@drawpro/mcp 0.1.0

package/dist/server.js

@@ -0,0 +1,1545 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/server.ts
+var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
+var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
+var import_zod = require("zod");
+
+// ../client/src/crypto.ts
+var import_node_module = require("node:module");
+var import_node_crypto = require("node:crypto");
+var import_node = __toESM(require("@phi-ag/argon2/node"));
+var import_argon2 = require("@phi-ag/argon2");
+var HKDF_SALT = new TextEncoder().encode("drawpro-e2ee-salt");
+var HKDF_INFO = new TextEncoder().encode("drawpro-e2ee-key");
+var AAD_MESSAGE = new TextEncoder().encode("drawpro-e2ee-message");
+var AAD_PRIVATE_KEY = new TextEncoder().encode("drawpro-e2ee-private-key");
+var ARGON2_PARAMS = {
+  memoryCost: 128 * 1024,
+  // 128 MB
+  timeCost: 4,
+  parallelism: 2,
+  hashLength: 32
+};
+var argon2Instance = null;
+async function getArgon2() {
+  if (!argon2Instance) {
+    const require2 = (0, import_node_module.createRequire)(__filename);
+    argon2Instance = await (0, import_node.default)(require2.resolve("@phi-ag/argon2/argon2.wasm"));
+  }
+  return argon2Instance;
+}
+async function deriveHKDFKey(sharedSecret) {
+  const material = await import_node_crypto.webcrypto.subtle.importKey("raw", sharedSecret, { name: "HKDF" }, false, [
+    "deriveBits"
+  ]);
+  return import_node_crypto.webcrypto.subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-512", salt: HKDF_SALT, info: HKDF_INFO },
+    material,
+    256
+  );
+}
+async function encryptMessage(message, publicKeyBase64) {
+  const ephemeral = await import_node_crypto.webcrypto.subtle.generateKey({ name: "X25519" }, true, [
+    "deriveBits"
+  ]);
+  const recipient = await import_node_crypto.webcrypto.subtle.importKey(
+    "raw",
+    Buffer.from(publicKeyBase64, "base64"),
+    { name: "X25519" },
+    false,
+    []
+  );
+  const shared = new Uint8Array(
+    await import_node_crypto.webcrypto.subtle.deriveBits(
+      { name: "X25519", public: recipient },
+      ephemeral.privateKey,
+      256
+    )
+  );
+  const aesKey = await import_node_crypto.webcrypto.subtle.importKey("raw", await deriveHKDFKey(shared), {
+    name: "AES-GCM"
+  }, false, ["encrypt"]);
+  const iv = import_node_crypto.webcrypto.getRandomValues(new Uint8Array(16));
+  const sealed = new Uint8Array(
+    await import_node_crypto.webcrypto.subtle.encrypt(
+      { name: "AES-GCM", iv, additionalData: AAD_MESSAGE },
+      aesKey,
+      new TextEncoder().encode(message)
+    )
+  );
+  const ciphertext = sealed.slice(0, -16);
+  const authTag = sealed.slice(-16);
+  const ephPub = new Uint8Array(await import_node_crypto.webcrypto.subtle.exportKey("raw", ephemeral.publicKey));
+  return Buffer.concat([
+    Buffer.from(ephPub),
+    Buffer.from(iv),
+    Buffer.from(authTag),
+    Buffer.from(ciphertext)
+  ]).toString("base64");
+}
+async function decryptMessage(encryptedBase64, privateKeyBytes) {
+  const blob = Buffer.from(encryptedBase64, "base64");
+  const ephPub = blob.subarray(0, 32);
+  const iv = blob.subarray(32, 48);
+  const authTag = blob.subarray(48, 64);
+  const ciphertext = blob.subarray(64);
+  const privateKey = await importX25519Private(privateKeyBytes);
+  const publicKey = await import_node_crypto.webcrypto.subtle.importKey(
+    "raw",
+    ephPub,
+    { name: "X25519" },
+    false,
+    []
+  );
+  const shared = new Uint8Array(
+    await import_node_crypto.webcrypto.subtle.deriveBits(
+      { name: "X25519", public: publicKey },
+      privateKey,
+      256
+    )
+  );
+  const aesKey = await import_node_crypto.webcrypto.subtle.importKey("raw", await deriveHKDFKey(shared), {
+    name: "AES-GCM"
+  }, false, ["decrypt"]);
+  const plain = await import_node_crypto.webcrypto.subtle.decrypt(
+    { name: "AES-GCM", iv, additionalData: AAD_MESSAGE },
+    aesKey,
+    Buffer.concat([ciphertext, authTag])
+  );
+  return new TextDecoder().decode(plain);
+}
+var PKCS8_X25519_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
+async function importX25519Private(raw) {
+  return import_node_crypto.webcrypto.subtle.importKey(
+    "pkcs8",
+    Buffer.concat([PKCS8_X25519_PREFIX, Buffer.from(raw)]),
+    { name: "X25519" },
+    false,
+    ["deriveBits"]
+  );
+}
+function hexToBytes(hex) {
+  return new Uint8Array(Buffer.from(hex, "hex"));
+}
+function pemToPrivateKeyBytes(pem) {
+  const b64 = pem.replace("-----BEGIN PRIVATE KEY-----", "").replace("-----END PRIVATE KEY-----", "").replace(/\s/g, "");
+  const decoded = new Uint8Array(Buffer.from(b64, "base64"));
+  if (decoded.length > 32) {
+    for (let i = 0; i <= decoded.length - 34; i++) {
+      if (decoded[i] === 4 && decoded[i + 1] === 32) {
+        const raw = decoded.slice(i + 2, i + 34);
+        if (raw.length === 32) return raw;
+      }
+    }
+    return decoded.slice(-32);
+  }
+  return decoded;
+}
+async function decryptPrivateKey(encryptedBase64, passcode, salt) {
+  const argon2 = await getArgon2();
+  const derived = argon2.hash(passcode, {
+    salt: Buffer.from(hexToBytes(salt)),
+    type: import_argon2.Argon2Type.Argon2id,
+    ...ARGON2_PARAMS
+  });
+  const combined = Buffer.from(encryptedBase64, "base64");
+  const iv = combined.subarray(0, 16);
+  const encrypted = combined.subarray(16);
+  const aesKey = await import_node_crypto.webcrypto.subtle.importKey(
+    "raw",
+    new Uint8Array(derived.hash),
+    { name: "AES-GCM" },
+    false,
+    ["decrypt"]
+  );
+  const pem = await import_node_crypto.webcrypto.subtle.decrypt(
+    { name: "AES-GCM", iv, additionalData: AAD_PRIVATE_KEY },
+    aesKey,
+    encrypted
+  );
+  return pemToPrivateKeyBytes(new TextDecoder().decode(pem));
+}
+async function decryptSheet(encryptedData, privateKeyBytes) {
+  return JSON.parse(await decryptMessage(encryptedData, privateKeyBytes));
+}
+
+// ../client/src/api.ts
+var DrawProClient = class {
+  constructor(baseUrl, token) {
+    this.baseUrl = baseUrl;
+    this.token = token;
+  }
+  async request(path, init) {
+    const res = await fetch(`${this.baseUrl}${path}`, {
+      ...init,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this.token}`,
+        ...init?.headers ?? {}
+      }
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new Error(`${path} -> ${res.status} ${body.error ?? JSON.stringify(body)}`);
+    }
+    return body.data;
+  }
+  me() {
+    return this.request("/auth/me");
+  }
+  listWorkspaces() {
+    return this.request("/workspaces");
+  }
+  listSheets(workspaceId) {
+    return this.request(`/workspaces/${workspaceId}/sheets`);
+  }
+  getSheet(workspaceId, sheetId) {
+    return this.request(`/workspaces/${workspaceId}/sheets/${sheetId}`);
+  }
+  /**
+   * Read a sheet's real contents. Requires the private key, so the caller must
+   * have unlocked it with the passcode first.
