anniedrawing 0.3.1

package/dist/docs/notice.txt

@@ -0,0 +1,292 @@
+AnnieDrawing
+Copyright 2026 Frontierz and AnnieDrawing contributors. MIT licensed.
+Frontierz. Originally developed by Pau Garcia-Mila.
+
+Independent implementation
+The application code, documentation, inline icons and sample diagrams were
+created for AnnieDrawing from its own product requirements. No implementation
+from another drawing editor is incorporated. The GitHub mark in the board menu
+is a trademark of GitHub, Inc., used only as a link to this project's
+repository. Dependency use is listed below; this statement does not claim
+ownership of third-party code or common ideas.
+
+Direct runtime dependencies (MIT)
+- @preact/signals-core — Preact contributors
+- perfect-freehand — Steve Ruiz and contributors
+- rbush — Vladimir Agafonkin
+- valibot — Fabian Hiller and contributors
+- nanoid — Andrey Sitnik
+
+Optional integrations
+- DOMPurify — dual licensed MPL-2.0 OR Apache-2.0; Cure53 and contributors.
+  AnnieDrawing consumers may use the Apache-2.0 option.
+- ws in the separate MCP example — MIT; Einar Otto Stangvik and contributors
+
+Demo typography
+- Nunito variable font, distributed by @fontsource-variable/nunito,
+  uses SIL Open Font License 1.1. The demo self-hosts the installed font.
+  Original font copyright and the complete OFL text are in
+  node_modules/@fontsource-variable/nunito/LICENSE.
+  The library uses a system fallback when consumers do not supply the font.
+
+The agent entry point also bundles @valibot/to-json-schema under MIT.
+Build and test tooling includes TypeScript, Vite, Vitest, Playwright, Terser
+and their transitive dependencies under the licenses in package-lock.json.
+Vite 8 uses Lightning CSS (MPL-2.0) to minify CSS; it is not shipped as a
+runtime dependency. Tooling is not a direct runtime dependency.
+
+The release build preserves third-party license comments. Distributors must
+retain applicable upstream notices for dependencies or font files they ship.
+The lockfiles pin the exact dependency versions used for this checkout;
+npm run check:licenses validates every locked package against a reviewed list.
+Frontierz names and marks are not granted as trademarks by the MIT license.
+GitHub and the GitHub logo are trademarks of GitHub, Inc.
+
+
+--- @preact/signals-core ---
+
+The MIT License (MIT)
+
+Copyright (c) 2022-present Preact Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+
+--- perfect-freehand ---
+
+MIT License
+
+Copyright (c) 2021 Stephen Ruiz Ltd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+
+--- rbush ---
+
+MIT License
+
+Copyright (c) 2024 Volodymyr Agafonkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+
+
+--- quickselect ---
+
+ISC License
+
+Copyright (c) 2024, Vladimir Agafonkin
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.
+
+
+
+--- valibot ---
+
+MIT License
+
+Copyright (c) Fabian Hiller
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+
+--- nanoid ---
+
+The MIT License (MIT)
+
+Copyright 2017 Andrey Sitnik <andrey@sitnik.es>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+
+--- Nunito ---
+
+Copyright 2014 The Nunito Project Authors (https://github.com/googlefonts/nunito) Nunito-Italic[wght].ttf: Copyright 2014 The Nunito Project Authors (https://github.com/googlefonts/nunito)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
+
+
+
+--- @valibot/to-json-schema (bundled in the agent entry point) ---
+
+MIT License
+
+Copyright (c) Fabian Hiller
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+

package/dist/docs/nunito-OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2014 The Nunito Project Authors (https://github.com/googlefonts/nunito) Nunito-Italic[wght].ttf: Copyright 2014 The Nunito Project Authors (https://github.com/googlefonts/nunito)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/dist/docs/releasing.md

