@notatemd/cli 4.3.0

package/dist/cli.js

@@ -0,0 +1,2956 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { createRequire as createRequire2 } from "module";
+import { Command } from "commander";
+
+// src/commands/auth.ts
+import { text, password as passwordPrompt, isCancel, cancel, spinner } from "@clack/prompts";
+
+// src/lib/api.ts
+var ApiError = class extends Error {
+  constructor(message, status, code) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "ApiError";
+  }
+  status;
+  code;
+};
+function buildUrl(server, path, query) {
+  const base = server.endsWith("/") ? server : `${server}/`;
+  const url = new URL(path.replace(/^\//, ""), base);
+  if (query) {
+    for (const [key, value] of Object.entries(query)) {
+      if (value !== void 0) url.searchParams.set(key, String(value));
+    }
+  }
+  return url.toString();
+}
+async function apiFetch(server, path, req = {}) {
+  const headers = { ...req.headers };
+  if (req.body !== void 0) headers["content-type"] = "application/json";
+  if (req.accessToken) headers.authorization = `Bearer ${req.accessToken}`;
+  const res = await fetch(buildUrl(server, path, req.query), {
+    method: req.method ?? "GET",
+    headers,
+    body: req.body !== void 0 ? JSON.stringify(req.body) : void 0
+  });
+  if (!res.ok) {
+    let code;
+    let message;
+    try {
+      const parsed = await res.clone().json();
+      code = parsed.code;
+      message = parsed.message;
+    } catch {
+    }
+    throw new ApiError(message ?? `Request failed with status ${res.status}`, res.status, code);
+  }
+  if (res.status === 204) return void 0;
+  return await res.json();
+}
+
+// ../shared/dist/crypto/masterKey.js
+var ARGON2ID_MASTER_KEY_PARAMS = {
+  /** Memory cost in KiB (19 MiB). */
+  memoryKiB: 19 * 1024,
+  /** Time cost (passes). */
+  iterations: 2,
+  /** Lanes. */
+  parallelism: 1,
+  /** Output length in bytes — 256 bits, matches AES-256-GCM in envelope.ts. */
+  keyLength: 32
+};
+function hexToKeyBytes(hex, keyLength) {
+  const clean2 = hex.replace(/\s+/g, "").toLowerCase();
+  if (clean2.length !== keyLength * 2) {
+    throw new Error(`argon2id backend returned ${clean2.length / 2} bytes, expected ${keyLength}`);
+  }
+  const out = new Uint8Array(keyLength);
+  for (let i = 0; i < keyLength; i++) {
+    out[i] = parseInt(clean2.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+async function deriveMasterKey(password, userId, backend) {
+  const hex = await backend({
+    password,
+    userId,
+    memoryKiB: ARGON2ID_MASTER_KEY_PARAMS.memoryKiB,
+    iterations: ARGON2ID_MASTER_KEY_PARAMS.iterations,
+    parallelism: ARGON2ID_MASTER_KEY_PARAMS.parallelism,
+    keyLength: ARGON2ID_MASTER_KEY_PARAMS.keyLength
+  });
+  return hexToKeyBytes(hex, ARGON2ID_MASTER_KEY_PARAMS.keyLength);
+}
+
+// ../shared/dist/crypto/envelope.js
+var VERSION = 1;
+var GCM_IV_LENGTH = 12;
+var AES_KEY_LENGTH = 32;
+function base64Encode(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.byteLength; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+}
+function base64Decode(b64) {
+  const binary = atob(b64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    out[i] = binary.charCodeAt(i);
+  }
+  return out;
+}
+function getRandomBytes(length) {
+  const out = new Uint8Array(length);
+  globalThis.crypto.getRandomValues(out);
+  return out;
+}
+async function importAesKey(rawKey) {
+  if (rawKey.byteLength !== AES_KEY_LENGTH) {
+    throw new Error(`AES key must be ${AES_KEY_LENGTH} bytes, got ${rawKey.byteLength}`);
+  }
+  return globalThis.crypto.subtle.importKey("raw", rawKey, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+async function aesGcmEncrypt(plaintext, key) {
+  const iv = getRandomBytes(GCM_IV_LENGTH);
+  const ct = new Uint8Array(await globalThis.crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, plaintext));
+  return {
+    v: VERSION,
+    iv: base64Encode(iv),
+    ct: base64Encode(ct)
+  };
+}
+async function aesGcmDecrypt(payload, key) {
+  if (payload.v !== VERSION) {
+    throw new Error(`Unsupported envelope version: ${payload.v}`);
+  }
+  const iv = base64Decode(payload.iv);
+  const ct = base64Decode(payload.ct);
+  const plain = new Uint8Array(await globalThis.crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ct));
+  return plain;
+}
+async function unwrapDEK(wrapped, mk) {
+  const mkKey = await importAesKey(mk);
+  return aesGcmDecrypt(wrapped, mkKey);
+}
+async function encryptBlob(plaintext, dek) {
+  const dekKey2 = await importAesKey(dek);
+  const bytes = new TextEncoder().encode(plaintext);
+  return aesGcmEncrypt(bytes, dekKey2);
+}
+async function decryptBlob(payload, dek) {
+  const dekKey2 = await importAesKey(dek);
+  const bytes = await aesGcmDecrypt(payload, dekKey2);
+  return new TextDecoder().decode(bytes);
+}
+function isEncryptedPayload(value) {
+  return typeof value === "object" && value !== null && "v" in value && "iv" in value && "ct" in value && typeof value.v === "number" && typeof value.iv === "string" && typeof value.ct === "string";
+}
+
+// ../../node_modules/@noble/hashes/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+function anumber(n, title = "") {
+  if (typeof n !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(`${prefix}expected number, got ${typeof n}`);
+  }
+  if (!Number.isSafeInteger(n) || n < 0) {
+    const prefix = title && `"${title}" `;
+    throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
+  }
+}
+function abytes(value, length, title = "") {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
+  }
+  return value;
+}
+function ahash(h) {
+  if (typeof h !== "function" || typeof h.create !== "function")
+    throw new TypeError("Hash must wrapped by utils.createHasher");
+  anumber(h.outputLen);
+  anumber(h.blockLen);
+  if (h.outputLen < 1)
+    throw new Error('"outputLen" must be >= 1');
+  if (h.blockLen < 1)
+    throw new Error('"blockLen" must be >= 1');
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out, void 0, "digestInto() output");
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+  }
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function rotr(word, shift) {
+  return word << 32 - shift | word >>> shift;
+}
+function createHasher(hashCons, info = {}) {
+  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(void 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.canXOF = tmp.canXOF;
+  hashC.create = (opts) => hashCons(opts);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+var oidNist = (suffix) => ({
+  // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+  // Larger suffix values would need base-128 OID encoding and a different length byte.
+  oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
+});
+
+// ../../node_modules/@noble/hashes/hmac.js
+var _HMAC = class {
+  oHash;
+  iHash;
+  blockLen;
+  outputLen;
+  canXOF = false;
+  finished = false;
+  destroyed = false;
+  constructor(hash, key) {
+    ahash(hash);
+    abytes(key, void 0, "key");
+    this.iHash = hash.create();
+    if (typeof this.iHash.update !== "function")
+      throw new Error("Expected instance of class which extends utils.Hash");
+    this.blockLen = this.iHash.blockLen;
+    this.outputLen = this.iHash.outputLen;
+    const blockLen = this.blockLen;
+    const pad = new Uint8Array(blockLen);
+    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+    for (let i = 0; i < pad.length; i++)
+      pad[i] ^= 54;
+    this.iHash.update(pad);
+    this.oHash = hash.create();
+    for (let i = 0; i < pad.length; i++)
+      pad[i] ^= 54 ^ 92;
+    this.oHash.update(pad);
+    clean(pad);
+  }
+  update(buf) {
+    aexists(this);
+    this.iHash.update(buf);
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const buf = out.subarray(0, this.outputLen);
+    this.iHash.digestInto(buf);
+    this.oHash.update(buf);
+    this.oHash.digestInto(buf);
+    this.destroy();
+  }
+  digest() {
+    const out = new Uint8Array(this.oHash.outputLen);
+    this.digestInto(out);
+    return out;
+  }
+  _cloneInto(to) {
+    to ||= Object.create(Object.getPrototypeOf(this), {});
+    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+    to = to;
+    to.finished = finished;
+    to.destroyed = destroyed;
+    to.blockLen = blockLen;
+    to.outputLen = outputLen;
+    to.oHash = oHash._cloneInto(to.oHash);
+    to.iHash = iHash._cloneInto(to.iHash);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  destroy() {
+    this.destroyed = true;
+    this.oHash.destroy();
+    this.iHash.destroy();
+  }
+};
+var hmac = /* @__PURE__ */ (() => {
+  const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());
+  hmac_.create = (hash, key) => new _HMAC(hash, key);
+  return hmac_;
+})();
+
+// ../../node_modules/@noble/hashes/hkdf.js
+function extract(hash, ikm, salt) {
+  ahash(hash);
+  if (salt === void 0)
+    salt = new Uint8Array(hash.outputLen);
+  return hmac(hash, salt, ikm);
+}
+var HKDF_COUNTER = /* @__PURE__ */ Uint8Array.of(0);
+var EMPTY_BUFFER = /* @__PURE__ */ Uint8Array.of();
+function expand(hash, prk, info, length = 32) {
+  ahash(hash);
+  anumber(length, "length");
+  abytes(prk, void 0, "prk");
+  const olen = hash.outputLen;
+  if (prk.length < olen)
+    throw new Error('"prk" must be at least HashLen octets');
+  if (length > 255 * olen)
+    throw new Error("Length must be <= 255*HashLen");
+  const blocks = Math.ceil(length / olen);
+  if (info === void 0)
+    info = EMPTY_BUFFER;
+  else
+    abytes(info, void 0, "info");
+  const okm = new Uint8Array(blocks * olen);
+  const HMAC = hmac.create(hash, prk);
+  const HMACTmp = HMAC._cloneInto();
+  const T = new Uint8Array(HMAC.outputLen);
+  for (let counter = 0; counter < blocks; counter++) {
+    HKDF_COUNTER[0] = counter + 1;
+    HMACTmp.update(counter === 0 ? EMPTY_BUFFER : T).update(info).update(HKDF_COUNTER).digestInto(T);
+    okm.set(T, olen * counter);
+    HMAC._cloneInto(HMACTmp);
+  }
+  HMAC.destroy();
+  HMACTmp.destroy();
+  clean(T, HKDF_COUNTER);
+  return okm.slice(0, length);
+}
+var hkdf = (hash, ikm, salt, info, length) => expand(hash, extract(hash, ikm, salt), info, length);
+
+// ../../node_modules/@noble/hashes/_md.js
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
+var HashMD = class {
+  blockLen;
+  outputLen;
+  canXOF = false;
+  padOffset;
+  isLE;
+  // For partial updates less than block size
+  buffer;
+  view;
+  finished = false;
+  length = 0;
+  pos = 0;
+  destroyed = false;
+  constructor(blockLen, outputLen, padOffset, isLE) {
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = createView(this.buffer);
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { view, buffer, blockLen } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        const dataView = createView(data);
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(dataView, pos);
+        continue;
+      }
+      buffer.set(data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view, 0);
+        this.pos = 0;
+      }
+    }
+    this.length += data.length;
+    this.roundClean();
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { buffer, view, blockLen, isLE } = this;
+    let { pos } = this;
+    buffer[pos++] = 128;
+    clean(this.buffer.subarray(pos));
+    if (this.padOffset > blockLen - pos) {
+      this.process(view, 0);
+      pos = 0;
+    }
+    for (let i = pos; i < blockLen; i++)
+      buffer[i] = 0;
+    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
+    this.process(view, 0);
+    const oview = createView(out);
+    const len = this.outputLen;
+    if (len % 4)
+      throw new Error("_sha2: outputLen must be aligned to 32bit");
+    const outLen = len / 4;
+    const state = this.get();
+    if (outLen > state.length)
+      throw new Error("_sha2: outputLen bigger than state");
+    for (let i = 0; i < outLen; i++)
+      oview.setUint32(4 * i, state[i], isLE);
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+  _cloneInto(to) {
+    to ||= new this.constructor();
+    to.set(...this.get());
+    const { blockLen, buffer, length, finished, destroyed, pos } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    if (length % blockLen)
+      to.buffer.set(buffer);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+};
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+
+// ../../node_modules/@noble/hashes/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA2_32B = class extends HashMD {
+  constructor(outputLen) {
+    super(64, outputLen, 8, false);
+  }
+  get() {
+    const { A, B, C, D, E, F, G, H } = this;
+    return [A, B, C, D, E, F, G, H];
+  }
+  // prettier-ignore