+   */
+  async readSheet(workspaceId, sheetId, privateKey) {
+    const sheet = await this.getSheet(workspaceId, sheetId);
+    if (!sheet.encryptedData) {
+      const raw = sheet;
+      return { name: sheet.name, elements: raw.elements ?? [], appState: raw.appState ?? {} };
+    }
+    return decryptSheet(sheet.encryptedData, privateKey);
+  }
+  /** Decrypt a workspace or sheet name for display. Returns null if unreadable. */
+  async readName(encrypted, privateKey) {
+    if (!encrypted) return null;
+    try {
+      const opened = await decryptMessage(encrypted, privateKey);
+      try {
+        return JSON.parse(opened).name;
+      } catch {
+        return opened;
+      }
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Create a sheet. POST requires a name field, which the server replaces with
+   * the '[encrypted]' sentinel; the real name travels inside the blob.
+   */
+  async createSheet(workspaceId, payload, publicKey) {
+    const body = publicKey ? { name: "[encrypted]", encryptedData: await encryptMessage(JSON.stringify(payload), publicKey) } : { name: payload.name };
+    return this.request(`/workspaces/${workspaceId}/sheets`, {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+  }
+  /**
+   * Replace a sheet's contents. Unlike POST, PUT rejects a plaintext name
+   * outright for an encrypted account — the blob is the whole update.
+   */
+  async updateSheet(workspaceId, sheetId, payload, publicKey) {
+    const body = publicKey ? { encryptedData: await encryptMessage(JSON.stringify(payload), publicKey) } : { name: payload.name, elements: payload.elements, appState: payload.appState };
+    return this.request(`/workspaces/${workspaceId}/sheets/${sheetId}`, {
+      method: "PUT",
+      body: JSON.stringify(body)
+    });
+  }
+};
+
+// ../client/src/keystore.ts
+var import_node_child_process = require("node:child_process");
+var import_node_fs = require("node:fs");
+var import_node_os = require("node:os");
+var import_node_path = require("node:path");
+var import_node_crypto2 = require("node:crypto");
+var SERVICE = "drawpro-mcp";
+function accountId(email) {
+  return (0, import_node_crypto2.createHash)("sha256").update(email).digest("hex").slice(0, 16);
+}
+function filePath(email) {
+  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".drawpro", `key-${accountId(email)}`);
+}
+function macOS() {
+  return process.platform === "darwin";
+}
+function storeKey(email, key) {
+  const encoded = Buffer.from(key).toString("base64");
+  if (macOS()) {
+    try {
+      (0, import_node_child_process.execFileSync)(
+        "security",
+        ["add-generic-password", "-a", accountId(email), "-s", SERVICE, "-w", encoded, "-U"],
+        { stdio: "ignore" }
+      );
+      return { location: "macOS keychain" };
+    } catch {
+    }
+  }
+  const path = filePath(email);
+  (0, import_node_fs.mkdirSync)((0, import_node_path.join)((0, import_node_os.homedir)(), ".drawpro"), { recursive: true, mode: 448 });
+  (0, import_node_fs.writeFileSync)(path, encoded, { mode: 384 });
+  (0, import_node_fs.chmodSync)(path, 384);
+  return { location: path };
+}
+function loadKey(email) {
+  if (macOS()) {
+    try {
+      const out = (0, import_node_child_process.execFileSync)(
+        "security",
+        ["find-generic-password", "-a", accountId(email), "-s", SERVICE, "-w"],
+        { stdio: ["ignore", "pipe", "ignore"] }
+      ).toString().trim();
+      if (out) return new Uint8Array(Buffer.from(out, "base64"));
+    } catch {
+    }
+  }
+  const path = filePath(email);
+  if (!(0, import_node_fs.existsSync)(path)) return null;
+  return new Uint8Array(Buffer.from((0, import_node_fs.readFileSync)(path, "utf8").trim(), "base64"));
+}
+function forgetKey(email) {
+  if (macOS()) {
+    try {
+      (0, import_node_child_process.execFileSync)(
+        "security",
+        ["delete-generic-password", "-a", accountId(email), "-s", SERVICE],
+        { stdio: "ignore" }
+      );
+    } catch {
+    }
+  }
+  const path = filePath(email);
+  if ((0, import_node_fs.existsSync)(path)) (0, import_node_fs.rmSync)(path);
+}
+
+// ../client/src/prompt.ts
+var import_node_readline = require("node:readline");
+var CLEAR_LINE = "\x1B[2K\x1B[200D";
+function askHidden(question) {
+  return new Promise((resolve) => {
+    const rl = (0, import_node_readline.createInterface)({ input: process.stdin, output: process.stdout, terminal: true });
+    process.stdout.write(question);
+    const onData = () => {
+      const typed = rl.line ?? "";
+      process.stdout.write(CLEAR_LINE + question + "*".repeat(typed.length));
+    };
+    process.stdin.on("data", onData);
+    rl.question("", (answer) => {
+      process.stdin.removeListener("data", onData);
+      rl.close();
+      process.stdout.write("\n");
+      resolve(answer);
+    });
+  });
+}
+
