agentic-canvas 0.12.1 → 0.14.0

package/README.md

@@ -7,7 +7,7 @@
 
 A shared whiteboard for diagrams, drawn by people and agents.
 
-> Status: 0.12.1. The board model, the agent operations, the exports, the CLI, the
+> Status: 0.14.0. The board model, the agent operations, the exports, the CLI, the
 > MCP server, a small Worker API, and live co-editing work. The CLI, the MCP server,
 > and the SDK can join a live room. A remote client calls the Worker API. A small web UI, served by the Worker, is new in 0.4.0.
 > The package exports `agentic-canvas/ui`, a board view you can mount in your own app, new in 0.5.0.
@@ -38,7 +38,7 @@ npx agentic-canvas export demo --out demo.svg
 npx agentic-canvas export demo --format png --out demo.png
 ```
 
-Other commands: `list`, `add`, `connect`, `update`, `move`, `rm`, `delete` (a whole board), and `access`, `grant`, `revoke`, `invite` (sharing, server only). Run `npx agentic-canvas --help`.
+Other commands: `list`, `add`, `connect`, `update`, `move`, `rm`, `delete` (a whole board), and `access`, `grant`, `revoke`, `invite`, `links`, `link`, `revoke-link` (sharing, server only). Run `npx agentic-canvas --help`.
 `repair` is for the owner only. It needs `CANVAS_ACTOR=human:<id>`.
 Boards live in `./.agentic-canvas` (or `--dir`, or `CANVAS_DIR`). Every write
 needs an actor in `CANVAS_ACTOR`, as `<kind>:<id>`. The operator sets it. A write
@@ -52,7 +52,7 @@ CANVAS_ACTOR=agent:helper npx agentic-canvas --dir ./boards mcp
 ```
 
 The server speaks MCP on stdio. It has one tool for each CLI command: `create_board`,
-`delete_board`, `list_boards`, `read_board`, `add_shape`, `connect`, `update_element`, `move`, `remove`, `draw_flow`, `export_svg`, `export_png`, and the sharing tools `list_access`, `grant_access`, `revoke_access`, and `create_invite`. `repair` is not a tool. Only a human operator runs it, from the CLI. The server will not start unless `CANVAS_ACTOR` is set to a valid
+`delete_board`, `list_boards`, `read_board`, `add_shape`, `connect`, `update_element`, `move`, `remove`, `draw_flow`, `export_svg`, `export_png`, and the sharing tools `list_access`, `grant_access`, `revoke_access`, `create_invite`, `list_links`, `create_link`, and `revoke_link`. `repair` is not a tool. Only a human operator runs it, from the CLI. The server will not start unless `CANVAS_ACTOR` is set to a valid
 `<kind>:<id>`. That actor stamps every write. No tool takes an actor, author, or kind, so a
 caller cannot choose who it writes as. An error comes back as a tool error with a code.
 
@@ -183,7 +183,7 @@ Roles, from least to most: `viewer`, `commenter`, `editor`, `owner`.
 |---|---|
 | viewer, commenter | Read the board, its SVG, and join its live room to read. A board has no comments yet, so a commenter reads as a viewer. |
 | editor | Also draw: add, update, move, and remove elements. |
-| owner | Also delete the board, grant and revoke roles, list access, invite, and make or revoke share links. |
+| owner | Also delete the board, grant and revoke roles, list access, invite, and list, make, or revoke share links. |
 
 A role never exceeds the scopes of the credential. An agent of an owner holds the owner's role only inside its own
 scopes: it needs `canvas:admin` to share, and `canvas:write` to draw. A caller with no role on a board gets 404, so a read or a write tells a stranger nothing. (A create with an id that is taken answers 409.) A caller with a role that is too low gets 403. `GET /boards` lists the boards you hold a role on.