+  set(A, B, C, D, E, F, G, H) {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+    this.F = F | 0;
+    this.G = G | 0;
+    this.H = H | 0;
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4)
+      SHA256_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 64; i++) {
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
+      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+    }
+    let { A, B, C, D, E, F, G, H } = this;
+    for (let i = 0; i < 64; i++) {
+      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+      const T2 = sigma0 + Maj(A, B, C) | 0;
+      H = G;
+      G = F;
+      F = E;
+      E = D + T1 | 0;
+      D = C;
+      C = B;
+      B = A;
+      A = T1 + T2 | 0;
+    }
+    A = A + this.A | 0;
+    B = B + this.B | 0;
+    C = C + this.C | 0;
+    D = D + this.D | 0;
+    E = E + this.E | 0;
+    F = F + this.F | 0;
+    G = G + this.G | 0;
+    H = H + this.H | 0;
+    this.set(A, B, C, D, E, F, G, H);
+  }
+  roundClean() {
+    clean(SHA256_W);
+  }
+  destroy() {
+    this.destroyed = true;
+    this.set(0, 0, 0, 0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+};
+var _SHA256 = class extends SHA2_32B {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  A = SHA256_IV[0] | 0;
+  B = SHA256_IV[1] | 0;
+  C = SHA256_IV[2] | 0;
+  D = SHA256_IV[3] | 0;
+  E = SHA256_IV[4] | 0;
+  F = SHA256_IV[5] | 0;
+  G = SHA256_IV[6] | 0;
+  H = SHA256_IV[7] | 0;
+  constructor() {
+    super(32);
+  }
+};
+var sha256 = /* @__PURE__ */ createHasher(
+  () => new _SHA256(),
+  /* @__PURE__ */ oidNist(1)
+);
+
+// ../shared/dist/crypto/kdf.js
+var AES_KEY_LENGTH2 = 32;
+function deriveKey32(ikm, info) {
+  return hkdf(sha256, ikm, void 0, new TextEncoder().encode(info), AES_KEY_LENGTH2);
+}
+
+// ../shared/dist/crypto/contentKey.js
+var NOTE_CONTENT_INFO = "notate/note-content/v1";
+function deriveContentKey(dek) {
+  return deriveKey32(dek, NOTE_CONTENT_INFO);
+}
+
+// ../shared/dist/crypto/noteFields.js
+var ENCRYPTED_NOTE_STRING_FIELDS = [
+  "title",
+  "content",
+  "summary",
+  "transcript"
+];
+function parseEncryptedString(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    return isEncryptedPayload(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function encryptNoteFields(note, contentKey) {
+  const out = { ...note };
+  for (const field of ENCRYPTED_NOTE_STRING_FIELDS) {
+    const value = note[field];
+    if (typeof value === "string" && parseEncryptedString(value) === null) {
+      out[field] = JSON.stringify(await encryptBlob(value, contentKey));
+    }
+  }
+  if (Array.isArray(note.tags)) {
+    out.tags = await encryptBlob(JSON.stringify(note.tags), contentKey);
+  }
+  return out;
+}
+async function decryptNoteFields(note, contentKey) {
+  const out = { ...note };
+  for (const field of ENCRYPTED_NOTE_STRING_FIELDS) {
+    const value = note[field];
+    if (typeof value === "string") {
+      const payload = parseEncryptedString(value);
+      if (payload) {
+        out[field] = await decryptBlob(payload, contentKey);
+      }
+    }
+  }
+  if (isEncryptedPayload(note.tags)) {
+    out.tags = JSON.parse(await decryptBlob(note.tags, contentKey));
+  }
+  return out;
+}
+
+// src/lib/argon2.ts
+import { hashRaw, Algorithm, Version } from "@node-rs/argon2";
+var nodeArgon2Backend = async (input) => {
+  const raw = await hashRaw(input.password, {
+    algorithm: Algorithm.Argon2id,
+    version: Version.V0x13,
+    memoryCost: input.memoryKiB,
+    timeCost: input.iterations,
+    parallelism: input.parallelism,
+    outputLen: input.keyLength,
+    salt: new TextEncoder().encode(input.userId)
+  });
+  return Buffer.from(raw).toString("hex");
+};
+
+// src/lib/crypto.ts
+async function unlockDEK(password, userId, wrappedDEK) {
+  const mk = await deriveMasterKey(password, userId, nodeArgon2Backend);
+  const parsed = JSON.parse(wrappedDEK);
+  if (!isEncryptedPayload(parsed)) {
+    throw new Error("wrappedDEK is not a valid encrypted payload");
+  }
+  return unwrapDEK(parsed, mk);
+}
+function encryptNote(note, contentKey) {
+  return encryptNoteFields(note, contentKey);
+}
+function decryptNote(note, contentKey) {
+  return decryptNoteFields(note, contentKey);
+}
+
+// src/lib/keychain.ts
+import { mkdirSync, readFileSync, writeFileSync, existsSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var SERVICE = "notate-cli";
+var KeychainStore = class {
+  get(key) {
+    const { Entry } = loadKeyring();
+    return new Entry(SERVICE, key).getPassword();
+  }
+  set(key, value) {
+    const { Entry } = loadKeyring();
+    new Entry(SERVICE, key).setPassword(value);
+  }
+  delete(key) {
+    const { Entry } = loadKeyring();
+    try {
+      new Entry(SERVICE, key).deleteCredential();
+    } catch {
+    }
+  }
+};
+var FileStore = class {
+  constructor(dir = defaultConfigDir()) {
+    this.dir = dir;
+  }
+  dir;
+  get file() {
+    return join(this.dir, "secrets.json");
+  }
+  read() {
+    if (!existsSync(this.file)) return {};
+    try {
+      return JSON.parse(readFileSync(this.file, "utf-8"));
+    } catch {
+      return {};
+    }
+  }
+  write(data) {
+    mkdirSync(this.dir, { recursive: true });
+    writeFileSync(this.file, JSON.stringify(data, null, 2), { mode: 384 });
+  }
+  get(key) {
+    return this.read()[key] ?? null;
+  }
+  set(key, value) {
+    const data = this.read();
+    data[key] = value;
+    this.write(data);
+  }
+  delete(key) {
+    const data = this.read();
+    if (key in data) {
+      delete data[key];
+      this.write(data);
+    }
+  }
+};
+var keyringModule = null;
+function loadKeyring() {
+  if (!keyringModule) {
+    keyringModule = require2("@napi-rs/keyring");
+  }
+  return keyringModule;
+}
+function defaultConfigDir() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  return xdg ? join(xdg, "notate-cli") : join(homedir(), ".config", "notate-cli");
+}
+function resolveStore() {
+  const forced = process.env.NOTATE_CLI_STORE;
+  if (forced === "file") return new FileStore();
+  if (forced === "keychain") return new KeychainStore();
+  try {
+    const { Entry } = loadKeyring();
+    new Entry(SERVICE, "__probe__").getPassword();
+    return new KeychainStore();
+  } catch {
+    return new FileStore();
+  }
+}
+var SESSION_KEY = "session";
+var dekKey = (userId) => `dek:${userId}`;
+function saveSession(store, session) {
+  store.set(SESSION_KEY, JSON.stringify(session));
+}
+function loadSession(store) {
+  const raw = store.get(SESSION_KEY);
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function clearSession(store) {
+  store.delete(SESSION_KEY);
+}
+function saveDEK(store, userId, dek) {
+  store.set(dekKey(userId), Buffer.from(dek).toString("base64"));
+}
+function loadDEK(store, userId) {
+  const raw = store.get(dekKey(userId));
+  if (!raw) return null;
+  const bytes = new Uint8Array(Buffer.from(raw, "base64"));
+  return bytes.byteLength === 32 ? bytes : null;
+}
+function clearDEK(store, userId) {
+  store.delete(dekKey(userId));
+}
+
+// src/lib/auth.ts
+function requireSession(store) {
+  const session = loadSession(store);
+  if (!session) {
+    throw new ApiError("Not logged in. Run `notate login`.", 401, "no_session");
+  }
+  return session;
+}
+function authContext(store) {
+  const session = requireSession(store);
+  return { authed: createAuthedClient(store), session };
+}
+function requestLogin(server, email, password) {
+  return apiFetch(server, "/auth/login", {
+    method: "POST",
+    body: { email, password }
+  });
+}
+function verifyTotp(server, totpToken, code) {
+  return apiFetch(server, "/auth/totp/verify", {
+    method: "POST",
+    body: { totpToken, code }
+  });
+}
+async function finalizeLogin(store, server, resp, password) {
+  if (!resp.refreshToken) {
+    throw new Error("Login response did not include a refresh token.");
+  }
+  const session = {
+    server,
+    userId: resp.user.id,
+    email: resp.user.email,
+    accessToken: resp.accessToken,
+    refreshToken: resp.refreshToken,
+    encryptionEnabled: resp.user.encryptionEnabled ?? false
+  };
+  saveSession(store, session);
+  if (resp.user.encryptionEnabled && resp.wrappedDEK) {
+    const dek = await unlockDEK(password, resp.user.id, resp.wrappedDEK);
+    saveDEK(store, resp.user.id, dek);
+  }
+  return session;
+}
+async function refreshSession(store, session) {
+  const resp = await apiFetch(session.server, "/auth/refresh", {
+    method: "POST",
+    body: { refreshToken: session.refreshToken },
+    headers: { "x-requested-with": "XMLHttpRequest" }
+  });
+  const updated = {
+    ...session,
+    accessToken: resp.accessToken,
+    refreshToken: resp.refreshToken ?? session.refreshToken
+  };
+  saveSession(store, updated);
+  return updated;
+}
+async function logout(store, session) {
+  if (session) {
+    try {
+      await apiFetch(session.server, "/auth/logout", {
+        method: "POST",
+        body: { refreshToken: session.refreshToken }
+      });
+    } catch {
+    }
+    clearDEK(store, session.userId);
+  }
+  clearSession(store);
+}
+function createAuthedClient(store) {
+  return async function authed(path, req = {}) {
+    let session = loadSession(store);
+    if (!session) {
+      throw new ApiError("Not logged in. Run `notate login`.", 401, "no_session");
+    }
+    try {
+      return await apiFetch(session.server, path, {
+        ...req,
+        accessToken: session.accessToken
+      });
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 401) {
+        session = await refreshSession(store, session);
+        return await apiFetch(session.server, path, {
+          ...req,
+          accessToken: session.accessToken
+        });
+      }
+      throw err;
+    }
+  };
+}
+
+// src/lib/config.ts
+import Conf from "conf";
+var CONFIG_DEFAULTS = {
+  server: "https://api.notate.md",
+  workspace: null,
+  defaultMode: "memo",
+  defaultSort: "updatedAt",
+  pageSize: 10
+};
+function createConfig(options = {}) {
+  return new Conf({
+    projectName: "notate-cli",
+    defaults: CONFIG_DEFAULTS,
+    ...options.cwd ? { cwd: options.cwd } : {}
+  });
+}
+function resolveServer(flag, env, configured) {
+  return flag ?? env ?? configured;
+}
+var CONFIG_KEYS = [
+  "server",
+  "workspace",
+  "defaultMode",
+  "defaultSort",
+  "pageSize"
+];
+function isConfigKey(key) {
+  return CONFIG_KEYS.includes(key);
+}
+function coerceConfigValue(key, value) {
+  if (key === "pageSize") {
+    const n = Number(value);
+    if (!Number.isFinite(n) || n <= 0) throw new Error("pageSize must be a positive number");
+    return Math.floor(n);
+  }
+  if (key === "workspace") return value === "" ? null : value;
+  return value;
+}
+
+// src/lib/output.ts
+import Table from "cli-table3";
+function renderJson(data) {
+  return JSON.stringify(data, null, 2);
+}
+function renderTable(head, rows) {
+  const table = new Table({ head });
+  for (const row of rows) {
+    table.push(row.map((cell) => String(cell)));
+  }
+  return table.toString();
+}
+function emit(data, opts, human, writer = console.log) {
+  if (opts.quiet) return;
+  writer(opts.json ? renderJson(data) : human(data));
+}
+
+// src/types.ts
+var EXIT = {
+  ok: 0,
+  error: 1,
+  usage: 2,
+  auth: 3
+};
+
+// src/commands/auth.ts
+function bail(message, code) {
+  cancel(message);
+  process.exit(code);
+}
+function fail(err) {
+  if (err instanceof ApiError) {
+    console.error(err.message);
+    process.exit(err.status === 401 || err.status === 403 ? EXIT.auth : EXIT.error);
+  }
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(EXIT.error);
+}
+async function loginAction(opts) {
+  const store = resolveStore();
+  const config = createConfig();
+  const server = resolveServer(opts.server, process.env.NOTATE_SERVER, config.get("server"));
+  let email = opts.email;
+  if (!email) {
+    const answer = await text({
+      message: "Email",
+      validate: (value) => value.includes("@") ? void 0 : "Enter a valid email address"
+    });
+    if (isCancel(answer)) bail("Cancelled.", EXIT.usage);
+    email = answer;
+  }
+  const pw = await passwordPrompt({ message: "Password" });
+  if (isCancel(pw)) bail("Cancelled.", EXIT.usage);
+  const progress = spinner();
+  progress.start("Signing in");
+  try {
+    let resp = await requestLogin(server, email, pw);
+    if (resp.requiresTotp && resp.totpToken) {
+      progress.stop("Two-factor authentication required");
+      const code = await text({ message: "Authentication code (or backup code)" });
+      if (isCancel(code)) bail("Cancelled.", EXIT.usage);
+      progress.start("Verifying code");
+      resp = await verifyTotp(server, resp.totpToken, code);
