MetaList 0.4.1__tar.gz → 0.6.0__tar.gz

{metalist-0.4.1 → metalist-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.4.1
+Version: 0.6.0
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -16,7 +16,6 @@ Requires-Dist: instructor==1.15.4
 Requires-Dist: latex2mathml==3.81.0
 Requires-Dist: loguru==0.7.3
 Requires-Dist: Mako==1.3.12
-Requires-Dist: mutagen==1.48.1
 Requires-Dist: nh3==0.3.6
 Requires-Dist: openai==2.54.0
 Requires-Dist: pillow==12.3.0
@@ -49,6 +48,20 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.6.0
+
+- Open notes and their children in multiple live, read-only floating windows. Drag and resize them, keep them visible across searches and tabs, and follow links or copy passwords. Saved changes refresh every half second.
+- Double-click selects complete tags, including punctuation and prefixes, in search and tag bars.
+- Choose sorting modes from the background right-click menu. Creation sorting uses the root note's creation time; last-updated sorting includes descendants and ignores reference display-form changes.
+- Context menus have icons throughout. Full-screen notes have compact spacing, and both read-only views keep steady borders on hover.
+- Fixed Version Info loading and state-transition errors during editing, focus changes, tab switching, and duplication.
+
+## Changes in 0.5.0
+
+- Sound support is removed entirely; reminders retain their visual behavior. The live database migrates to schema 9, with encrypted namespaces migrating after unlock. Existing backups remain unchanged. See [sound removal](docs/ui/sounds.md).
+- Remove Formatting supports arbitrary spans within pasted headings. Whole-note Cmd+U removes leading/trailing blank lines and retains at most one empty line between sections.
+- This release includes the security, recovery, resource-limit, state-ownership, and performance work documented in the [implementation and coverage map](docs/testing/coverage-map.md).
+
 ## Technology Stack
 
 ### Backend
@@ -68,7 +81,7 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 ## Architecture (High Level)
 - Server renders the base page via Mako templates.
 - The browser client drives interaction via `/api2` JSON endpoints.
-- Notes are loaded/decrypted into an in-memory store at startup; a post-startup DB read guard prevents accidental runtime SELECTs.
+- Passwordless notes load into memory at startup; encrypted notes load after login. Rendering/search and ordinary authentication use memory; a read guard restricts intentional SQLite access to explicit windows.
 
 ## Security Boundary
 
@@ -102,23 +115,28 @@ After the first installation, update and restart MetaList with one cross-platfor
 ```bash
 metalist update
 ```
-The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks the installer prerequisites, stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments/sounds database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
+The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks the installer prerequisites, stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
-Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.4.1.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
+Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
 
 For pip, users can run `pip install metalist`. For a non-editable local install from this checkout, use `uv pip install .` or `pip install .` instead of the editable command below.
 
 ```bash
 python3 -m venv .venv
 source .venv/bin/activate
-uv pip install -e .[dev]
+python -m pip install --require-hashes -r requirements/ci.txt
+python -m pip install --no-deps --no-build-isolation -e ".[dev]"
 
 npm install
 ```
 