@@ -197,6 +197,7 @@ HTTP routes, under `/api/v1/canvas`. Each needs a bearer token, except the link
 | `DELETE /boards/:id/grants?subjectKind=&subjectId=` | Owner. Revoke. The last owner cannot be removed. |
 | `POST /boards/:id/invites` | Owner. Body `{ role, email }` or `{ role, handle }`, and optional `expiresInMs`. The role is not `owner`. Returns `{ id }`. |
 | `POST /invites/accept` | Body `{ id }`. The caller must be the person (verified email) or the agent (handle) the invite names. |
+| `GET /boards/:id/links` | Owner. The links of the board: `{ id, role, signedInOnly, expiresAt?, revokedAt? }`. No token. Up to 200, and `truncated: true` if there are more. `skipped` counts damaged records left out. |
 | `POST /boards/:id/links` | Owner. Body `{ role, signedInOnly?, expiresInMs? }`. Returns `{ id, token }`. The token shows once. |
 | `DELETE /boards/:id/links/:link` | Owner. Revoke a link of this board. |
 | `GET /shared/:id` and `GET /shared/:id/svg` | No bearer token needed. Send the link token in `x-link-token`. Read only. |
@@ -212,6 +213,9 @@ await canvas.grant("demo", { subjectKind: "agent", subjectId: "helper", role: "e
 await canvas.invite("demo", { role: "viewer", email: "ada@example.com", expiresInMs: 86_400_000 });
 const { grants, invites } = await canvas.access("demo"); // an invite shows no email
 await canvas.revoke("demo", { subjectKind: "agent", subjectId: "helper" });
+const link = await canvas.createLink("demo", { role: "viewer", expiresInMs: 86_400_000 }); // link.token shows once
+const { links } = await canvas.links("demo"); // no tokens
+await canvas.revokeLink("demo", link.id);
 ```
 
 ```sh
@@ -220,16 +224,49 @@ npx agentic-canvas access demo
 npx agentic-canvas grant demo agent:helper --role editor
 npx agentic-canvas invite demo --role viewer --handle helper --expires-in-ms 86400000
 npx agentic-canvas revoke demo agent:helper
+npx agentic-canvas link demo --role viewer --expires-in-ms 86400000   # prints the token once
+npx agentic-canvas links demo
+npx agentic-canvas revoke-link demo <link-id>
 ```
 
-With `CANVAS_SERVER` set, `npx agentic-canvas mcp` serves `list_access`, `grant_access`, `revoke_access`, and `create_invite` as well.
+With `CANVAS_SERVER` set, `npx agentic-canvas mcp` serves `list_access`, `grant_access`, `revoke_access`, `create_invite`, `list_links`, `create_link`, and `revoke_link` as well.
 Each prints or returns the server's JSON. A refusal has the server's code, such as `NOT_FOUND`, `FORBIDDEN`, or `INVALID`.
-Share links and invite acceptance stay on the HTTP API.
+Invite acceptance stays on the HTTP API.
 
 A live MCP server with an admin token can share boards: an agent that holds it can grant `owner` and revoke grants. Give an agent a token with `canvas:write` only, unless it must share.
 
 The static dev fallback holds no board roles. Its tokens reach every board and cannot share.
 
+## Account export and erase
+
+A host that runs a person's data export and erase imports `canvasAccount` from `agentic-canvas/account`. It never reads the storage layout.
+
+```ts
+import { canvasAccount } from "agentic-canvas/account";
+const data = await canvasAccount.exportAccount({ kind: "human", id: "ada" }, { store, saveRoom, eraseRoom });
+const counts = await canvasAccount.eraseAccount({ kind: "human", id: "ada" }, { store, saveRoom, eraseRoom });
+```
+
+The export is plain JSON in the collections `boards`, `grants`, `invites`, `authored_elements`, `edited_elements`, `titles`, and `audit`. It has no format or time. The erase returns a count for each name.
+
+- A board that the subject alone owns is deleted with its grants, invites, links, and audit entries. The erase calls `eraseRoom(boardId)` first, as the Worker does.
+- On any other board, the subject's grant and invites go. The elements it made are deleted. A connector of someone else that was bound to one of them goes too, and no count or export lists it. The members of a deleted group move to its parent. The editor of an element it only edited becomes `(erased)`, and a title it set is cleared.
+- Its audit entries (it acted, it roots the chain, or a grant named it) stay with the id set to `(erased)`. The kinds stay, so an entry still says if a machine acted.
+- A second erase counts zero. Stop writes first: a write between export and erase is erased and not exported.
+- The erase reads every stored board to find the subject's elements, before it changes data. It stops with `INVALID` on a board that does not decode, on a damaged grant of the subject, on a damaged invite of the subject, on a board with child resources, on an owner grant that the sharing records do not accept, on a damaged co-owner grant, and on an audit entry that names the subject, as the actor, the root of the chain, or the target, with an unknown kind. The checks may add audit entries about the subject: the erase scrubs them.