+    }
+    const session = await finalizeLogin(store, server, resp, pw);
+    progress.stop(`Logged in as ${session.email}`);
+    if (opts.json) {
+      console.log(renderJson({ email: session.email, server, userId: session.userId }));
+    }
+  } catch (err) {
+    progress.stop("Login failed");
+    fail(err);
+  }
+}
+function whoamiAction(opts) {
+  const store = resolveStore();
+  const session = loadSession(store);
+  if (!session) {
+    if (!opts.quiet) console.error("Not logged in. Run `notate login`.");
+    process.exit(EXIT.auth);
+  }
+  emit(
+    { email: session.email, server: session.server, userId: session.userId },
+    opts,
+    () => `${session.email}
+${session.server}`
+  );
+}
+async function logoutAction(opts) {
+  const store = resolveStore();
+  const session = loadSession(store);
+  await logout(store, session);
+  if (!opts.quiet) console.log("Logged out.");
+}
+function registerAuthCommands(program2) {
+  program2.command("login").description("Log in to a Notate account").option("--email <email>", "account email (otherwise prompted)").option("--server <url>", "API server URL (default: configured server)").option("--json", "print session info as JSON on success").option("--quiet", "suppress output").action(loginAction);
+  program2.command("logout").description("Log out and clear stored credentials").option("--quiet", "suppress output").action(logoutAction);
+  program2.command("whoami").description("Show the current user and server").option("--json", "output JSON").option("--quiet", "suppress output").action(whoamiAction);
+}
+
+// src/commands/notes.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { confirm, isCancel as isCancel2, multiselect, cancel as cancel2 } from "@clack/prompts";
+
+// src/lib/notes.ts
+async function refreshEncryptionState(store) {
+  const session = requireSession(store);
+  const authed = createAuthedClient(store);
+  const status = await authed("/auth/encryption/status");
+  const enabled = Boolean(status.enabled);
+  const fresh = enabled === session.encryptionEnabled ? session : { ...session, encryptionEnabled: enabled };
+  if (fresh !== session) saveSession(store, fresh);
+  return { authed, session: fresh, enabled };
+}
+async function buildNotesContext(store) {
+  const { authed, session, enabled } = await refreshEncryptionState(store);
+  if (!enabled) {
+    return { authed, encryptionEnabled: false };
+  }
+  const dek = loadDEK(store, session.userId);
+  if (!dek) {
+    throw new ApiError(
+      "This account is encrypted but not unlocked on this machine. Run `notate login`.",
+      401,
+      "e2e_locked"
+    );
+  }
+  return { authed, contentKey: deriveContentKey(dek), encryptionEnabled: true };
+}
+async function decrypt(ctx, note) {
+  return ctx.contentKey ? decryptNote(note, ctx.contentKey) : note;
+}
+async function listNotes(ctx, params = {}) {
+  const res = await ctx.authed("/notes", {
+    query: {
+      workspaceId: params.workspaceId,
+      folder: params.folder,
+      folderId: params.folderId,
+      tags: params.tags?.length ? params.tags.join(",") : void 0,
+      favorite: params.favorite ? "true" : void 0,
+      search: params.search,
+      searchMode: params.searchMode,
+      sortBy: params.sortBy,
+      sortOrder: params.sortOrder,
+      page: params.page,
+      pageSize: params.pageSize
+    }
+  });
+  const notes = await Promise.all(res.notes.map((n) => decrypt(ctx, n)));
+  return { notes, total: res.total };
+}
+async function searchNotes(ctx, query, params = {}) {
+  const res = await ctx.authed("/notes", {
+    query: {
+      search: query,
+      searchMode: params.searchMode ?? "keyword",
+      workspaceId: params.workspaceId,
+      folder: params.folder,
+      tags: params.tags?.length ? params.tags.join(",") : void 0,
+      pageSize: params.pageSize
+    }
+  });
+  const notes = await Promise.all(res.notes.map((n) => decrypt(ctx, n)));
+  return { notes, total: res.total };
+}
+async function getNote(ctx, id) {
+  const res = await ctx.authed(`/notes/${id}`);
+  return decrypt(ctx, res.note);
+}
+async function createNote(ctx, input) {
+  const body = ctx.contentKey ? await encryptNote(input, ctx.contentKey) : input;
+  const res = await ctx.authed("/notes", { method: "POST", body });
+  return decrypt(ctx, res.note);
+}
+async function updateNote(ctx, id, patch) {
+  const body = ctx.contentKey ? await encryptNote(patch, ctx.contentKey) : patch;
+  const res = await ctx.authed(`/notes/${id}`, { method: "PATCH", body });
+  return decrypt(ctx, res.note);
+}
+async function deleteNote(ctx, id) {
+  await ctx.authed(`/notes/${id}`, { method: "DELETE" });
+}
+async function permanentDeleteNote(ctx, id) {
+  await ctx.authed(`/notes/${id}/permanent`, { method: "DELETE" });
+}
+function listNoteVersions(ctx, noteId, params = {}) {
+  return ctx.authed(`/notes/${noteId}/versions`, {
+    query: { page: params.page, pageSize: params.pageSize }
+  });
+}
+async function restoreNoteVersion(ctx, noteId, versionId) {
+  const res = await ctx.authed(
+    `/notes/${noteId}/versions/${versionId}/restore`,
+    { method: "POST" }
+  );
+  return decrypt(ctx, res.note);
+}
+async function restoreNote(ctx, id) {
+  const res = await ctx.authed(`/notes/${id}/restore`, { method: "PATCH" });
+  return decrypt(ctx, res.note);
+}
+async function emptyTrash(ctx, workspaceId) {
+  return ctx.authed("/notes/trash", {
+    method: "DELETE",
+    body: workspaceId ? { workspaceId } : void 0
+  });
+}
+async function listTrashedNotes(ctx, params = {}) {
+  const res = await ctx.authed("/notes/trash", {
+    query: {
+      workspaceId: params.workspaceId,
+      page: params.page,
+      pageSize: params.pageSize
+    }
+  });
+  const notes = await Promise.all(res.notes.map((n) => decrypt(ctx, n)));
+  return { notes, total: res.total };
+}
+
+// src/lib/workspace.ts
+async function listWorkspaces(authed) {
+  const res = await authed("/workspaces");
+  return res.workspaces;
+}
+var AmbiguousWorkspaceError = class extends Error {
+  matches;
+  constructor(workspaceName, matches) {
+    const lines = matches.map(
+      (w) => `  ${w.id}  ${w.name} (${w.folderCount} folders \xB7 ${w.noteCount ?? 0} notes)`
+    );
+    super(
+      `Multiple workspaces named "${workspaceName}":
+${lines.join("\n")}
+Re-run with the id.`
+    );
+    this.name = "AmbiguousWorkspaceError";
+    this.matches = matches;
+  }
+};
+function resolveWorkspace(workspaces, candidate) {
+  if (workspaces.length === 0) {
+    throw new Error("No workspaces found on this account.");
+  }
+  if (!candidate) {
+    return [...workspaces].sort(
+      (a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" })
+    )[0];
+  }
+  const byId = workspaces.find((w) => w.id === candidate);
+  if (byId) return byId;
+  const byName = workspaces.filter((w) => w.name.toLowerCase() === candidate.toLowerCase());
+  if (byName.length === 1) return byName[0];
+  if (byName.length === 0) throw new Error(`Workspace not found: ${candidate}`);
+  throw new AmbiguousWorkspaceError(candidate, byName);
+}
+function matchWorkspaces(workspaces, candidate) {
+  const byId = workspaces.find((w) => w.id === candidate);
+  if (byId) return [byId];
+  return workspaces.filter((w) => w.name.toLowerCase() === candidate.toLowerCase());
+}
+async function resolveActiveWorkspace(authed, flag, configured) {
+  const workspaces = await listWorkspaces(authed);
+  return resolveWorkspace(workspaces, flag ?? configured);
+}
+function createWorkspace(authed, name, opts = {}) {
+  return authed("/workspaces", {
+    method: "POST",
+    body: { name, ...opts }
+  });
+}
+function renameWorkspace(authed, id, name) {
+  return authed(`/workspaces/${id}`, {
+    method: "PATCH",
+    body: { name }
+  });
+}
+function deleteWorkspace(authed, id) {
+  return authed(`/workspaces/${id}`, { method: "DELETE" });
+}
+function setWorkspaceDefaultFolder(authed, id, defaultFolderId) {
+  return authed(`/workspaces/${id}`, {
+    method: "PATCH",
+    body: { defaultFolderId }
+  });
+}
+function addFolderToWorkspace(authed, workspaceId, folderId) {
+  return authed(`/workspaces/${workspaceId}/folders`, {
+    method: "POST",
+    body: { folderId }
+  });
+}
+function removeFolderFromWorkspace(authed, workspaceId, folderId) {
+  return authed(`/workspaces/${workspaceId}/folders/${folderId}`, { method: "DELETE" });
+}
+
+// src/lib/folders.ts
+async function listFolders(authed, workspaceId) {
+  const res = await authed("/notes/folders", { query: { workspaceId } });
+  return flattenFolders(res.folders);
+}
+async function listTrashedFolders(authed, workspaceId) {
+  const res = await authed("/notes/folders/trash", { query: { workspaceId } });
+  return flattenFolders(res.folders);
+}
+function flattenFolders(folders) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const walk = (list) => {
+    for (const f of list) {
+      if (!seen.has(f.id)) {
+        seen.add(f.id);
+        out.push(f);
+      }
+      if (f.children?.length) walk(f.children);
+    }
+  };
+  walk(folders);
+  return out;
+}
+function orderFolderTree(flat) {
+  const ids = new Set(flat.map((f) => f.id));
+  const childrenOf = /* @__PURE__ */ new Map();
+  for (const f of flat) {
+    if (f.parentId && ids.has(f.parentId)) {
+      const arr = childrenOf.get(f.parentId) ?? [];
+      arr.push(f);
+      childrenOf.set(f.parentId, arr);
+    }
+  }
+  const byName = (a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" });
+  const out = [];
+  const emit2 = (f, depth) => {
+    out.push({ ...f, depth });
+    for (const child of (childrenOf.get(f.id) ?? []).sort(byName)) emit2(child, depth + 1);
+  };
+  const roots = flat.filter((f) => !f.parentId || !ids.has(f.parentId));
+  for (const root of roots.sort(byName)) emit2(root, 0);
+  return out;
+}
+function firstRootId(folders) {
+  const roots = folders.filter((f) => f.parentId === null);
+  return (roots.find((f) => f.isRoot) ?? roots[0])?.id ?? null;
+}
+function resolveNewNoteFolderId(defaultFolderId, folders) {
+  if (defaultFolderId && folders.some((f) => f.id === defaultFolderId)) {
+    return defaultFolderId;
+  }
+  return firstRootId(folders);
+}
+function folderTreeLines(flat, label) {
+  const ids = new Set(flat.map((f) => f.id));
+  const childrenOf = /* @__PURE__ */ new Map();
+  for (const f of flat) {
+    if (f.parentId && ids.has(f.parentId)) {
+      const arr = childrenOf.get(f.parentId) ?? [];
+      arr.push(f);
+      childrenOf.set(f.parentId, arr);
+    }
+  }
+  const byName = (a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" });
+  const lines = [];
+  const walk = (nodes, ancestorHasNext) => {
+    const sorted = [...nodes].sort(byName);
+    sorted.forEach((f, i) => {
+      const isLast = i === sorted.length - 1;
+      const prefix = ancestorHasNext.map((hasNext) => hasNext ? "\u2502   " : "    ").join("");
+      lines.push(`${prefix}${isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 "}${label(f)}`);
+      const kids = childrenOf.get(f.id);
+      if (kids?.length) walk(kids, [...ancestorHasNext, !isLast]);
+    });
+  };
+  walk(
+    flat.filter((f) => !f.parentId || !ids.has(f.parentId)),
+    []
+  );
+  return lines;
+}
+var AmbiguousFolderError = class extends Error {
+  constructor(folderName, matches) {
+    super(`Multiple folders named "${folderName}".`);
+    this.folderName = folderName;
+    this.matches = matches;
+    this.name = "AmbiguousFolderError";
+  }
+  folderName;
+  matches;
+};
+function resolveFolder(flat, nameOrId) {
+  const byId = flat.find((f) => f.id === nameOrId);
+  if (byId) return byId;
+  const matches = flat.filter((f) => f.name === nameOrId);
+  if (matches.length === 1) return matches[0];
+  if (matches.length === 0) throw new ApiError(`No folder named "${nameOrId}".`, 1, "not_found");
+  throw new AmbiguousFolderError(nameOrId, matches);
+}
+function createFolder(authed, req) {
+  return authed(
+    "/notes/folders",
+    { method: "POST", body: req }
+  );
+}
+function renameFolder(authed, id, newName) {
+  return authed(`/notes/folders/${id}`, {
+    method: "PATCH",
+    body: { newName }
+  });
+}
+function deleteFolder(authed, id, mode) {
+  return authed(`/notes/folders/${id}`, {
+    method: "DELETE",
+    query: { mode }
+  });
+}
+function restoreFolder(authed, id) {
+  return authed(`/notes/folders/${id}/restore`, { method: "PATCH" });
+}
+function permanentDeleteFolder(authed, id) {
+  return authed(`/notes/folders/${id}/permanent`, { method: "DELETE" });
+}
+function setFolderFavorite(authed, id, favorite) {
+  return authed(`/notes/folders/${id}/favorite`, {
