,
+              quote: typeof b2.quote === "string" ? b2.quote : void 0,
+              model: modelFrom(b2)
             }));
             return;
           }
@@ -58489,6 +59101,7 @@ async function serveShare(file, opts = {}) {
     url: links.editor,
     links,
     agentToken,
+    agentTokens: opts.agents ? Object.fromEntries(agentEntries.map((e) => [e.name, e.token])) : void 0,
     host,
     port: boundPort,
     slug,
@@ -58503,11 +59116,15 @@ async function serveShare(file, opts = {}) {
 }
 
 // packages/mddocs-cli/src/util/resolve-file.ts
-function fileForId(opts) {
-  if (!opts.file) {
-    throw new Error("This command needs --file <path> in M1 (id->file index is a later milestone).");
+async function fileForId(id3, opts) {
+  if (opts.file) return opts.file;
+  const found2 = await findFileForMark(id3, process.cwd());
+  if (!found2) {
+    throw new Error(
+      `could not find mark ${id3} in any managed .md file under ${process.cwd()} (pass --file <path> to point at it directly)`
+    );
   }
-  return opts.file;
+  return found2;
 }
 function actor() {
   return `human:${process.env.USER ?? "unknown"}`;
@@ -58544,7 +59161,7 @@ function registerComment(program2) {
     }
   });
   cmd.command("reply <id>").requiredOption("--text <t>").option("--file <f>").action(async (id3, o2) => {
-    const file = fileForId(o2);
+    const file = await fileForId(id3, o2);
     const doc4 = await loadDoc(file);
     const mark = doc4.marks[id3];
     if (!mark || mark.kind !== "comment") throw new Error(`no comment with id ${id3} in ${file}`);
@@ -58557,7 +59174,7 @@ function registerComment(program2) {
     console.log(`replied to ${id3}`);
   });
   cmd.command("resolve <id>").option("--file <f>").action(async (id3, o2) => {
-    const file = fileForId(o2);
+    const file = await fileForId(id3, o2);
     const doc4 = await loadDoc(file);
     const next = proof_exports.resolveComment(toArray(doc4.marks), id3);
     await saveDoc(file, doc4.content, toRecord(next));
@@ -58586,18 +59203,28 @@ function registerSuggest(program2) {
 }
 
 // packages/mddocs-cli/src/commands/accept-reject.ts
-function decide(apply2, verb) {
-  return async (id3, o2) => {
-    const file = fileForId(o2);
+var SUGGESTION_KINDS = ["insert", "delete", "replace"];
+function registerAcceptReject(program2) {
+  program2.command("accept <id>").option("--file <f>").action(async (id3, o2) => {
+    const file = await fileForId(id3, o2);
     const doc4 = await loadDoc(file);
-    const next = apply2(toArray(doc4.marks), id3);
+    const stored = doc4.marks[id3];
+    const mark = stored && { ...stored, id: id3 };
+    if (!mark || !SUGGESTION_KINDS.includes(mark.kind)) {
+      throw new Error(`no suggestion with id ${id3} in ${file}`);
+    }
+    const content3 = applySuggestion(doc4.content, mark);
+    const { [id3]: _applied, ...rest } = doc4.marks;
+    await saveDoc(file, content3, rest);
+    console.log(`accepted ${id3} (applied to ${file})`);
+  });
+  program2.command("reject <id>").option("--file <f>").action(async (id3, o2) => {
+    const file = await fileForId(id3, o2);
+    const doc4 = await loadDoc(file);
+    const next = proof_exports.rejectSuggestion(toArray(doc4.marks), id3);
     await saveDoc(file, doc4.content, toRecord(next));
-    console.log(`${verb} ${id3}`);
-  };
-}
-function registerAcceptReject(program2) {
-  program2.command("accept <id>").option("--file <f>").action(decide(proof_exports.acceptSuggestion, "accepted"));
-  program2.command("reject <id>").option("--file <f>").action(decide(proof_exports.rejectSuggestion, "rejected"));
+    console.log(`rejected ${id3}`);
+  });
 }
 