+- Live rooms: give `saveRoom(boardId)`, which saves the room to the Store as the Worker does before a read. Without it, edits that no request has saved yet are not seen, and the reset below drops them. Give `eraseRoom(boardId)` too: the erase calls it for every board that it changes or deletes, so the room opens again from the Store.
+- `boards` holds each stored entry as it is, with full images and groups. It includes the elements that others made on the board.
+- Run the canvas erase before the identity erase of the person: the identity erase removes the grants that this erase finds boards by.
+- The subject is any principal kind, for example `agent_of_human`: call once for each principal. The id follows the strict identity rule: an old board that has an id from the older, looser rule cannot be named.
+- Known gaps:
+  - Invites and audit entries name a principal by id with no kind, so `human:ada` and `agent:ada` share them. Do not give two principals one id.
+  - An audit entry where the subject is only a middle step of the chain is not found.
+  - An invite that someone else made for the subject's email or handle stays. The package cannot map a principal to an address.
+  - Image bytes in the image store have no uploader record, so they are not exported or erased. Only the `blob:` key in an element is.
+  - A deleted element leaves its id in the stored Yjs history. Its content is gone, and an id that the caller chose can stay in the stored bytes.
+  - A connector of someone else that the subject edited, and that goes with a deleted shape, is in `edited_elements` of the export and not in its erase count.
+- The shape is provisional. It is the `AccountPackage` contract that a later `agentic-identity` release adds to `agentic-identity/account`. The `AccountApp` of 0.9.0 is a different contract, and this does not fit it.
+
 ## UI
 
 The Worker serves a small web UI at its root. It uses the published `agentic-design` package for
@@ -431,7 +468,7 @@ old author stays on its elements. Only new writes follow the strict rule.
 |---|---|
 | `createClient(options)`, `CanvasApiError` | The remote client. See Remote client above. |
 | `parseSubject(text)` | Reads `human:<id>` or `agent:<id>` as `{ subjectKind, subjectId }`. It throws a `TypeError` for any other text. |
-| `BoardSharing` (type), `BoardRole` (type), `SubjectKind` (type), `Subject` (type), `BoardGrant` (type), `BoardInvite` (type), `InviteInput` (type) | Types for sharing. |
+| `BoardSharing` (type), `BoardRole` (type), `SubjectKind` (type), `Subject` (type), `BoardGrant` (type), `BoardInvite` (type), `InviteInput` (type), `BoardLink` (type), `LinkInput` (type) | Types for sharing. |
 | `ClientOptions` (type), `CallOptions` (type), `CanvasClient` (type), `ShapeInput` (type), `ConnectorInput` (type), `ShapePatch` (type), `ConnectorPatch` (type), `ImageInfo` (type), `ApiErrorCode` (type) | Types for the client. `ApiErrorCode` adds the client's own codes, such as `NETWORK`, to `ErrorCode`. |
 
 ### `agentic-canvas/file-store`

package/dist/account.d.ts

@@ -0,0 +1,33 @@
+import { Store, Json } from 'agentic-identity';
+import { P as Principal } from './principal-blhsFbdS.js';
+import 'zod';
+
+interface CanvasAccountDeps {
+    /** The Store that holds the boards and the sharing records. */
+    store: Store;
+    /** Saves the live room of a board to the Store, as the Worker does before it reads a board. Without it, edits that no request has saved yet are not seen, and an erase that resets a room drops them. The call runs for every stored board, so it must be cheap for a board with no room. A board with no room needs no work. Omit it when no room runs. */
+    saveRoom?: (boardId: string) => Promise<void>;
+    /** Erases the live room of a board, so it opens again from the Store. The erase calls it for every board that it changes or deletes. Omit it when no room runs. */
+    eraseRoom?: (boardId: string) => Promise<void>;
+}
+type CanvasCollection = "boards" | "grants" | "invites" | "authored_elements" | "edited_elements" | "titles" | "audit";
+interface CanvasAccount {
+    id: "canvas";
+    /**
+     * Collections: `boards` (each board the subject is the only owner of, with its elements), `grants` (every role the subject
+     * holds on a board), `invites` (made by the subject, with no email), `authored_elements` (made by the subject on a board of someone else, with
+     * its `boardId`), `edited_elements` (made by someone else, last edited by the subject: `boardId` and `elementId`), `titles` (boards
+     * of someone else whose title the subject set), and `audit` (entries on a board where the subject acted as the principal, as the root of the chain, or was the target of a grant, as stored). It holds no format, version, or time.