+    method: "PATCH",
+    body: { favorite }
+  });
+}
+function moveFolder(authed, id, parentId, opts = {}) {
+  return authed(
+    `/notes/folders/${id}/move`,
+    {
+      method: "PATCH",
+      body: { parentId },
+      query: opts.confirmCrossBoundary ? { confirmCrossBoundary: 1 } : void 0
+    }
+  );
+}
+
+// src/lib/resolve.ts
+var RESOLVE_SCAN_LIMIT = 500;
+var AmbiguousTitleError = class extends Error {
+  constructor(title, matches) {
+    super(`Multiple notes match "${title}".`);
+    this.title = title;
+    this.matches = matches;
+    this.name = "AmbiguousTitleError";
+  }
+  title;
+  matches;
+};
+async function resolveNoteTarget(opts, lister) {
+  if (opts.id) return { id: opts.id };
+  const title = opts.title;
+  if (!title) {
+    throw new ApiError("Provide a note title or --id.", 2, "usage");
+  }
+  const { notes } = await lister({
+    workspaceId: opts.workspaceId,
+    search: opts.useSearch ? title : void 0,
+    pageSize: RESOLVE_SCAN_LIMIT
+  });
+  const matches = notes.filter((n) => n.title === title);
+  if (matches.length === 1) return { id: matches[0].id, note: matches[0] };
+  if (matches.length === 0) {
+    throw new ApiError(`No note titled "${title}".`, 1, "not_found");
+  }
+  throw new AmbiguousTitleError(title, matches);
+}
+
+// src/commands/notes.ts
+function handleError(err) {
+  if (err instanceof AmbiguousTitleError) {
+    console.error(err.message);
+    console.error(
+      renderTable(
+        ["ID", "Title", "Folder"],
+        err.matches.map((n) => [n.id, n.title, n.folder ?? ""])
+      )
+    );
+    console.error("Re-run with --id <id>.");
+    process.exit(EXIT.error);
+  }
+  if (err instanceof ApiError) {
+    console.error(err.message);
+    process.exit(err.status === 401 || err.status === 403 ? EXIT.auth : EXIT.error);
+  }
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(EXIT.error);
+}
+async function setup(opts) {
+  const store = resolveStore();
+  const config = createConfig();
+  const ctx = await buildNotesContext(store);
+  const workspace = await resolveActiveWorkspace(
+    ctx.authed,
+    opts.workspace,
+    config.get("workspace")
+  );
+  return { ctx, workspaceId: workspace.id, defaultFolderId: workspace.defaultFolderId ?? null };
+}
+function readContentInput(opts) {
+  if (opts.stdin) return readStdin();
+  if (opts.file) return Promise.resolve(readFileSync2(opts.file, "utf-8"));
+  return Promise.resolve(opts.content);
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf-8");
+}
+function splitCsv(value) {
+  if (!value) return void 0;
+  return value.split(",").map((s) => s.trim()).filter(Boolean);
+}
+async function resolveTarget(ctx, workspaceId, opts, source = "active") {
+  const lister = source === "trash" ? (params) => listTrashedNotes(ctx, params) : (params) => listNotes(ctx, params);
+  return resolveNoteTarget(
+    {
+      id: opts.id,
+      title: opts.title,
+      workspaceId,
+      // Server search can't match encrypted titles; only narrow for non-E2E.
+      useSearch: source === "active" && !ctx.contentKey
+    },
+    lister
+  );
+}
+function noteSummary(n) {
+  return { id: n.id, title: n.title, folder: n.folder, tags: n.tags, updatedAt: n.updatedAt };
+}
+async function listAction(opts) {
+  try {
+    const { ctx, workspaceId } = await setup(opts);
+    const { notes } = await listNotes(ctx, {
+      workspaceId,
+      folder: opts.folder,
+      tags: opts.tag ? [opts.tag] : void 0,
+      favorite: opts.favorite,
+      sortBy: opts.sort ?? "updatedAt",
+      sortOrder: "desc",
+      pageSize: opts.limit ? Number(opts.limit) : 10
+    });
+    emit(
+      notes.map(noteSummary),
+      opts,
+      () => renderTable(
+        ["Title", "Folder", "Tags", "Updated"],
+        notes.map((n) => [n.title, n.folder ?? "", n.tags.join(", "), n.updatedAt.slice(0, 10)])
+      )
+    );
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function searchAction(query, opts) {
+  try {
+    const store = resolveStore();
+    if ((await refreshEncryptionState(store)).enabled) {
+      console.error(
+        "Search isn't available on encrypted accounts. (The server can't read your encrypted notes. Use the app to search.)"
+      );
+      process.exit(EXIT.error);
+    }
+    const { ctx, workspaceId } = await setup(opts);
+    const { notes } = await searchNotes(ctx, query, {
+      searchMode: opts.mode,
+      workspaceId,
+      folder: opts.folder,
+      tags: opts.tag ? [opts.tag] : void 0,
+      pageSize: opts.limit ? Number(opts.limit) : 10
+    });
+    emit(
+      notes.map((n) => ({
+        id: n.id,
+        title: n.title,
+        folder: n.folder,
+        headline: n.headline,
+        updatedAt: n.updatedAt
+      })),
+      opts,
+      () => renderTable(
+        ["Title", "Folder", "Snippet", "Updated"],
+        notes.map((n) => [
+          n.title,
+          n.folder ?? "",
+          (n.headline ?? "").replace(/\s+/g, " ").trim().slice(0, 60),
+          n.updatedAt.slice(0, 10)
+        ])
+      )
+    );
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function getAction(title, opts) {
+  try {
+    const { ctx, workspaceId } = await setup(opts);
+    const target = await resolveTarget(ctx, workspaceId, { id: opts.id, title });
+    const note = target.note ?? await getNote(ctx, target.id);
+    emit(note, opts, () => note.content);
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function createAction(title, opts) {
+  try {
+    const { ctx, workspaceId, defaultFolderId } = await setup(opts);
+    const content = await readContentInput(opts);
+    const folders = await listFolders(ctx.authed, workspaceId);
+    let dest;
+    if (opts.folder) {
+      const f = resolveFolder(folders, opts.folder);
+      dest = { id: f.id, name: f.name };
+    } else {
+      const folderId = resolveNewNoteFolderId(defaultFolderId, folders);
+      if (!folderId) {
+        throw new ApiError(
+          "This workspace has no folders. Create one first (e.g. `notate folders create Notes`), or pass --folder.",
+          2,
+          "no_root"
+        );
+      }
+      dest = { id: folderId, name: folders.find((x) => x.id === folderId)?.name ?? "" };
+    }
+    const note = await createNote(ctx, {
+      title,
+      content,
+      folderId: dest.id,
+      folder: dest.name,
+      tags: splitCsv(opts.tags),
+      workspaceId
+    });
+    emit(noteSummary(note), opts, () => `Created "${note.title}" (${note.id}).`);
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function editAction(title, opts) {
+  try {
+    const { ctx, workspaceId } = await setup(opts);
+    const target = await resolveTarget(ctx, workspaceId, { id: opts.id, title });
+    let content;
+    if (opts.append !== void 0) {
+      const current = target.note ?? await getNote(ctx, target.id);
+      content = `${current.content}
+${opts.append}`;
+    } else {
+      content = await readContentInput(opts);
+    }
+    if (content === void 0) {
+      throw new ApiError("Nothing to write. Use --content, --stdin, --file, or --append.", 2, "usage");
+    }
+    const note = await updateNote(ctx, target.id, { content });
+    emit(noteSummary(note), opts, () => `Updated "${note.title}".`);
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function favoriteAction(title, opts) {
+  try {
+    const { ctx, workspaceId } = await setup(opts);
+    const target = await resolveTarget(ctx, workspaceId, { id: opts.id, title });
+    const favorite = !opts.off;
+    const note = await updateNote(ctx, target.id, { favorite });
+    emit(
+      { id: note.id, title: note.title, favorite: note.favorite },
+      opts,
+      () => `${favorite ? "Favorited" : "Unfavorited"} "${note.title}".`
+    );
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function deleteAction(title, opts) {
+  try {
+    const { ctx, workspaceId } = await setup(opts);
+    const target = await resolveTarget(ctx, workspaceId, { id: opts.id, title });
+    if (!opts.confirm) {
+      const ok = await confirm({ message: `Move "${title ?? target.id}" to Trash?` });
+      if (isCancel2(ok) || !ok) {
+        if (!opts.quiet) console.error("Cancelled.");
+        process.exit(EXIT.usage);
+      }
+    }
+    await deleteNote(ctx, target.id);
+    if (!opts.quiet) console.log("Moved to Trash.");
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function trashContext(opts) {
+  const store = resolveStore();
+  const ctx = await buildNotesContext(store);
+  let workspaceId;
+  if (opts.workspace) {
+    const config = createConfig();
+    workspaceId = (await resolveActiveWorkspace(ctx.authed, opts.workspace, config.get("workspace"))).id;
+  }
+  return { ctx, workspaceId };
+}
+async function trashListAction(opts) {
+  try {
+    const { ctx, workspaceId } = await trashContext(opts);
+    const { notes } = await listTrashedNotes(ctx, { workspaceId, pageSize: 500 });
+    emit(
+      notes.map((n) => ({ id: n.id, title: n.title, folder: n.folder, deletedAt: n.deletedAt })),
+      opts,
+      () => notes.length ? renderTable(
+        ["Title", "Folder", "Deleted", "ID"],
+        notes.map((n) => [n.title, n.folder ?? "", (n.deletedAt ?? "").slice(0, 10), n.id])
+      ) : "Trash is empty."
+    );
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function trashDeleteAction(title, opts) {
+  try {
+    const { ctx, workspaceId } = await trashContext(opts);
+    if (title || opts.id) {
+      const target = await resolveTarget(ctx, workspaceId, { id: opts.id, title }, "trash");
+      await permanentDeleteNote(ctx, target.id);
+      if (!opts.quiet) console.log(`Permanently deleted "${title ?? target.id}".`);
+      return;
+    }
+    const { notes } = await listTrashedNotes(ctx, { workspaceId, pageSize: 500 });
+    if (notes.length === 0) {
+      if (!opts.quiet) console.log("Trash is empty.");
+      return;
+    }
+    if (!process.stdin.isTTY) {
+      throw new ApiError("Specify a note title or --id (or run in a terminal to pick).", 2, "usage");
+    }
+    const chosen = await multiselect({
+      message: "Select trashed notes to permanently delete (space to toggle, enter to confirm)",
+      options: notes.map((n) => ({ value: n.id, label: n.title, hint: (n.deletedAt ?? "").slice(0, 10) })),
+      required: false
+    });
+    if (isCancel2(chosen)) {
+      cancel2("Cancelled.");
+      process.exit(EXIT.usage);
+    }
+    const ids = chosen;
+    if (ids.length === 0) {
+      if (!opts.quiet) console.log("Nothing selected.");
+      return;
+    }
+    for (const id of ids) await permanentDeleteNote(ctx, id);
+    if (!opts.quiet) console.log(`Permanently deleted ${ids.length} note(s).`);
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function emptyTrashAction(opts) {
+  try {
+    const { ctx, workspaceId } = await trashContext(opts);
+    if (!opts.confirm) {
+      const target = opts.workspace ? `the "${opts.workspace}" workspace` : "all workspaces";
+      const ok = await confirm({
+        message: `Permanently delete all trashed notes in ${target}? This can't be undone.`
+      });
+      if (isCancel2(ok) || !ok) {
+        if (!opts.quiet) console.error("Cancelled.");
+        process.exit(EXIT.usage);
+      }
+    }
+    const res = await emptyTrash(ctx, workspaceId);
+    if (!opts.quiet) console.log(`Permanently deleted ${res.deleted} note(s) from Trash.`);
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function restoreAction(title, opts) {
+  try {
+    const { ctx, workspaceId } = await setup(opts);
+    const target = await resolveTarget(ctx, workspaceId, { id: opts.id, title }, "trash");
+    const note = await restoreNote(ctx, target.id);
+    emit(noteSummary(note), opts, () => `Restored "${note.title}".`);
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function versionsAction(title, opts) {
+  try {
+    const { ctx, workspaceId } = await setup(opts);
+    const target = await resolveTarget(ctx, workspaceId, { id: opts.id, title });
+    if (opts.restore) {
+      const note = await restoreNoteVersion(ctx, target.id, opts.restore);
+      emit(noteSummary(note), opts, () => `Restored "${note.title}" to version ${opts.restore}.`);
+      return;
+    }
+    const { versions } = await listNoteVersions(ctx, target.id, { pageSize: 50 });
+    emit(
+      versions.map((v) => ({ id: v.id, origin: v.origin, createdAt: v.createdAt })),
+      opts,
+      () => versions.length ? renderTable(
+        ["Version ID", "Origin", "Saved"],
+        versions.map((v) => [v.id, v.origin, v.createdAt.slice(0, 19).replace("T", " ")])
+      ) : "No version history yet."