@@ -0,0 +1,38 @@
+# Release checklist
+
+Publication is a maintainer action. The repository URL, issue tracker, and private contacts are pau@frontierz.com plus this GitHub project. The npm package is `anniedrawing`.
+
+## Before publishing a version
+
+- Confirm access to the `anniedrawing` npm package. Check the intended release version and update the changelog.
+- Keep SECURITY.md and CODE_OF_CONDUCT.md pointed at pau@frontierz.com, and keep GitHub private vulnerability reporting enabled.
+- Review the license, third-party notices, DCO requirements, and provenance. Keep full dependency and font notices in distributed bundles where required.
+- Keep branch protection, required CI, Dependabot, and secret scanning enabled on the public repository.
+
+## Verify the release tree
+
+```sh
+npm ci
+npm ci --prefix examples/mcp
+npm run check
+npm run build:demo
+npx playwright install --with-deps chromium firefox webkit
+npm run test:e2e
+npm run test:perf
+npm test --prefix examples/mcp
+node examples/mcp/live-smoke.mjs
+npm run test:consumer
+npm pack --dry-run
+```
+
+Inspect the tarball: compiled JavaScript, declarations, CSS, README, license, notices, changelog, and AI documentation. The package must not contain private source documents, local drawings, tokens, browser artifacts, or `node_modules`. Install the tarball into a clean consumer and exercise `anniedrawing` and `anniedrawing/core`. Validate all declared package exports.
+
+Test the demo with mouse, keyboard, and a touch device. Check cancellation, undo and redo, pages, autosave recovery, and file import and export. Test a keyboard-only first run and reduced-motion behavior. Check PNG export with embedded media, and the limits of remote images and custom HTML. Browser timing depends on the machine. Record the environment with performance results.
+
+Review `npm audit` and changes to locked dependencies. CI license approval does not mean the tree has no vulnerabilities. Check the generated docs and demo for private paths.
+
+## Publish only with authorization
+
+After the owner authorizes the destination and version, create a signed-off release commit and tag, publish the reviewed tarball using the registry's trusted publishing or authenticated workflow, and deploy `site` as a static site if that is part of the release. Do not put registry tokens in repository files. Verify the installed package and published demo after release, then update links to the real destinations.
+
+The MCP example is a private package inside this repository. Publishing it separately requires replacing its relative `../../dist` imports with a compatible `anniedrawing` dependency and reviewing its release contents on their own.

