agentic-canvas 0.12.1 → 0.13.0

package/README.md

@@ -7,7 +7,7 @@
 
 A shared whiteboard for diagrams, drawn by people and agents.
 
-> Status: 0.12.1. The board model, the agent operations, the exports, the CLI, the
+> Status: 0.13.0. The board model, the agent operations, the exports, the CLI, the
 > MCP server, a small Worker API, and live co-editing work. The CLI, the MCP server,
 > and the SDK can join a live room. A remote client calls the Worker API. A small web UI, served by the Worker, is new in 0.4.0.
 > The package exports `agentic-canvas/ui`, a board view you can mount in your own app, new in 0.5.0.
@@ -230,6 +230,36 @@ A live MCP server with an admin token can share boards: an agent that holds it c
 
 The static dev fallback holds no board roles. Its tokens reach every board and cannot share.
 
+## Account export and erase
+
+A host that runs a person's data export and erase imports `canvasAccount` from `agentic-canvas/account`. It never reads the storage layout.
+
+```ts
+import { canvasAccount } from "agentic-canvas/account";
+const data = await canvasAccount.exportAccount({ kind: "human", id: "ada" }, { store, saveRoom, eraseRoom });
+const counts = await canvasAccount.eraseAccount({ kind: "human", id: "ada" }, { store, saveRoom, eraseRoom });
+```
+
+The export is plain JSON in the collections `boards`, `grants`, `invites`, `authored_elements`, `edited_elements`, `titles`, and `audit`. It has no format or time. The erase returns a count for each name.
+
+- A board that the subject alone owns is deleted with its grants, invites, links, and audit entries. The erase calls `eraseRoom(boardId)` first, as the Worker does.
+- On any other board, the subject's grant and invites go. The elements it made are deleted. A connector of someone else that was bound to one of them goes too, and no count or export lists it. The members of a deleted group move to its parent. The editor of an element it only edited becomes `(erased)`, and a title it set is cleared.
+- Its audit entries (it acted, it roots the chain, or a grant named it) stay with the id set to `(erased)`. The kinds stay, so an entry still says if a machine acted.
+- A second erase counts zero. Stop writes first: a write between export and erase is erased and not exported.
+- The erase reads every stored board to find the subject's elements, before it changes data. It stops with `INVALID` on a board that does not decode, on a damaged grant of the subject, on a damaged invite of the subject, on a board with child resources, on an owner grant that the sharing records do not accept, on a damaged co-owner grant, and on an audit entry that names the subject, as the actor, the root of the chain, or the target, with an unknown kind. The checks may add audit entries about the subject: the erase scrubs them.
+- Live rooms: give `saveRoom(boardId)`, which saves the room to the Store as the Worker does before a read. Without it, edits that no request has saved yet are not seen, and the reset below drops them. Give `eraseRoom(boardId)` too: the erase calls it for every board that it changes or deletes, so the room opens again from the Store.
+- `boards` holds each stored entry as it is, with full images and groups. It includes the elements that others made on the board.
+- Run the canvas erase before the identity erase of the person: the identity erase removes the grants that this erase finds boards by.
+- The subject is any principal kind, for example `agent_of_human`: call once for each principal. The id follows the strict identity rule: an old board that has an id from the older, looser rule cannot be named.
+- Known gaps:
+  - Invites and audit entries name a principal by id with no kind, so `human:ada` and `agent:ada` share them. Do not give two principals one id.
+  - An audit entry where the subject is only a middle step of the chain is not found.
+  - An invite that someone else made for the subject's email or handle stays. The package cannot map a principal to an address.
+  - Image bytes in the image store have no uploader record, so they are not exported or erased. Only the `blob:` key in an element is.
+  - A deleted element leaves its id in the stored Yjs history. Its content is gone, and an id that the caller chose can stay in the stored bytes.
+  - A connector of someone else that the subject edited, and that goes with a deleted shape, is in `edited_elements` of the export and not in its erase count.
+- The shape is provisional. It is the `AccountPackage` contract that a later `agentic-identity` release adds to `agentic-identity/account`. The `AccountApp` of 0.9.0 is a different contract, and this does not fit it.
+
 ## UI
 
 The Worker serves a small web UI at its root. It uses the published `agentic-design` package for

package/dist/account.d.ts

@@ -0,0 +1,33 @@
+import { Store, Json } from 'agentic-identity';
+import { P as Principal } from './principal-blhsFbdS.js';
+import 'zod';
+
+interface CanvasAccountDeps {
+    /** The Store that holds the boards and the sharing records. */
+    store: Store;
+    /** Saves the live room of a board to the Store, as the Worker does before it reads a board. Without it, edits that no request has saved yet are not seen, and an erase that resets a room drops them. The call runs for every stored board, so it must be cheap for a board with no room. A board with no room needs no work. Omit it when no room runs. */
+    saveRoom?: (boardId: string) => Promise<void>;
+    /** Erases the live room of a board, so it opens again from the Store. The erase calls it for every board that it changes or deletes. Omit it when no room runs. */
+    eraseRoom?: (boardId: string) => Promise<void>;
+}
+type CanvasCollection = "boards" | "grants" | "invites" | "authored_elements" | "edited_elements" | "titles" | "audit";
+interface CanvasAccount {
+    id: "canvas";
+    /**
+     * Collections: `boards` (each board the subject is the only owner of, with its elements), `grants` (every role the subject
+     * holds on a board), `invites` (made by the subject, with no email), `authored_elements` (made by the subject on a board of someone else, with
+     * its `boardId`), `edited_elements` (made by someone else, last edited by the subject: `boardId` and `elementId`), `titles` (boards
+     * of someone else whose title the subject set), and `audit` (entries on a board where the subject acted as the principal, as the root of the chain, or was the target of a grant, as stored). It holds no format, version, or time.
+     */
+    exportAccount(subject: Principal, deps: CanvasAccountDeps): Promise<Record<CanvasCollection, Json[]>>;
+    /**
+     * Deletes the boards the subject is the only owner of, with their grants, invites, links, and audit entries. On every other
+     * board it removes the subject's grant and invites, deletes the elements the subject made, sets the editor of the
+     * elements it edited to `(erased)`, clears a title it set, and sets its audit entries to `(erased)`. Counts by the same collection
+     * names. A second run counts zero. Run it with writes stopped: a write after the export is erased and not exported.
+     */
+    eraseAccount(subject: Principal, deps: CanvasAccountDeps): Promise<Record<CanvasCollection, number>>;
+}
+declare const canvasAccount: CanvasAccount;
+
+export { type CanvasAccount, type CanvasAccountDeps, type CanvasCollection, canvasAccount };