+    );
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function moveAction(title, opts) {
+  try {
+    const { ctx, workspaceId, defaultFolderId } = await setup(opts);
+    const target = await resolveTarget(ctx, workspaceId, { id: opts.id, title });
+    const folders = await listFolders(ctx.authed, workspaceId);
+    let dest;
+    if (opts.toDefault) {
+      if (!defaultFolderId) {
+        throw new ApiError("This workspace has no default folder to move into.", 2, "no_default");
+      }
+      const f = folders.find((x) => x.id === defaultFolderId);
+      dest = { id: defaultFolderId, name: f?.name ?? "" };
+    } else if (opts.to) {
+      const f = resolveFolder(folders, opts.to);
+      dest = { id: f.id, name: f.name };
+    } else {
+      throw new ApiError("Provide --to <folder> or --to-default.", 2, "usage");
+    }
+    const note = await updateNote(ctx, target.id, { folderId: dest.id, folder: dest.name });
+    emit(noteSummary(note), opts, () => `Moved "${note.title}" to "${dest.name}".`);
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function tagAction(title, opts) {
+  try {
+    const { ctx, workspaceId } = await setup(opts);
+    const target = await resolveTarget(ctx, workspaceId, { id: opts.id, title });
+    let tags;
+    if (opts.set !== void 0) {
+      tags = splitCsv(opts.set) ?? [];
+    } else {
+      const current = target.note ?? await getNote(ctx, target.id);
+      const set = new Set(current.tags);
+      for (const t of splitCsv(opts.add) ?? []) set.add(t);
+      for (const t of splitCsv(opts.remove) ?? []) set.delete(t);
+      tags = [...set];
+    }
+    const note = await updateNote(ctx, target.id, { tags });
+    emit(noteSummary(note), opts, () => `Tags: ${note.tags.join(", ") || "(none)"}`);
+  } catch (err) {
+    handleError(err);
+  }
+}
+function registerNotesCommands(program2) {
+  const notes = program2.command("notes").description("Create, read, update, and delete notes");
+  notes.command("list").description("List notes").option("--folder <name>", "filter by folder").option("--tag <name>", "filter by tag").option("--favorite", "favorites only").option("--sort <field>", "sort by title|createdAt|updatedAt").option("--limit <n>", "max results (default 10)").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").option("--quiet", "suppress output").action(listAction);
+  notes.command("search <query>").description("Search notes (keyword/semantic/hybrid). Unavailable on encrypted accounts.").option("--mode <mode>", "keyword | semantic | hybrid (default keyword)").option("--folder <name>", "restrict to a folder").option("--tag <name>", "restrict to a tag").option("--limit <n>", "max results (default 10)").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(searchAction);
+  notes.command("get [title]").description("Print a note (markdown to stdout, or --json)").option("--id <id>", "address by id instead of title").option("--workspace <name|id>", "workspace scope").option("--json", "output the full note as JSON").action(getAction);
+  notes.command("create <title>").description("Create a note (defaults to the workspace's default folder)").option("--content <text>", "note content").option("--stdin", "read content from stdin").option("--file <path>", "read content from a file").option("--folder <name>", "place in a folder").option("--tags <csv>", "comma-separated tags").option("--workspace <name|id>", "workspace scope").option("--json", "output the created note as JSON").action(createAction);
+  notes.command("edit [title]").description("Replace or append note content").option("--id <id>", "address by id instead of title").option("--content <text>", "new content").option("--stdin", "read content from stdin").option("--file <path>", "read content from a file").option("--append <text>", "append to existing content").option("--workspace <name|id>", "workspace scope").option("--json", "output the updated note as JSON").action(editAction);
+  notes.command("delete [title]").description("Move a note to Trash").option("--id <id>", "address by id instead of title").option("--confirm", "skip the confirmation prompt").option("--workspace <name|id>", "workspace scope").option("--quiet", "suppress output").action(deleteAction);
+  const trash = notes.command("trash").description("List and manage trashed notes").option("--workspace <name|id>", "scope to a workspace (default: all)").option("--json", "output JSON").action(trashListAction);
+  trash.command("list").description("List trashed notes").option("--workspace <name|id>", "scope to a workspace (default: all)").option("--json", "output JSON").action(trashListAction);
+  trash.command("delete [title]").description("Permanently delete a trashed note by name or --id, or pick interactively").option("--id <id>", "address by id instead of name").option("--workspace <name|id>", "scope to a workspace (default: all)").option("--quiet", "suppress output").action(trashDeleteAction);
+  trash.command("empty").description("Permanently delete all trashed notes").option("--workspace <name|id>", "only this workspace's trash").option("--confirm", "skip the confirmation prompt").option("--quiet", "suppress output").action(emptyTrashAction);
+  notes.command("restore [title]").description("Restore a note from Trash").option("--id <id>", "address by id instead of title").option("--workspace <name|id>", "workspace scope").option("--json", "output the restored note as JSON").action(restoreAction);
+  notes.command("move [title]").description("Move a note to a folder").option("--id <id>", "address by id instead of title").option("--to <folder>", "destination folder name").option("--to-default", "move to the workspace's default folder").option("--workspace <name|id>", "workspace scope").option("--json", "output the updated note as JSON").action(moveAction);
+  notes.command("tag [title]").description("Add, remove, or replace a note's tags").option("--id <id>", "address by id instead of title").option("--add <csv>", "tags to add").option("--remove <csv>", "tags to remove").option("--set <csv>", "replace all tags").option("--workspace <name|id>", "workspace scope").option("--json", "output the updated note as JSON").action(tagAction);
+  notes.command("favorite [title]").description("Mark a note as favorite (--off to unfavorite)").option("--id <id>", "address by id instead of title").option("--off", "remove from favorites").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(favoriteAction);
+  notes.command("versions [title]").description("List a note's version history (restore one with --restore <version-id>)").option("--restore <version-id>", "restore the note to this version (id from the list)").option("--id <id>", "address the note by id instead of title").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(versionsAction);
+  return notes;
+}
+
+// src/commands/folders.ts
+import { confirm as confirm2, isCancel as isCancel3 } from "@clack/prompts";
+
+// src/lib/cli-error.ts
+function exitWithError(err) {
+  if (err instanceof ApiError) {
+    console.error(err.message);
+    process.exit(err.status === 401 || err.status === 403 ? EXIT.auth : EXIT.error);
+  }
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(EXIT.error);
+}
+
+// src/commands/folders.ts
+function fail2(err) {
+  if (err instanceof AmbiguousFolderError) {
+    console.error(err.message);
+    console.error(
+      renderTable(
+        ["ID", "Name", "Parent"],
+        err.matches.map((f) => [f.id, f.name, f.parentId ?? ""])
+      )
+    );
+    console.error("Re-run with --id <id>.");
+    process.exit(EXIT.error);
+  }
+  exitWithError(err);
+}
+async function scope(opts) {
+  const store = resolveStore();
+  const { authed } = authContext(store);
+  const config = createConfig();
+  const workspace = await resolveActiveWorkspace(authed, opts.workspace, config.get("workspace"));
+  return { authed, workspaceId: workspace.id };
+}
+async function listAction2(opts) {
+  try {
+    const { authed, workspaceId } = await scope(opts);
+    const folders = await listFolders(authed, workspaceId);
+    emit(
+      orderFolderTree(folders).map((n) => ({
+        id: n.id,
+        name: n.name,
+        parentId: n.parentId,
+        // Direct note count (like web/desktop/mobile), not the subtree total.
+        notes: n.count
+      })),
+      opts,
+      () => folderTreeLines(
+        folders,
+        (f) => `${f.name} (${f.count} note${f.count === 1 ? "" : "s"})`
+      ).join("\n") || "(no folders)"
+    );
+  } catch (err) {
+    fail2(err);
+  }
+}
+async function createAction2(name, opts) {
+  try {
+    const { authed, workspaceId } = await scope(opts);
+    let parentId;
+    if (opts.parent) {
+      const folders = await listFolders(authed, workspaceId);
+      parentId = resolveFolder(folders, opts.parent).id;
+    }
+    const folder = await createFolder(authed, { name, parentId });
+    if (!parentId) {
+      await addFolderToWorkspace(authed, workspaceId, folder.id);
+    }
+    emit(folder, opts, () => `Created folder "${folder.name}" (${folder.id}).`);
+  } catch (err) {
+    fail2(err);
+  }
+}
+async function renameAction(name, newName, opts) {
+  try {
+    const { authed, workspaceId } = await scope(opts);
+    const id = opts.id ?? resolveFolder(await listFolders(authed, workspaceId), name).id;
+    const folder = await renameFolder(authed, id, newName);
+    emit(folder, opts, () => `Renamed to "${folder.name}".`);
+  } catch (err) {
+    fail2(err);
+  }
+}
+async function deleteAction2(name, opts) {
+  try {
+    const { authed, workspaceId } = await scope(opts);
+    const id = opts.id ?? resolveFolder(await listFolders(authed, workspaceId), name).id;
+    const mode = opts.recursive ? "recursive" : "move-up";
+    if (!opts.confirm) {
+      const message = opts.recursive ? `Move "${name}" and everything inside it to Trash?` : `Move "${name}" to Trash (its notes rise to the parent)?`;
+      const ok = await confirm2({ message });
+      if (isCancel3(ok) || !ok) {
+        if (!opts.quiet) console.error("Cancelled.");
+        process.exit(EXIT.usage);
+      }
+    }
+    await deleteFolder(authed, id, mode);
+    if (!opts.quiet) console.log("Moved to Trash.");
+  } catch (err) {
+    fail2(err);
+  }
+}
+async function restoreAction2(name, opts) {
+  try {
+    const { authed, workspaceId } = await scope(opts);
+    const id = opts.id ?? resolveFolder(await listTrashedFolders(authed, workspaceId), name).id;
+    await restoreFolder(authed, id);
+    if (!opts.quiet) console.log(`Restored "${name}".`);
+  } catch (err) {
+    fail2(err);
+  }
+}
+async function favoriteAction2(name, opts) {
+  try {
+    const { authed, workspaceId } = await scope(opts);
+    const id = opts.id ?? resolveFolder(await listFolders(authed, workspaceId), name).id;
+    const favorite = !opts.off;
+    const res = await setFolderFavorite(authed, id, favorite);
+    emit(res, opts, () => `${favorite ? "Favorited" : "Unfavorited"} folder "${name}".`);
+  } catch (err) {
+    fail2(err);
+  }
+}
+async function moveAction2(name, opts) {
+  try {
+    const { authed, workspaceId } = await scope(opts);
+    const folders = await listFolders(authed, workspaceId);
+    const folder = resolveFolder(folders, opts.id ?? name);
+    let parentId;
+    if (opts.toRoot) {
+      parentId = null;
+    } else if (opts.to) {
+      parentId = resolveFolder(folders, opts.to).id;
+    } else {
+      throw new ApiError("Provide --to <parent> or --to-root.", 2, "usage");
+    }
+    let res;
+    try {
+      res = await moveFolder(authed, folder.id, parentId);
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 409) {
+        res = await moveFolder(authed, folder.id, parentId, { confirmCrossBoundary: true });
+      } else {
+        throw err;
+      }
+    }
+    if (parentId === null) {
+      await addFolderToWorkspace(authed, workspaceId, folder.id);
+    }
+    emit(res, opts, () => `Moved "${folder.name}"${parentId ? "" : " to the top level"}.`);
+  } catch (err) {
+    fail2(err);
+  }
+}
+async function trashListAction2(opts) {
+  try {
+    const { authed, workspaceId } = await scope(opts);
+    const folders = await listTrashedFolders(authed, workspaceId);
+    emit(
+      folders.map((f) => ({ id: f.id, name: f.name, parentId: f.parentId })),
+      opts,
+      () => folders.length ? renderTable(["Name", "ID"], folders.map((f) => [f.name, f.id])) : "Folder trash is empty."