+// ../diagram/src/ids.ts
+var import_fractional_indexing = require("fractional-indexing");
+var ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-";
+function elementId() {
+  let out = "";
+  for (let i = 0; i < 21; i++) {
+    out += ALPHABET[Math.floor(Math.random() * ALPHABET.length)];
+  }
+  return out;
+}
+function seed() {
+  return Math.floor(Math.random() * 2 ** 31);
+}
+function elementMeta() {
+  return {
+    seed: seed(),
+    version: 1,
+    versionNonce: seed(),
+    isDeleted: false,
+    updated: Date.now()
+  };
+}
+function assignIndices(elements) {
+  const keys = (0, import_fractional_indexing.generateNKeysBetween)(null, null, elements.length);
+  elements.forEach((el, i) => {
+    el.index = keys[i];
+  });
+  return elements;
+}
+
+// ../diagram/src/font-metrics.ts
+var EXCALIFONT_ADVANCE = {
+  " ": 0.4,
+  "!": 0.314,
+  '"': 0.371,
+  "#": 0.783,
+  "$": 0.721,
+  "%": 0.928,
+  "&": 0.718,
+  "'": 0.218,
+  "(": 0.441,
+  ")": 0.402,
+  "*": 0.525,
+  "+": 0.55,
+  ",": 0.257,
+  "-": 0.411,
+  ".": 0.274,
+  "/": 0.561,
+  "0": 0.664,
+  "1": 0.427,
+  "2": 0.7,
+  "3": 0.608,
+  "4": 0.585,
+  "5": 0.618,
+  "6": 0.64,
+  "7": 0.558,
+  "8": 0.636,
+  "9": 0.629,
+  ":": 0.264,
+  ";": 0.298,
+  "<": 0.55,
+  "=": 0.55,
+  ">": 0.55,
+  "?": 0.466,
+  "@": 0.829,
+  "A": 0.676,
+  "B": 0.761,
+  "C": 0.629,
+  "D": 0.78,
+  "E": 0.707,
+  "F": 0.661,
+  "G": 0.78,
+  "H": 0.573,
+  "I": 0.545,
+  "J": 0.569,
+  "K": 0.613,
+  "L": 0.543,
+  "M": 0.766,
+  "N": 0.632,
+  "O": 0.767,
+  "P": 0.698,
+  "Q": 0.768,
+  "R": 0.736,
+  "S": 0.622,
+  "T": 0.857,
+  "U": 0.73,
+  "V": 0.592,
+  "W": 0.786,
+  "X": 0.628,
+  "Y": 0.564,
+  "Z": 0.832,
+  "[": 0.472,
+  "\\": 0.589,
+  "]": 0.497,
+  "^": 0.51,
+  "_": 0.67,
+  "`": 0.6,
+  "a": 0.576,
+  "b": 0.555,
+  "c": 0.504,
+  "d": 0.605,
+  "e": 0.537,
+  "f": 0.497,
+  "g": 0.555,
+  "h": 0.567,
+  "i": 0.244,
+  "j": 0.328,
+  "k": 0.533,
+  "l": 0.225,
+  "m": 0.663,
+  "n": 0.526,
+  "o": 0.6,
+  "p": 0.537,
+  "q": 0.539,
+  "r": 0.412,
+  "s": 0.543,
+  "t": 0.553,
+  "u": 0.548,
+  "v": 0.525,
+  "w": 0.693,
+  "x": 0.591,
+  "y": 0.53,
+  "z": 0.572,
+  "{": 0.504,
+  "|": 0.299,
+  "}": 0.544,
+  "~": 0.669,
+  "\xA0": 0.4,
+  "\xA1": 0.29,
+  "\xA2": 0.489,
+  "\xA3": 0.71,
+  "\xA5": 0.656,
+  "\xA6": 0.299,
+  "\xA8": 0.6,
+  "\xA9": 0.858,
+  "\xAA": 0.422,
+  "\xAB": 0.649,
+  "\xAD": 0.692,
+  "\xAE": 0.65,
+  "\xAF": 0.6,
+  "\xB0": 0.412,
+  "\xB1": 0.55,
+  "\xB4": 0.6,
+  "\xB6": 0.643,
+  "\xB7": 0.2,
+  "\xB8": 0.6,
+  "\xBA": 0.422,
+  "\xBB": 0.668,
+  "\xBC": 0.762,
+  "\xBD": 0.762,
+  "\xBE": 0.868,
+  "\xBF": 0.455,
+  "\xC0": 0.676,
+  "\xC1": 0.676,
+  "\xC2": 0.676,
+  "\xC3": 0.676,
+  "\xC4": 0.676,
+  "\xC5": 0.676,
+  "\xC6": 1.028,
+  "\xC7": 0.629,
+  "\xC8": 0.707,
+  "\xC9": 0.707,
+  "\xCA": 0.707,
+  "\xCB": 0.707,
+  "\xCC": 0.545,
+  "\xCD": 0.545,
+  "\xCE": 0.545,
+  "\xCF": 0.545,
+  "\xD0": 0.815,
+  "\xD1": 0.632,
+  "\xD2": 0.767,
+  "\xD3": 0.767,
+  "\xD4": 0.767,
+  "\xD5": 0.767,
+  "\xD6": 0.767,
+  "\xD7": 0.55,
+  "\xD8": 0.772,
+  "\xD9": 0.73,
+  "\xDA": 0.73,
+  "\xDB": 0.73,
+  "\xDC": 0.73,
+  "\xDD": 0.564,
+  "\xDE": 0.678,
+  "\xDF": 0.573,
+  "\xE0": 0.542,
+  "\xE1": 0.542,
+  "\xE2": 0.542,
+  "\xE3": 0.542,
+  "\xE4": 0.542,
+  "\xE5": 0.542,
+  "\xE6": 0.909,
+  "\xE7": 0.504,
+  "\xE8": 0.551,
+  "\xE9": 0.551,
+  "\xEA": 0.551,
+  "\xEB": 0.551,
+  "\xEC": 0.244,
+  "\xED": 0.244,
+  "\xEE": 0.244,
+  "\xEF": 0.244,
+  "\xF0": 0.514,
+  "\xF1": 0.526,
+  "\xF2": 0.561,
+  "\xF3": 0.561,
+  "\xF4": 0.561,
+  "\xF5": 0.561,
+  "\xF6": 0.561,
+  "\xF7": 0.55,
+  "\xF8": 0.617,
+  "\xF9": 0.508,
+  "\xFA": 0.508,
+  "\xFB": 0.508,
+  "\xFC": 0.508,
+  "\xFD": 0.522,
+  "\xFE": 0.568,
+  "\xFF": 0.522,
+  "\u2013": 0.702,
+  "\u2014": 0.935,
+  "\u2018": 0.267,
+  "\u2019": 0.304,
+  "\u201A": 0.239,
+  "\u201C": 0.412,
+  "\u201D": 0.428,
+  "\u201E": 0.428,
+  "\u2020": 0.549,
+  "\u2022": 0.522,
+  "\u2024": 0.274,
+  "\u2025": 0.548,
+  "\u2026": 0.709,
+  "\u2030": 1.298,
+  "\u2039": 0.507,
+  "\u203A": 0.38,
+  "\u2212": 0.55
+};
+var FALLBACK_ADVANCE = 0.5773;
+
+// ../diagram/src/theme.ts
+var STROKE = "#1e1e1e";
+var ACCENT_FILL = {
+  blue: "#a5d8ff",
+  green: "#b2f2bb",
+  yellow: "#ffec99",
+  red: "#ffc9c9",
+  violet: "#d0bfff",
+  grey: "#e9ecef",
+  none: "transparent"
+};
+function fillFor(accent) {
+  return ACCENT_FILL[accent ?? "none"];
+}
+var FONT_SIZE = 20;
+var EDGE_LABEL_FONT_SIZE = 16;
+var FONT_FAMILY = 5;
+var LINE_HEIGHT = 1.25;
+var CONTAINER_PADDING = 16;
+var MAX_LABEL_WIDTH = 220;
+var MIN_NODE_WIDTH = 120;
+var MIN_NODE_HEIGHT = 60;
+var GRID = 20;
+var BASE_STYLE = {
+  angle: 0,
+  strokeColor: STROKE,
+  fillStyle: "solid",
+  strokeWidth: 2,
+  strokeStyle: "solid",
+  roughness: 1,
+  opacity: 100,
