@openparachute/vault 0.6.4-rc.9 → 0.6.5-rc.1

package/src/routing.test.ts

@@ -1956,6 +1956,131 @@ describe("scope enforcement on /api/*", () => {
     expect(res.status).toBe(200);
   });
 
+  // ----- vault#283: Schema editor read endpoints -------------------------
+
+  test("POST /api/tags/:name/conformance → counts notes violating a proposed spec", async () => {
+    createVault("journal");
+    const store = getVaultStore("journal");
+    await store.createNote("ok", { tags: ["task"], metadata: { status: "open" } });
+    await store.createNote("missing", { tags: ["task"], metadata: {} });
+    const admin = await createAdminToken("journal");
+
+    const path = "/vault/journal/api/tags/task/conformance";
+    const res = await route(
+      new Request(`http://localhost:1940${path}`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${admin}`, "content-type": "application/json" },
+        body: JSON.stringify({ fields: { status: { type: "string", required: true } } }),
+      }),
+      path,
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      tag: string;
+      total_notes: number;
+      violating_notes: number;
+      checked_fields: string[];
+    };
+    expect(body.tag).toBe("task");
+    expect(body.total_notes).toBe(2);
+    expect(body.violating_notes).toBe(1);
+    expect(body.checked_fields).toEqual(["status"]);
+  });
+
+  test("POST /api/tags/:name/conformance is read-only — a read token may run it", async () => {
+    createVault("journal");
+    const store = getVaultStore("journal");
+    await store.createNote("missing", { tags: ["task"], metadata: {} });
+    const readToken = await mintToken("journal", {
+      permission: "read",
+      scopes: ["vault:read"],
+    });
+
+    const path = "/vault/journal/api/tags/task/conformance";
+    const res = await route(
+      new Request(`http://localhost:1940${path}`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${readToken}`, "content-type": "application/json" },
+        body: JSON.stringify({ fields: { status: { type: "string", required: true } } }),
+      }),
+      path,
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { violating_notes: number };
+    expect(body.violating_notes).toBe(1);
+  });
+
+  test("PUT /api/tags/:name with replace_fields drops omitted fields (no merge resurrection)", async () => {
+    createVault("journal");
+    const store = getVaultStore("journal");
+    await store.upsertTagRecord("task", {
+      fields: { status: { type: "string" }, due: { type: "string" } },
+    });
+    const admin = await createAdminToken("journal");
+
+    const path = "/vault/journal/api/tags/task";
+    // Send only `status` WITH replace_fields → `due` must be dropped.
+    const res = await route(
+      new Request(`http://localhost:1940${path}`, {
+        method: "PUT",
+        headers: { authorization: `Bearer ${admin}`, "content-type": "application/json" },
+        body: JSON.stringify({ fields: { status: { type: "string" } }, replace_fields: true }),
+      }),
+      path,
+    );
+    expect(res.status).toBe(200);
+    const rec = await store.getTagRecord("task");
+    expect(Object.keys(rec?.fields ?? {})).toEqual(["status"]);
+    expect(rec?.fields?.due).toBeUndefined();
+  });
+
+  test("PUT /api/tags/:name WITHOUT replace_fields preserves omitted fields (merge — MCP contract)", async () => {
+    createVault("journal");
+    const store = getVaultStore("journal");
+    await store.upsertTagRecord("task", {
+      fields: { status: { type: "string" }, due: { type: "string" } },
+    });
+    const admin = await createAdminToken("journal");
+
+    const path = "/vault/journal/api/tags/task";
+    // Send only `status` WITHOUT the flag → `due` preserved (partial update).
+    const res = await route(
+      new Request(`http://localhost:1940${path}`, {
+        method: "PUT",
+        headers: { authorization: `Bearer ${admin}`, "content-type": "application/json" },
+        body: JSON.stringify({ fields: { status: { type: "string", enum: ["a"] } } }),
+      }),
+      path,
+    );
+    expect(res.status).toBe(200);
+    const rec = await store.getTagRecord("task");
+    expect(Object.keys(rec?.fields ?? {}).sort()).toEqual(["due", "status"]);
+  });
+
+  test("GET /api/tags/:name/effective → surfaces inherited fields + parents", async () => {
+    createVault("journal");
+    const store = getVaultStore("journal");
+    // dev declares a field; dev/log inherits it via parent_names.
+    await store.upsertTagRecord("dev", {
+      fields: { area: { type: "string" } },
+    });
+    await store.upsertTagRecord("dev/log", { parent_names: ["dev"] });
+    const admin = await createAdminToken("journal");
+
+    const path = "/vault/journal/api/tags/dev%2Flog/effective";
+    const res = await route(authed(admin, "GET", path), path);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      name: string;
+      parents: string[];
+      effective_parents: string[];
+      effective_fields: Record<string, { type?: string }>;
+    };
+    expect(body.parents).toEqual(["dev"]);
+    expect(body.effective_parents).toContain("dev");
+    expect(body.effective_fields.area?.type).toBe("string");
+  });
+
   test("POST /api/tags/:name/rename → 200 cascades token allowlists (vault#240)", async () => {
     createVault("journal");
     const store = getVaultStore("journal");