+    );
+  } catch (err) {
+    fail2(err);
+  }
+}
+async function trashDeleteAction2(name, opts) {
+  try {
+    const { authed, workspaceId } = await scope(opts);
+    const folder = resolveFolder(await listTrashedFolders(authed, workspaceId), opts.id ?? name);
+    if (!opts.confirm) {
+      const ok = await confirm2({
+        message: `Permanently delete folder "${folder.name}" and its subtree? This can't be undone.`
+      });
+      if (isCancel3(ok) || !ok) {
+        if (!opts.quiet) console.error("Cancelled.");
+        process.exit(EXIT.usage);
+      }
+    }
+    await permanentDeleteFolder(authed, folder.id);
+    if (!opts.quiet) console.log(`Permanently deleted folder "${folder.name}".`);
+  } catch (err) {
+    fail2(err);
+  }
+}
+function registerFoldersCommands(program2) {
+  const folders = program2.command("folders").description("Manage folders");
+  folders.command("list").description("Show the folder tree with note counts").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(listAction2);
+  folders.command("create <name>").description("Create a folder").option("--parent <name|id>", "parent folder (otherwise top-level)").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(createAction2);
+  folders.command("rename <name> <newName>").description("Rename a folder").option("--id <id>", "address by id instead of name").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(renameAction);
+  folders.command("delete <name>").description("Move a folder to Trash").option("--recursive", "also trash the folder's subtree (default: children rise to parent)").option("--id <id>", "address by id instead of name").option("--confirm", "skip the confirmation prompt").option("--workspace <name|id>", "workspace scope").option("--quiet", "suppress output").action(deleteAction2);
+  folders.command("restore <name>").description("Restore a folder from Trash").option("--id <id>", "address by id instead of name").option("--workspace <name|id>", "workspace scope").option("--quiet", "suppress output").action(restoreAction2);
+  folders.command("move <name>").description("Move a folder under a new parent (or --to-root for top-level)").option("--to <parent>", "destination parent folder").option("--to-root", "move to the top level (no parent)").option("--id <id>", "address by id instead of name").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(moveAction2);
+  folders.command("favorite <name>").description("Mark a folder as favorite (--off to unfavorite)").option("--off", "remove from favorites").option("--id <id>", "address by id instead of name").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(favoriteAction2);
+  const trash = folders.command("trash").description("List and manage trashed folders").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(trashListAction2);
+  trash.command("list").description("List trashed folders").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(trashListAction2);
+  trash.command("delete <name>").description("Permanently delete a trashed folder + its subtree").option("--id <id>", "address by id instead of name").option("--confirm", "skip the confirmation prompt").option("--workspace <name|id>", "workspace scope").option("--quiet", "suppress output").action(trashDeleteAction2);
+}
+
+// src/commands/tags.ts
+import { confirm as confirm3, isCancel as isCancel4 } from "@clack/prompts";
+
+// src/lib/tags.ts
+async function listTags(authed, workspaceId) {
+  const res = await authed("/notes/tags", { query: { workspaceId } });
+  return res.tags;
+}
+function renameTag(authed, name, newName) {
+  return authed(`/notes/tags/${encodeURIComponent(name)}`, {
+    method: "PATCH",
+    body: { newName }
+  });
+}
+function deleteTag(authed, name) {
+  return authed(`/notes/tags/${encodeURIComponent(name)}`, {
+    method: "DELETE"
+  });
+}
+
+// src/commands/tags.ts
+async function scope2(opts) {
+  const store = resolveStore();
+  const { authed, enabled } = await refreshEncryptionState(store);
+  if (enabled) {
+    console.error(
+      "Tags aren't available on encrypted accounts. (The server can't read your encrypted tags.)"
+    );
+    process.exit(EXIT.error);
+  }
+  const config = createConfig();
+  const workspace = await resolveActiveWorkspace(authed, opts.workspace, config.get("workspace"));
+  return { authed, workspaceId: workspace.id };
+}
+async function listAction3(opts) {
+  try {
+    const { authed, workspaceId } = await scope2(opts);
+    const tags = await listTags(authed, workspaceId);
+    if (opts.sort === "count") tags.sort((a, b) => b.count - a.count);
+    emit(
+      tags,
+      opts,
+      () => renderTable(
+        ["Tag", "Count"],
+        tags.map((t) => [t.name, t.count])
+      )
+    );
+  } catch (err) {
+    exitWithError(err);
+  }
+}
+async function renameAction2(oldName, newName, opts) {
+  try {
+    const { authed } = await scope2(opts);
+    const res = await renameTag(authed, oldName, newName);
+    emit(res, opts, () => `Renamed tag on ${res.updated} note(s).`);
+  } catch (err) {
+    exitWithError(err);
+  }
+}
+async function deleteAction3(name, opts) {
+  try {
+    const { authed } = await scope2(opts);
+    if (!opts.confirm) {
+      const ok = await confirm3({ message: `Remove tag "${name}" from all notes?` });
+      if (isCancel4(ok) || !ok) {
+        if (!opts.quiet) console.error("Cancelled.");
+        process.exit(EXIT.usage);
+      }
+    }
+    const res = await deleteTag(authed, name);
+    if (!opts.quiet) console.log(`Removed tag from ${res.updated} note(s).`);
+  } catch (err) {
+    exitWithError(err);
+  }
+}
+function registerTagsCommands(program2) {
+  const tags = program2.command("tags").description("Manage tags");
+  tags.command("list").description("List tags with usage counts").option("--sort <field>", "sort by count").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(listAction3);
+  tags.command("rename <oldName> <newName>").description("Rename a tag across all notes").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(renameAction2);
+  tags.command("delete <name>").description("Remove a tag from all notes").option("--confirm", "skip the confirmation prompt").option("--workspace <name|id>", "workspace scope").option("--quiet", "suppress output").action(deleteAction3);
+}
+
+// src/lib/stats.ts
+async function gatherStats(authed, workspaceId, encryptionEnabled) {
+  const [all, favs, folders, dashboard] = await Promise.all([
+    authed("/notes", { query: { workspaceId, pageSize: 1 } }),
+    authed("/notes", { query: { workspaceId, favorite: "true", pageSize: 1 } }),
+    authed("/notes/folders", { query: { workspaceId } }),
+    authed("/notes/dashboard", {
+      query: { workspaceId }
+    })
+  ]);
+  let tags = null;
+  if (!encryptionEnabled) {
+    tags = (await authed("/notes/tags", { query: { workspaceId } })).tags.length;
+  }
+  return {
+    notes: all.total,
+    favorites: favs.total,
+    folders: flattenFolders(folders.folders).length,
+    tags,
+    audio: dashboard.audioNotes.length
+  };
+}
+
+// src/commands/stats.ts
+async function statsAction(opts) {
+  try {
+    const store = resolveStore();
+    const { authed, enabled } = await refreshEncryptionState(store);
+    const config = createConfig();
+    const workspace = await resolveActiveWorkspace(authed, opts.workspace, config.get("workspace"));
+    const stats = await gatherStats(authed, workspace.id, enabled);
+    emit(stats, opts, () => {
+      const tags = stats.tags === null ? "n/a (encrypted)" : String(stats.tags);
+      return [
+        `Notes:     ${stats.notes}`,
+        `Favorites: ${stats.favorites}`,
+        `Folders:   ${stats.folders}`,
+        `Tags:      ${tags}`,
+        `Audio:     ${stats.audio}`
+      ].join("\n");
+    });
+  } catch (err) {
+    exitWithError(err);
+  }
+}
+function registerStatsCommand(program2) {
+  program2.command("stats").description("Show summary statistics for the active workspace").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(statsAction);
+}
+
+// src/commands/workspaces.ts
+import { confirm as confirm4, select, isCancel as isCancel5, cancel as cancel3 } from "@clack/prompts";
+function scope3() {
+  const store = resolveStore();
+  const { authed } = authContext(store);
+  return { authed, config: createConfig() };
+}
+var plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+function workspaceOptionLabel(w) {
+  return `${w.name}   ${plural(w.folderCount, "folder")} \xB7 ${plural(w.noteCount ?? 0, "note")}   ${w.id}`;
+}
+async function chooseWorkspace(matches, name, opts) {
+  if (!process.stdin.isTTY || opts.quiet) {
+    throw new AmbiguousWorkspaceError(name, matches);
+  }
+  const choice = await select({
+    message: `Multiple workspaces named "${name}". Which one?`,
+    options: matches.map((w) => ({ value: w.id, label: workspaceOptionLabel(w) }))
+  });
+  if (isCancel5(choice)) {
+    cancel3("Cancelled.");
+    process.exit(EXIT.usage);
+  }
+  return matches.find((w) => w.id === choice);
+}
+async function listAction4(opts) {
+  try {
+    const { authed, config } = scope3();
+    const workspaces = await listWorkspaces(authed);
+    let activeId = null;
+    try {
+      activeId = resolveWorkspace(workspaces, config.get("workspace")).id;
+    } catch {
+      activeId = null;
+    }
+    const sorted = [...workspaces].sort(
+      (a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" })
+    );
+    emit(
+      sorted.map((w) => ({
+        id: w.id,
+        name: w.name,
+        folders: w.folderCount,
+        notes: w.noteCount ?? 0,
+        active: w.id === activeId
+      })),
+      opts,
+      () => renderTable(
+        ["", "Name", "ID", "Folders", "Notes"],
+        sorted.map((w) => [
+          w.id === activeId ? "\u2605" : "",
+          w.name,
+          w.id,
+          w.folderCount,
+          w.noteCount ?? 0
+        ])
+      )
+    );
+  } catch (err) {
+    exitWithError(err);
+  }
+}
+async function useAction(nameOrId, opts) {
+  try {
+    const { authed, config } = scope3();
+    const matches = matchWorkspaces(await listWorkspaces(authed), nameOrId);
+    if (matches.length === 0) throw new Error(`Workspace not found: ${nameOrId}`);
+    const ws = matches.length === 1 ? matches[0] : await chooseWorkspace(matches, nameOrId, opts);
+    config.set("workspace", ws.id);
+    if (!opts.quiet) console.log(`Active workspace: ${ws.name}`);
+  } catch (err) {
+    exitWithError(err);
+  }
+}
+async function createAction3(name, opts) {
+  try {
+    const { authed } = scope3();
+    const { workspace } = await createWorkspace(authed, name, { color: opts.color, icon: opts.icon });
+    emit(workspace, opts, () => `Created workspace "${workspace.name}" (${workspace.id}).`);
+  } catch (err) {
+    exitWithError(err);
+  }
+}
+async function renameAction3(name, newName, opts) {
+  try {
+    const { authed } = scope3();
+    const ws = resolveWorkspace(await listWorkspaces(authed), name);
+    const { workspace } = await renameWorkspace(authed, ws.id, newName);
+    emit(workspace, opts, () => `Renamed workspace to "${workspace.name}".`);
+  } catch (err) {
+    exitWithError(err);
+  }
+}
+async function deleteAction4(name, opts) {
+  try {
+    const { authed, config } = scope3();
+    const matches = matchWorkspaces(await listWorkspaces(authed), name);
+    if (matches.length === 0) throw new Error(`Workspace not found: ${name}`);
+    const ws = matches.length === 1 ? matches[0] : await chooseWorkspace(matches, name, opts);
+    if (!opts.confirm) {
+      const ok = await confirm4({ message: `Delete workspace "${ws.name}"? (folders/notes stay; they're just unscoped)` });
+      if (isCancel5(ok) || !ok) {
+        if (!opts.quiet) console.error("Cancelled.");
+        process.exit(EXIT.usage);
+      }
+    }
+    await deleteWorkspace(authed, ws.id);
+    if (config.get("workspace") === ws.name || config.get("workspace") === ws.id) {
+      config.set("workspace", null);
+    }
+    if (!opts.quiet) console.log(`Deleted workspace "${ws.name}".`);
+  } catch (err) {
+    exitWithError(err);
+  }
+}
+async function setDefaultFolderAction(folderName, opts) {
+  try {
+    const { authed, config } = scope3();
+    const ws = resolveWorkspace(await listWorkspaces(authed), opts.workspace ?? config.get("workspace"));
+    const folder = resolveFolder(await listFolders(authed, ws.id), folderName);
+    const { workspace } = await setWorkspaceDefaultFolder(authed, ws.id, folder.id);
+    emit(workspace, opts, () => `Default folder for "${workspace.name}" set to "${folder.name}".`);
+  } catch (err) {
+    exitWithError(err);
+  }
+}
+async function removeFolderAction(folderName, opts) {
+  try {
+    const { authed, config } = scope3();
+    const ws = resolveWorkspace(await listWorkspaces(authed), opts.workspace ?? config.get("workspace"));
+    const folder = resolveFolder(await listFolders(authed, ws.id), folderName);