+  groupIds: [],
+  frameId: null,
+  locked: false,
+  link: null
+};
+function snap(n) {
+  return Math.ceil(n / GRID) * GRID;
+}
+
+// ../diagram/src/text.ts
+function charWidth(ch) {
+  return EXCALIFONT_ADVANCE[ch] ?? FALLBACK_ADVANCE;
+}
+function measureLine(line, fontSize) {
+  let w = 0;
+  for (const ch of line) w += charWidth(ch);
+  return w * fontSize;
+}
+function wrapText(text2, fontSize, maxWidth) {
+  const paragraphs = text2.split("\n");
+  const lines = [];
+  for (const paragraph of paragraphs) {
+    const words = paragraph.split(/\s+/).filter(Boolean);
+    if (words.length === 0) {
+      lines.push("");
+      continue;
+    }
+    let current = words[0];
+    for (let i = 1; i < words.length; i++) {
+      const candidate = `${current} ${words[i]}`;
+      if (measureLine(candidate, fontSize) <= maxWidth) {
+        current = candidate;
+      } else {
+        lines.push(current);
+        current = words[i];
+      }
+    }
+    lines.push(current);
+  }
+  return lines;
+}
+function measureText(text2, fontSize, maxWidth) {
+  const lines = wrapText(text2, fontSize, maxWidth);
+  const width = Math.max(...lines.map((l) => measureLine(l, fontSize)), 0);
+  const height = Math.ceil(lines.length * fontSize * LINE_HEIGHT);
+  return { lines, width: Math.ceil(width), height };
+}
+
+// ../diagram/src/geometry.ts
+function centerOf(b) {
+  return { x: b.x + b.width / 2, y: b.y + b.height / 2 };
+}
+function boundaryPoint(box, kind, target) {
+  const c = centerOf(box);
+  const dx = target.x - c.x;
+  const dy = target.y - c.y;
+  if (dx === 0 && dy === 0) return c;
+  const hw = box.width / 2;
+  const hh = box.height / 2;
+  if (kind === "ellipse") {
+    const denom = Math.hypot(dx / hw, dy / hh);
+    return { x: c.x + dx / denom, y: c.y + dy / denom };
+  }
+  if (kind === "diamond") {
+    const t2 = 1 / (Math.abs(dx) / hw + Math.abs(dy) / hh);
+    return { x: c.x + dx * t2, y: c.y + dy * t2 };
+  }
+  const t = 1 / Math.max(Math.abs(dx) / hw, Math.abs(dy) / hh);
+  return { x: c.x + dx * t, y: c.y + dy * t };
+}
+function retract(from, toward, gap) {
+  const dx = from.x - toward.x;
+  const dy = from.y - toward.y;
+  const len = Math.hypot(dx, dy);
+  if (len === 0) return from;
+  return { x: from.x + dx / len * gap, y: from.y + dy / len * gap };
+}
+function boxesOverlap(a, b, tolerance = 0) {
+  return a.x < b.x + b.width - tolerance && a.x + a.width - tolerance > b.x && a.y < b.y + b.height - tolerance && a.y + a.height - tolerance > b.y;
+}
+function roundPoint(p) {
+  return { x: Math.round(p.x), y: Math.round(p.y) };
+}
+function polylineMidpoint(points) {
+  if (points.length === 0) return { x: 0, y: 0 };
+  if (points.length === 1) return points[0];
+  const segments = points.slice(1).map((p, i) => Math.hypot(p.x - points[i].x, p.y - points[i].y));
+  const total = segments.reduce((a, b) => a + b, 0);
+  if (total === 0) return points[0];
+  let travelled = 0;
+  for (let i = 0; i < segments.length; i++) {
+    if (travelled + segments[i] >= total / 2) {
+      const t = (total / 2 - travelled) / segments[i];
+      return {
+        x: points[i].x + (points[i + 1].x - points[i].x) * t,
+        y: points[i].y + (points[i + 1].y - points[i].y) * t
+      };
+    }
+    travelled += segments[i];
+  }
+  return points[points.length - 1];
+}
+function distanceToSegment(p, a, b) {
+  const dx = b.x - a.x;
+  const dy = b.y - a.y;
+  if (dx === 0 && dy === 0) return Math.hypot(p.x - a.x, p.y - a.y);
+  const t = Math.max(
+    0,
+    Math.min(1, ((p.x - a.x) * dx + (p.y - a.y) * dy) / (dx * dx + dy * dy))
+  );
+  return Math.hypot(p.x - (a.x + t * dx), p.y - (a.y + t * dy));
+}
+function distanceToPolyline(p, points) {
+  if (points.length < 2) return points.length ? Math.hypot(p.x - points[0].x, p.y - points[0].y) : 0;
+  let best = Infinity;
+  for (let i = 0; i < points.length - 1; i++) {
+    best = Math.min(best, distanceToSegment(p, points[i], points[i + 1]));
+  }
+  return best;
+}
+
+// ../diagram/src/elements.ts
+var ROUNDNESS = {
+  rectangle: { type: 3 },
+  diamond: { type: 2 },
+  ellipse: null
+};
+var STROKE_STYLE = {
+  solid: "solid",
+  dashed: "dashed",
+  dotted: "dotted"
+};
+function createLabeledShape(opts) {
+  const shapeId = elementId();
+  const textId = elementId();
+  const metrics = measureText(opts.label, FONT_SIZE, Math.max(opts.width - 16, 40));
+  const shape = {
+    id: shapeId,
+    type: opts.kind,
+    x: opts.x,
+    y: opts.y,
+    width: opts.width,
+    height: opts.height,
+    ...BASE_STYLE,
+    backgroundColor: fillFor(opts.accent),
+    roundness: ROUNDNESS[opts.kind],
+    boundElements: [{ type: "text", id: textId }],
+    ...elementMeta()
+  };
+  const text2 = {
+    id: textId,
+    type: "text",
+    // Centred within the container; Excalidraw recomputes this on first render.