package/dist/account.js

@@ -0,0 +1,213 @@
+import {
+  RESOURCE_TYPE
+} from "./chunk-LMSMUGBF.js";
+import {
+  fromBase64,
+  isBoardId,
+  toBase64
+} from "./chunk-GLNF43N4.js";
+import "./chunk-NWQED42L.js";
+import "./chunk-BKG3FXX3.js";
+import {
+  Board,
+  CanvasError,
+  PRINCIPAL_KINDS,
+  principalSchema
+} from "./chunk-ZP6BLCB7.js";
+
+// src/account.ts
+import { createSharing, ROLES, SUBJECT_KINDS } from "agentic-identity";
+var ERASED = "(erased)";
+var PAGE = 100;
+async function* pages(store, collection, where) {
+  let cursor;
+  do {
+    const page = await store.query(collection, { where, limit: PAGE, ...cursor === void 0 ? {} : { cursor } });
+    yield* page.items;
+    cursor = page.nextCursor;
+  } while (cursor !== void 0);
+}
+var rows = async (store, collection, where) => {
+  const out = [];
+  for await (const row of pages(store, collection, where)) out.push(row);
+  return out;
+};
+var plain = (value) => JSON.parse(JSON.stringify(value));
+function check(subject, deps) {
+  if (typeof deps?.store?.query !== "function") throw new CanvasError("INVALID", "canvasAccount needs deps.store");
+  for (const hook of [deps.saveRoom, deps.eraseRoom]) if (hook !== void 0 && typeof hook !== "function") throw new CanvasError("INVALID", "deps.saveRoom and deps.eraseRoom must be functions");
+  if (!principalSchema.safeParse(subject).success) throw new CanvasError("INVALID", "subject needs an id and a known kind");
+}
+async function held(store, subject) {
+  const all = [];
+  const sole = /* @__PURE__ */ new Set();
+  for await (const { id: grantId, data } of pages(store, "grants", { subjectKind: subject.kind, subjectId: subject.id })) {
+    const { resourceId: id, role } = data;
+    if (typeof id !== "string" || typeof role !== "string" || !ROLES.includes(role)) throw new CanvasError("INVALID", `grant "${grantId}" of the subject is damaged`);
+    const resource = await store.get("resources", id);
+    if (resource === null ? !isBoardId(id) : resource.type !== RESOURCE_TYPE) continue;
+    all.push({ grantId, resourceId: id, role });
+    if (resource === null || role !== "owner") continue;
+    const owners = await rows(store, "grants", { resourceId: id, role: "owner" });
+    if (owners.some((o) => typeof o.data.subjectId !== "string" || !SUBJECT_KINDS.includes(o.data.subjectKind))) throw new CanvasError("INVALID", `an owner grant on board "${id}" is damaged`);
+    if (owners.every((o) => o.data.subjectKind === subject.kind && o.data.subjectId === subject.id)) sole.add(id);
+  }
+  return { all, sole };
+}
+async function* boards(store, saveRoom) {
+  let cursor;
+  do {
+    const page = await store.query("boards", { limit: PAGE, ...cursor === void 0 ? {} : { cursor } });
+    for (const item of page.items) {
+      const { id } = item;
+      let data = item.data;
+      if (saveRoom) {
+        await saveRoom(id);
+        data = await store.get("boards", id) ?? data;
+      }
+      try {
+        yield { id, board: Board.open(fromBase64(String(data.update))) };
+      } catch {
+        throw new CanvasError("INVALID", `stored board "${id}" is damaged`);
+      }
+    }
+    cursor = page.nextCursor;
+  } while (cursor !== void 0);
+}
+var isSubject = (value, subject) => typeof value === "object" && value !== null && value.kind === subject.kind && value.id === subject.id;
+async function auditOf(store, subject) {
+  const found = /* @__PURE__ */ new Map();
+  for (const field of ["principalId", "rootId", "targetId"]) for (const row of await rows(store, "audit", { [field]: subject.id })) found.set(row.id, row);
+  const out = [];
+  const known = (kind, extra = []) => PRINCIPAL_KINDS.includes(kind) || extra.includes(kind);
+  for (const row of found.values()) {
+    const { principalId, principalKind, chain, rootId, resourceId, targetKind, targetId } = row.data;
+    if (typeof resourceId !== "string" || !isBoardId(resourceId)) continue;
+    const resource = await store.get("resources", resourceId);
+    if (resource !== null && resource.type !== RESOURCE_TYPE) continue;
+    const first = Array.isArray(chain) ? chain[0] : null;
+    const damaged = principalId === subject.id && !known(principalKind, ["anonymous"]) || targetId === subject.id && !known(targetKind, ["invite", "link", "person", "app", "key"]) || (first?.id === subject.id || first === null && rootId === subject.id) && !known(first?.kind);
+    if (damaged) throw new CanvasError("INVALID", `audit entry "${row.id}" is damaged`);
+    if (isSubject({ kind: principalKind, id: principalId }, subject) || isSubject(first, subject) || isSubject({ kind: targetKind, id: targetId }, subject)) out.push(row);
+  }
+  return out;
+}
+async function invitesOf(store, subject) {
+  const out = [];
+  for (const row of await rows(store, "invites", { createdBy: subject.id })) {
+    const { resourceId } = row.data;
+    if (typeof resourceId !== "string") throw new CanvasError("INVALID", `invite "${row.id}" of the subject is damaged`);
+    if (!isBoardId(resourceId)) continue;
+    const resource = await store.get("resources", resourceId);
+    if (resource === null || resource.type === RESOURCE_TYPE) out.push(row);
+  }
+  return out;
+}
+function scrub(data, subject) {
+  const erase = (step) => isSubject(step, subject) ? { ...step, id: ERASED } : step;
+  return {
+    ...data,
+    ...isSubject({ kind: data.principalKind, id: data.principalId }, subject) ? { principalId: ERASED } : {},
+    ...data.rootId === subject.id ? { rootId: ERASED } : {},
+    ...isSubject({ kind: data.targetKind, id: data.targetId }, subject) ? { targetId: ERASED } : {},
+    ...Array.isArray(data.chain) ? { chain: data.chain.map(erase) } : {}
+  };
+}
+var canvasAccount = {
+  id: "canvas",
+  async exportAccount(subject, deps) {
+    check(subject, deps);
+    const { store } = deps;
+    const out = { boards: [], grants: [], invites: [], authored_elements: [], edited_elements: [], titles: [], audit: [] };
+    const mine = await held(store, subject);
+    const owned = /* @__PURE__ */ new Map();
+    for await (const { id, board } of boards(store, deps.saveRoom)) {
+      if (mine.sole.has(id)) {
+        owned.set(id, plain([{ id, title: board.title, elements: board.rawElements() }])[0]);
+        continue;
+      }
+      const found = board.stampedBy(subject);
+      out.authored_elements.push(...plain(found.authored.map((element) => ({ boardId: id, element }))));
+      out.edited_elements.push(...plain(found.edited.map((elementId) => ({ boardId: id, elementId }))));
+      if (found.titleBy) out.titles.push(...plain([{ boardId: id, title: board.title }]));
+    }
+    for (const g of mine.all) {
+      out.grants.push(...plain([{ resourceId: g.resourceId, subjectKind: subject.kind, subjectId: subject.id, role: g.role }]));
+    }
+    for (const id of mine.sole) if (owned.has(id)) out.boards.push(owned.get(id));
+    for (const { id, data } of await invitesOf(store, subject)) {
+      const { resourceId, role, expiresAt, acceptedAt, revokedAt } = data;
+      out.invites.push(...plain([{ id, resourceId, role, expiresAt, acceptedAt, revokedAt }]));
+    }
+    out.audit.push(...plain((await auditOf(store, subject)).map((r) => r.data)));
+    return out;
+  },
+  async eraseAccount(subject, deps) {
+    check(subject, deps);
+    const { store } = deps;
+    const sharing = createSharing(store);
+    const total = { boards: 0, grants: 0, invites: 0, authored_elements: 0, edited_elements: 0, titles: 0, audit: 0 };
+    const ctx = { principalId: subject.id, kind: subject.kind, chain: [{ id: subject.id, kind: subject.kind }], scopes: [`${RESOURCE_TYPE}:admin`] };
+    const mine = await held(store, subject);
+    const stamped = [];
+    for await (const { id, board } of boards(store, deps.saveRoom)) {
+      if (mine.sole.has(id)) continue;
+      const found = board.stampedBy(subject);
+      if (found.authored.length > 0 || found.edited.length > 0 || found.titleBy) stamped.push(id);
+    }
+    for (const id of mine.sole) {
+      if ((await rows(store, "resources", { parentId: id })).length > 0) throw new CanvasError("INVALID", `board "${id}" has child resources: remove them first`);
+      if (!(await sharing.can(ctx, "admin", id)).allowed) throw new CanvasError("INVALID", `the owner grant on board "${id}" is not valid: an operator repairs it first`);
+    }
+    for (const { id, data } of await auditOf(store, subject)) {
+      await store.put("audit", id, scrub(data, subject));
+      total.audit += 1;
+    }
+    for (const { id } of await invitesOf(store, subject)) {
+      await store.delete("invites", id);
+      total.invites += 1;
+    }
+    for (const id of mine.sole) {
+      await deps.eraseRoom?.(id);
+      await store.delete("boards", id);
+      await deps.eraseRoom?.(id);
+      await sharing.deleteResource(ctx, id).catch((e) => {
+        if (e instanceof Error && (e.name === "EraseRefusedError" || e.message === "forbidden")) throw new CanvasError("INVALID", e.message);
+        throw e;
+      });
+      total.boards += 1;
+    }
+    for (const id of stamped) {
+      const done = await store.transaction(async (tx) => {
+        const doc = await tx.get("boards", id);
+        if (!doc) return null;
+        let board;
+        try {
+          board = Board.open(fromBase64(String(doc.update)));
+        } catch {
+          throw new CanvasError("INVALID", `stored board "${id}" is damaged`);
+        }
+        const counts = board.eraseStamps(subject, { kind: subject.kind, id: ERASED });
+        await tx.put("boards", id, { update: toBase64(board.encode()) });
+        return counts;
+      });
+      await deps.eraseRoom?.(id);
+      if (!done) continue;
+      total.authored_elements += done.authored;
+      total.edited_elements += done.edited;
+      total.titles += done.title ? 1 : 0;
+    }
+    for (const g of mine.all) {
+      if (mine.sole.has(g.resourceId)) {
+        total.grants += 1;
+        continue;
+      }
+      await store.delete("grants", g.grantId);
+      total.grants += 1;
+    }
+    return total;
+  }
+};
+export {
+  canvasAccount
+};