+     */
+    exportAccount(subject: Principal, deps: CanvasAccountDeps): Promise<Record<CanvasCollection, Json[]>>;
+    /**
+     * Deletes the boards the subject is the only owner of, with their grants, invites, links, and audit entries. On every other
+     * board it removes the subject's grant and invites, deletes the elements the subject made, sets the editor of the
+     * elements it edited to `(erased)`, clears a title it set, and sets its audit entries to `(erased)`. Counts by the same collection
+     * names. A second run counts zero. Run it with writes stopped: a write after the export is erased and not exported.
+     */
+    eraseAccount(subject: Principal, deps: CanvasAccountDeps): Promise<Record<CanvasCollection, number>>;
+}
+declare const canvasAccount: CanvasAccount;
+
+export { type CanvasAccount, type CanvasAccountDeps, type CanvasCollection, canvasAccount };

package/dist/account.js

@@ -0,0 +1,213 @@
+import {
+  RESOURCE_TYPE
+} from "./chunk-A2F73EQJ.js";
+import {
+  fromBase64,
+  isBoardId,
+  toBase64
+} from "./chunk-GLNF43N4.js";
+import "./chunk-NWQED42L.js";
+import "./chunk-BKG3FXX3.js";
+import {
+  Board,
+  CanvasError,
+  PRINCIPAL_KINDS,
+  principalSchema
+} from "./chunk-ZP6BLCB7.js";
+
+// src/account.ts
+import { createSharing, ROLES, SUBJECT_KINDS } from "agentic-identity";
+var ERASED = "(erased)";
+var PAGE = 100;
+async function* pages(store, collection, where) {
+  let cursor;
+  do {
+    const page = await store.query(collection, { where, limit: PAGE, ...cursor === void 0 ? {} : { cursor } });
+    yield* page.items;
+    cursor = page.nextCursor;
+  } while (cursor !== void 0);
+}
+var rows = async (store, collection, where) => {
+  const out = [];
+  for await (const row of pages(store, collection, where)) out.push(row);
+  return out;
+};
+var plain = (value) => JSON.parse(JSON.stringify(value));
+function check(subject, deps) {
+  if (typeof deps?.store?.query !== "function") throw new CanvasError("INVALID", "canvasAccount needs deps.store");
+  for (const hook of [deps.saveRoom, deps.eraseRoom]) if (hook !== void 0 && typeof hook !== "function") throw new CanvasError("INVALID", "deps.saveRoom and deps.eraseRoom must be functions");
+  if (!principalSchema.safeParse(subject).success) throw new CanvasError("INVALID", "subject needs an id and a known kind");
+}
+async function held(store, subject) {
+  const all = [];
+  const sole = /* @__PURE__ */ new Set();
+  for await (const { id: grantId, data } of pages(store, "grants", { subjectKind: subject.kind, subjectId: subject.id })) {
+    const { resourceId: id, role } = data;
+    if (typeof id !== "string" || typeof role !== "string" || !ROLES.includes(role)) throw new CanvasError("INVALID", `grant "${grantId}" of the subject is damaged`);
+    const resource = await store.get("resources", id);
+    if (resource === null ? !isBoardId(id) : resource.type !== RESOURCE_TYPE) continue;
+    all.push({ grantId, resourceId: id, role });
+    if (resource === null || role !== "owner") continue;
+    const owners = await rows(store, "grants", { resourceId: id, role: "owner" });
+    if (owners.some((o) => typeof o.data.subjectId !== "string" || !SUBJECT_KINDS.includes(o.data.subjectKind))) throw new CanvasError("INVALID", `an owner grant on board "${id}" is damaged`);
+    if (owners.every((o) => o.data.subjectKind === subject.kind && o.data.subjectId === subject.id)) sole.add(id);
+  }
+  return { all, sole };
+}
+async function* boards(store, saveRoom) {
+  let cursor;
+  do {
+    const page = await store.query("boards", { limit: PAGE, ...cursor === void 0 ? {} : { cursor } });
+    for (const item of page.items) {
+      const { id } = item;
+      let data = item.data;
+      if (saveRoom) {
+        await saveRoom(id);