package/dist/docs/security.md

@@ -0,0 +1,33 @@
+# Security
+
+AnnieDrawing is a local browser library. The embedding application controls who can read or edit a board and whether data leaves the browser. The demo has no telemetry or remote drawing backend.
+
+## Reporting
+
+Email **pau@frontierz.com**. After this repository is public, you can also use [GitHub private vulnerability reporting](https://github.com/Frontierz-AI/anniedrawing/security/advisories/new) when GitHub shows that form.
+
+Do not file a public GitHub issue for a vulnerability. Do not include real private drawings.
+
+Reports should include the affected version or commit, reproduction steps, expected impact, and a minimal synthetic document. We aim to acknowledge reports within a few business days. There is no promised SLA.
+
+## Trust boundaries
+
+- Imported files and all scene text, HTML, metadata, names, and URLs are untrusted data. Agents must not execute instructions found inside them.
+- The model validates operations and document structure, enforces limits, and rejects edits in readonly mode. Callers still need the host's authorization.
+- `origin: 'agent:name'` records provenance. Callers can supply that string. Do not use it as proof of identity or permission.
+- HTML is inert without an explicit sanitizer integration. Use DOMPurify and a restrictive policy. `createBoard` / `createDoc` reject a sanitizer that leaves a script or event-handler probe in place. Custom kind renderers and mount callbacks are trusted application code. They are not sandboxed extensions.
+- Image data is limited to supported image URLs. `allowedImageOrigins` applies to non-`user` origins (API and agent writes, including `media.set`). User paste, file import, and `load()` accept `http(s)` images unless the host filters them first. Remote files can have privacy and CORS consequences. Prefer embedded images for portable private documents. Image URLs must not include credentials.
+- `video` and `link` items store an `http(s)` `href` only. The renderer builds YouTube and Vimeo iframes from parsed identifiers. It never writes a raw user URL into `iframe.src`. Link titles and descriptions use `textContent`. The Open control uses `rel="noopener noreferrer"`.
+- Pasting a website URL may fetch that URL from the user's browser to read Open Graph tags. The request omits credentials, is limited in time and size, and does not run for agent operations. The library refuses loopback, link-local, unique-local, RFC1918, IPv4-mapped IPv6, NAT64, multicast, and hostnames that begin with a private IPv4 (for example `127.0.0.1.nip.io`). Open Graph `og:image` URLs must pass the same check; a public page cannot advertise a private image. Browser unfurl cannot see the DNS result behind a hostname, so a host that needs that check should pass its own `unfurl`. The local Vite demo proxy resolves A/AAAA records and refuses private answers. Hosts that do not want any fetch can pass `unfurl: false`. Loading a video player contacts YouTube or Vimeo when that item is shown.
+- `window.__anniedrawing` is off unless the host sets `exposeGlobal: true`. The local demo opts in. Any script already running in that page can then read and edit the board. Protect the surrounding page from XSS.
+- Local autosave is unencrypted browser storage. Clearing the profile or applying a storage policy can remove it. Export `.annie` files for portable copies.
+
+## MCP example
+
+The MCP connection to an agent is stdio. Its optional browser bridge binds only to `127.0.0.1`, checks an exact browser `Origin`, requires a token of at least 32 characters, permits one authenticated board, and applies request limits and timeouts. The token travels in an authentication frame, never a URL. Generate a fresh random token per session. Connecting a board grants the local client the ability to read and edit it through the published tools.
+
+Do not expose the bridge port on a public interface, place the token in source control, or attach a board automatically. Disconnect it when finished. A timeout is ambiguous for a mutation: re-read state before retrying. The bridge is a development integration for one local board.
+
+## Maintenance
+
+Run `npm run check:licenses`, review `npm audit` and dependency changes, and preserve lockfiles. The license checker is an allowlist. It does not replace legal review or a vulnerability scanner. Releases require a fresh review of dependency updates, sanitizer behavior, and export behavior. See [the release checklist](releasing.md).

package/dist/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48"><rect width="48" height="48" rx="15" fill="#05D9AB"/><path d="M14 32 24 12l10 20M18 25h12" fill="none" stroke="#103639" stroke-linecap="round" stroke-linejoin="round" stroke-width="4"/><circle cx="35" cy="13" r="3" fill="#103639"/></svg>

package/dist/fellow.d.ts

@@ -0,0 +1,7 @@
+import { type BoardOptions } from './board.js';
+import type { AgentPresenceOptions, ApplyOptions, ApplyResult, ChangeLog } from './core/types.js';
+export type { AgentPresenceOptions, ApplyOptions, ApplyResult, BoardOptions, ChangeLog };
+export interface FellowBoardOptions extends BoardOptions {
+    fellowName?: string;
+}
+export declare function createFellowBoard(host: HTMLElement, options?: FellowBoardOptions): import("./board.js").Board;

package/dist/fellow.js

@@ -0,0 +1,2 @@
+import{n as e}from"./shared/board-Bya0O1I7.js";function a(a,n={}){const{fellowName:t,...o}=n;return e(a,{agentHistory:"hidden",agentReveal:"fit",agentPlaceGap:120,agentPresence:{maxStops:3,durationScale:.55},exposeGlobal:!1,unfurl:!1,ui:{menu:!1,export:!1,pages:!1},...o,agentName:o.agentName??t})}export{a as createFellowBoard};
+//# sourceMappingURL=fellow.js.map

