Подключите AppNotes и настройте доступ команды

import { initAppNotes } from "@appnotes/sdk";

const appNotes = initAppNotes({
  projectKey: "appnotes_pk_...",
  roomId: currentAccount.id,
  roomName: currentAccount.name,
  url: window.location.href,
  toggleDomElement: "#appnotes-toggle",
  rootDomElement: document.body,
  theme: "system",
});

// Если пользователь переключил аккаунт внутри SPA:
appNotes.setRoom(nextAccount.id, nextAccount.name);

"use client";

import { AppNotes } from "@appnotes/react";

export function InternalTools({ account, employee }) {
  if (!employee.canUseAppNotes) return null;

  return (
    <AppNotes
      projectKey="appnotes_pk_..."
      roomId={account.id}
      roomName={account.name}
      theme="system"
      drawerWidth={420}
    />
  );
}

function showAccount(account: { id: string; name: string }, pageUrl: string) {
  appNotes.setRoom(account.id, account.name);
  appNotes.setPage(pageUrl);
  appNotes.open();
}

// Например, после выбора другого клиента:
showAccount(
  { id: "account-43", name: "Codeception" },
  "https://app.example.com/orders",
);

"use client";

import { AppNotes, type AppNotesInstance } from "@appnotes/react";
import { useRef } from "react";

export function NotesPanel({ account }: { account: { id: string; name: string } }) {
  const appNotesRef = useRef<AppNotesInstance>(null);

  return (
    <>
      <button onClick={() => appNotesRef.current?.open()}>
        Открыть заметки
      </button>
      <AppNotes
        ref={appNotesRef}
        projectKey="appnotes_pk_..."
        roomId={account.id}
        roomName={account.name}
      />
    </>
  );
}

# Прикрепить файл к заметке
curl --request POST \
  https://api.appnotes.tech/api/v1/notes/NOTE_ID/attachments \
  --header "Authorization: Bearer $APPNOTES_API_KEY" \
  --form "file=@./contract.pdf"

# Прикрепить файл к комментарию
curl --request POST \
  https://api.appnotes.tech/api/v1/notes/NOTE_ID/comments/COMMENT_ID/attachments \
  --header "Authorization: Bearer $APPNOTES_API_KEY" \
  --form "file=@./approval.png"

# Скачать приватное вложение
curl --fail \
  https://api.appnotes.tech/api/v1/attachments/ATTACHMENT_ID/content \
  --header "Authorization: Bearer $APPNOTES_API_KEY" \
  --output contract.pdf

# Удалить вложение
curl --request DELETE \
  https://api.appnotes.tech/api/v1/attachments/ATTACHMENT_ID \
  --header "Authorization: Bearer $APPNOTES_API_KEY"

{
  "id": "evt_019fd1...",
  "apiVersion": "2026-08-01",
  "type": "comment.updated",
  "createdAt": "2026-08-05T12:10:30.000Z",
  "projectId": "project_42",
  "actor": {
    "id": "user_17",
    "email": "agent@example.com",
    "name": "Анна"
  },
  "data": {
    "note": {
      "id": "note_91",
      "roomId": "customer_128",
      "title": "Нужно сверить договор",
      "attachments": [{
        "id": "attachment_18",
        "threadId": "note_91",
        "commentId": null,
        "fileName": "contract.pdf",
        "mediaType": "application/pdf",
        "sizeBytes": 483102,
        "kind": "file",
        "uploadedBy": {
          "id": "user_17",
          "email": "agent@example.com",
          "name": "Анна"
        },
        "createdAt": "2026-08-05T12:08:00.000Z"
      }]
    },
    "comment": {
      "id": "comment_33",
      "body": "Согласовано",
      "attachments": [{
        "id": "attachment_19",
        "threadId": "note_91",
        "commentId": "comment_33",
        "fileName": "approval.png",
        "mediaType": "image/png",
        "sizeBytes": 204800,
        "kind": "image",
        "uploadedBy": {
          "id": "user_17",
          "email": "agent@example.com",
          "name": "Анна"
        },
        "createdAt": "2026-08-05T12:10:30.000Z"
      }]
    }
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

function verifyAppNotesWebhook(rawBody: string, headers: Headers, secret: string) {
  const timestamp = headers.get("x-appnotes-timestamp") ?? "";
  const received = headers.get("x-appnotes-signature") ?? "";
  const timestampMs = Number(timestamp) * 1_000;
  if (!Number.isFinite(timestampMs) || Math.abs(Date.now() - timestampMs) > 5 * 60_000) {
    return false;
  }
  const expected = "v1=" + createHmac("sha256", secret)
    .update(timestamp + "." + rawBody)
    .digest("hex");

  const receivedBytes = Buffer.from(received);
  const expectedBytes = Buffer.from(expected);
  return receivedBytes.length === expectedBytes.length &&
    timingSafeEqual(receivedBytes, expectedBytes);
}