package/src/routing.ts

@@ -831,9 +831,17 @@ export async function route(
   // and the broad-vs-narrowed shape (`vault:<verb>` from pvt_*, or
   // `vault:<vaultName>:<verb>` from hub JWTs) are handled by
   // `hasScopeForVault`.
-  const requiredVerb = verbForMethod(req.method);
+  //
+  // Read-only POST carve-out (vault#283): the conformance check is a POST
+  // (it carries a proposed-fields body) but mutates nothing — it counts
+  // notes. Gate it on `read`, not `write`, so a read-scoped caller can
+  // preview a schema tightening without holding a write credential.
+  const apiSubpath = apiMatch[1] ?? "";
+  const isReadOnlyPost =
+    req.method === "POST" && /^\/tags\/[^/]+\/conformance$/.test(apiSubpath);
+  const requiredVerb = isReadOnlyPost ? "read" : verbForMethod(req.method);
   if (!hasScopeForVault(auth.scopes, vaultName, requiredVerb)) {
-    const requiredApiScope = scopeForMethod(req.method);
+    const requiredApiScope = isReadOnlyPost ? SCOPE_READ : scopeForMethod(req.method);
     return Response.json(
       {
         error: "Forbidden",

package/src/self-register.test.ts

@@ -62,17 +62,17 @@ function captureLogs(): {
 
 describe("self-register", () => {
   test("buildVaultServicePaths — no vaults yet → empty paths (no phantom /vault/default, #478)", () => {
-    expect(buildVaultServicePaths(undefined, [], ["/vault/default"])).toEqual([]);
+    expect(buildVaultServicePaths(undefined, [])).toEqual([]);
   });
 
   test("buildVaultServicePaths — default vault sorts first", () => {
     expect(
-      buildVaultServicePaths("default", ["alpha", "default", "beta"], ["/"]),
+      buildVaultServicePaths("default", ["alpha", "default", "beta"]),
     ).toEqual(["/vault/default", "/vault/alpha", "/vault/beta"]);
   });
 
   test("buildVaultServicePaths — no default → map by listed order", () => {
-    expect(buildVaultServicePaths(undefined, ["alpha", "beta"], ["/"])).toEqual([
+    expect(buildVaultServicePaths(undefined, ["alpha", "beta"])).toEqual([
       "/vault/alpha",
       "/vault/beta",
     ]);
@@ -80,7 +80,7 @@ describe("self-register", () => {
 
   test("buildVaultServicePaths — default points to missing vault → ignore default", () => {
     expect(
-      buildVaultServicePaths("missing", ["alpha", "beta"], ["/"]),
+      buildVaultServicePaths("missing", ["alpha", "beta"]),
     ).toEqual(["/vault/alpha", "/vault/beta"]);
   });
 

package/src/self-register.ts

@@ -69,7 +69,6 @@ import { listVaults, readGlobalConfig, DEFAULT_PORT } from "./config.ts";
 export function buildVaultServicePaths(
   defaultVault: string | undefined,
   vaults: readonly string[],
-  fallbackFromManifest: readonly string[],
 ): string[] {
   if (vaults.length === 0) return [];
   if (defaultVault && vaults.includes(defaultVault)) {
@@ -165,7 +164,7 @@ export function selfRegister(deps: SelfRegisterDeps): SelfRegisterResult {
     return { status: "failed", reason: msg };
   }
 
-  const paths = buildVaultServicePaths(globalConfig.default_vault, vaults, manifest.paths);
+  const paths = buildVaultServicePaths(globalConfig.default_vault, vaults);
   const port = globalConfig.port ?? DEFAULT_PORT;
 
   // Derive the health path from the primary path (paths[0]) rather than

package/src/server.ts

@@ -153,17 +153,23 @@ if (process.env.VAULT_AUTH_TOKEN?.trim()) {
 // logic lives in auth.ts (import-safe + unit-tested); see warnLegacyGlobalApiKeys.
 warnLegacyGlobalApiKeys(readGlobalConfig().api_keys);
 