package/dist/{chunk-5II2WZIL.js → chunk-4PY5SN2N.js}

@@ -1,15 +1,16 @@
+import {
+  CanvasAccess
+} from "./chunk-LMSMUGBF.js";
 import {
   CanvasService,
-  MAX_LIVE_BYTES,
-  isBoardId,
-  isStoreId
-} from "./chunk-Z6KLGAFP.js";
+  MAX_LIVE_BYTES
+} from "./chunk-GLNF43N4.js";
 import {
   CanvasError
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/worker.ts
-import { createStoreAuth, hasScope as hasScope2, parsePrincipal, parseRegion } from "agentic-identity";
+import { createStoreAuth, hasScope, parsePrincipal, parseRegion } from "agentic-identity";
 import { createD1Store, createR2Blobs, D1_SCHEMA } from "agentic-identity/cloudflare";
 import { acceptWebSocketProtocol, principalFromWebSocketRequest } from "agentic-identity/http";
 
@@ -1790,150 +1791,6 @@ var Hono3 = class extends Hono {
   }
 };
 
-// src/access.ts
-import { createSharing, EraseRefusedError, hasScope, ROLES, SUBJECT_KINDS } from "agentic-identity";
-var RESOURCE_TYPE = "canvas";
-var SHARE_ROLES = ROLES.filter((r) => r !== "owner");
-var BAD_INPUT = /^(give an email or a handle|invalid handle|invalid email|invalid subject( kind "[^"]*")?|the last owner cannot be removed|expiresInMs must be .*|expiresAt must be .*|invalid role .*)$/;
-function refuse(error) {
-  if (error instanceof EraseRefusedError) throw new CanvasError("INVALID", error.message);
-  if (error instanceof Error && error.message === "forbidden") throw new CanvasError("FORBIDDEN", "you may not do this on this board");
-  if (error instanceof Error && BAD_INPUT.test(error.message)) throw new CanvasError("INVALID", error.message);
-  throw error;
-}
-var oneOf = (value, list, name) => {
-  if (typeof value !== "string" || !list.includes(value)) throw new CanvasError("INVALID", `${name} must be one of: ${list.join(", ")}`);
-  return value;
-};
-var storeId = (value, name) => {
-  if (typeof value !== "string" || !isStoreId(value)) throw new CanvasError("INVALID", `${name} must be 1 to 128 of A-Z, a-z, 0-9, _ and -, and not like __x__`);
-  return value;
-};
-var word = (value, name) => {
-  if (typeof value !== "string" || value === "") throw new CanvasError("INVALID", `${name} must be a non-empty string`);
-  return value;
-};
-var lifetime = (value, name) => {
-  if (value === void 0) return void 0;
-  if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new CanvasError("INVALID", `${name} must be a whole number of milliseconds above 0`);
-  return value;
-};
-var CanvasAccess = class {
-  constructor(store, options = {}) {
-    this.store = store;
-    this.sharing = createSharing(store, options);
-    this.now = options.now ?? Date.now;
-  }
-  store;
-  sharing;
-  now;
-  /** A board id that the Store refuses names no board. The gate checks this for a role holder: a token of the dev list skips the gate. */
-  known(id) {
-    if (!isBoardId(id)) throw new CanvasError("NOT_FOUND", `no board "${id}"`);
-  }
-  /** Make the actor the owner of a new board. */
-  async register(ctx, id) {
-    await this.sharing.createResource(ctx, { id, type: RESOURCE_TYPE }).catch((error) => {
-      if (error instanceof Error && error.message === "resource exists") throw new CanvasError("DUPLICATE_ID", `board "${id}" already exists`);
-      if (error instanceof Error && error.message === "resource id has old audit entries") throw new CanvasError("UNAVAILABLE", "this board id was used a moment ago. Try again, or use another id");
-      return refuse(error);
-    });
-  }
-  /** Remove the sharing records of a board. Needs an owner. */
-  async unregister(ctx, id) {
-    await this.sharing.deleteResource(ctx, id).catch(refuse);
-  }
-  /** True if the board has sharing records: it was made by an identity credential. */
-  async registered(id) {
-    if (!isBoardId(id)) return false;
-    return (await this.store.get("resources", id))?.type === RESOURCE_TYPE;
-  }
-  /**
-   * True if the caller may do `action` on the board. A link token adds the role of its link. It writes an audit entry.
-   * An id that belongs to a resource of another type, in a Store shared with another app, is no board: it is denied.
-   */
-  async allowed(ctx, action, id, linkToken) {
-    if (!await this.registered(id)) return false;
-    return (await this.sharing.can(ctx, action, id, linkToken === void 0 ? {} : { linkToken })).allowed;
-  }
-  /** Throw NOT_FOUND for a caller who cannot read the board, and FORBIDDEN for one who can read it but not do `action`. */
-  async require(ctx, action, id, linkToken) {
-    if (await this.allowed(ctx, action, id, linkToken)) return;
-    if (action === "read" || !await this.allowed(ctx, "read", id, linkToken)) throw new CanvasError("NOT_FOUND", `no board "${id}"`);
-    throw new CanvasError("FORBIDDEN", `this needs the ${action === "admin" ? "owner" : "editor"} role on the board`);
-  }
-  /** The ids of the boards a person or agent holds a role on, the first 100. A credential without `canvas:read` gets none. */
-  async readable(ctx) {
-    const root = ctx.chain[0];
-    if (!root || !SUBJECT_KINDS.includes(root.kind) || !hasScope(ctx.scopes, `${RESOURCE_TYPE}:read`)) return [];
-    const ids = [];
-    let cursor;