+    x: Math.round(opts.x + (opts.width - metrics.width) / 2),
+    y: Math.round(opts.y + (opts.height - metrics.height) / 2),
+    width: metrics.width,
+    height: metrics.height,
+    ...BASE_STYLE,
+    backgroundColor: "transparent",
+    roundness: null,
+    boundElements: null,
+    text: metrics.lines.join("\n"),
+    originalText: opts.label,
+    fontSize: FONT_SIZE,
+    fontFamily: FONT_FAMILY,
+    textAlign: "center",
+    verticalAlign: "middle",
+    containerId: shapeId,
+    lineHeight: LINE_HEIGHT,
+    autoResize: true,
+    ...elementMeta()
+  };
+  return { shape, text: text2 };
+}
+function createArrow(opts) {
+  const pts = opts.points.map(roundPoint);
+  const [origin, ...rest] = pts;
+  const relative = [[0, 0], ...rest.map((p) => [p.x - origin.x, p.y - origin.y])];
+  const xs = relative.map((p) => p[0]);
+  const ys = relative.map((p) => p[1]);
+  return {
+    id: elementId(),
+    type: "arrow",
+    x: origin.x,
+    y: origin.y,
+    width: Math.max(...xs) - Math.min(...xs),
+    height: Math.max(...ys) - Math.min(...ys),
+    ...BASE_STYLE,
+    backgroundColor: "transparent",
+    strokeStyle: STROKE_STYLE[opts.style ?? "solid"],
+    roundness: { type: 2 },
+    points: relative,
+    lastCommittedPoint: null,
+    startBinding: { elementId: opts.startElementId, focus: 0, gap: opts.gap ?? 4 },
+    endBinding: { elementId: opts.endElementId, focus: 0, gap: opts.gap ?? 4 },
+    startArrowhead: null,
+    endArrowhead: opts.arrowhead === false ? null : "arrow",
+    elbowed: false,
+    boundElements: null,
+    ...elementMeta()
+  };
+}
+function attachArrow(shape, arrowId) {
+  const bound = shape.boundElements ?? [];
+  bound.push({ type: "arrow", id: arrowId });
+  shape.boundElements = bound;
+}
+function createArrowLabel(arrow, label) {
+  const metrics = measureText(label, EDGE_LABEL_FONT_SIZE, MAX_LABEL_WIDTH);
+  const textId = elementId();
+  const bound = arrow.boundElements ?? [];
+  bound.push({ type: "text", id: textId });
+  arrow.boundElements = bound;
+  const relative = arrow.points;
+  const absolute = relative.map(([dx, dy]) => ({
+    x: arrow.x + dx,
+    y: arrow.y + dy
+  }));
+  const mid = polylineMidpoint(absolute);
+  const labelX = Math.round(mid.x - metrics.width / 2);
+  const labelY = Math.round(mid.y - metrics.height / 2);
+  return {
+    id: textId,
+    type: "text",
+    x: labelX,
+    y: labelY,
+    width: metrics.width,
+    height: metrics.height,
+    ...BASE_STYLE,
+    strokeColor: STROKE,
+    backgroundColor: "transparent",
+    roundness: null,
+    boundElements: null,
+    text: metrics.lines.join("\n"),
+    originalText: label,
+    fontSize: EDGE_LABEL_FONT_SIZE,
+    fontFamily: FONT_FAMILY,
+    textAlign: "center",
+    verticalAlign: "middle",
+    containerId: arrow.id,
+    lineHeight: LINE_HEIGHT,
+    autoResize: true,
+    ...elementMeta()
+  };
+}
+
+// ../diagram/src/layout.ts
+var import_dagre = __toESM(require("@dagrejs/dagre"));
+function layoutDiagram(spec, sizes, edgeLabels) {
+  const g = new import_dagre.default.graphlib.Graph({ multigraph: true });
+  g.setGraph({
+    rankdir: spec.direction ?? "TB",
+    nodesep: spec.spacing?.node ?? 60,
+    ranksep: spec.spacing?.rank ?? 90,
+    marginx: 40,
+    marginy: 40
+  });
+  g.setDefaultEdgeLabel(() => ({}));
+  for (const s of sizes) {
+    g.setNode(s.id, { width: s.width, height: s.height });
+  }
+  spec.edges.forEach((edge, i) => {
+    const label = edgeLabels[i];
+    g.setEdge(
+      edge.from,
+      edge.to,
+      label ? { width: label.width, height: label.height, labelpos: "c" } : {},
+      `e${i}`
+    );
+  });
+  import_dagre.default.layout(g);
+  const nodes = /* @__PURE__ */ new Map();
+  for (const s of sizes) {
+    const n = g.node(s.id);
+    nodes.set(s.id, {
+      id: s.id,
+      x: Math.round(n.x - n.width / 2),
+      y: Math.round(n.y - n.height / 2),
+      width: n.width,
+      height: n.height
+    });
+  }
+  const edges = spec.edges.map((edge, i) => {
+    const e = g.edge({ v: edge.from, w: edge.to, name: `e${i}` });
+    return {
+      from: edge.from,
+      to: edge.to,
+      points: (e?.points ?? []).map((p) => ({ x: Math.round(p.x), y: Math.round(p.y) }))
+    };
+  });
+  return { nodes, edges };
+}
+
+// ../diagram/src/validate.ts
+function validateSpec(spec) {
+  const issues = [];
+  const ids = /* @__PURE__ */ new Set();
+  if (spec.nodes.length === 0) {
+    issues.push({ level: "error", message: "Diagram has no nodes." });
+  }
+  for (const node of spec.nodes) {
+    if (ids.has(node.id)) {
+      issues.push({ level: "error", message: `Duplicate node id '${node.id}'.` });
+    }
+    ids.add(node.id);
+    if (!node.label?.trim()) {
+      issues.push({ level: "warning", message: `Node '${node.id}' has an empty label.` });
+    }
+  }
+  spec.edges.forEach((edge, i) => {
+    if (!ids.has(edge.from)) {
+      issues.push({ level: "error", message: `Edge ${i} references unknown node '${edge.from}'.` });
+    }
+    if (!ids.has(edge.to)) {
+      issues.push({ level: "error", message: `Edge ${i} references unknown node '${edge.to}'.` });
+    }
+  });
+  const connected = /* @__PURE__ */ new Set();
+  for (const e of spec.edges) {
+    connected.add(e.from);
+    connected.add(e.to);
+  }
+  for (const node of spec.nodes) {
+    if (spec.nodes.length > 1 && !connected.has(node.id)) {
+      issues.push({
+        level: "warning",
+        message: `Node '${node.id}' is not connected to anything \u2014 it will float alone.`
+      });
+    }
+  }
+  return issues;
+}
+function validateScene(elements) {
+  const issues = [];
+  const byId = new Map(elements.map((el) => [el.id, el]));
+  if (byId.size !== elements.length) {
+    issues.push({ level: "error", message: "Duplicate element ids in scene." });
+  }
+  for (const el of elements) {
+    for (const key of ["startBinding", "endBinding"]) {
+      const binding = el[key];
+      if (binding && !byId.has(binding.elementId)) {
+        issues.push({
+          level: "error",
+          message: `Arrow ${el.id} ${key} points at missing element ${binding.elementId}.`
+        });
+      }
+    }
+    const bound = el.boundElements;
+    for (const ref of bound ?? []) {