-// Auto-init: create a default vault if none exist (first run in Docker).
-// The vault name comes from PARACHUTE_VAULT_NAME when set + valid; otherwise
-// falls back to "default". Hub's first-boot wizard (hub#267) passes through
-// an operator-chosen name via this env var.
+// First-boot vault creation — ONLY when PARACHUTE_VAULT_NAME is explicitly
+// set in the environment. (#478 Part 2)
+//
+// The hub setup wizard and `parachute init --vault-name <name>` both spawn
+// the vault server with PARACHUTE_VAULT_NAME=<operator-chosen-name>; that
+// env var is the load-bearing signal that an external orchestrator has
+// decided what the first vault should be called. With the env var unset the
+// server boots with zero vaults and stays that way — no silent "default"
+// — so a fresh install without a wizard can't accidentally squash an
+// explicit later `parachute-vault create <name>` call.
 //
 // Gated on the `auto_create: false` marker (2026-06-09 hub-module-boundary
 // migration): `parachute-vault remove` writes it when the operator deletes
 // their LAST vault, so an explicit empty-the-server action isn't silently
 // undone by a resurrection with fresh credentials on the next boot. Fresh
-// installs have no config.yaml — no marker — so Docker first-run still
-// auto-creates.
+// installs have no config.yaml — no marker — so the env-var-driven path
+// still works on a clean box.
 if (listVaults().length === 0) {
   const globalConfig = readGlobalConfig();
   if (!bootAutoCreateAllowed(globalConfig)) {
@@ -173,43 +179,57 @@ if (listVaults().length === 0) {
   } else if (!globalConfig.default_vault) {
     const firstBoot = resolveFirstBootVaultName(process.env.PARACHUTE_VAULT_NAME);
     if (firstBoot.source === "env") {
-      console.log(`[vault first-boot] using PARACHUTE_VAULT_NAME=${firstBoot.name}`);
+      // PARACHUTE_VAULT_NAME explicitly set + valid — create the named vault.
+      console.log(`[vault first-boot] PARACHUTE_VAULT_NAME=${firstBoot.name} — creating vault`);
+      const vaultName = firstBoot.name;
+      const { fullKey, keyId } = generateApiKey();
+      writeVaultConfig({
+        name: vaultName,
+        api_keys: [{
+          id: keyId,
+          label: "default",
+          scope: "write",
+          key_hash: hashKey(fullKey),
+          created_at: new Date().toISOString(),
+        }],
+        created_at: new Date().toISOString(),
+      });
+      globalConfig.default_vault = vaultName;
+      if (!globalConfig.api_keys?.length) {
+        globalConfig.api_keys = [{
+          id: keyId,
+          label: "default",
+          scope: "write",
+          key_hash: hashKey(fullKey),
+          created_at: new Date().toISOString(),
+        }];
+      }
+      writeGlobalConfig(globalConfig);
+      console.log(`Auto-created vault "${vaultName}" (API key: ${fullKey})`);
+      // Seed the in-vault onboarding guide so a connected AI can self-orient and
+      // help set the vault up — same as the `create`/`init` CLI path. Idempotent
+      // + best-effort (never fails first boot). Mirrors createVault() in cli.ts.
+      await seedOnboardingNotesBestEffort(getVaultStore(vaultName));
     } else if (firstBoot.source === "env-invalid") {
+      // PARACHUTE_VAULT_NAME was set but failed validation — do NOT silently
+      // fall back to "default". Log the problem and stay empty so the operator
+      // sees the misconfiguration instead of a phantom vault.
       console.warn(
-        `[vault first-boot] PARACHUTE_VAULT_NAME=${JSON.stringify(firstBoot.rawValue)} is invalid (${firstBoot.reason}); falling back to "default"`,
+        `[vault first-boot] PARACHUTE_VAULT_NAME=${JSON.stringify(firstBoot.rawValue)} is invalid (${firstBoot.reason}) — server starting with zero vaults. Fix the env var, or create one via the admin wizard, parachute init --vault-name <name>, or parachute-vault create <name>.`,
       );
     } else {
-      console.log("[vault first-boot] using default name (no PARACHUTE_VAULT_NAME set)");
-    }
-    const vaultName = firstBoot.name;
-    const { fullKey, keyId } = generateApiKey();
-    writeVaultConfig({
-      name: vaultName,
-      api_keys: [{
-        id: keyId,
-        label: "default",
-        scope: "write",
-        key_hash: hashKey(fullKey),
-        created_at: new Date().toISOString(),
-      }],
-      created_at: new Date().toISOString(),
-    });
-    globalConfig.default_vault = vaultName;
-    if (!globalConfig.api_keys?.length) {
-      globalConfig.api_keys = [{
-        id: keyId,
-        label: "default",
-        scope: "write",
-        key_hash: hashKey(fullKey),
-        created_at: new Date().toISOString(),
-      }];
+      // PARACHUTE_VAULT_NAME unset — stay empty. No silent "default".
+      console.log(
+        '[vault first-boot] no vaults and PARACHUTE_VAULT_NAME unset — staying empty. Create one via the admin wizard, parachute init --vault-name <name>, or parachute-vault create <name>.',
+      );
     }
-    writeGlobalConfig(globalConfig);
-    console.log(`Auto-created vault "${vaultName}" (API key: ${fullKey})`);
-    // Seed the in-vault onboarding guide so a connected AI can self-orient and
-    // help set the vault up — same as the `create`/`init` CLI path. Idempotent
-    // + best-effort (never fails first boot). Mirrors createVault() in cli.ts.
-    await seedOnboardingNotesBestEffort(getVaultStore(vaultName));
+  } else {
+    // Stale config: default_vault is set but no vault DB exists on disk, so
+    // first-boot create is skipped. Without a log line the server would boot
+    // empty and silent here, which is confusing. (#478 Part 2)
+    console.warn(
+      '[vault first-boot] config.yaml has default_vault set but no vaults exist on disk — skipping first-boot create. Create one with: parachute-vault create <name>',
+    );
   }
 }
 

package/src/storage.test.ts

@@ -1,10 +1,16 @@
 /**
- * Storage upload allowlist tests (issue #127).
+ * Storage upload policy tests (issue #127 origin; vault#517 deny-list).
  *
- * The allowlist guards `POST /api/storage/upload` against turning user
- * uploads into XSS vectors when the asset is later served back from
- * `/storage/`. We pin both the accepted set and the deliberate exclusions
- * so a future widening doesn't quietly let SVG/HTML in.
+ * `POST /api/storage/upload` accepts ANY file EXCEPT the active-content set a
+ * browser can execute when the asset is served back same-origin from
+ * `/storage/` (.svg/.html/.htm/.xhtml/.xml/.js/.mjs/.cjs/.css). A knowledge
+ * vault stores arbitrary files — ebooks, office docs, datasets, archives,
+ * binaries — so the long tail (.epub/.csv/.zip/.exe/…) is accepted, not
+ * rejected. We pin the accepted breadth AND the deliberate blocklist so a
+ * future edit can't quietly let SVG/HTML in (or quietly start rejecting docs).
+ * Two guards keep served files inert: every non-curated type serves as
+ * application/octet-stream, and the GET serve path pins
+ * `X-Content-Type-Options: nosniff`.
  */
 
 import { describe, test, expect, beforeAll, afterAll } from "bun:test";
@@ -91,6 +97,43 @@ describe("storage upload allowlist", () => {
     }
   });
 