-    for (let pages = 0; pages < 10 && ids.length < 100; pages++) {
-      const page = await this.store.query("grants", { where: { subjectKind: root.kind, subjectId: root.id }, limit: 100, ...cursor === void 0 ? {} : { cursor } });
-      for (const { data } of page.items) {
-        if (ids.length >= 100 || typeof data.resourceId !== "string" || !ROLES.includes(data.role)) continue;
-        if (await this.registered(data.resourceId)) ids.push(data.resourceId);
-      }
-      if ((cursor = page.nextCursor) === void 0) break;
-    }
-    return ids;
-  }
-  async grant(ctx, id, input) {
-    this.known(id);
-    const subject = { kind: oneOf(input.subjectKind, SUBJECT_KINDS, "subjectKind"), id: storeId(input.subjectId, "subjectId") };
-    await this.sharing.grant(ctx, id, subject, oneOf(input.role, ROLES, "role")).catch(refuse);
-    return { ok: true };
-  }
-  async revoke(ctx, id, input) {
-    this.known(id);
-    const subject = { kind: oneOf(input.subjectKind, SUBJECT_KINDS, "subjectKind"), id: storeId(input.subjectId, "subjectId") };
-    await this.sharing.revokeGrant(ctx, id, subject).catch(refuse);
-    return { ok: true };
-  }
-  /** The grants and the invites on a board. An invite never shows its email. Links are not listed: a token shows once. */
-  async list(ctx, id) {
-    this.known(id);
-    const [grants, invites] = await Promise.all([this.sharing.listGrants(ctx, id, { limit: 200 }), this.sharing.listInvites(ctx, id, { limit: 200 })]).catch(refuse);
-    return { grants: grants.grants, invites: invites.invites };
-  }
-  async invite(ctx, id, input) {
-    this.known(id);
-    const role = oneOf(input.role, SHARE_ROLES, "role");
-    const expiresInMs = lifetime(input.expiresInMs, "expiresInMs");
-    const who = input.email !== void 0 ? { email: word(input.email, "email") } : input.handle !== void 0 ? { handle: word(input.handle, "handle") } : {};
-    if (input.email !== void 0 && input.handle !== void 0) throw new CanvasError("INVALID", "give an email or a handle, not both");
-    return this.sharing.createInvite(ctx, id, { role, ...who, ...expiresInMs === void 0 ? {} : { expiresInMs } }).catch(refuse);
-  }
-  /** The email comes from a verified sign-in and the handle from the agent's own record, never from the request. */
-  async accept(ctx, inviteId) {
-    if (!isStoreId(inviteId)) throw new CanvasError("FORBIDDEN", "you may not do this on this board");
-    const user = await this.store.get("users", ctx.principalId);
-    const agent = await this.store.get("principals", ctx.principalId);
-    const identity = {
-      ...user?.emailVerified === true && typeof user.email === "string" ? { email: user.email } : {},
-      ...typeof agent?.handle === "string" ? { handle: agent.handle } : {}
-    };
-    await this.sharing.acceptInvite(ctx, word(inviteId, "id"), identity).catch(refuse);
-    return { ok: true };
-  }
-  /** The token shows once. Only its hash is stored. */
-  async createLink(ctx, id, input) {
-    this.known(id);
-    const role = oneOf(input.role, SHARE_ROLES, "role");
-    const expiresInMs = lifetime(input.expiresInMs, "expiresInMs");
-    if (input.signedInOnly !== void 0 && typeof input.signedInOnly !== "boolean") throw new CanvasError("INVALID", "signedInOnly must be true or false");
-    return this.sharing.createLink(ctx, id, { role, signedInOnly: input.signedInOnly === true, ...expiresInMs === void 0 ? {} : { expiresAt: this.now() + expiresInMs } }).catch(refuse);
-  }
-  /** Revoke a link of this board. A link of another board is NOT_FOUND here, even for an owner of both. */
-  async revokeLink(ctx, id, linkId) {
-    this.known(id);
-    const link = isStoreId(linkId) ? await this.store.get("links", linkId) : null;
-    if (!link || link.resourceId !== id) throw new CanvasError("NOT_FOUND", "no such link on this board");
-    await this.sharing.revokeLink(ctx, linkId).catch(refuse);
-    return { ok: true };
-  }
-};
-
 // src/room-sync.ts
 import * as Y from "yjs";
 var SEEDER = { kind: "agent", id: "canvas-room" };
@@ -2171,7 +2028,7 @@ async function identify(request, env, store) {
   const found = await principalFromWebSocketRequest(request, auth, { protocol: WS_PROTOCOL, scope: "canvas:read" });
   if (failure() !== void 0) throw failure();
   if (found instanceof Response) return null;
-  return { actor: { kind: found.kind, id: found.principalId }, role: hasScope2(found.scopes, "canvas:write") ? "editor" : "viewer", principal: found, dev: dev() };
+  return { actor: { kind: found.kind, id: found.principalId }, role: hasScope(found.scopes, "canvas:write") ? "editor" : "viewer", principal: found, dev: dev() };
 }
 var svgResponse = (svg) => new Response(svg, { headers: { "content-type": "image/svg+xml", "x-content-type-options": "nosniff", "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; img-src data:" } });
 function sniffImage(bytes) {

package/dist/{chunk-7EWHZCKY.js → chunk-AI5NWPEW.js}

@@ -2,11 +2,11 @@ import {
   CanvasError,
   PRINCIPAL_KINDS,
   SHAPE_TYPES
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "0.12.1" : readPackageVersion();
+var VERSION = true ? "0.13.0" : readPackageVersion();
 