+        data = await store.get("boards", id) ?? data;
+      }
+      try {
+        yield { id, board: Board.open(fromBase64(String(data.update))) };
+      } catch {
+        throw new CanvasError("INVALID", `stored board "${id}" is damaged`);
+      }
+    }
+    cursor = page.nextCursor;
+  } while (cursor !== void 0);
+}
+var isSubject = (value, subject) => typeof value === "object" && value !== null && value.kind === subject.kind && value.id === subject.id;
+async function auditOf(store, subject) {
+  const found = /* @__PURE__ */ new Map();
+  for (const field of ["principalId", "rootId", "targetId"]) for (const row of await rows(store, "audit", { [field]: subject.id })) found.set(row.id, row);
+  const out = [];
+  const known = (kind, extra = []) => PRINCIPAL_KINDS.includes(kind) || extra.includes(kind);
+  for (const row of found.values()) {
+    const { principalId, principalKind, chain, rootId, resourceId, targetKind, targetId } = row.data;
+    if (typeof resourceId !== "string" || !isBoardId(resourceId)) continue;
+    const resource = await store.get("resources", resourceId);
+    if (resource !== null && resource.type !== RESOURCE_TYPE) continue;
+    const first = Array.isArray(chain) ? chain[0] : null;
+    const damaged = principalId === subject.id && !known(principalKind, ["anonymous"]) || targetId === subject.id && !known(targetKind, ["invite", "link", "person", "app", "key"]) || (first?.id === subject.id || first === null && rootId === subject.id) && !known(first?.kind);
+    if (damaged) throw new CanvasError("INVALID", `audit entry "${row.id}" is damaged`);
+    if (isSubject({ kind: principalKind, id: principalId }, subject) || isSubject(first, subject) || isSubject({ kind: targetKind, id: targetId }, subject)) out.push(row);
+  }
+  return out;
+}
+async function invitesOf(store, subject) {
+  const out = [];
+  for (const row of await rows(store, "invites", { createdBy: subject.id })) {
+    const { resourceId } = row.data;
+    if (typeof resourceId !== "string") throw new CanvasError("INVALID", `invite "${row.id}" of the subject is damaged`);
+    if (!isBoardId(resourceId)) continue;
+    const resource = await store.get("resources", resourceId);
+    if (resource === null || resource.type === RESOURCE_TYPE) out.push(row);
+  }
+  return out;
+}
+function scrub(data, subject) {
+  const erase = (step) => isSubject(step, subject) ? { ...step, id: ERASED } : step;
+  return {
+    ...data,
+    ...isSubject({ kind: data.principalKind, id: data.principalId }, subject) ? { principalId: ERASED } : {},
+    ...data.rootId === subject.id ? { rootId: ERASED } : {},
+    ...isSubject({ kind: data.targetKind, id: data.targetId }, subject) ? { targetId: ERASED } : {},
+    ...Array.isArray(data.chain) ? { chain: data.chain.map(erase) } : {}
+  };
+}
+var canvasAccount = {
+  id: "canvas",
+  async exportAccount(subject, deps) {
+    check(subject, deps);
+    const { store } = deps;
+    const out = { boards: [], grants: [], invites: [], authored_elements: [], edited_elements: [], titles: [], audit: [] };
+    const mine = await held(store, subject);
+    const owned = /* @__PURE__ */ new Map();
+    for await (const { id, board } of boards(store, deps.saveRoom)) {
+      if (mine.sole.has(id)) {
+        owned.set(id, plain([{ id, title: board.title, elements: board.rawElements() }])[0]);
+        continue;
+      }
+      const found = board.stampedBy(subject);
+      out.authored_elements.push(...plain(found.authored.map((element) => ({ boardId: id, element }))));
+      out.edited_elements.push(...plain(found.edited.map((elementId) => ({ boardId: id, elementId }))));
+      if (found.titleBy) out.titles.push(...plain([{ boardId: id, title: board.title }]));
+    }
+    for (const g of mine.all) {