+On Windows, create the same `.venv` with `python -m venv .venv` and activate it with `.venv\Scripts\Activate.ps1` in PowerShell. Run the same `python -m pip` commands after activation. Node dependencies are developer tooling; the application itself does not require Node.
+
 ### Run
+
+Persistent data defaults to `~/MetaList`. Set `METALIST_DATA_DIRECTORY` to an absolute directory path before launch to use a separate data root, including namespaces, backups, certificates, logs, and runtime jobs. This is used by release tests to keep their disposable data separate from real notes.
 The installed entrypoint starts or restarts every known namespace, prints their URLs, and exits:
 ```bash
 metalist
@@ -245,9 +263,9 @@ scheme/client metadata is accepted only from `METALIST_FORWARDED_ALLOW_IPS`.
 Do not widen that list beyond the actual proxy addresses.
 
 ### Legacy Import
-`convert-from-legacy.py` replaces the SQLite database referenced by `app.config.DATABASE_URL`, clears its files/sounds sidecar, and imports notes from a legacy JSON export.
+`convert-from-legacy.py` replaces the SQLite database referenced by `app.config.DATABASE_URL`, clears its files sidecar, and imports notes from a legacy JSON export.
 
-This is destructive. It deletes the existing notes DB and related files/sounds DB before rebuilding the namespace.
+This is destructive. It deletes the existing notes DB and related files DB before rebuilding the namespace.
 
 Example usage:
 ```bash
@@ -310,3 +328,8 @@ Render Mermaid diagrams to PNGs:
 ```bash
 npm run render-diagrams
 ```
+
+
+## Maintenance and recovery
+
+See the [dependency and release procedure](docs/security/supply-chain.md), [recovery runbook](docs/security/recovery.md), and [current test/implementation map](docs/testing/coverage-map.md). The dated [August code review](CODE_REVIEW.md) is historical.

{metalist-0.4.1 → metalist-0.6.0}/README.md

@@ -12,6 +12,20 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.6.0
+
+- Open notes and their children in multiple live, read-only floating windows. Drag and resize them, keep them visible across searches and tabs, and follow links or copy passwords. Saved changes refresh every half second.
+- Double-click selects complete tags, including punctuation and prefixes, in search and tag bars.
+- Choose sorting modes from the background right-click menu. Creation sorting uses the root note's creation time; last-updated sorting includes descendants and ignores reference display-form changes.
+- Context menus have icons throughout. Full-screen notes have compact spacing, and both read-only views keep steady borders on hover.
+- Fixed Version Info loading and state-transition errors during editing, focus changes, tab switching, and duplication.
+
+## Changes in 0.5.0
+
+- Sound support is removed entirely; reminders retain their visual behavior. The live database migrates to schema 9, with encrypted namespaces migrating after unlock. Existing backups remain unchanged. See [sound removal](docs/ui/sounds.md).
+- Remove Formatting supports arbitrary spans within pasted headings. Whole-note Cmd+U removes leading/trailing blank lines and retains at most one empty line between sections.
+- This release includes the security, recovery, resource-limit, state-ownership, and performance work documented in the [implementation and coverage map](docs/testing/coverage-map.md).
+
 ## Technology Stack
 
 ### Backend
@@ -31,7 +45,7 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 ## Architecture (High Level)
 - Server renders the base page via Mako templates.
 - The browser client drives interaction via `/api2` JSON endpoints.
-- Notes are loaded/decrypted into an in-memory store at startup; a post-startup DB read guard prevents accidental runtime SELECTs.
+- Passwordless notes load into memory at startup; encrypted notes load after login. Rendering/search and ordinary authentication use memory; a read guard restricts intentional SQLite access to explicit windows.
 
 ## Security Boundary
 
@@ -65,23 +79,28 @@ After the first installation, update and restart MetaList with one cross-platfor
 ```bash
 metalist update
 ```
-The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks the installer prerequisites, stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments/sounds database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
+The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks the installer prerequisites, stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
-Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.4.1.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
+Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
 
 For pip, users can run `pip install metalist`. For a non-editable local install from this checkout, use `uv pip install .` or `pip install .` instead of the editable command below.
 
 ```bash
 python3 -m venv .venv
 source .venv/bin/activate
-uv pip install -e .[dev]
+python -m pip install --require-hashes -r requirements/ci.txt
+python -m pip install --no-deps --no-build-isolation -e ".[dev]"
 
 npm install
 ```
 