 // src/brand.ts
 var BRAND = {

package/dist/{chunk-EDQNA2SU.js → chunk-BKG3FXX3.js}

@@ -4,7 +4,7 @@ import {
   IMAGE_PATTERN,
   MAX_ELEMENTS,
   SHAPE_TYPES
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/core/flow.ts
 import dagre from "@dagrejs/dagre";

package/dist/{chunk-Z6KLGAFP.js → chunk-GLNF43N4.js}

@@ -4,13 +4,13 @@ import {
 import {
   drawFlow,
   toSvg
-} from "./chunk-EDQNA2SU.js";
+} from "./chunk-BKG3FXX3.js";
 import {
   Board,
   CanvasError,
   principalSchema,
   readBoard
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/service.ts
 import * as Y from "yjs";
@@ -224,6 +224,8 @@ function decodeStored(doc, id, decode) {
 
 export {
   MAX_LIVE_BYTES,
+  toBase64,
+  fromBase64,
   isStoreId,
   isBoardId,
   CanvasService

package/dist/chunk-LMSMUGBF.js

@@ -0,0 +1,156 @@
+import {
+  isBoardId,
+  isStoreId
+} from "./chunk-GLNF43N4.js";
+import {
+  CanvasError
+} from "./chunk-ZP6BLCB7.js";
+
+// src/access.ts
+import { createSharing, EraseRefusedError, hasScope, ROLES, SUBJECT_KINDS } from "agentic-identity";
+var RESOURCE_TYPE = "canvas";
+var SHARE_ROLES = ROLES.filter((r) => r !== "owner");
+var BAD_INPUT = /^(give an email or a handle|invalid handle|invalid email|invalid subject( kind "[^"]*")?|the last owner cannot be removed|expiresInMs must be .*|expiresAt must be .*|invalid role .*)$/;
+function refuse(error) {
+  if (error instanceof EraseRefusedError) throw new CanvasError("INVALID", error.message);
+  if (error instanceof Error && error.message === "forbidden") throw new CanvasError("FORBIDDEN", "you may not do this on this board");
+  if (error instanceof Error && BAD_INPUT.test(error.message)) throw new CanvasError("INVALID", error.message);
+  throw error;
+}
+var oneOf = (value, list, name) => {
+  if (typeof value !== "string" || !list.includes(value)) throw new CanvasError("INVALID", `${name} must be one of: ${list.join(", ")}`);
+  return value;
+};
+var storeId = (value, name) => {
+  if (typeof value !== "string" || !isStoreId(value)) throw new CanvasError("INVALID", `${name} must be 1 to 128 of A-Z, a-z, 0-9, _ and -, and not like __x__`);
+  return value;
+};
+var word = (value, name) => {
+  if (typeof value !== "string" || value === "") throw new CanvasError("INVALID", `${name} must be a non-empty string`);
+  return value;
+};
+var lifetime = (value, name) => {
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new CanvasError("INVALID", `${name} must be a whole number of milliseconds above 0`);
+  return value;
+};
+var CanvasAccess = class {
+  constructor(store, options = {}) {
+    this.store = store;
+    this.sharing = createSharing(store, options);
+    this.now = options.now ?? Date.now;
+  }
+  store;
+  sharing;
+  now;
+  /** A board id that the Store refuses names no board. The gate checks this for a role holder: a token of the dev list skips the gate. */
+  known(id) {
+    if (!isBoardId(id)) throw new CanvasError("NOT_FOUND", `no board "${id}"`);
+  }
+  /** Make the actor the owner of a new board. */
+  async register(ctx, id) {
+    await this.sharing.createResource(ctx, { id, type: RESOURCE_TYPE }).catch((error) => {
+      if (error instanceof Error && error.message === "resource exists") throw new CanvasError("DUPLICATE_ID", `board "${id}" already exists`);
+      if (error instanceof Error && error.message === "resource id has old audit entries") throw new CanvasError("UNAVAILABLE", "this board id was used a moment ago. Try again, or use another id");
+      return refuse(error);
+    });
+  }
+  /** Remove the sharing records of a board. Needs an owner. */
+  async unregister(ctx, id) {
+    await this.sharing.deleteResource(ctx, id).catch(refuse);
+  }
+  /** True if the board has sharing records: it was made by an identity credential. */
+  async registered(id) {
+    if (!isBoardId(id)) return false;
+    return (await this.store.get("resources", id))?.type === RESOURCE_TYPE;
+  }
+  /**
+   * True if the caller may do `action` on the board. A link token adds the role of its link. It writes an audit entry.
+   * An id that belongs to a resource of another type, in a Store shared with another app, is no board: it is denied.
+   */
+  async allowed(ctx, action, id, linkToken) {
+    if (!await this.registered(id)) return false;
+    return (await this.sharing.can(ctx, action, id, linkToken === void 0 ? {} : { linkToken })).allowed;
+  }
+  /** Throw NOT_FOUND for a caller who cannot read the board, and FORBIDDEN for one who can read it but not do `action`. */
+  async require(ctx, action, id, linkToken) {
+    if (await this.allowed(ctx, action, id, linkToken)) return;
+    if (action === "read" || !await this.allowed(ctx, "read", id, linkToken)) throw new CanvasError("NOT_FOUND", `no board "${id}"`);
+    throw new CanvasError("FORBIDDEN", `this needs the ${action === "admin" ? "owner" : "editor"} role on the board`);
+  }
+  /** The ids of the boards a person or agent holds a role on, the first 100. A credential without `canvas:read` gets none. */
+  async readable(ctx) {
+    const root = ctx.chain[0];
+    if (!root || !SUBJECT_KINDS.includes(root.kind) || !hasScope(ctx.scopes, `${RESOURCE_TYPE}:read`)) return [];
+    const ids = [];
+    let cursor;
+    for (let pages = 0; pages < 10 && ids.length < 100; pages++) {
+      const page = await this.store.query("grants", { where: { subjectKind: root.kind, subjectId: root.id }, limit: 100, ...cursor === void 0 ? {} : { cursor } });
+      for (const { data } of page.items) {
+        if (ids.length >= 100 || typeof data.resourceId !== "string" || !ROLES.includes(data.role)) continue;
+        if (await this.registered(data.resourceId)) ids.push(data.resourceId);
+      }
+      if ((cursor = page.nextCursor) === void 0) break;
+    }
+    return ids;
+  }
+  async grant(ctx, id, input) {
+    this.known(id);
+    const subject = { kind: oneOf(input.subjectKind, SUBJECT_KINDS, "subjectKind"), id: storeId(input.subjectId, "subjectId") };
+    await this.sharing.grant(ctx, id, subject, oneOf(input.role, ROLES, "role")).catch(refuse);
+    return { ok: true };
+  }
+  async revoke(ctx, id, input) {
+    this.known(id);
+    const subject = { kind: oneOf(input.subjectKind, SUBJECT_KINDS, "subjectKind"), id: storeId(input.subjectId, "subjectId") };
+    await this.sharing.revokeGrant(ctx, id, subject).catch(refuse);
+    return { ok: true };
+  }
+  /** The grants and the invites on a board. An invite never shows its email. Links are not listed: a token shows once. */
+  async list(ctx, id) {
+    this.known(id);
+    const [grants, invites] = await Promise.all([this.sharing.listGrants(ctx, id, { limit: 200 }), this.sharing.listInvites(ctx, id, { limit: 200 })]).catch(refuse);
+    return { grants: grants.grants, invites: invites.invites };
+  }
+  async invite(ctx, id, input) {
+    this.known(id);
+    const role = oneOf(input.role, SHARE_ROLES, "role");
+    const expiresInMs = lifetime(input.expiresInMs, "expiresInMs");
+    const who = input.email !== void 0 ? { email: word(input.email, "email") } : input.handle !== void 0 ? { handle: word(input.handle, "handle") } : {};
+    if (input.email !== void 0 && input.handle !== void 0) throw new CanvasError("INVALID", "give an email or a handle, not both");
+    return this.sharing.createInvite(ctx, id, { role, ...who, ...expiresInMs === void 0 ? {} : { expiresInMs } }).catch(refuse);
+  }
+  /** The email comes from a verified sign-in and the handle from the agent's own record, never from the request. */
+  async accept(ctx, inviteId) {
+    if (!isStoreId(inviteId)) throw new CanvasError("FORBIDDEN", "you may not do this on this board");
+    const user = await this.store.get("users", ctx.principalId);
+    const agent = await this.store.get("principals", ctx.principalId);
+    const identity = {
+      ...user?.emailVerified === true && typeof user.email === "string" ? { email: user.email } : {},
+      ...typeof agent?.handle === "string" ? { handle: agent.handle } : {}
+    };
+    await this.sharing.acceptInvite(ctx, word(inviteId, "id"), identity).catch(refuse);
+    return { ok: true };
+  }
+  /** The token shows once. Only its hash is stored. */
+  async createLink(ctx, id, input) {
+    this.known(id);
+    const role = oneOf(input.role, SHARE_ROLES, "role");
+    const expiresInMs = lifetime(input.expiresInMs, "expiresInMs");
+    if (input.signedInOnly !== void 0 && typeof input.signedInOnly !== "boolean") throw new CanvasError("INVALID", "signedInOnly must be true or false");
+    return this.sharing.createLink(ctx, id, { role, signedInOnly: input.signedInOnly === true, ...expiresInMs === void 0 ? {} : { expiresAt: this.now() + expiresInMs } }).catch(refuse);
+  }
+  /** Revoke a link of this board. A link of another board is NOT_FOUND here, even for an owner of both. */
+  async revokeLink(ctx, id, linkId) {
+    this.known(id);
+    const link = isStoreId(linkId) ? await this.store.get("links", linkId) : null;
+    if (!link || link.resourceId !== id) throw new CanvasError("NOT_FOUND", "no such link on this board");
+    await this.sharing.revokeLink(ctx, linkId).catch(refuse);
+    return { ok: true };
+  }
+};
+
+export {
+  RESOURCE_TYPE,
+  CanvasAccess
+};