+  test("accepts .epub — the reported gap (ebooks are knowledge content)", async () => {
+    const res = await handleStorage(uploadRequest("book.epub", "application/epub+zip"), "/upload", "default", uploadStore);
+    expect(res.status).toBe(201);
+    const body = (await res.json()) as { mimeType: string; path: string };
+    expect(body.mimeType).toBe("application/epub+zip");
+    expect(body.path).toMatch(/\.epub$/);
+  });
+
+  test("accepts common document / text / data / archive types", async () => {
+    for (const [name, mime, expected] of [
+      ["notes.txt", "text/plain", "text/plain; charset=utf-8"],
+      ["readme.md", "text/markdown", "text/markdown; charset=utf-8"],
+      ["data.csv", "text/csv", "text/csv; charset=utf-8"],
+      ["data.json", "application/json", "application/json; charset=utf-8"],
+      ["doc.docx", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "application/vnd.openxmlformats-officedocument.wordprocessingml.document"],
+      ["archive.zip", "application/zip", "application/zip"],
+      ["clip.mov", "video/quicktime", "video/quicktime"],
+      ["photo.heic", "image/heic", "image/heic"],
+    ] as const) {
+      const res = await handleStorage(uploadRequest(name, mime), "/upload", "default", uploadStore);
+      expect(res.status).toBe(201);
+      const body = (await res.json()) as { mimeType: string };
+      expect(body.mimeType).toBe(expected);
+    }
+  });
+
+  test("accepts arbitrary / unknown files — served as octet-stream (download), never run", async () => {
+    // Deny-list policy (vault#517): anything not in the active-content blocklist
+    // is accepted. Unknown/no-MIME extensions serve as octet-stream — a download.
+    for (const name of ["deck.pages", "tool.exe", "data.bin", "Makefile", "archive.tar.gz"] as const) {
+      const res = await handleStorage(uploadRequest(name, "application/octet-stream"), "/upload", "default", uploadStore);
+      expect(res.status).toBe(201);
+      const body = (await res.json()) as { mimeType: string };
+      expect(body.mimeType).toBe("application/octet-stream");
+    }
+  });
+
   test("rejects .svg — XSS vector via inline <script> (#127)", async () => {
     const res = await handleStorage(uploadRequest("evil.svg", "image/svg+xml"), "/upload", "default", uploadStore);
     expect(res.status).toBe(400);
@@ -105,9 +148,31 @@ describe("storage upload allowlist", () => {
     expect(body.error).toContain(".html");
   });
 
-  test("rejects unknown extensions (default-deny)", async () => {
-    const res = await handleStorage(uploadRequest("payload.exe", "application/octet-stream"), "/upload", "default", uploadStore);
-    expect(res.status).toBe(400);
+  test("rejects the active-content set (.js/.mjs/.cjs/.xhtml/.htm/.xml/.css/.shtml)", async () => {
+    for (const [name, mime] of [
+      ["script.js", "text/javascript"],
+      ["mod.mjs", "text/javascript"],
+      ["mod.cjs", "text/javascript"],
+      ["page.xhtml", "application/xhtml+xml"],
+      ["page.xht", "application/xhtml+xml"],
+      ["page.htm", "text/html"],
+      ["page.shtml", "text/html"],
+      ["feed.xml", "application/xml"],
+      ["style.css", "text/css"],
+    ] as const) {
+      const res = await handleStorage(uploadRequest(name, mime), "/upload", "default", uploadStore);
+      expect(res.status).toBe(400);
+      const body = (await res.json()) as { error: string };
+      expect(body.error).toContain("not allowed");
+    }
+  });
+
+  test("trailing-dot / trailing-space can't slip a blocked type past the guard", async () => {
+    // extname("evil.html.") === "." — normalize the trailing run first.
+    for (const name of ["evil.html.", "evil.svg ", "evil.js."] as const) {
+      const res = await handleStorage(uploadRequest(name, "text/plain"), "/upload", "default", uploadStore);
+      expect(res.status).toBe(400);
+    }
   });
 });
 
@@ -166,6 +231,8 @@ describe("storage GET tag-scope enforcement", () => {
     const res = await handleStorage(getReq(inScopePath), `/${inScopePath}`, VAULT, store, ctx);
     expect(res.status).toBe(200);
     expect(res.headers.get("Content-Type")).toBe("application/pdf");
+    // Served bytes pin nosniff so a browser can't sniff them into an active type.
+    expect(res.headers.get("X-Content-Type-Options")).toBe("nosniff");
     expect((await res.arrayBuffer()).byteLength).toBe(4);
   });
 