+On Windows, create the same `.venv` with `python -m venv .venv` and activate it with `.venv\Scripts\Activate.ps1` in PowerShell. Run the same `python -m pip` commands after activation. Node dependencies are developer tooling; the application itself does not require Node.
+
 ### Run
+
+Persistent data defaults to `~/MetaList`. Set `METALIST_DATA_DIRECTORY` to an absolute directory path before launch to use a separate data root, including namespaces, backups, certificates, logs, and runtime jobs. This is used by release tests to keep their disposable data separate from real notes.
 The installed entrypoint starts or restarts every known namespace, prints their URLs, and exits:
 ```bash
 metalist
@@ -208,9 +227,9 @@ scheme/client metadata is accepted only from `METALIST_FORWARDED_ALLOW_IPS`.
 Do not widen that list beyond the actual proxy addresses.
 
 ### Legacy Import
-`convert-from-legacy.py` replaces the SQLite database referenced by `app.config.DATABASE_URL`, clears its files/sounds sidecar, and imports notes from a legacy JSON export.
+`convert-from-legacy.py` replaces the SQLite database referenced by `app.config.DATABASE_URL`, clears its files sidecar, and imports notes from a legacy JSON export.
 
-This is destructive. It deletes the existing notes DB and related files/sounds DB before rebuilding the namespace.
+This is destructive. It deletes the existing notes DB and related files DB before rebuilding the namespace.
 
 Example usage:
 ```bash
@@ -273,3 +292,8 @@ Render Mermaid diagrams to PNGs:
 ```bash
 npm run render-diagrams
 ```
+
+
+## Maintenance and recovery
+
+See the [dependency and release procedure](docs/security/supply-chain.md), [recovery runbook](docs/security/recovery.md), and [current test/implementation map](docs/testing/coverage-map.md). The dated [August code review](CODE_REVIEW.md) is historical.

{metalist-0.4.1 → metalist-0.6.0}/app/api/middleware/auth.py

@@ -5,9 +5,8 @@ from fastapi.responses import JSONResponse, RedirectResponse
 from starlette.middleware.base import BaseHTTPMiddleware
 from app.api.request_auth import read_request_auth_token
 from app.services.tokens import token_service
-from app.services.auth_service import AuthService
 from app.services.maintenance_mode import maintenance_service
-from app.models.database import SafeSession
+from app.security.encryption import is_encryption_required
 from app.config import API_PREFIX, TEST_MODE
 
 
@@ -63,10 +62,7 @@ class AuthMiddleware(BaseHTTPMiddleware):
 
         # Block any v1 API usage with an explicit 410 Gone (no DB access)
         if path.startswith('/api') and not (path.startswith(API_PREFIX) or path == API_PREFIX):
-            ref = request.headers.get('referer', '-')
-            ua = request.headers.get('user-agent', '-')
-            print(f"V1 API call blocked: path={path} referer={ref} ua={ua}")
-            raise RuntimeError(f"V1 API disabled: {path}")
+            return JSONResponse(status_code=410, content={"detail": "Use the current API version"})
         
         # Check if maintenance mode is active first
         if maintenance_service.is_active():
@@ -91,19 +87,9 @@ class AuthMiddleware(BaseHTTPMiddleware):
         if not is_quiet:
             print(f"Path {path} is NOT public, checking auth")
         
-        # Check if password is required (v1 disabled; only v2 status is public)
-        db = SafeSession()
-        try:
-            auth = AuthService(db)
-            has_password = auth.has_password()
-
-            # Special case: password creation endpoint is only public if no password exists
-            if path in {"/api/auth/settings/password/create", f"{API_PREFIX}/auth/settings/password/create"} and not has_password:
-                if not is_quiet:
-                    print(f"Password creation allowed - no password set")
-                return await call_next(request)
-        finally:
-            db.close()  # Always close the database connection
+        # Startup and recoverable password transitions publish this memory-owned flag.
+        if path == f"{API_PREFIX}/auth/settings/password/create" and not is_encryption_required():
+            return await call_next(request)
 
         token, error_detail = read_request_auth_token(request)
         if error_detail is not None:

metalist-0.6.0/app/api/note_requests.py

@@ -0,0 +1,335 @@
+"""Required HTTP request contracts; null remains explicit where the protocol allows it."""
+
+from typing import Annotated, Literal
+from app.services.resource_limits import SHELL_SECONDS
+from typing_extensions import TypedDict
+from pydantic import AfterValidator, ConfigDict, Field, with_config
+
+Identifier = Annotated[str, Field(min_length=1, max_length=256)]
+Text = Annotated[str, Field(max_length=1024 * 1024)]
+Content = Annotated[str, Field(max_length=16 * 1024 * 1024)]
+Nonnegative = Annotated[int, Field(ge=0)]
+
+
+def _unique_windows(value):
+    if len(value) != len(set(value)):
+        raise ValueError('Search windows must be unique')
+    return value
+
+
+WindowDays = Annotated[list[Annotated[int, Field(ge=1, le=365)]], Field(max_length=20), AfterValidator(_unique_windows)]
+
+@with_config(ConfigDict(strict=True))
+class SortKey(TypedDict):
+    domIndex: Nonnegative
+
+@with_config(ConfigDict(strict=True))
+class ScrollAnchor(TypedDict):
+    anchorId: Identifier
+    anchorBias: Literal['center', 'top']
+    intraOffset: Nonnegative
+    beltPrev: list[Identifier]
+    beltNext: list[Identifier]
+    anchorSortKey: SortKey
+
+@with_config(ConfigDict(strict=True))
+class Viewport(TypedDict):
+    scrollY: Nonnegative
+    scrollAnchor: ScrollAnchor | None
+
+@with_config(ConfigDict(strict=True))
+class Tab(TypedDict):
+    searchQuery: Text
+    scrollY: Nonnegative
+    anchorRootId: Text | None
+    scrollAnchor: ScrollAnchor | None
+    sortMode: Literal['normal', 'created', 'updated', 'alphabetical', 'content-volume']
+
+@with_config(ConfigDict(strict=True))
+class ViewDiffRequest(TypedDict):
+    clientId: Identifier
+    editingNoteId: Text | None
+    search: Text | None
+    tabId: Identifier
+    undoContext: Identifier
+    clientNoteUuidHashes: dict[Identifier, Text]
+    visibleRootAnchorId: Text | None
+    isUntaggedView: bool
+
+@with_config(ConfigDict(strict=True))
+class UpdateTabStateRequest(TypedDict):
+    activeTabId: Identifier
+    tabs: dict[Identifier, Tab]
+    tabOrder: list[Identifier]
+
+@with_config(ConfigDict(strict=True))
+class UpdateTabSortModeRequest(TypedDict):
+    tabId: Identifier
+    sortMode: Literal['normal', 'created', 'updated', 'alphabetical', 'content-volume']
+    clientId: Identifier
+    undoContext: Identifier
+
+@with_config(ConfigDict(strict=True))
+class CreateNewTabRequest(TypedDict):
+    copyFromTabId: Identifier
+
+@with_config(ConfigDict(strict=True))
+class DeleteTabRequest(TypedDict):
+    tabId: Identifier
+
+@with_config(ConfigDict(strict=True))
+class SearchSuggestionsRequest(TypedDict):
+    query: Text
+    windowDays: WindowDays
+
+@with_config(ConfigDict(strict=True))
+class PrioritizeTagSuggestionsRequest(TypedDict):
+    query: Text
+    search_query: Text | None
+
+@with_config(ConfigDict(strict=True))
+class TagInteractionsRequest(TypedDict):
+    noteId: Identifier
+    interactionType: Literal['edit', 'expand', 'command', 'fullscreen', 'move', 'indent', 'outdent']
+
+@with_config(ConfigDict(strict=True))
+class SearchSuggestionInteractionRequest(TypedDict):
+    tag: Identifier
+
+@with_config(ConfigDict(strict=True))
+class TabSearchInteractionRequest(TypedDict):
+    searchQuery: Text
+
+@with_config(ConfigDict(strict=True))
+class TagSuggestionsRequest(TypedDict):
+    note_id: Identifier
+    anchors: list[Identifier]
+    explicit_tags: list[Identifier]
+    prefix: Text
+    content_html: Content
+
+@with_config(ConfigDict(strict=True))
+class CreateNoteTopRequest(TypedDict):
+    first_visible_note_id: Text | None
+    search_query: Text | None
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class CreateSiblingRequest(TypedDict):
+    search_query: Text | None
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class CreateChildRequest(TypedDict):
+    search_query: Text | None
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class UpdateNoteRequest(TypedDict):
+    clientId: Identifier
+    content: Content
+    tags: Text