+      out.grants.push(...plain([{ resourceId: g.resourceId, subjectKind: subject.kind, subjectId: subject.id, role: g.role }]));
+    }
+    for (const id of mine.sole) if (owned.has(id)) out.boards.push(owned.get(id));
+    for (const { id, data } of await invitesOf(store, subject)) {
+      const { resourceId, role, expiresAt, acceptedAt, revokedAt } = data;
+      out.invites.push(...plain([{ id, resourceId, role, expiresAt, acceptedAt, revokedAt }]));
+    }
+    out.audit.push(...plain((await auditOf(store, subject)).map((r) => r.data)));
+    return out;
+  },
+  async eraseAccount(subject, deps) {
+    check(subject, deps);
+    const { store } = deps;
+    const sharing = createSharing(store);
+    const total = { boards: 0, grants: 0, invites: 0, authored_elements: 0, edited_elements: 0, titles: 0, audit: 0 };
+    const ctx = { principalId: subject.id, kind: subject.kind, chain: [{ id: subject.id, kind: subject.kind }], scopes: [`${RESOURCE_TYPE}:admin`] };
+    const mine = await held(store, subject);
+    const stamped = [];
+    for await (const { id, board } of boards(store, deps.saveRoom)) {
+      if (mine.sole.has(id)) continue;
+      const found = board.stampedBy(subject);
+      if (found.authored.length > 0 || found.edited.length > 0 || found.titleBy) stamped.push(id);
+    }
+    for (const id of mine.sole) {
+      if ((await rows(store, "resources", { parentId: id })).length > 0) throw new CanvasError("INVALID", `board "${id}" has child resources: remove them first`);
+      if (!(await sharing.can(ctx, "admin", id)).allowed) throw new CanvasError("INVALID", `the owner grant on board "${id}" is not valid: an operator repairs it first`);
+    }
+    for (const { id, data } of await auditOf(store, subject)) {
+      await store.put("audit", id, scrub(data, subject));
+      total.audit += 1;
+    }
+    for (const { id } of await invitesOf(store, subject)) {
+      await store.delete("invites", id);
+      total.invites += 1;
+    }
+    for (const id of mine.sole) {
+      await deps.eraseRoom?.(id);
+      await store.delete("boards", id);
+      await deps.eraseRoom?.(id);
+      await sharing.deleteResource(ctx, id).catch((e) => {
+        if (e instanceof Error && (e.name === "EraseRefusedError" || e.message === "forbidden")) throw new CanvasError("INVALID", e.message);
+        throw e;
+      });
+      total.boards += 1;
+    }
+    for (const id of stamped) {
+      const done = await store.transaction(async (tx) => {
+        const doc = await tx.get("boards", id);
+        if (!doc) return null;
+        let board;
+        try {
+          board = Board.open(fromBase64(String(doc.update)));
+        } catch {
+          throw new CanvasError("INVALID", `stored board "${id}" is damaged`);
+        }
+        const counts = board.eraseStamps(subject, { kind: subject.kind, id: ERASED });
+        await tx.put("boards", id, { update: toBase64(board.encode()) });
+        return counts;
+      });
+      await deps.eraseRoom?.(id);
+      if (!done) continue;
+      total.authored_elements += done.authored;
+      total.edited_elements += done.edited;
+      total.titles += done.title ? 1 : 0;
+    }
+    for (const g of mine.all) {
+      if (mine.sole.has(g.resourceId)) {
+        total.grants += 1;
+        continue;
+      }
+      await store.delete("grants", g.grantId);
+      total.grants += 1;
+    }
+    return total;
+  }
+};
+export {
+  canvasAccount
+};

package/dist/{chunk-5II2WZIL.js → chunk-5QUL3URJ.js}

@@ -1,15 +1,16 @@
+import {
+  CanvasAccess
+} from "./chunk-A2F73EQJ.js";
 import {
   CanvasService,
-  MAX_LIVE_BYTES,
-  isBoardId,
-  isStoreId
-} from "./chunk-Z6KLGAFP.js";
+  MAX_LIVE_BYTES
+} from "./chunk-GLNF43N4.js";
 import {
   CanvasError