+      if (!byId.has(ref.id)) {
+        issues.push({
+          level: "error",
+          message: `Element ${el.id} boundElements references missing ${ref.id}.`
+        });
+      }
+    }
+    const containerId = el.containerId;
+    if (containerId) {
+      const container = byId.get(containerId);
+      if (!container) {
+        issues.push({
+          level: "error",
+          message: `Text ${el.id} has containerId ${containerId}, which does not exist.`
+        });
+      } else {
+        const back = container.boundElements ?? [];
+        if (!back.some((r) => r.id === el.id)) {
+          issues.push({
+            level: "error",
+            message: `Text ${el.id} names container ${containerId}, but the container does not list it back.`
+          });
+        }
+      }
+    }
+  }
+  for (const el of elements) {
+    const containerId = el.containerId;
+    if (el.type !== "text" || !containerId) continue;
+    const container = byId.get(containerId);
+    if (!container) continue;
+    if (["rectangle", "ellipse", "diamond"].includes(container.type)) {
+      if (el.width > container.width - 8) {
+        issues.push({
+          level: "error",
+          message: `Label on ${container.id} is ${Math.round(el.width)}px wide inside a ${Math.round(container.width)}px shape \u2014 it will overflow.`
+        });
+      }
+    }
+    if (container.type === "arrow") {
+      const pts = container.points.map(([dx, dy]) => ({
+        x: container.x + dx,
+        y: container.y + dy
+      }));
+      const centre2 = { x: el.x + el.width / 2, y: el.y + el.height / 2 };
+      const drift = distanceToPolyline(centre2, pts);
+      if (drift > 12) {
+        issues.push({
+          level: "error",
+          message: `Label on arrow ${container.id} sits ${Math.round(drift)}px off the line.`
+        });
+      }
+    }
+  }
+  let previousIndex = "";
+  for (const el of elements) {
+    const index = el.index;
+    if (typeof index !== "string" || index.length === 0) {
+      issues.push({ level: "error", message: `Element ${el.id} is missing a z-order index.` });
+    } else if (index <= previousIndex) {
+      issues.push({
+        level: "error",
+        message: `Element ${el.id} index '${index}' does not follow '${previousIndex}'.`
+      });
+    } else {
+      previousIndex = index;
+    }
+  }
+  const shapes = elements.filter((el) => ["rectangle", "ellipse", "diamond"].includes(el.type));
+  for (let i = 0; i < shapes.length; i++) {
+    for (let j = i + 1; j < shapes.length; j++) {
+      if (boxesOverlap(shapes[i], shapes[j], 2)) {
+        issues.push({
+          level: "error",
+          message: `Shapes ${shapes[i].id} and ${shapes[j].id} overlap.`
+        });
+      }
+    }
+  }
+  return issues;
+}
+
+// ../diagram/src/describe.ts
+var SHAPES = /* @__PURE__ */ new Set(["rectangle", "ellipse", "diamond"]);
+var ARROW_LABEL_RADIUS = 60;
+function centre(b) {
+  return { x: b.x + b.width / 2, y: b.y + b.height / 2 };
+}
+function contains(box, p) {
+  return p.x >= box.x && p.x <= box.x + box.width && p.y >= box.y && p.y <= box.y + box.height;
+}
+function distanceToPath(p, pts) {
+  let best = Infinity;
+  for (let i = 0; i < pts.length - 1; i++) {
+    const a = pts[i];
+    const b = pts[i + 1];
+    const dx = b.x - a.x;
+    const dy = b.y - a.y;
+    const t = dx === 0 && dy === 0 ? 0 : Math.max(0, Math.min(1, ((p.x - a.x) * dx + (p.y - a.y) * dy) / (dx * dx + dy * dy)));
+    best = Math.min(best, Math.hypot(p.x - (a.x + t * dx), p.y - (a.y + t * dy)));
+  }
+  return best;
+}
+function describeScene(elements) {
+  const byId = new Map(elements.map((el) => [el.id, el]));
+  const textOf = (el) => (el?.originalText ?? el?.text)?.replace(/\n/g, " ").trim() ?? "";
+  const boundLabel = (id) => {
+    const owner = byId.get(id);
+    const bound = owner?.boundElements ?? [];
+    const ref = bound.find((b) => b.type === "text");
+    return ref ? textOf(byId.get(ref.id)) : "";
+  };
+  const ownedText = new Set(
+    elements.flatMap(
+      (el) => (el.boundElements ?? []).filter((b) => b.type === "text").map((b) => b.id)
+    )
+  );
+  const floating = elements.filter((el) => el.type === "text" && !ownedText.has(el.id));
+  const adopted = /* @__PURE__ */ new Set();
+  const labelFor = (id) => {
+    const bound = boundLabel(id);
+    if (bound) return bound;
+    const owner = byId.get(id);
+    if (!owner) return "";
+    if (SHAPES.has(owner.type)) {
+      const hit = floating.find((t) => !adopted.has(t.id) && contains(owner, centre(t)));
+      if (hit) {
+        adopted.add(hit.id);
+        return textOf(hit);
+      }
+      return "";
+    }
+    if (owner.type === "arrow") {
+      const pts = (owner.points ?? []).map(([dx, dy]) => ({
+        x: owner.x + dx,
+        y: owner.y + dy
+      }));
+      if (pts.length < 2) return "";
+      let best = null;
+      for (const t of floating) {
+        if (adopted.has(t.id)) continue;
+        const d = distanceToPath(centre(t), pts);
+        if (d <= ARROW_LABEL_RADIUS && (!best || d < best.d)) {
+          best = { id: t.id, text: textOf(t), d };
+        }
+      }
+      if (best) {
+        adopted.add(best.id);
+        return best.text;
+      }
+    }
+    return "";
+  };
+  const counts = {};
+  for (const el of elements) counts[el.type] = (counts[el.type] ?? 0) + 1;
+  const shapes = elements.filter((el) => SHAPES.has(el.type)).map((el) => ({ id: el.id, type: el.type, label: labelFor(el.id) }));
+  const shapeLabel = new Map(shapes.map((s) => [s.id, s.label]));
+  const edges = elements.filter((el) => el.type === "arrow").map((el) => {
+    const start = el.startBinding;
+    const end = el.endBinding;
+    const name = (id) => id ? shapeLabel.get(id) || labelFor(id) || `<${id.slice(0, 6)}>` : "(unbound)";
+    return {
+      from: name(start?.elementId),
+      to: name(end?.elementId),
+      label: labelFor(el.id)
+    };
+  });
+  const looseText = floating.filter((el) => !adopted.has(el.id)).map((el) => textOf(el));
+  return { shapes, edges, looseText, counts };
+}
+function formatOutline(outline) {
+  const lines = [];
+  for (const t of outline.looseText) lines.push(`# ${t}`);