package/dist/fellow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fellow.js","names":[],"sources":["../src/fellow.ts"],"sourcesContent":["import { createBoard, type BoardOptions } from './board';\nimport type { AgentPresenceOptions, ApplyOptions, ApplyResult, ChangeLog } from './core/types';\n\nexport type { AgentPresenceOptions, ApplyOptions, ApplyResult, BoardOptions, ChangeLog };\n\nexport interface FellowBoardOptions extends BoardOptions {\n  fellowName?: string;\n}\n\nexport function createFellowBoard(host: HTMLElement, options: FellowBoardOptions = {}) {\n  const { fellowName, ...rest } = options;\n  return createBoard(host, {\n    agentHistory: 'hidden',\n    agentReveal: 'fit',\n    agentPlaceGap: 120,\n    agentPresence: { maxStops: 3, durationScale: 0.55 },\n    exposeGlobal: false,\n    unfurl: false,\n    ui: { menu: false, export: false, pages: false },\n    ...rest,\n    agentName: rest.agentName ?? fellowName,\n  });\n}\n"],"mappings":"+CASA,SAAgB,EAAkB,EAAmB,EAA8B,CAAC,GAClF,MAAM,WAAE,KAAe,GAAS,EAChC,OAAO,EAAY,EAAM,CACvB,aAAc,SACd,YAAa,MACb,cAAe,IACf,cAAe,CAAE,SAAU,EAAG,cAAe,KAC7C,cAAc,EACd,QAAQ,EACR,GAAI,CAAE,MAAM,EAAO,QAAQ,EAAO,OAAO,MACtC,EACH,UAAW,EAAK,WAAa,GAEjC"}

package/dist/geo/box.d.ts

@@ -0,0 +1,13 @@
+import type { Box, Item, Point } from '../core/types.js';
+import { type OutlineResolver } from './router.js';
+export type ItemLookup = ((id: string) => Item | undefined) | Map<string, Item> | Record<string, Item> | Item[];
+export declare function lookupItem(lookup: ItemLookup | undefined, id: string): Item | undefined;
+export declare function flattenItems(items: Item[]): Item[];
+export declare const centerOf: (b: Box) => Point;
+export declare function boxCorners(box: Box, rotation?: number, origin?: Point): Point[];
+export declare function boxFromPoints(points: Point[]): Box;
+export declare function itemBounds(item: Item, lookup?: ItemLookup, outline?: OutlineResolver): Box;
+export declare function boundsOf(items: Item[], lookup?: ItemLookup, outline?: OutlineResolver): Box;
+export declare const intersects: (a: Box, b: Box) => boolean;
+export declare const contains: (a: Box, b: Box) => boolean;
+export declare const containsPoint: (b: Box, p: Point) => boolean;

package/dist/geo/index.d.ts

@@ -0,0 +1,5 @@
+/** Page-space geometry used by the document model and the renderer. */
+export * from './vec.js';
+export * from './box.js';
+export * from './router.js';
+export * from './picker.js';

package/dist/geo/picker.d.ts

@@ -0,0 +1,25 @@
+import type { Box, Item, Outline, Point } from '../core/types.js';
+import { type ItemLookup } from './box.js';
+import { type OutlineResolver } from './router.js';
+export interface PickOptions {
+    tolerance?: number;
+    enteredGroup?: string;
+    includeLocked?: boolean;
+    outline?: OutlineResolver;
+    ignore?: (item: Item) => boolean;
+}
+export declare function hitTest(item: Item, point: Point, tolerance?: number, lookup?: ItemLookup, outline?: Outline | Outline[] | OutlineResolver): boolean;
+export declare class SpatialIndex {
+    private outline?;
+    private tree;
+    private lookup;
+    private entries;
+    constructor(items?: Item[], outline?: OutlineResolver | undefined);
+    set(items: Item[], outline?: OutlineResolver | undefined): void;
+    search(box: Box): Item[];
+    enclosed(box: Box, options?: {
+        enteredGroup?: string;
+        ignore?: (item: Item) => boolean;
+    }): Item[];
+    pick(point: Point, options?: PickOptions): Item | undefined;
+}

package/dist/geo/router.d.ts

@@ -0,0 +1,11 @@
+import type { Box, Endpoint, Item, Outline, Point } from '../core/types.js';
+import { type ItemLookup } from './box.js';
+export type OutlineResolver = (item: Item) => Outline | Outline[] | undefined;
+export declare function resolveEndpoint(endpoint: Endpoint | undefined, other: Endpoint | Point | undefined, lookup?: ItemLookup, outline?: OutlineResolver): Point;
+export interface ConnectorGeometry {
+    points: Point[];
+    d: string;
+    midpoint: Point;
+    bounds: Box;
+}
+export declare function routeConnector(item: Item, lookup?: ItemLookup, outline?: OutlineResolver): ConnectorGeometry;