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/worker.ts
-import { createStoreAuth, hasScope as hasScope2, parsePrincipal, parseRegion } from "agentic-identity";
+import { createStoreAuth, hasScope, parsePrincipal, parseRegion } from "agentic-identity";
 import { createD1Store, createR2Blobs, D1_SCHEMA } from "agentic-identity/cloudflare";
 import { acceptWebSocketProtocol, principalFromWebSocketRequest } from "agentic-identity/http";
 
@@ -1790,150 +1791,6 @@ var Hono3 = class extends Hono {
   }
 };
 
-// src/access.ts
-import { createSharing, EraseRefusedError, hasScope, ROLES, SUBJECT_KINDS } from "agentic-identity";
-var RESOURCE_TYPE = "canvas";
-var SHARE_ROLES = ROLES.filter((r) => r !== "owner");
-var BAD_INPUT = /^(give an email or a handle|invalid handle|invalid email|invalid subject( kind "[^"]*")?|the last owner cannot be removed|expiresInMs must be .*|expiresAt must be .*|invalid role .*)$/;
-function refuse(error) {
-  if (error instanceof EraseRefusedError) throw new CanvasError("INVALID", error.message);
-  if (error instanceof Error && error.message === "forbidden") throw new CanvasError("FORBIDDEN", "you may not do this on this board");
-  if (error instanceof Error && BAD_INPUT.test(error.message)) throw new CanvasError("INVALID", error.message);
-  throw error;
-}
-var oneOf = (value, list, name) => {
-  if (typeof value !== "string" || !list.includes(value)) throw new CanvasError("INVALID", `${name} must be one of: ${list.join(", ")}`);
-  return value;
-};
-var storeId = (value, name) => {
-  if (typeof value !== "string" || !isStoreId(value)) throw new CanvasError("INVALID", `${name} must be 1 to 128 of A-Z, a-z, 0-9, _ and -, and not like __x__`);
-  return value;
-};
-var word = (value, name) => {
-  if (typeof value !== "string" || value === "") throw new CanvasError("INVALID", `${name} must be a non-empty string`);
-  return value;
-};
-var lifetime = (value, name) => {
-  if (value === void 0) return void 0;
-  if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new CanvasError("INVALID", `${name} must be a whole number of milliseconds above 0`);
-  return value;
-};
-var CanvasAccess = class {
-  constructor(store, options = {}) {
-    this.store = store;
-    this.sharing = createSharing(store, options);
-    this.now = options.now ?? Date.now;
-  }
-  store;
-  sharing;
-  now;
-  /** A board id that the Store refuses names no board. The gate checks this for a role holder: a token of the dev list skips the gate. */
-  known(id) {
-    if (!isBoardId(id)) throw new CanvasError("NOT_FOUND", `no board "${id}"`);
-  }
-  /** Make the actor the owner of a new board. */
-  async register(ctx, id) {
-    await this.sharing.createResource(ctx, { id, type: RESOURCE_TYPE }).catch((error) => {
-      if (error instanceof Error && error.message === "resource exists") throw new CanvasError("DUPLICATE_ID", `board "${id}" already exists`);
-      if (error instanceof Error && error.message === "resource id has old audit entries") throw new CanvasError("UNAVAILABLE", "this board id was used a moment ago. Try again, or use another id");
-      return refuse(error);
-    });
-  }
-  /** Remove the sharing records of a board. Needs an owner. */
-  async unregister(ctx, id) {
-    await this.sharing.deleteResource(ctx, id).catch(refuse);
-  }
-  /** True if the board has sharing records: it was made by an identity credential. */
-  async registered(id) {
-    if (!isBoardId(id)) return false;
-    return (await this.store.get("resources", id))?.type === RESOURCE_TYPE;
-  }
-  /**
-   * True if the caller may do `action` on the board. A link token adds the role of its link. It writes an audit entry.
-   * An id that belongs to a resource of another type, in a Store shared with another app, is no board: it is denied.