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class SaveNoteRequest(TypedDict):
+    clientId: Identifier
+    content: Content
+    tags: Text
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class AddSelectedTextTagRequest(TypedDict):
+    selectedText: Identifier
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class MakePseudoTagProposalsRequest(TypedDict):
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class AcceptTagProposalRequest(TypedDict):
+    proposal: Identifier
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class RejectTagProposalRequest(TypedDict):
+    proposal: Identifier
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class SplitNoteRequest(TypedDict):
+    clientId: Identifier
+    segments: Annotated[list[Content], Field(min_length=1)]
+    tags: Text
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class ToggleTodoDoneRequest(TypedDict):
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class UnformatNoteContentRequest(TypedDict):
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class ResizeNoteImageRequest(TypedDict):
+    clientId: Identifier
+    sourceKind: Literal['inline', 'file']
+    occurrenceIndex: Nonnegative
+    action: Literal['bigger', 'smaller', 'reset']
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class RunShellEndpointRequest(TypedDict):
+    timeoutSeconds: Annotated[int, Field(ge=0, le=SHELL_SECONDS)]
+
+@with_config(ConfigDict(strict=True))
+class ToggleReferenceModeEndpointRequest(TypedDict):
+    reference_note_id: Identifier
+    occurrence_index: Nonnegative
+    mode: Literal['embed', 'link']
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class MoveNoteEndpointRequest(TypedDict):
+    tab_id: Identifier
+    new_parent_id: Text | None
+    sibling_id: Identifier
+    position: Literal['BEFORE', 'AFTER']
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class MoveNoteToTopEndpointRequest(TypedDict):
+    search_query: Text | None
+    tab_id: Identifier
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class IndentNoteEndpointRequest(TypedDict):
+    visible_prev_id: Text | None
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class OutdentNoteEndpointRequest(TypedDict):
+    search_query: Text | None
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class CollapseEndpointRequest(TypedDict):
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class ExpandEndpointRequest(TypedDict):
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class SetCollapsedBulkEndpointRequest(TypedDict):
+    note_ids: Annotated[list[Identifier], Field(min_length=1)]
+    collapsed: bool
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class SetCollapsedInContextEndpointRequest(TypedDict):
+    search_query: Text | None
+    collapsed: bool
+    recursive: bool
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class SetCollapsedSubtreeEndpointRequest(TypedDict):
+    collapsed: bool
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class PrioritizeInViewEndpointRequest(TypedDict):
+    tag: Identifier
+    direction: Literal['front', 'back']
+    search_query: Text | None
+    tab_id: Identifier
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class AlphabetizeRootNotesEndpointRequest(TypedDict):
+    direction: Literal['asc', 'desc']
+    search_query: Text | None
+    tab_id: Identifier
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class ResetUpdatedAtToCreatedAtEndpointRequest(TypedDict):
+    search_query: Text | None
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class DeleteNoteRequest(TypedDict):
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class CopyNoteEndpointRequest(TypedDict):
+    clientId: Identifier
+
+@with_config(ConfigDict(strict=True))
+class PasteSiblingEndpointRequest(TypedDict):
+    search_query: Text | None
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+
+@with_config(ConfigDict(strict=True))
+class PasteChildEndpointRequest(TypedDict):
+    search_query: Text | None
+    clientId: Identifier
+    undoContext: Identifier
+    viewport: Viewport
+