+  if (outline.looseText.length) lines.push("");
+  lines.push(`shapes (${outline.shapes.length}):`);
+  for (const s of outline.shapes) lines.push(`  [${s.type}] ${s.label || "(no label)"}`);
+  lines.push("");
+  lines.push(`edges (${outline.edges.length}):`);
+  for (const e of outline.edges) {
+    lines.push(`  ${e.from} -> ${e.to}${e.label ? `  "${e.label}"` : ""}`);
+  }
+  lines.push("");
+  lines.push(
+    "element counts: " + Object.entries(outline.counts).map(([k, v]) => `${k}=${v}`).join(" ")
+  );
+  return lines.join("\n");
+}
+
+// ../diagram/src/index.ts
+var ARROW_GAP = 4;
+var TITLE_FONT_SIZE = 28;
+function shapePadding(kind) {
+  if (kind === "ellipse") return CONTAINER_PADDING * 2.2;
+  if (kind === "diamond") return CONTAINER_PADDING * 2.6;
+  return CONTAINER_PADDING;
+}
+var WIDTH_SAFETY = 1.02;
+function sizeNode(label, kind) {
+  const metrics = measureText(label, FONT_SIZE, MAX_LABEL_WIDTH);
+  const pad = shapePadding(kind);
+  return {
+    width: Math.max(snap(metrics.width * WIDTH_SAFETY + pad * 2), MIN_NODE_WIDTH),
+    height: Math.max(snap(metrics.height + pad * 2), MIN_NODE_HEIGHT)
+  };
+}
+function buildDiagram(spec) {
+  const specIssues = validateSpec(spec);
+  if (specIssues.some((i) => i.level === "error")) {
+    return { scene: emptyScene(), issues: specIssues };
+  }
+  const kinds = /* @__PURE__ */ new Map();
+  const sizes = spec.nodes.map((node) => {
+    const kind = node.shape ?? "rectangle";
+    kinds.set(node.id, kind);
+    return { id: node.id, ...sizeNode(node.label, kind) };
+  });
+  const edgeLabels = spec.edges.map((edge) => {
+    if (!edge.label) return null;
+    const m = measureText(edge.label, EDGE_LABEL_FONT_SIZE, MAX_LABEL_WIDTH);
+    return { width: m.width + 12, height: m.height + 8 };
+  });
+  const layout = layoutDiagram(spec, sizes, edgeLabels);
+  const elements = [];
+  const shapesById = /* @__PURE__ */ new Map();
+  for (const node of spec.nodes) {
+    const placed = layout.nodes.get(node.id);
+    const { shape, text: text2 } = createLabeledShape({
+      kind: kinds.get(node.id),
+      accent: node.accent,
+      label: node.label,
+      x: placed.x,
+      y: placed.y,
+      width: placed.width,
+      height: placed.height
+    });
+    shapesById.set(node.id, shape);
+    elements.push(shape, text2);
+  }
+  const arrowElements = [];
+  spec.edges.forEach((edge, i) => {
+    const fromShape = shapesById.get(edge.from);
+    const toShape = shapesById.get(edge.to);
+    const fromBox = layout.nodes.get(edge.from);
+    const toBox = layout.nodes.get(edge.to);
+    const routed = layout.edges[i].points;
+    const interior = routed.length > 2 ? routed.slice(1, -1) : [];
+    const towardTarget = interior[0] ?? centerOf(toBox);
+    const towardSource = interior[interior.length - 1] ?? centerOf(fromBox);
+    const rawStart = boundaryPoint(fromBox, kinds.get(edge.from), towardTarget);
+    const rawEnd = boundaryPoint(toBox, kinds.get(edge.to), towardSource);
+    const start = retract(rawStart, centerOf(fromBox), ARROW_GAP);
+    const end = retract(rawEnd, centerOf(toBox), ARROW_GAP);
+    const arrow = createArrow({
+      points: [start, ...interior, end],
+      startElementId: fromShape.id,
+      endElementId: toShape.id,
+      style: edge.style,
+      arrowhead: edge.arrowhead,
+      gap: ARROW_GAP
+    });
+    attachArrow(fromShape, arrow.id);
+    attachArrow(toShape, arrow.id);
+    arrowElements.push(arrow);
+    if (edge.label) {
+      arrowElements.push(createArrowLabel(arrow, edge.label));
+    }
+  });
+  elements.push(...arrowElements);
+  if (spec.title) {
+    elements.unshift(createTitle(spec.title, elements));
+  }
+  return { scene: toScene(elements), issues: [...specIssues, ...validateScene(elements)] };
+}
+function createTitle(title, elements) {
+  const minX = Math.min(...elements.map((e) => e.x));
+  const minY = Math.min(...elements.map((e) => e.y));
+  const metrics = measureText(title, TITLE_FONT_SIZE, 600);
+  return {
+    id: elementId(),
+    type: "text",
+    x: minX,
+    y: Math.round(minY - metrics.height - 32),
+    width: metrics.width,
+    height: metrics.height,
+    ...BASE_STYLE,
+    backgroundColor: "transparent",
+    roundness: null,
+    boundElements: null,
+    text: metrics.lines.join("\n"),
+    originalText: title,
+    fontSize: TITLE_FONT_SIZE,
+    fontFamily: FONT_FAMILY,
+    textAlign: "left",
+    verticalAlign: "top",
+    containerId: null,
+    lineHeight: LINE_HEIGHT,
+    autoResize: true,
+    ...elementMeta()
+  };
+}
+function toScene(elements) {
+  assignIndices(elements);
+  return {
+    type: "excalidraw",
+    version: 2,
+    source: "https://drawpro.kithly.app",
+    elements,
+    appState: { viewBackgroundColor: "#ffffff", gridSize: null },
+    files: {}
+  };
+}
+function emptyScene() {
+  return toScene([]);
+}
+
+// src/server.ts
+var BASE_URL = process.env.DRAWPRO_URL ?? "https://drawpro.kithly.app/api";
+var APP_URL = BASE_URL.replace(/\/api\/?$/, "");
+var ConfigError = class extends Error {
+};
+var clientInstance = null;
+function api() {
+  if (!clientInstance) {
+    const token = process.env.DRAWPRO_TOKEN;
+    if (!token) {
+      throw new ConfigError(
+        'DRAWPRO_TOKEN is not set. Create a token in DrawPro under "Connect to Claude Code", then:\n  claude mcp add drawpro -e DRAWPRO_TOKEN="dp_live_..." -- npx -y @drawpro/mcp'
+      );
+    }
+    clientInstance = new DrawProClient(BASE_URL, token);
+  }
+  return clientInstance;
+}
+var cachedUser = null;
+async function currentUser() {
+  if (!cachedUser) cachedUser = await api().me();
+  return cachedUser;
+}
+async function unlockedKey() {
+  const user = await currentUser();
+  if (!user.encryptedPrivateKey) {
+    return { error: "This account has no encryption keys set up." };
+  }
+  const key = loadKey(user.email);
+  if (!key) {
+    return {
+      error: "This account is locked, so names and contents cannot be read. Ask the user to run `DRAWPRO_TOKEN=... npx -y @drawpro/mcp login` in a terminal. It prompts for their passcode and stores the derived key in the OS keychain. Never ask the user for their passcode here \u2014 it must not pass through this conversation."