package/web/ui/dist/assets/{index-UlvD8KHr.css → index-C5XqQM-c.css}

@@ -1 +1 @@
-:root{--bg: #faf8f4;--bg-soft: #f3f0ea;--fg: #2c2a26;--fg-muted: #6b6860;--fg-dim: #9a9690;--accent: #4a7c59;--accent-soft: rgba(74, 124, 89, .08);--accent-hover: #3d6849;--border: #e4e0d8;--border-light: #ece9e2;--card-bg: #ffffff;--error: #a3392b;--error-soft: rgba(163, 57, 43, .08);--warn: #b08023;--warn-soft: rgba(176, 128, 35, .08);--success: #3d6849;--success-soft: rgba(61, 104, 73, .08);--font-serif: Georgia, "Times New Roman", serif;--font-sans: -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif;--font-mono: ui-monospace, "SF Mono", Menlo, Monaco, "Cascadia Mono", monospace;font-family:var(--font-sans)}*{box-sizing:border-box}html,body{margin:0;padding:0;background:var(--bg);color:var(--fg)}a{color:var(--accent);text-decoration:none}a:hover{text-decoration:underline}code{font-family:var(--font-mono);font-size:.85em;background:var(--bg-soft);padding:.1em .3em;border-radius:3px}.page{max-width:880px;margin:0 auto;padding:1.5rem 1.5rem 6rem}.nav{display:flex;gap:1rem;align-items:center;padding-bottom:1rem;border-bottom:1px solid var(--border);margin-bottom:2rem}.nav .brand{font-weight:600;font-family:var(--font-serif);font-size:1.15rem;margin-right:auto}.nav .brand .sub{color:var(--fg-dim);font-size:.78rem;font-weight:400;margin-left:.4rem;font-family:var(--font-sans)}.nav a{color:var(--fg-muted);font-size:.95rem}.nav a:hover{text-decoration:none;color:var(--fg)}h2{margin:0 0 1rem;font-size:1.4rem;font-weight:500}.muted{color:var(--fg-muted);font-size:.92rem}.dim{color:var(--fg-dim);font-size:.85rem}.error-banner{background:var(--error-soft);border:1px solid var(--error);color:var(--error);padding:.75rem 1rem;border-radius:8px;margin-bottom:1rem;font-size:.9rem}.warn-banner{background:var(--warn-soft);border:1px solid var(--warn);color:var(--warn);padding:.75rem 1rem;border-radius:8px;margin-bottom:1rem;font-size:.9rem}.empty{padding:3rem 1.5rem;text-align:center;color:var(--fg-muted);background:var(--bg-soft);border-radius:10px}.list-header{display:flex;align-items:baseline;justify-content:space-between;gap:1rem;margin-bottom:1rem}.list-header h2{margin:0}.vault-row{display:flex;align-items:center;gap:1rem;padding:.85rem 1rem;background:#fff;border:1px solid var(--border);border-radius:8px;margin-bottom:.5rem;text-decoration:none;color:inherit;transition:border-color .15s ease}.vault-row:hover{border-color:var(--accent);text-decoration:none}.vault-row .body{flex:1;min-width:0}.vault-row .name{display:flex;align-items:center;gap:.5rem;flex-wrap:wrap}.vault-row .name code{font-size:.95em}.vault-row .chev{color:var(--fg-dim);font-size:1.2rem}.vault-row-group{margin-bottom:.5rem}.vault-row-group .vault-row{margin-bottom:0}.vault-row-actions{display:flex;align-items:center;gap:.5rem;flex-shrink:0}.vault-usage{font-size:.85rem}.field-error{color:#b3402a;font-size:.85rem;margin-top:.35rem}.section{background:#fff;border:1px solid var(--border);border-radius:10px;padding:1.25rem 1.5rem;margin-bottom:1.5rem}.kv{display:grid;grid-template-columns:8.5rem 1fr;gap:.5rem 1rem;font-size:.92rem}.kv>div:nth-child(odd){color:var(--fg-muted)}.kv code{word-break:break-all}.stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(8rem,1fr));gap:1rem;font-size:.92rem}.stat{background:var(--bg-soft);border-radius:8px;padding:.85rem 1rem}.stat .label{color:var(--fg-muted);font-size:.82rem;margin-bottom:.2rem}.stat .value{font-size:1.4rem;font-weight:500;font-family:var(--font-mono)}button{font:inherit;background:var(--accent);color:#fff;border:0;border-radius:6px;padding:.55rem 1.1rem;cursor:pointer;transition:background .15s ease}button:hover{background:var(--accent-hover)}button:disabled{opacity:.5;cursor:not-allowed}button.secondary{background:#fff;color:var(--fg);border:1px solid var(--border)}button.secondary:hover{background:var(--bg-soft)}input,select{font:inherit;background:#fff;color:var(--fg);border:1px solid var(--border);border-radius:6px;padding:.5rem .7rem;width:100%;max-width:28rem}input:focus,select:focus{outline:2px solid var(--accent-soft);border-color:var(--accent)}.form-row{margin-bottom:1rem}.form-row label{display:block;font-size:.88rem;color:var(--fg-muted);margin-bottom:.3rem}.actions{display:flex;gap:.5rem;margin-top:1rem}.manage-list{margin:0;padding-left:1.1rem;font-size:.95rem}.manage-list li{margin-bottom:.4rem}.mint-banner{background:var(--success-soft);border:1px solid var(--success);border-radius:10px;padding:1.25rem 1.5rem;margin-bottom:1.5rem}.mint-banner h3{margin:0 0 .5rem;font-size:1rem;color:var(--success)}.mint-banner .token-box{display:flex;align-items:center;gap:.5rem;margin:.85rem 0 .5rem}.mint-banner code{flex:1;font-size:.9rem;padding:.6rem .75rem;background:#fff;border:1px solid var(--border);word-break:break-all;-webkit-user-select:all;user-select:all}.mint-banner .warn{margin:.75rem 0 0;font-size:.85rem;color:var(--warn)}.mint-banner .actions{margin-top:1rem}.mcp-connect-card