+    await removeFolderFromWorkspace(authed, ws.id, folder.id);
+    if (!opts.quiet) console.log(`Removed folder "${folder.name}" from workspace "${ws.name}".`);
+  } catch (err) {
+    exitWithError(err);
+  }
+}
+async function addFolderAction(folderName, opts) {
+  try {
+    const { authed, config } = scope3();
+    const ws = resolveWorkspace(await listWorkspaces(authed), opts.workspace ?? config.get("workspace"));
+    const folder = resolveFolder(await listFolders(authed), folderName);
+    await addFolderToWorkspace(authed, ws.id, folder.id);
+    if (!opts.quiet) console.log(`Added folder "${folder.name}" to workspace "${ws.name}".`);
+  } catch (err) {
+    exitWithError(err);
+  }
+}
+function registerWorkspacesCommands(program2) {
+  const workspaces = program2.command("workspaces").description("Manage workspaces");
+  workspaces.command("list").description("List workspaces (the active one is marked \u2605)").option("--json", "output JSON").action(listAction4);
+  workspaces.command("use <name|id>").description("Set the active (default) workspace").option("--quiet", "suppress output").action(useAction);
+  workspaces.command("create <name>").description("Create a workspace").option("--color <color>", "workspace color").option("--icon <icon>", "workspace icon").option("--json", "output JSON").action(createAction3);
+  workspaces.command("rename <name> <newName>").description("Rename a workspace").option("--json", "output JSON").action(renameAction3);
+  workspaces.command("delete <name>").description("Delete a workspace (its folders/notes are kept, just unscoped)").option("--confirm", "skip the confirmation prompt").option("--quiet", "suppress output").action(deleteAction4);
+  workspaces.command("set-default-folder <folder>").description("Set the folder new notes default into for a workspace").option("--workspace <name|id>", "target workspace (else the active one)").option("--json", "output JSON").action(setDefaultFolderAction);
+  workspaces.command("add-folder <folder>").description("Link an existing folder (root) into a workspace (multi-workspace membership)").option("--workspace <name|id>", "target workspace (else the active one)").option("--quiet", "suppress output").action(addFolderAction);
+  workspaces.command("remove-folder <folder>").description("Unlink a folder (root) from a workspace (the folder is not deleted)").option("--workspace <name|id>", "target workspace (else the active one)").option("--quiet", "suppress output").action(removeFolderAction);
+}
+
+// src/commands/ai.ts
+import pc from "picocolors";
+
+// src/lib/ai.ts
+async function parseSseStream(stream, handlers) {
+  const reader = stream.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+    let sep;
+    while ((sep = buffer.indexOf("\n\n")) !== -1) {
+      const block = buffer.slice(0, sep);
+      buffer = buffer.slice(sep + 2);
+      const dataLine = block.split("\n").find((l) => l.startsWith("data:"));
+      if (!dataLine) continue;
+      const data = dataLine.slice(5).trim();
+      if (data === "[DONE]") return;
+      let event;
+      try {
+        event = JSON.parse(data);
+      } catch {
+        continue;
+      }
+      dispatch(event, handlers);
+    }
+  }
+}
+function dispatch(event, handlers) {
+  if (typeof event.text === "string") handlers.onText?.(event.text);
+  else if (event.tool && typeof event.tool === "object") {
+    const t = event.tool;
+    handlers.onTool?.(t.name ?? "", t.description ?? "");
+  } else if (Array.isArray(event.noteCards)) handlers.onNoteCards?.(event.noteCards);
+  else if (event.confirmation) handlers.onConfirmation?.(event.confirmation);
+  else if (typeof event.error === "string") handlers.onError?.(event.error);
+}
+async function streamAsk(store, question, handlers) {
+  let session = requireSession(store);
+  const post = (token) => fetch(buildUrl(session.server, "/ai/ask"), {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      accept: "text/event-stream",
+      authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ question })
+  });
+  let res = await post(session.accessToken);
+  if (res.status === 401) {
+    session = await refreshSession(store, session);
+    res = await post(session.accessToken);
+  }
+  if (!res.ok || !res.body) {
+    let code;
+    try {
+      code = (await res.clone().json()).code;
+    } catch {
+    }
+    throw new ApiError(`AI request failed with status ${res.status}`, res.status, code);
+  }
+  await parseSseStream(res.body, handlers);
+}
+async function summarizeNote(authed, noteId) {
+  const res = await authed("/ai/summarize", {
+    method: "POST",
+    body: { noteId }
+  });
+  return res.summary;
+}
+async function suggestTags(authed, noteId) {
+  const res = await authed("/ai/tags", { method: "POST", body: { noteId } });
+  return res.tags;
+}
+async function rewriteText(authed, text2, action) {
+  const res = await authed("/ai/rewrite", {
+    method: "POST",
+    body: { text: text2, action }
+  });
+  return res.text;
+}
+function aiErrorMessage(err) {
+  if (err instanceof ApiError) {
+    if (err.code === "encryption_no_ai") {
+      return "AI features are unavailable while end-to-end encryption is on.";
+    }
+    if (err.status === 403) {
+      return "AI is not available on your plan.";
+    }
+  }
+  return err instanceof Error ? err.message : String(err);
+}
+
+// src/commands/ai.ts
+async function guardE2E(store) {
+  if ((await refreshEncryptionState(store)).enabled) {
+    console.error("AI features are unavailable while end-to-end encryption is on.");
+    process.exit(EXIT.error);
+  }
+}
+function failAi(err) {
+  console.error(aiErrorMessage(err));
+  const code = err instanceof ApiError && (err.status === 401 || err.status === 403) ? EXIT.auth : EXIT.error;
+  process.exit(code);
+}
+async function resolveNote(opts, title) {
+  const store = resolveStore();
+  await guardE2E(store);
+  const ctx = await buildNotesContext(store);
+  const config = createConfig();
+  const workspace = await resolveActiveWorkspace(ctx.authed, opts.workspace, config.get("workspace"));
+  const target = await resolveNoteTarget(
+    { id: opts.id, title, workspaceId: workspace.id, useSearch: !ctx.contentKey },
+    (params) => listNotes(ctx, params)
+  );
+  return { ctx, target };
+}
+async function askAction(question, opts) {
+  const store = resolveStore();
+  await guardE2E(store);
+  try {
+    await streamAsk(store, question, {
+      onText: (t) => process.stdout.write(t),
+      onTool: (name, description) => {
+        if (!opts.quietTools) process.stderr.write(pc.dim(`
+${description || name}\u2026
+`));
+      },
+      onNoteCards: (cards) => {
+        if (opts.quietTools) return;
+        for (const card of cards) {
+          const title = card.title;
+          if (title) process.stderr.write(pc.dim(`  \xB7 ${title}
+`));
+        }
+      },
+      onError: (message) => process.stderr.write(`
+${message}
+`)
+    });
+    process.stdout.write("\n");
+  } catch (err) {
+    failAi(err);
+  }
+}
+async function summarizeAction(title, opts) {
+  try {
+    const { ctx, target } = await resolveNote(opts, title);
+    const summary = await summarizeNote(ctx.authed, target.id);
+    emit({ summary }, opts, () => summary);
+  } catch (err) {
+    failAi(err);
+  }
+}
+async function gentagsAction(title, opts) {
+  try {
+    const { ctx, target } = await resolveNote(opts, title);
+    const tags = await suggestTags(ctx.authed, target.id);
+    if (opts.apply) {
+      const note = target.note ?? await getNote(ctx, target.id);
+      const merged = [.../* @__PURE__ */ new Set([...note.tags, ...tags])];
+      await updateNote(ctx, target.id, { tags: merged });
+    }
+    emit(
+      { tags, applied: Boolean(opts.apply) },
+      opts,
+      () => `${opts.apply ? "Applied" : "Suggested"} tags: ${tags.join(", ") || "(none)"}`
+    );
+  } catch (err) {
+    failAi(err);
+  }
+}
+async function readStdin2() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf-8");
+}
+async function rewriteAction(text2, opts) {
+  const store = resolveStore();
+  await guardE2E(store);
+  try {
+    const input = opts.stdin ? await readStdin2() : text2;
+    if (!input || !input.trim()) {
+      console.error("Provide text to rewrite (an argument or --stdin).");
+      process.exit(EXIT.usage);
+    }
+    const authed = createAuthedClient(store);
+    const result = await rewriteText(authed, input, opts.action ?? "rewrite");
+    process.stdout.write(result.endsWith("\n") ? result : `${result}
+`);
+  } catch (err) {
+    failAi(err);
+  }
+}
+function registerAiCommands(program2) {
+  program2.command("ask <question>").description("Ask the AI about your notes (streams the answer)").option("--quiet-tools", "hide tool-activity lines").action(askAction);
+  program2.command("summarize [title]").description("Generate and save a note's summary").option("--id <id>", "address by id instead of title").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(summarizeAction);
+  program2.command("gentags [title]").description("Suggest tags for a note (use --apply to add them)").option("--apply", "apply the suggested tags to the note").option("--id <id>", "address by id instead of title").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").action(gentagsAction);
+  program2.command("rewrite [text]").description("Rewrite text with AI (prints the result to stdout)").option(
+    "--action <action>",
+    "rewrite | concise | fix-grammar | to-list | expand | summarize",
+    "rewrite"
+  ).option("--stdin", "read text from stdin").action(rewriteAction);
+}
+
+// src/commands/transcribe.ts
+import ora from "ora";
+
+// src/lib/transcribe.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { basename, extname } from "path";
+var MIME_BY_EXT = {
+  ".wav": "audio/wav",
+  ".mp3": "audio/mpeg",
+  ".m4a": "audio/mp4",
+  ".mp4": "audio/mp4",
+  ".webm": "audio/webm",
+  ".ogg": "audio/ogg"
+};
+function audioMimeForFile(path) {
+  const ext = extname(path).toLowerCase();
+  const mime = MIME_BY_EXT[ext];
+  if (!mime) {
+    throw new Error(
+      `Unsupported audio type: ${ext || "(no extension)"}. Supported: wav, mp3, m4a/mp4, webm, ogg.`
+    );
+  }
+  return mime;
+}
+async function transcribeFile(store, path, opts) {
+  const buffer = readFileSync3(path);
+  const mime = audioMimeForFile(path);
+  let session = requireSession(store);
+  const send = (token) => {
+    const form = new FormData();
+    form.append("mode", opts.mode);
+    if (opts.folderId) form.append("folderId", opts.folderId);
+    form.append("file", new Blob([buffer], { type: mime }), basename(path));
+    return fetch(buildUrl(session.server, "/ai/transcribe"), {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` },
+      body: form
+    });
+  };
+  let res = await send(session.accessToken);
+  if (res.status === 401) {
+    session = await refreshSession(store, session);
+    res = await send(session.accessToken);
+  }
+  if (!res.ok) {
+    let code;
+    try {
+      code = (await res.clone().json()).code;
+    } catch {
+    }
+    throw new ApiError(`Transcription failed with status ${res.status}`, res.status, code);
+  }
+  return await res.json();
+}
+
+// src/commands/transcribe.ts
+var VALID_MODES = ["meeting", "lecture", "memo", "verbatim"];
+function fail3(err) {
+  console.error(aiErrorMessage(err));
+  const code = err instanceof ApiError && (err.status === 401 || err.status === 403) ? EXIT.auth : EXIT.error;
+  process.exit(code);
+}
+async function transcribeAction(file, opts) {
+  const store = resolveStore();
+  if ((await refreshEncryptionState(store)).enabled) {
+    console.error("AI features are unavailable while end-to-end encryption is on.");
+    process.exit(EXIT.error);
+  }
+  const mode = opts.mode ?? "memo";
+  if (!VALID_MODES.includes(mode)) {
+    console.error(`Invalid --mode "${opts.mode}". Use: ${VALID_MODES.join(", ")}.`);
+    process.exit(EXIT.usage);
+  }
+  try {
+    const ctx = await buildNotesContext(store);
+    const config = createConfig();
+    const workspace = await resolveActiveWorkspace(ctx.authed, opts.workspace, config.get("workspace"));
+    const folders = await listFolders(ctx.authed, workspace.id);
+    let folderId;
+    if (opts.folder) {
+      folderId = resolveFolder(folders, opts.folder).id;
+    } else {
+      const target = resolveNewNoteFolderId(workspace.defaultFolderId ?? null, folders);
+      if (!target) {
+        throw new ApiError(
+          "This workspace has no folders. Create one first (e.g. `notate folders create Notes`), or pass --folder.",
+          2,
+          "no_root"
+        );
+      }
+      folderId = target;
+    }
+    const spinner2 = opts.quiet || opts.json ? null : ora(`Transcribing ${file}`).start();
+    try {
+      const result = await transcribeFile(store, file, { mode, folderId });
+      let note = result.note;
+      const patch = {};
+      if (opts.title) patch.title = opts.title;