package/dist/{chunk-MVWUIBGV.js → chunk-ZP6BLCB7.js}

@@ -94,6 +94,7 @@ var isBindable = (type) => typeof type === "string" && type !== "connector" && t
 var isValidZ = (value) => typeof value === "number" && Number.isFinite(value) && Math.abs(value) <= MAX_Z;
 var clampZ = (value) => Math.min(MAX_Z, Math.max(-MAX_Z, value));
 var samePrincipal = (a, b) => a.kind === b.kind && a.id === b.id;
+var isStamp = (value, who) => typeof value === "object" && value !== null && value.kind === who.kind && value.id === who.id;
 var hasId = (e) => typeof e === "object" && e !== null && typeof e.id === "string";
 var Board = class _Board {
   doc;
@@ -348,6 +349,62 @@ var Board = class _Board {
     this.write(plan, by);
     return plan.map(([memberId]) => memberId);
   }
+  /** Every stored entry as it is, valid or not, with its key as `id`. */
+  rawElements() {
+    return [...this.elements].map(([key, entry]) => ({ ...entry instanceof Y.Map ? entry.toJSON() : {}, id: key }));
+  }
+  /**
+   * The raw stored elements that `who` made (`author`) and the ids of those that `who` last edited but did not make.
+   * It reads entries as they are, with no element checks, so a damaged entry still shows. Account export uses it.
+   */
+  stampedBy(who) {
+    const authored = [];
+    const edited = [];
+    for (const [key, entry] of this.elements) {
+      if (!(entry instanceof Y.Map)) continue;
+      if (isStamp(entry.get("author"), who)) authored.push({ ...entry.toJSON(), id: key });
+      else if (isStamp(entry.get("editedBy"), who)) edited.push(key);
+    }
+    return { authored, edited, titleBy: isStamp(this.meta.get("titleBy"), who) };
+  }
+  /**
+   * Erase `who` from the board. An element they made is deleted alone: its members go to its parent group, and a
+   * connector of someone else that was bound to it goes too, because it would be hidden. An element they only edited
+   * keeps its content, and its editor becomes `(erased)`. A title they set is cleared. Idempotent. Returns the counts.
+   */
+  eraseStamps(who, erased) {
+    const mine = /* @__PURE__ */ new Set();
+    for (const [key, entry] of this.elements) if (entry instanceof Y.Map && isStamp(entry.get("author"), who)) mine.add(key);
+    const counts = { authored: mine.size, edited: 0, dangling: 0, title: isStamp(this.meta.get("titleBy"), who) };
+    this.doc.transact(() => {
+      for (const key of mine) {
+        const parent = this.elements.get(key).get("groupId");
+        for (const [, other] of this.elements) {
+          if (other instanceof Y.Map && other.get("groupId") === key) {
+            if (typeof parent === "string") other.set("groupId", parent);
+            else other.delete("groupId");
+          }
+        }
+      }
+      mine.forEach((key) => this.elements.delete(key));
+      for (const [key, entry] of [...this.elements]) {
+        if (!(entry instanceof Y.Map)) continue;
+        const ends = [entry.get("from"), entry.get("to")];
+        if (entry.get("type") === "connector" && ends.some((e) => hasId(e) && mine.has(e.id))) {
+          this.elements.delete(key);
+          counts.dangling += 1;
+        } else if (isStamp(entry.get("editedBy"), who)) {
+          entry.set("editedBy", erased);
+          counts.edited += 1;
+        }
+      }
+      if (counts.title) {
+        this.meta.delete("title");
+        this.meta.set("titleBy", erased);
+      }
+    });
+    return counts;
+  }
   /** Delete an element. A shape takes its connectors and a group takes its members. Returns the ids removed. */
   remove(elementId) {
     this.require(elementId);

package/dist/cli.js

@@ -5,18 +5,18 @@ import {
   operatorActor,
   runMcp,
   svgToPng
-} from "./chunk-7EWHZCKY.js";
+} from "./chunk-AI5NWPEW.js";
 import {
   openLocalStore
 } from "./chunk-NRLF6MGR.js";
 import {
   CanvasService
-} from "./chunk-Z6KLGAFP.js";
+} from "./chunk-GLNF43N4.js";
 import "./chunk-NWQED42L.js";
-import "./chunk-EDQNA2SU.js";
+import "./chunk-BKG3FXX3.js";
 import {
   CanvasError
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/cli.ts
 import { readFileSync, writeFileSync } from "fs";

package/dist/{client-Dyd30StF.d.ts → client-DBb1jpxl.d.ts}

@@ -1,4 +1,4 @@
-import { a as BoardData, c as ShapeType, S as Shape, E as Endpoint, C as Connector } from './read-UIJlrkwx.js';
+import { a as BoardData, c as ShapeType, S as Shape, E as Endpoint, C as Connector } from './read-DeS2Zaz8.js';
 import { PrincipalKind } from 'agentic-identity';
 