h3{margin:0 0 .4rem;font-size:1rem;font-weight:500}.mcp-connect-card>p{margin-top:0}.mcp-connect-card .token-box{display:flex;align-items:center;gap:.5rem;margin:.35rem 0 .25rem}.mcp-connect-card .token-box code{flex:1;font-size:.85rem;padding:.55rem .7rem;background:var(--bg-soft);border:1px solid var(--border);border-radius:6px;word-break:break-all;-webkit-user-select:all;user-select:all}.mcp-field{margin-top:.9rem}.mcp-field-label{display:block;font-size:.82rem;font-weight:600;color:var(--fg-muted)}.mcp-field .dim{margin:.3rem 0 0}.mcp-docs-link{margin:.9rem 0 0}.token-list{display:flex;flex-direction:column;gap:.5rem}.token-row{display:flex;align-items:flex-start;gap:1rem;padding:.85rem 1rem;background:#fff;border:1px solid var(--border);border-radius:8px}.token-row .body{flex:1;min-width:0}.token-row .name{display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;margin-bottom:.3rem}.token-row .meta{font-size:.85rem;margin-bottom:.2rem}.token-row .actions{margin-top:0;flex-shrink:0}.scope-tag{font-size:.78rem;padding:.1em .4em;margin-right:.3em}.tag-pill{background:var(--accent-soft, rgba(120, 120, 200, .12))}.tag-picker{display:flex;flex-wrap:wrap;gap:.4rem .8rem;margin-top:.35rem;max-height:9rem;overflow-y:auto;padding:.4rem .5rem;border:1px solid var(--border, #d8d8de);border-radius:4px}.tag-checkbox{display:inline-flex;align-items:center;gap:.3rem;font-size:.85rem;cursor:pointer;-webkit-user-select:none;user-select:none}.tag-checkbox input[type=checkbox]{margin:0}.preset-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(11rem,1fr));gap:.75rem;margin-top:.35rem}.preset-card{background:var(--bg-soft);color:var(--fg);border:1px solid var(--border);border-radius:8px;padding:.85rem 1rem;text-align:left;display:flex;flex-direction:column;gap:.25rem;cursor:pointer;transition:border-color .15s ease,background .15s ease}.preset-card:hover{border-color:var(--accent);background:#fff}.preset-card:disabled{opacity:.5;cursor:not-allowed}.preset-card strong{font-size:.95rem;font-weight:500}.preset-card .dim{font-size:.8rem;line-height:1.35}.radio-row{display:flex;align-items:center;gap:.5rem;margin-bottom:.35rem;font-size:.92rem;cursor:pointer}.radio-row input[type=radio]{margin:0}.info-banner{background:var(--accent-soft);border:1px solid var(--accent);color:var(--accent-hover);padding:.75rem 1rem;border-radius:8px;margin-bottom:1rem;font-size:.9rem}.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;background:#00000059;display:flex;align-items:center;justify-content:center;z-index:100;padding:1rem}.modal{background:var(--bg);border:1px solid var(--border);border-radius:12px;padding:1.5rem;width:min(520px,100%);max-height:90vh;overflow-y:auto;box-shadow:0 10px 40px #0003}.device-code-row{display:flex;align-items:center;gap:.75rem;margin:.75rem 0}.device-code{font-size:1.4rem;letter-spacing:.1em;padding:.6rem 1rem;background:var(--bg-soft);border-radius:8px;border:1px solid var(--border);font-family:ui-monospace,SF Mono,Menlo,monospace;-webkit-user-select:all;user-select:all;flex:1;text-align:center}.repo-list{display:flex;flex-direction:column;gap:.35rem;max-height:260px;overflow-y:auto;border:1px solid var(--border);border-radius:8px;padding:.4rem;background:var(--bg-soft)}.repo-row{background:var(--bg);border:1px solid transparent;border-radius:6px;padding:.55rem .75rem;font-size:.92rem;display:flex;align-items:baseline;justify-content:space-between;gap:1rem;cursor:pointer;text-align:left;color:inherit;transition:border-color .12s ease,background .12s ease}.repo-row:hover{border-color:var(--accent);background:#fff}.repo-row:disabled{opacity:.5;cursor:not-allowed}
+:root{--bg: #faf8f4;--bg-soft: #f3f0ea;--fg: #2c2a26;--fg-muted: #6b6860;--fg-dim: #9a9690;--accent: #4a7c59;--accent-soft: rgba(74, 124, 89, .08);--accent-hover: #3d6849;--border: #e4e0d8;--border-light: #ece9e2;--card-bg: #ffffff;--error: #a3392b;--error-soft: rgba(163, 57, 43, .08);--warn: #b08023;--warn-soft: rgba(176, 128, 35, .08);--success: #3d6849;--success-soft: rgba(61, 104, 73, .08);--font-serif: Georgia, "Times New Roman", serif;--font-sans: -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif;--font-mono: ui-monospace, "SF Mono", Menlo, Monaco, "Cascadia Mono", monospace;font-family:var(--font-sans)}*{box-sizing:border-box}html,body{margin:0;padding:0;background:var(--bg);color:var(--fg)}a{color:var(--accent);text-decoration:none}a:hover{text-decoration:underline}code{font-family:var(--font-mono);font-size:.85em;background:var(--bg-soft);padding:.1em .3em;border-radius:3px}.page{max-width:880px;margin:0 auto;padding:1.5rem 1.5rem 6rem}.nav{display:flex;gap:1rem;align-items:center;padding-bottom:1rem;border-bottom:1px solid var(--border);margin-bottom:2rem}.nav .brand{font-weight:600;font-family:var(--font-serif);font-size:1.15rem;margin-right:auto}.nav .brand .sub{color:var(--fg-dim);font-size:.78rem;font-weight:400;margin-left:.4rem;font-family:var(--font-sans)}.nav a{color:var(--fg-muted);font-size:.95rem}.nav