package/dist/geo/vec.d.ts

@@ -0,0 +1,8 @@
+import type { Point } from '../core/types.js';
+export declare const distance: (a: Point, b: Point) => number;
+export declare function rotatePoint(p: Point, center: Point, degrees: number): Point;
+export declare function segmentDistance(p: Point, a: Point, b: Point): number;
+export declare function pointInPolygon(p: Point, polygon: Point[]): boolean;
+export declare function simplifyPoints<T extends [number, number, number?]>(points: T[], epsilon?: number): T[];
+/** Recursive simplification that also keeps pressure inflections. Used for freehand strokes. */
+export declare function simplifyStroke<T extends [number, number, number?]>(points: T[], epsilon: number): T[];

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { Board, createBoard } from './board.js';
+export type { BoardOptions, UiOptions, UiExportFormat } from './board.js';
+export type * from './core/types.js';
+export { CATALOG_VERSION, KIND_CATALOG, kindsSince } from './core/catalog.js';
+export type { KindCatalogEntry, KindCatalogSnapshot } from './core/catalog.js';
+export { defineKind, registerKind } from './kinds/index.js';
+export type { KindDef, KindView, Outline, SVGContext } from './kinds/index.js';

package/dist/index.js

@@ -0,0 +1 @@
+import{b as s,v as a,y as r}from"./shared/defaults-C-aC_B4z.js";import{i as o,n as t,r as d,t as e}from"./shared/board-Bya0O1I7.js";export{e as Board,a as CATALOG_VERSION,r as KIND_CATALOG,t as createBoard,d as defineKind,s as kindsSince,o as registerKind};

package/dist/input/autosave.d.ts

@@ -0,0 +1,2 @@
+import type { Board } from '../board.js';
+export declare function openAutosave(board: Board, key: string): Promise<void>;

package/dist/input/cursors.d.ts

@@ -0,0 +1,8 @@
+export declare const cursorArrow = "M8.5 6.5c-1.3-.5-2.5.7-2 2l6.1 19.4c.5 1.6 2.7 1.7 3.3.1l3.1-8a1.5 1.5 0 0 1 .9-.9l8-3.1c1.6-.6 1.5-2.8-.1-3.3Z";
+export declare const selectionCursor: string;
+export declare const drawingCursor: string;
+export declare function cursorForTool(tool: string, state?: {
+    space?: boolean;
+    readonly?: boolean;
+    panning?: boolean;
+}): string;

package/dist/input/measure.d.ts

@@ -0,0 +1,6 @@
+import type { ItemText } from '../core/types.js';
+/** Measure only when text is committed; pointer movement never reads layout. */
+export declare function measureText(owner: Document, text: ItemText): {
+    w: number;
+    h: number;
+};

package/dist/input/urlPaste.d.ts

@@ -0,0 +1,18 @@
+import { type LinkPreview } from '../core/links.js';
+import type { ApplyOptions, ApplyResult, Item, Op, Point } from '../core/types.js';
+export interface PasteHost {
+    pageId: string;
+    items: Item[];
+    destroyed: boolean;
+    unfurl?: false | ((url: string) => Promise<LinkPreview | undefined>);
+    view: {
+        center: Point;
+    };
+    host: HTMLElement;
+    apply(ops: Op[], options?: ApplyOptions): ApplyResult;
+    select(ids: string[]): void;
+    get(id: string): Item | undefined;
+}
+/** Replace the href on an existing video or link item. */
+export declare function updateHref(host: PasteHost, id: string, value: string): ApplyResult;
+export declare function pastePlain(host: PasteHost, value: string, point?: Point): void;

package/dist/kinds/index.d.ts

@@ -0,0 +1,2 @@
+export { defineKind, registerKind, getKind, getKinds, createKindRegistry } from './registry.js';
+export type { KindDef, KindView, Outline, SVGContext } from './registry.js';