 /** Options for every call. */

package/dist/embed.d.ts

@@ -1,9 +1,10 @@
 import * as react from 'react';
-import { C as CanvasClient } from './client-Dyd30StF.js';
+import { C as CanvasClient } from './client-DBb1jpxl.js';
 import { PrincipalKind } from 'agentic-identity';
 import { SyncClient, Status } from 'agentic-realtime/client';
 import * as Y from 'yjs';
-import './read-UIJlrkwx.js';
+import './read-DeS2Zaz8.js';
+import './principal-blhsFbdS.js';
 import 'zod';
 
 /** The presence of a room: who is here. A `SyncClient` of agentic-realtime has these. */

package/dist/embed.js

@@ -3,7 +3,7 @@ import {
   PRINCIPAL_KINDS,
   principalSchema,
   readBoard
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // ui/embed.tsx
 import { ToastProvider, TooltipProvider } from "agentic-design/react";

package/dist/index.d.ts

@@ -1,9 +1,11 @@
-import { B as Board, P as Principal } from './read-UIJlrkwx.js';
-export { a as BoardData, b as CanvasElement, d as CanvasError, C as Connector, e as EdgeData, E as Endpoint, f as ErrorCode, G as Group, M as MAX_ELEMENTS, g as MAX_TEXT, N as NodeData, h as SHAPE_TYPES, S as Shape, c as ShapeType, p as principalSchema, r as readBoard } from './read-UIJlrkwx.js';
-import { B as BoardAccess } from './service-ojpxVNVl.js';
-export { C as CanvasService, D as DrawOptions, F as FlowEdge, a as FlowGraph, b as FlowNode, M as MAX_FLOW_EDGES, c as MAX_FLOW_NODES, P as Placement, d as drawFlow, l as layoutFlow, p as parseFlow } from './service-ojpxVNVl.js';
+import { B as Board } from './read-DeS2Zaz8.js';
+export { a as BoardData, b as CanvasElement, d as CanvasError, C as Connector, e as EdgeData, E as Endpoint, f as ErrorCode, G as Group, M as MAX_ELEMENTS, g as MAX_TEXT, N as NodeData, h as SHAPE_TYPES, S as Shape, c as ShapeType, r as readBoard } from './read-DeS2Zaz8.js';
+import { P as Principal } from './principal-blhsFbdS.js';
+export { p as principalSchema } from './principal-blhsFbdS.js';
+import { B as BoardAccess } from './service-BNEH2Z12.js';
+export { C as CanvasService, D as DrawOptions, F as FlowEdge, a as FlowGraph, b as FlowNode, M as MAX_FLOW_EDGES, c as MAX_FLOW_NODES, P as Placement, d as drawFlow, l as layoutFlow, p as parseFlow } from './service-BNEH2Z12.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { B as BoardSharing } from './client-Dyd30StF.js';
+import { B as BoardSharing } from './client-DBb1jpxl.js';
 export { FileStoreOptions, createFileStore, openLocalStore } from './store-file.js';
 export { PRINCIPAL_KINDS, PrincipalKind, isMachineMade } from 'agentic-identity';
 import 'yjs';

package/dist/index.js

@@ -6,14 +6,14 @@ import {
   operatorActor,
   runMcp,
   svgToPng
-} from "./chunk-7EWHZCKY.js";
+} from "./chunk-AI5NWPEW.js";
 import {
   createFileStore,
   openLocalStore
 } from "./chunk-NRLF6MGR.js";
 import {
   CanvasService
-} from "./chunk-Z6KLGAFP.js";
+} from "./chunk-GLNF43N4.js";
 import "./chunk-NWQED42L.js";
 import {
   MAX_FLOW_EDGES,
@@ -22,7 +22,7 @@ import {
   layoutFlow,
   parseFlow,
   toSvg
-} from "./chunk-EDQNA2SU.js";
+} from "./chunk-BKG3FXX3.js";
 import {
   Board,
   CanvasError,
@@ -33,7 +33,7 @@ import {
   isMachineMade,
   principalSchema,
   readBoard
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 export {
   ActorConfigError,
   BRAND,

package/dist/live-worker.d.ts

@@ -5,10 +5,11 @@ import 'agentic-identity';
 import 'agentic-realtime';
 import 'agentic-identity/cloudflare';
 import 'hono';
-import './read-UIJlrkwx.js';
-import 'yjs';
+import './principal-blhsFbdS.js';
 import 'zod';
-import './service-ojpxVNVl.js';
+import './service-BNEH2Z12.js';
+import './read-DeS2Zaz8.js';
+import 'yjs';
 
 type Namespace = Parameters<typeof createDurableObjectRealtime>[0];
 interface LiveEnv extends WorkerEnv {

package/dist/live-worker.js

@@ -1,12 +1,13 @@
 import {
   createApp
-} from "./chunk-5II2WZIL.js";
-import "./chunk-Z6KLGAFP.js";
+} from "./chunk-4PY5SN2N.js";
+import "./chunk-LMSMUGBF.js";
+import "./chunk-GLNF43N4.js";
 import "./chunk-NWQED42L.js";
-import "./chunk-EDQNA2SU.js";
+import "./chunk-BKG3FXX3.js";
 import {
   CanvasError
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/live-worker.ts
 import { parseRegion } from "agentic-identity";

package/dist/live.d.ts

@@ -1,6 +1,7 @@
-import { B as Board, P as Principal, a as BoardData, S as Shape, C as Connector, b as CanvasElement } from './read-UIJlrkwx.js';
+import { B as Board, a as BoardData, S as Shape, C as Connector, b as CanvasElement } from './read-DeS2Zaz8.js';
 import { Peer } from 'agentic-realtime/client';
-import { B as BoardAccess, D as DrawOptions } from './service-ojpxVNVl.js';
+import { B as BoardAccess, D as DrawOptions } from './service-BNEH2Z12.js';
+import { P as Principal } from './principal-blhsFbdS.js';
 import 'yjs';
 import 'agentic-identity';
 import 'zod';

package/dist/live.js

@@ -1,12 +1,12 @@
 import {
   drawFlow,
   toSvg
-} from "./chunk-EDQNA2SU.js";
+} from "./chunk-BKG3FXX3.js";
 import {
   Board,
   CanvasError,
   readBoard
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/live.ts
 import { parsePrincipal } from "agentic-identity";