+      if (opts.tags) {
+        patch.tags = [.../* @__PURE__ */ new Set([...note.tags, ...opts.tags.split(",").map((t) => t.trim()).filter(Boolean)])];
+      }
+      if (patch.title || patch.tags) note = await updateNote(ctx, note.id, patch);
+      spinner2?.succeed(`Created "${note.title}"`);
+      emit(
+        { id: note.id, title: note.title, folder: note.folder, tags: note.tags },
+        opts,
+        () => `Created "${note.title}"
+  Folder: ${note.folder ?? "(default)"}
+  Tags: ${note.tags.join(", ") || "(none)"}`
+      );
+    } catch (err) {
+      spinner2?.fail("Transcription failed");
+      throw err;
+    }
+  } catch (err) {
+    fail3(err);
+  }
+}
+function registerTranscribeCommand(program2) {
+  program2.command("transcribe <file>").description("Transcribe an audio file into a structured note").option("--mode <mode>", "meeting | lecture | memo | verbatim (default memo)").option("--folder <name>", "place the note in a folder").option("--tags <csv>", "add tags").option("--title <title>", "override the generated title").option("--workspace <name|id>", "workspace scope").option("--json", "output JSON").option("--quiet", "suppress output").action(transcribeAction);
+}
+
+// src/commands/importExport.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { join as join3 } from "path";
+
+// src/lib/importExport.ts
+import { readdirSync, statSync } from "fs";
+import { basename as basename2, extname as extname2, join as join2 } from "path";
+function deriveTitle(content, filename) {
+  const heading = content.match(/^#\s+(.+?)\s*$/m);
+  if (heading) return heading[1].trim();
+  return basename2(filename).replace(/\.md$/i, "");
+}
+function sanitizeFilename(title) {
+  const cleaned = title.replace(/[/\\:*?"<>|]/g, "-").replace(/\s+/g, " ").trim().slice(0, 100);
+  return cleaned || "untitled";
+}
+function collectMarkdownFiles(path, recursive) {
+  const stat = statSync(path);
+  if (stat.isFile()) return extname2(path).toLowerCase() === ".md" ? [path] : [];
+  const out = [];
+  for (const entry of readdirSync(path, { withFileTypes: true })) {
+    const full = join2(path, entry.name);
+    if (entry.isDirectory()) {
+      if (recursive) out.push(...collectMarkdownFiles(full, recursive));
+    } else if (extname2(entry.name).toLowerCase() === ".md") {
+      out.push(full);
+    }
+  }
+  return out.sort();
+}
+
+// src/commands/importExport.ts
+var EXPORT_BATCH_CAP = 1e3;
+function fail4(err) {
+  if (err instanceof AmbiguousTitleError) {
+    console.error(err.message);
+    console.error(
+      renderTable(
+        ["ID", "Title", "Folder"],
+        err.matches.map((n) => [n.id, n.title, n.folder ?? ""])
+      )
+    );
+    console.error("Re-run with --id <id>.");
+    process.exit(EXIT.error);
+  }
+  if (err instanceof ApiError) {
+    console.error(err.message);
+    process.exit(err.status === 401 || err.status === 403 ? EXIT.auth : EXIT.error);
+  }
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(EXIT.error);
+}
+async function exportAction(title, opts) {
+  try {
+    const store = resolveStore();
+    const ctx = await buildNotesContext(store);
+    const config = createConfig();
+    const workspace = await resolveActiveWorkspace(ctx.authed, opts.workspace, config.get("workspace"));
+    if (opts.all || opts.folder) {
+      if (!opts.out) throw new ApiError("Batch export needs -o <dir>.", 2, "usage");
+      const { notes, total } = await listNotes(ctx, {
+        workspaceId: workspace.id,
+        folder: opts.folder,
+        pageSize: EXPORT_BATCH_CAP
+      });
+      mkdirSync2(opts.out, { recursive: true });
+      const used = /* @__PURE__ */ new Set();
+      for (const note2 of notes) {
+        let name = sanitizeFilename(note2.title);
+        if (used.has(name.toLowerCase())) name = `${name}-${note2.id.slice(0, 8)}`;
+        used.add(name.toLowerCase());
+        writeFileSync2(join3(opts.out, `${name}.md`), note2.content);
+      }
+      let msg = `Exported ${notes.length} note(s) to ${opts.out}`;
+      if (total > notes.length) msg += ` (capped at ${EXPORT_BATCH_CAP} of ${total})`;
+      if (!opts.quiet) console.log(`${msg}.`);
+      return;
+    }
+    const target = await resolveNoteTarget(
+      { id: opts.id, title, workspaceId: workspace.id, useSearch: !ctx.contentKey },
+      (params) => listNotes(ctx, params)
+    );
+    const note = target.note ?? await getNote(ctx, target.id);
+    const payload = opts.format === "json" ? JSON.stringify(note, null, 2) : note.content;
+    if (opts.out) {
+      writeFileSync2(opts.out, payload);
+      if (!opts.quiet) console.error(`Wrote ${opts.out}`);
+    } else {
+      process.stdout.write(payload.endsWith("\n") ? payload : `${payload}
+`);
+    }
+  } catch (err) {
+    fail4(err);
+  }
+}
+async function importAction(path, opts) {
+  try {
+    const store = resolveStore();
+    const ctx = await buildNotesContext(store);
+    const config = createConfig();
+    const workspace = await resolveActiveWorkspace(ctx.authed, opts.workspace, config.get("workspace"));
+    const files = collectMarkdownFiles(path, Boolean(opts.recursive));
+    if (files.length === 0) {
+      console.error("No .md files found.");
+      process.exit(EXIT.error);
+    }
+    const folders = await listFolders(ctx.authed, workspace.id);
+    let dest;
+    if (opts.folder) {
+      const f = resolveFolder(folders, opts.folder);
+      dest = { id: f.id, name: f.name };
+    } else {
+      const target = resolveNewNoteFolderId(workspace.defaultFolderId ?? null, folders);
+      if (!target) {
+        throw new ApiError(
+          "This workspace has no folders. Create one first (e.g. `notate folders create Notes`), or pass --folder.",
+          2,
+          "no_root"
+        );
+      }
+      dest = { id: target, name: folders.find((x) => x.id === target)?.name ?? "" };
+    }
+    const existing = new Set(
+      (await listNotes(ctx, { workspaceId: workspace.id, pageSize: EXPORT_BATCH_CAP })).notes.map(
+        (n) => n.title
+      )
+    );
+    const tags = opts.tags ? opts.tags.split(",").map((t) => t.trim()).filter(Boolean) : void 0;
+    let imported = 0;
+    let skipped = 0;
+    for (const file of files) {
+      const content = readFileSync4(file, "utf-8");
+      const title = deriveTitle(content, file);
+      if (existing.has(title)) {
+        skipped++;
+        continue;
+      }
+      if (!opts.dryRun) {
+        await createNote(ctx, {
+          title,
+          content,
+          folderId: dest.id,
+          folder: dest.name,
+          tags,
+          workspaceId: workspace.id
+        });
+        existing.add(title);
+      }
+      imported++;
+    }
+    const verb = opts.dryRun ? "Would import" : "Imported";
+    const tail = skipped ? ` (${skipped} skipped \u2014 already exist)` : "";
+    console.log(`${verb} ${imported} note(s)${tail}.`);
+  } catch (err) {
+    fail4(err);
+  }
+}
+function registerImportExportCommands(notes) {
+  notes.command("export [title]").description("Export a note (markdown/JSON), or a folder/all to a directory").option("-o, --out <path>", "output file (single) or directory (batch)").option("--format <fmt>", "md | json (single-note only, default md)").option("--folder <name>", "export all notes in a folder").option("--all", "export every note in the workspace").option("--id <id>", "address a single note by id").option("--workspace <name|id>", "workspace scope").option("--quiet", "suppress status output").action(exportAction);
+  notes.command("import <path>").description("Import a markdown file or a directory of .md files").option("--folder <name>", "place imported notes in a folder").option("--tags <csv>", "add tags to imported notes").option("--recursive", "include subdirectories").option("--dry-run", "preview without creating notes").option("--workspace <name|id>", "workspace scope").action(importAction);
+}
+
+// src/commands/config.ts
+function setAction(key, value) {
+  if (!isConfigKey(key)) {
+    console.error(`Unknown config key "${key}". Valid keys: ${CONFIG_KEYS.join(", ")}.`);
+    process.exit(EXIT.usage);
+  }
+  let coerced;
+  try {
+    coerced = coerceConfigValue(key, value);
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(EXIT.usage);
+  }
+  const config = createConfig();
+  config.set(key, coerced);
+  console.log(`${key} = ${coerced === null ? "(none)" : coerced}`);
+}
+function getAction2(key) {
+  if (!isConfigKey(key)) {
+    console.error(`Unknown config key "${key}". Valid keys: ${CONFIG_KEYS.join(", ")}.`);
+    process.exit(EXIT.usage);
+  }
+  const value = createConfig().get(key);
+  console.log(value === null || value === void 0 ? "(none)" : String(value));
+}
+function listAction5(opts) {
+  const config = createConfig();
+  const store = Object.fromEntries(
+    CONFIG_KEYS.map((k) => [k, config.get(k)])
+  );
+  if (opts.json) {
+    console.log(JSON.stringify(store, null, 2));
+    return;
+  }
+  for (const k of CONFIG_KEYS) {
+    const v = store[k];
+    console.log(`${k} = ${v === null || v === void 0 ? "(none)" : String(v)}`);
+  }
+}
+function resetAction() {
+  createConfig().clear();
+  console.log("Config reset to defaults.");
+}
+function registerConfigCommands(program2) {
+  const config = program2.command("config").description("Manage CLI configuration");
+  config.command("set <key> <value>").description(`Set a value (keys: ${CONFIG_KEYS.join(", ")})`).action(setAction);
+  config.command("get <key>").description("Print a value").action(getAction2);
+  config.command("list").description("Show all config").option("--json", "output JSON").action(listAction5);
+  config.command("reset").description("Reset config to defaults").action(resetAction);
+}
+
+// src/lib/completion.ts
+function extractCommandTree(program2) {
+  const walk = (cmd) => ({
+    name: cmd.name(),
+    subcommands: cmd.commands.map(walk)
+  });
+  return walk(program2);
+}
+function summarize(tree) {
+  const top = tree.subcommands.map((c) => c.name).filter((n) => n !== "help");
+  const groups = tree.subcommands.filter((c) => c.subcommands.length > 0).map((c) => ({
+    name: c.name,
+    subs: c.subcommands.map((s) => s.name).filter((n) => n !== "help")
+  }));
+  return { top, groups };
+}
+function generateCompletion(shell, tree) {
+  const { top, groups } = summarize(tree);
+  switch (shell) {
+    case "bash":
+      return generateBash(top, groups);
+    case "zsh":
+      return generateZsh(top, groups);
+    case "fish":
+      return generateFish(top, groups);
+  }
+}
+function generateBash(top, groups) {
+  const cases = groups.map((g) => `    ${g.name}) COMPREPLY=( $(compgen -W "${g.subs.join(" ")}" -- "$cur") );;`).join("\n");
+  return `# notate bash completion
+_notate() {
+  local cur="\${COMP_WORDS[COMP_CWORD]}"
+  if [ "$COMP_CWORD" -eq 1 ]; then
+    COMPREPLY=( $(compgen -W "${top.join(" ")}" -- "$cur") )
+    return
+  fi
+  case "\${COMP_WORDS[1]}" in
+${cases}
+    *) ;;
+  esac
+}
+complete -F _notate notate
+`;
+}
+function generateZsh(top, groups) {
+  const cases = groups.map((g) => `    ${g.name}) compadd ${g.subs.join(" ")} ;;`).join("\n");
+  return `#compdef notate
+_notate() {
+  if (( CURRENT == 2 )); then
+    compadd ${top.join(" ")}
+    return
+  fi
+  case "\${words[2]}" in
+${cases}
+  esac
+}
+compdef _notate notate
+`;
+}
+function generateFish(top, groups) {
+  const lines = [
+    "# notate fish completion",
+    "complete -c notate -f",
+    `complete -c notate -n __fish_use_subcommand -a "${top.join(" ")}"`
+  ];
+  for (const g of groups) {
+    lines.push(
+      `complete -c notate -n "__fish_seen_subcommand_from ${g.name}" -a "${g.subs.join(" ")}"`
+    );
+  }
+  return `${lines.join("\n")}
+`;
+}
+
+// src/commands/completion.ts
+var SHELLS = ["bash", "zsh", "fish"];
+function registerCompletionCommand(program2) {
+  program2.command("completion <shell>").description("Print a shell completion script (bash, zsh, or fish)").action((shell) => {
+    if (!SHELLS.includes(shell)) {
+      console.error(`Unsupported shell "${shell}". Use: ${SHELLS.join(", ")}.`);
+      process.exit(EXIT.usage);
+    }
+    console.log(generateCompletion(shell, extractCommandTree(program2)));
+  });
+}
+
+// src/cli.ts
+var require3 = createRequire2(import.meta.url);
+var pkg = require3("../package.json");
+var program = new Command();
+program.name("notate").description(
+  pkg.description ?? "Notate.md CLI - Empower your markdown"
+).version(pkg.version, "-v, --version", "output the version number");
+registerAuthCommands(program);
+registerImportExportCommands(registerNotesCommands(program));
+registerFoldersCommands(program);
+registerTagsCommands(program);
+registerWorkspacesCommands(program);
+registerStatsCommand(program);
+registerAiCommands(program);
+registerTranscribeCommand(program);
+registerConfigCommands(program);
+registerCompletionCommand(program);
+program.parseAsync().catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});