a:hover{text-decoration:none;color:var(--fg)}h2{margin:0 0 1rem;font-size:1.4rem;font-weight:500}.muted{color:var(--fg-muted);font-size:.92rem}.dim{color:var(--fg-dim);font-size:.85rem}.error-banner{background:var(--error-soft);border:1px solid var(--error);color:var(--error);padding:.75rem 1rem;border-radius:8px;margin-bottom:1rem;font-size:.9rem}.warn-banner{background:var(--warn-soft);border:1px solid var(--warn);color:var(--warn);padding:.75rem 1rem;border-radius:8px;margin-bottom:1rem;font-size:.9rem}.empty{padding:3rem 1.5rem;text-align:center;color:var(--fg-muted);background:var(--bg-soft);border-radius:10px}.list-header{display:flex;align-items:baseline;justify-content:space-between;gap:1rem;margin-bottom:1rem}.list-header h2{margin:0}.vault-row{display:flex;align-items:center;gap:1rem;padding:.85rem 1rem;background:#fff;border:1px solid var(--border);border-radius:8px;margin-bottom:.5rem;text-decoration:none;color:inherit;transition:border-color .15s ease}.vault-row:hover{border-color:var(--accent);text-decoration:none}.vault-row .body{flex:1;min-width:0}.vault-row .name{display:flex;align-items:center;gap:.5rem;flex-wrap:wrap}.vault-row .name code{font-size:.95em}.vault-row .chev{color:var(--fg-dim);font-size:1.2rem}.vault-row-group{margin-bottom:.5rem}.vault-row-group .vault-row{margin-bottom:0}.vault-row-actions{display:flex;align-items:center;gap:.5rem;flex-shrink:0}.vault-usage{font-size:.85rem}.field-error{color:#b3402a;font-size:.85rem;margin-top:.35rem}.section{background:#fff;border:1px solid var(--border);border-radius:10px;padding:1.25rem 1.5rem;margin-bottom:1.5rem}.kv{display:grid;grid-template-columns:8.5rem 1fr;gap:.5rem 1rem;font-size:.92rem}.kv>div:nth-child(odd){color:var(--fg-muted)}.kv code{word-break:break-all}.stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(8rem,1fr));gap:1rem;font-size:.92rem}.stat{background:var(--bg-soft);border-radius:8px;padding:.85rem 1rem}.stat .label{color:var(--fg-muted);font-size:.82rem;margin-bottom:.2rem}.stat .value{font-size:1.4rem;font-weight:500;font-family:var(--font-mono)}button{font:inherit;background:var(--accent);color:#fff;border:0;border-radius:6px;padding:.55rem 1.1rem;cursor:pointer;transition:background .15s ease}button:hover{background:var(--accent-hover)}button:disabled{opacity:.5;cursor:not-allowed}button.secondary{background:#fff;color:var(--fg);border:1px solid var(--border)}button.secondary:hover{background:var(--bg-soft)}input,select{font:inherit;background:#fff;color:var(--fg);border:1px solid var(--border);border-radius:6px;padding:.5rem .7rem;width:100%;max-width:28rem}input:focus,select:focus{outline:2px solid var(--accent-soft);border-color:var(--accent)}.form-row{margin-bottom:1rem}.form-row label{display:block;font-size:.88rem;color:var(--fg-muted);margin-bottom:.3rem}.actions{display:flex;gap:.5rem;margin-top:1rem}.manage-list{margin:0;padding-left:1.1rem;font-size:.95rem}.manage-list li{margin-bottom:.4rem}.mint-banner{background:var(--success-soft);border:1px solid var(--success);border-radius:10px;padding:1.25rem 1.5rem;margin-bottom:1.5rem}.mint-banner h3{margin:0 0 .5rem;font-size:1rem;color:var(--success)}.mint-banner .token-box{display:flex;align-items:center;gap:.5rem;margin:.85rem 0 .5rem}.mint-banner code{flex:1;font-size:.9rem;padding:.6rem .75rem;background:#fff;border:1px solid var(--border);word-break:break-all;-webkit-user-select:all;user-select:all}.mint-banner .warn{margin:.75rem 0 0;font-size:.85rem;color:var(--warn)}.mint-banner .actions{margin-top:1rem}.mcp-connect-card h3{margin:0 0 .4rem;font-size:1rem;font-weight:500}.mcp-connect-card>p{margin-top:0}.mcp-connect-card .token-box{display:flex;align-items:center;gap:.5rem;margin:.35rem 0 .25rem}.mcp-connect-card .token-box code{flex:1;font-size:.85rem;padding:.55rem .7rem;background:var(--bg-soft);border:1px solid var(--border);border-radius:6px;word-break:break-all;-webkit-user-select:all;user-select:all}.mcp-field{margin-top:.9rem}.mcp-field-label{display:block;font-size:.82rem;font-weight:600;color:var(--fg-muted)}.mcp-field .dim{margin:.3rem 0 0}.mcp-docs-link{margin:.9rem 0 0}.token-list{display:flex;flex-direction:column;gap:.5rem}.token-row{display:flex;align-items:flex-start;gap:1rem;padding:.85rem 1rem;background:#fff;border:1px solid var(--border);border-radius:8px}.token-row .body{flex:1;min-width:0}.token-row .name{display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;margin-bottom:.3rem}.token-row .meta{font-size:.85rem;margin-bottom:.2rem}.token-row .actions{margin-top:0;flex-shrink:0}.scope-tag{font-size:.78rem;padding:.1em .4em;margin-right:.3em}.tag-pill{background:var(--accent-soft, rgba(120, 120, 200, .12))}.tag-picker{display:flex;flex-wrap:wrap;gap:.4rem .8rem;margin-top:.35rem;max-height:9rem;overflow-y:auto;padding:.4rem .5rem;border:1px solid var(--border, #d8d8de);border-radius:4px}.tag-checkbox{display:inline-flex;align-items:center;gap:.3rem;font-size:.85rem;cursor:pointer;-webkit-user-select:none;user-select:none}.tag-checkbox