 // packages/mddocs-cli/src/commands/history.ts
@@ -58654,21 +59281,34 @@ function registerOpen(program2) {
 // packages/mddocs-cli/src/commands/serve.ts
 import { dirname as dirname5 } from "node:path";
 function registerServe(program2) {
-  program2.command("serve <file>").description("host a live multiplayer editing session (share the URL on your LAN)").option("--port <n>", "port to listen on", (v) => parseInt(v, 10)).option("--host <h>", "interface to bind (use 0.0.0.0 to share on your LAN)", "127.0.0.1").option("--no-autocommit", "do not auto-commit edits to git").action(async (file, o2) => {
+  program2.command("serve <file>").description("host a live multiplayer editing session (share the URL on your LAN)").option("--port <n>", "port to listen on", (v) => parseInt(v, 10)).option("--host <h>", "interface to bind (use 0.0.0.0 to share on your LAN)", "127.0.0.1").option("--no-autocommit", "do not auto-commit edits to git").option("--agent <name>", "register a named agent with its own token (repeatable)", (v, acc) => [...acc, v], []).action(async (file, o2) => {
     const autocommit = o2.autocommit !== false;
     if (autocommit && !await isGitRepo(dirname5(file))) {
       console.warn("mddocs: not a git repo - history/autocommit disabled. Run `mddocs init` + `git init` to enable.");
     }
-    const handle2 = await serveShare(file, { port: o2.port, host: o2.host, autocommit });
+    const agents = (o2.agent ?? []).map((name2) => ({ name: name2 }));
+    const handle2 = await serveShare(file, {
+      port: o2.port,
+      host: o2.host,
+      autocommit,
+      agents: agents.length > 0 ? agents : void 0
+    });
     console.log(`mddocs: live session for ${file}`);
     console.log(`  edit (you):   ${handle2.links.editor}`);
     console.log(`  comment link: ${handle2.links.commenter}`);
     console.log(`  view link:    ${handle2.links.viewer}`);
     console.log("  (share the link matching the access you want to grant)");
     console.log("");
-    console.log("  agent API (programmatic comments/suggestions, live + git-backed):");
+    console.log("  agent API (programmatic comments/suggestions/rewrites, live + git-backed):");
     console.log(`    base:  http://${handle2.host}:${handle2.port}/api/agent/${handle2.slug}`);
-    console.log(`    token: ${handle2.agentToken}   (send as header: x-share-token)`);
+    if (handle2.agentTokens) {
+      console.log("    tokens (send as header: x-share-token):");
+      for (const [name2, token] of Object.entries(handle2.agentTokens)) {
+        console.log(`      ${name2}: ${token}`);
+      }
+    } else {
+      console.log(`    token: ${handle2.agentToken}   (send as header: x-share-token)`);
+    }
     console.log(`    e.g.   curl -H "x-share-token: ${handle2.agentToken}" -H 'content-type: application/json' \\`);
     console.log(`             -d '{"quote":"...","text":"..."}' http://${handle2.host}:${handle2.port}/api/agent/${handle2.slug}/comment`);
     console.log("  (Ctrl-C to stop)");
@@ -58696,11 +59336,11 @@ function registerResolve(program2) {
 
 // packages/mddocs-cli/src/commands/init.ts
 import { readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var MD_LINE = "*.md diff text";
 function registerInit(program2) {
   program2.command("init").description("mark this repo as mddocs-managed (.gitattributes)").action(async () => {
-    const attrsPath = join5(process.cwd(), ".gitattributes");
+    const attrsPath = join6(process.cwd(), ".gitattributes");
     let existing = "";
     try {
       existing = await readFile5(attrsPath, "utf8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devyrpauli/mddocs",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Local-first, git-native collaborative Markdown: real-time multiplayer, comments and suggestions, and an HTTP API for AI agents. Self-hostable, built on proof-sdk.",
   "type": "module",
   "bin": {