+    };
+  }
+  return { key };
+}
+function text(body) {
+  return { content: [{ type: "text", text: body }] };
+}
+function sheetUrl(workspaceId, sheetId) {
+  return `${APP_URL}/workspace/${workspaceId}/sheet/${sheetId}`;
+}
+var server = new import_mcp.McpServer({ name: "drawpro", version: "0.0.1" });
+server.tool(
+  "list_workspaces",
+  "List the DrawPro workspaces this account can access. Workspace names are encrypted at rest and are only readable once the account is unlocked.",
+  {},
+  async () => {
+    const workspaces = await api().listWorkspaces();
+    const unlocked = await unlockedKey();
+    const rows = await Promise.all(
+      workspaces.map(async (ws) => {
+        const name = "key" in unlocked ? await api().readName(ws.encryptedName, unlocked.key) : null;
+        return `${ws.id}  ${name ?? ws.name}  (${ws.sheetsCount ?? "?"} sheets)`;
+      })
+    );
+    const note = "error" in unlocked ? `
+
+Names are encrypted. ${unlocked.error}` : "";
+    return text(rows.join("\n") + note);
+  }
+);
+server.tool(
+  "list_sheets",
+  "List the sheets in a DrawPro workspace, with their decrypted names.",
+  { workspace_id: import_zod.z.string().describe("Workspace id, from list_workspaces") },
+  async ({ workspace_id }) => {
+    const sheets = await api().listSheets(workspace_id);
+    const unlocked = await unlockedKey();
+    const rows = await Promise.all(
+      sheets.map(async (s) => {
+        const name = "key" in unlocked ? await api().readName(s.encryptedData, unlocked.key) : null;
+        return `${s.id}  ${name ?? s.name}  updated ${s.updatedAt}`;
+      })
+    );
+    const note = "error" in unlocked ? `
+
+Names are encrypted. ${unlocked.error}` : "";
+    return text((rows.join("\n") || "(no sheets)") + note);
+  }
+);
+server.tool(
+  "read_sheet",
+  "Read what a DrawPro sheet contains: its shapes, and which arrows connect what. Returns a readable outline rather than raw Excalidraw JSON, which is mostly coordinates and style.",
+  {
+    workspace_id: import_zod.z.string(),
+    sheet_id: import_zod.z.string()
+  },
+  async ({ workspace_id, sheet_id }) => {
+    const unlocked = await unlockedKey();
+    if ("error" in unlocked) return text(unlocked.error);
+    const scene = await api().readSheet(workspace_id, sheet_id, unlocked.key);
+    const outline = describeScene(scene.elements);
+    return text(
+      `sheet: ${scene.name}
+elements: ${scene.elements.length}
+
+${formatOutline(outline)}`
+    );
+  }
+);
+var specShape = {
+  spec: import_zod.z.object({
+    title: import_zod.z.string().optional(),
+    direction: import_zod.z.enum(["TB", "BT", "LR", "RL"]).optional(),
+    nodes: import_zod.z.array(
+      import_zod.z.object({
+        id: import_zod.z.string(),
+        label: import_zod.z.string(),
+        shape: import_zod.z.enum(["rectangle", "ellipse", "diamond"]).optional(),
+        accent: import_zod.z.enum(["blue", "green", "yellow", "red", "violet", "grey", "none"]).optional()
+      })
+    ),
+    edges: import_zod.z.array(
+      import_zod.z.object({
+        from: import_zod.z.string(),
+        to: import_zod.z.string(),
+        label: import_zod.z.string().optional(),
+        style: import_zod.z.enum(["solid", "dashed", "dotted"]).optional(),
+        arrowhead: import_zod.z.boolean().optional()
+      })
+    )
+  }).describe(
+    "What connects to what. Layout, sizing, text wrapping, and arrow binding are derived \u2014 never supply coordinates."
+  )
+};
+server.tool(
+  "validate_spec",
+  "Check a diagram spec without creating anything. Use this before writing if the diagram is large or the spec was assembled programmatically.",
+  specShape,
+  async ({ spec }) => {
+    const issues = validateSpec(spec);
+    if (issues.length === 0) return text("Spec is valid.");
+    return text(issues.map((i) => `${i.level}: ${i.message}`).join("\n"));
+  }
+);
+function buildOrExplain(spec) {
+  const { scene, issues } = buildDiagram(spec);
+  const errors = issues.filter((i) => i.level === "error");
+  if (errors.length > 0) {
+    return {
+      ok: false,
+      error: "The diagram was not created. Fix the spec and try again:\n" + errors.map((i) => `  error: ${i.message}`).join("\n")
+    };
+  }
+  const warnings = issues.filter((i) => i.level === "warning");
+  return { ok: true, scene, warnings: warnings.map((w) => w.message) };
+}
+server.tool(
+  "create_diagram",
+  "Create a new sheet in DrawPro from a diagram spec. Returns a link to open it.",
+  {
+    workspace_id: import_zod.z.string().describe("Workspace id, from list_workspaces"),
+    name: import_zod.z.string().describe("Sheet name, shown in the dashboard"),
+    ...specShape
+  },
+  async ({ workspace_id, name, spec }) => {
+    const built = buildOrExplain(spec);
+    if (!built.ok) return text(built.error);
+    const user = await currentUser();
+    const sheet = await api().createSheet(
+      workspace_id,
+      { name, elements: built.scene.elements, appState: built.scene.appState },
+      user.publicKey
+    );
+    const warned = built.warnings.length ? `
+
+warnings:
+${built.warnings.map((w) => `  ${w}`).join("\n")}` : "";
+    return text(
+      `Created "${name}" with ${built.scene.elements.length} elements.
+${sheetUrl(workspace_id, sheet.id)}${warned}`
+    );
+  }
+);
+server.tool(
+  "update_diagram",
+  "Replace a sheet\u2019s contents with a new diagram. This overwrites the whole sheet, so read_sheet first if you intend to preserve anything already there.",
+  {
+    workspace_id: import_zod.z.string(),
+    sheet_id: import_zod.z.string(),
+    name: import_zod.z.string().describe("Sheet name; the existing name is inside the encrypted blob"),
+    ...specShape
+  },
+  async ({ workspace_id, sheet_id, name, spec }) => {
+    const built = buildOrExplain(spec);
+    if (!built.ok) return text(built.error);
+    const user = await currentUser();
+    await api().updateSheet(
+      workspace_id,
+      sheet_id,
+      { name, elements: built.scene.elements, appState: built.scene.appState },
+      user.publicKey
+    );
+    const warned = built.warnings.length ? `
+
+warnings:
+${built.warnings.map((w) => `  ${w}`).join("\n")}` : "";
+    return text(
+      `Updated "${name}" to ${built.scene.elements.length} elements.
+${sheetUrl(workspace_id, sheet_id)}${warned}`
+    );
+  }
+);
+async function login(forget) {
+  const user = await currentUser();
+  if (forget) {
+    forgetKey(user.email);
+    console.log(`Forgot the stored key for ${user.email}.`);
+    return;
+  }
+  if (!user.encryptedPrivateKey || !user.salt) {
+    console.log(`${user.email} has no encryption keys \u2014 nothing to unlock.`);
+    return;
+  }
+  if (loadKey(user.email)) {
+    console.log(`${user.email} is already unlocked. Use \`login --forget\` to clear it.`);
+    return;
+  }
+  const passcode = await askHidden("passcode: ");
+  process.stdout.write("deriving key (argon2id, 128 MB)... ");
+  const started = Date.now();
+  let key;
+  try {
+    key = await decryptPrivateKey(user.encryptedPrivateKey, passcode, user.salt);
+  } catch {
+    console.log("");
+    throw new ConfigError("Incorrect passcode.");
+  }
+  console.log(`${Date.now() - started} ms`);
+  const { location } = storeKey(user.email, key);
+  console.log(`Unlocked ${user.email}. Key stored in the ${location}.`);
+  console.log("Claude can now read your sheets. The passcode was not stored or sent anywhere.");
+}
+async function main() {
+  const command = process.argv[2];
+  if (command === "login") {
+    await login(process.argv.includes("--forget"));
+    return;
+  }
+  if (command && command !== "serve") {
+    console.error(`Unknown command "${command}". Use: drawpro-mcp [serve|login] [--forget]`);
+    process.exit(2);
+  }
+  await server.connect(new import_stdio.StdioServerTransport());
+}
+main().catch((err) => {
+  if (err instanceof ConfigError) {
+    console.error(err.message);
+    process.exit(2);
+  }
+  console.error("[drawpro-mcp]", err.message);
+  process.exit(1);
+});