package/dist/principal-blhsFbdS.d.ts

@@ -0,0 +1,23 @@
+import { PrincipalKind } from 'agentic-identity';
+import { z } from 'zod';
+
+/**
+ * The actor of a new write. The rule is the identity kernel's `parsePrincipal`: a known kind, and an id of 1 to 128
+ * characters from A-Z, a-z, 0-9, ".", "_" and "-". The Worker, the CLI and the SDK all use it.
+ */
+declare const principalSchema: z.ZodPipe<z.ZodObject<{
+    kind: z.ZodString;
+    id: z.ZodString;
+}, z.core.$strict>, z.ZodTransform<{
+    kind: PrincipalKind;
+    id: string;
+}, {
+    kind: string;
+    id: string;
+}>>;
+type Principal = {
+    kind: PrincipalKind;
+    id: string;
+};
+
+export { type Principal as P, principalSchema as p };

package/dist/{read-UIJlrkwx.d.ts → read-DeS2Zaz8.d.ts}

@@ -1,25 +1,5 @@
 import * as Y from 'yjs';
-import { PrincipalKind } from 'agentic-identity';
-import { z } from 'zod';
-
-/**
- * The actor of a new write. The rule is the identity kernel's `parsePrincipal`: a known kind, and an id of 1 to 128
- * characters from A-Z, a-z, 0-9, ".", "_" and "-". The Worker, the CLI and the SDK all use it.
- */
-declare const principalSchema: z.ZodPipe<z.ZodObject<{
-    kind: z.ZodString;
-    id: z.ZodString;
-}, z.core.$strict>, z.ZodTransform<{
-    kind: PrincipalKind;
-    id: string;
-}, {
-    kind: string;
-    id: string;
-}>>;
-type Principal = {
-    kind: PrincipalKind;
-    id: string;
-};
+import { P as Principal } from './principal-blhsFbdS.js';
 
 type ErrorCode = "INVALID" | "DUPLICATE_ID" | "NOT_FOUND" | "BAD_REFERENCE" | "LIMIT" | "UNAVAILABLE" | "FORBIDDEN";
 declare class CanvasError extends Error {
@@ -132,6 +112,28 @@ declare class Board {
     update(elementId: string, patch: unknown, actor: Principal): CanvasElement;
     /** Shift an element, or a whole group. Returns the ids that moved. Bound connector ends follow their shapes. */
     move(elementId: string, dx: number, dy: number, actor: Principal): string[];
+    /** Every stored entry as it is, valid or not, with its key as `id`. */
+    rawElements(): Record<string, unknown>[];
+    /**
+     * The raw stored elements that `who` made (`author`) and the ids of those that `who` last edited but did not make.
+     * It reads entries as they are, with no element checks, so a damaged entry still shows. Account export uses it.
+     */
+    stampedBy(who: Principal): {
+        authored: Record<string, unknown>[];
+        edited: string[];
+        titleBy: boolean;
+    };
+    /**
+     * Erase `who` from the board. An element they made is deleted alone: its members go to its parent group, and a
+     * connector of someone else that was bound to it goes too, because it would be hidden. An element they only edited
+     * keeps its content, and its editor becomes `(erased)`. A title they set is cleared. Idempotent. Returns the counts.
+     */
+    eraseStamps(who: Principal, erased: Principal): {
+        authored: number;
+        edited: number;
+        dangling: number;
+        title: boolean;
+    };
     /** Delete an element. A shape takes its connectors and a group takes its members. Returns the ids removed. */
     remove(elementId: string): string[];
     group(ids: string[], actor: Principal, groupId?: string): Group;
@@ -181,4 +183,4 @@ interface BoardData {
 /** The board as plain data for an agent. Reads only. Embedded image bytes are left out. */
 declare function readBoard(board: Board): BoardData;
 
-export { Board as B, type Connector as C, type Endpoint as E, type Group as G, MAX_ELEMENTS as M, type NodeData as N, type Principal as P, type Shape as S, type BoardData as a, type CanvasElement as b, type ShapeType as c, CanvasError as d, type EdgeData as e, type ErrorCode as f, MAX_TEXT as g, SHAPE_TYPES as h, principalSchema as p, readBoard as r };
+export { Board as B, type Connector as C, type Endpoint as E, type Group as G, MAX_ELEMENTS as M, type NodeData as N, type Shape as S, type BoardData as a, type CanvasElement as b, type ShapeType as c, CanvasError as d, type EdgeData as e, type ErrorCode as f, MAX_TEXT as g, SHAPE_TYPES as h, readBoard as r };

package/dist/{service-ojpxVNVl.d.ts → service-BNEH2Z12.d.ts}

@@ -1,5 +1,6 @@
-import { c as ShapeType, B as Board, P as Principal, a as BoardData, S as Shape, C as Connector, b as CanvasElement } from './read-UIJlrkwx.js';
+import { c as ShapeType, B as Board, a as BoardData, S as Shape, C as Connector, b as CanvasElement } from './read-DeS2Zaz8.js';
 import { Store } from 'agentic-identity';
+import { P as Principal } from './principal-blhsFbdS.js';
 
 declare const MAX_FLOW_NODES = 500;
 declare const MAX_FLOW_EDGES = 2000;

package/dist/worker.d.ts

@@ -2,10 +2,11 @@ import { Store, PrincipalContext, Action, Grant, InviteSummary, Blobs } from 'ag
 import { Realtime } from 'agentic-realtime';
 import { D1Like, R2Like } from 'agentic-identity/cloudflare';
 import { Hono } from 'hono';
-import { P as Principal } from './read-UIJlrkwx.js';
-import { C as CanvasService } from './service-ojpxVNVl.js';
-import 'yjs';
+import { P as Principal } from './principal-blhsFbdS.js';
+import { C as CanvasService } from './service-BNEH2Z12.js';
 import 'zod';
+import './read-DeS2Zaz8.js';
+import 'yjs';
 
 /**
  * Who may do what on a board. A board is an identity resource of type `canvas`. The roles, the grants, the invites,

package/dist/worker.js

@@ -5,11 +5,12 @@ import {
   identify,
   sniffImage,
   worker_default
-} from "./chunk-5II2WZIL.js";
-import "./chunk-Z6KLGAFP.js";
+} from "./chunk-4PY5SN2N.js";
+import "./chunk-LMSMUGBF.js";
+import "./chunk-GLNF43N4.js";
 import "./chunk-NWQED42L.js";
-import "./chunk-EDQNA2SU.js";
-import "./chunk-MVWUIBGV.js";
+import "./chunk-BKG3FXX3.js";
+import "./chunk-ZP6BLCB7.js";
 export {
   WS_PROTOCOL,
   authenticate,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-canvas",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "description": "A shared whiteboard for diagrams, drawn by people and agents.",
   "keywords": [
     "whiteboard",
@@ -44,6 +44,10 @@
       "types": "./dist/worker.d.ts",
       "import": "./dist/worker.js"
     },
+    "./account": {
+      "types": "./dist/account.d.ts",
+      "import": "./dist/account.js"
+    },
     "./live": {
       "types": "./dist/live.d.ts",
       "import": "./dist/live.js"