input[type=checkbox]{margin:0}.preset-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(11rem,1fr));gap:.75rem;margin-top:.35rem}.preset-card{background:var(--bg-soft);color:var(--fg);border:1px solid var(--border);border-radius:8px;padding:.85rem 1rem;text-align:left;display:flex;flex-direction:column;gap:.25rem;cursor:pointer;transition:border-color .15s ease,background .15s ease}.preset-card:hover{border-color:var(--accent);background:#fff}.preset-card:disabled{opacity:.5;cursor:not-allowed}.preset-card strong{font-size:.95rem;font-weight:500}.preset-card .dim{font-size:.8rem;line-height:1.35}.radio-row{display:flex;align-items:center;gap:.5rem;margin-bottom:.35rem;font-size:.92rem;cursor:pointer}.radio-row input[type=radio]{margin:0}.info-banner{background:var(--accent-soft);border:1px solid var(--accent);color:var(--accent-hover);padding:.75rem 1rem;border-radius:8px;margin-bottom:1rem;font-size:.9rem}.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;background:#00000059;display:flex;align-items:center;justify-content:center;z-index:100;padding:1rem}.modal{background:var(--bg);border:1px solid var(--border);border-radius:12px;padding:1.5rem;width:min(520px,100%);max-height:90vh;overflow-y:auto;box-shadow:0 10px 40px #0003}.device-code-row{display:flex;align-items:center;gap:.75rem;margin:.75rem 0}.device-code{font-size:1.4rem;letter-spacing:.1em;padding:.6rem 1rem;background:var(--bg-soft);border-radius:8px;border:1px solid var(--border);font-family:ui-monospace,SF Mono,Menlo,monospace;-webkit-user-select:all;user-select:all;flex:1;text-align:center}.repo-list{display:flex;flex-direction:column;gap:.35rem;max-height:260px;overflow-y:auto;border:1px solid var(--border);border-radius:8px;padding:.4rem;background:var(--bg-soft)}.repo-row{background:var(--bg);border:1px solid transparent;border-radius:6px;padding:.55rem .75rem;font-size:.92rem;display:flex;align-items:baseline;justify-content:space-between;gap:1rem;cursor:pointer;text-align:left;color:inherit;transition:border-color .12s ease,background .12s ease}.repo-row:hover{border-color:var(--accent);background:#fff}.repo-row:disabled{opacity:.5;cursor:not-allowed}.schema-layout{display:grid;grid-template-columns:minmax(180px,240px) 1fr;gap:1.25rem;align-items:start}@media(max-width:720px){.schema-layout{grid-template-columns:1fr}}.schema-taglist{border:1px solid var(--border);border-radius:10px;padding:.5rem;background:var(--bg-soft);max-height:70vh;overflow-y:auto}.tag-list{list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:.25rem}.tag-list-item{width:100%;display:flex;flex-direction:column;gap:.2rem;align-items:flex-start;background:transparent;border:1px solid transparent;border-radius:7px;padding:.4rem .5rem;cursor:pointer;text-align:left;color:inherit;font:inherit}.tag-list-item:hover{background:#fff;border-color:var(--border)}.tag-list-item.selected{background:var(--accent-soft);border-color:var(--accent)}.tag-list-item .tag-name{font-size:.9rem}.tag-meta{display:flex;flex-wrap:wrap;gap:.3rem;align-items:center}.badge{display:inline-block;font-size:.7rem;line-height:1.4;padding:0 .4rem;border-radius:999px;background:var(--accent-soft);color:var(--accent);border:1px solid var(--accent)}.badge-strict{background:var(--error-soft);color:var(--error);border-color:var(--error)}.schema-detail{border:1px solid var(--border);border-radius:10px;padding:1rem 1.25rem;min-width:0}.schema-fields,.schema-parents{border:1px solid var(--border);border-radius:8px;padding:.75rem;margin:1rem 0}.schema-fields legend,.schema-parents legend{font-weight:600;font-size:.9rem;padding:0 .4rem}.field-row{border-bottom:1px solid var(--border-light);padding:.5rem 0}.field-row:last-of-type{border-bottom:none}.field-row-main{display:flex;flex-wrap:wrap;gap:.5rem;align-items:center}.field-name-input{flex:1 1 140px;min-width:120px}.field-row-main select{flex:0 0 auto;width:auto}.field-flag{display:inline-flex;align-items:center;gap:.25rem;font-size:.85rem;white-space:nowrap}.field-flag input{width:auto;margin:0}.field-remove{padding:.2rem .5rem;line-height:1}.field-row-extra{display:flex;flex-wrap:wrap;gap:.5rem;margin-top:.4rem}.field-enum-input,.field-desc-input{flex:1 1 200px;min-width:160px}.field-codeclarers{margin:.35rem 0 0}.field-codeclarers code{margin-left:.25rem}.parent-grid{display:flex;flex-wrap:wrap;gap:.4rem}.parent-chip{display:inline-flex;align-items:center;gap:.3rem;border:1px solid var(--border);border-radius:999px;padding:.15rem .55rem;font-size:.85rem}.parent-chip input{width:auto;margin:0}.schema-table{width:100%;border-collapse:collapse;font-size:.88rem}.schema-table th,.schema-table td{text-align:left;padding:.3rem .5rem;border-bottom:1px solid var(--border-light)}.schema-table th{font-weight:600;color:var(--fg-muted)}.schema-table td code{margin-right:.3rem}.schema-table .tag-self{background:var(--accent-soft);border-radius:4px;padding:0 .2rem}.schema-table .row-this-tag td{background:var(--accent-soft)}