-   */
-  async allowed(ctx, action, id, linkToken) {
-    if (!await this.registered(id)) return false;
-    return (await this.sharing.can(ctx, action, id, linkToken === void 0 ? {} : { linkToken })).allowed;
-  }
-  /** Throw NOT_FOUND for a caller who cannot read the board, and FORBIDDEN for one who can read it but not do `action`. */
-  async require(ctx, action, id, linkToken) {
-    if (await this.allowed(ctx, action, id, linkToken)) return;
-    if (action === "read" || !await this.allowed(ctx, "read", id, linkToken)) throw new CanvasError("NOT_FOUND", `no board "${id}"`);
-    throw new CanvasError("FORBIDDEN", `this needs the ${action === "admin" ? "owner" : "editor"} role on the board`);
-  }
-  /** The ids of the boards a person or agent holds a role on, the first 100. A credential without `canvas:read` gets none. */
-  async readable(ctx) {
-    const root = ctx.chain[0];
-    if (!root || !SUBJECT_KINDS.includes(root.kind) || !hasScope(ctx.scopes, `${RESOURCE_TYPE}:read`)) return [];
-    const ids = [];
-    let cursor;
-    for (let pages = 0; pages < 10 && ids.length < 100; pages++) {
-      const page = await this.store.query("grants", { where: { subjectKind: root.kind, subjectId: root.id }, limit: 100, ...cursor === void 0 ? {} : { cursor } });
-      for (const { data } of page.items) {
-        if (ids.length >= 100 || typeof data.resourceId !== "string" || !ROLES.includes(data.role)) continue;
-        if (await this.registered(data.resourceId)) ids.push(data.resourceId);
-      }
-      if ((cursor = page.nextCursor) === void 0) break;
-    }
-    return ids;
-  }
-  async grant(ctx, id, input) {
-    this.known(id);
-    const subject = { kind: oneOf(input.subjectKind, SUBJECT_KINDS, "subjectKind"), id: storeId(input.subjectId, "subjectId") };
-    await this.sharing.grant(ctx, id, subject, oneOf(input.role, ROLES, "role")).catch(refuse);
-    return { ok: true };
-  }
-  async revoke(ctx, id, input) {
-    this.known(id);
-    const subject = { kind: oneOf(input.subjectKind, SUBJECT_KINDS, "subjectKind"), id: storeId(input.subjectId, "subjectId") };
-    await this.sharing.revokeGrant(ctx, id, subject).catch(refuse);
-    return { ok: true };
-  }
-  /** The grants and the invites on a board. An invite never shows its email. Links are not listed: a token shows once. */
-  async list(ctx, id) {
-    this.known(id);
-    const [grants, invites] = await Promise.all([this.sharing.listGrants(ctx, id, { limit: 200 }), this.sharing.listInvites(ctx, id, { limit: 200 })]).catch(refuse);
-    return { grants: grants.grants, invites: invites.invites };
-  }
-  async invite(ctx, id, input) {
-    this.known(id);
-    const role = oneOf(input.role, SHARE_ROLES, "role");
-    const expiresInMs = lifetime(input.expiresInMs, "expiresInMs");
-    const who = input.email !== void 0 ? { email: word(input.email, "email") } : input.handle !== void 0 ? { handle: word(input.handle, "handle") } : {};
-    if (input.email !== void 0 && input.handle !== void 0) throw new CanvasError("INVALID", "give an email or a handle, not both");
-    return this.sharing.createInvite(ctx, id, { role, ...who, ...expiresInMs === void 0 ? {} : { expiresInMs } }).catch(refuse);
-  }
-  /** The email comes from a verified sign-in and the handle from the agent's own record, never from the request. */
-  async accept(ctx, inviteId) {
-    if (!isStoreId(inviteId)) throw new CanvasError("FORBIDDEN", "you may not do this on this board");
-    const user = await this.store.get("users", ctx.principalId);
-    const agent = await this.store.get("principals", ctx.principalId);
-    const identity = {
-      ...user?.emailVerified === true && typeof user.email === "string" ? { email: user.email } : {},
-      ...typeof agent?.handle === "string" ? { handle: agent.handle } : {}
-    };
-    await this.sharing.acceptInvite(ctx, word(inviteId, "id"), identity).catch(refuse);
-    return { ok: true };
-  }
-  /** The token shows once. Only its hash is stored. */
-  async createLink(ctx, id, input) {
-    this.known(id);
-    const role = oneOf(input.role, SHARE_ROLES, "role");
-    const expiresInMs = lifetime(input.expiresInMs, "expiresInMs");
-    if (input.signedInOnly !== void 0 && typeof input.signedInOnly !== "boolean") throw new CanvasError("INVALID", "signedInOnly must be true or false");
-    return this.sharing.createLink(ctx, id, { role, signedInOnly: input.signedInOnly === true, ...expiresInMs === void 0 ? {} : { expiresAt: this.now() + expiresInMs } }).catch(refuse);
-  }
-  /** Revoke a link of this board. A link of another board is NOT_FOUND here, even for an owner of both. */
-  async revokeLink(ctx, id, linkId) {
-    this.known(id);
-    const link = isStoreId(linkId) ? await this.store.get("links", linkId) : null;
-    if (!link || link.resourceId !== id) throw new CanvasError("NOT_FOUND", "no such link on this board");
-    await this.sharing.revokeLink(ctx, linkId).catch(refuse);
-    return { ok: true };
-  }
-};
-
 // src/room-sync.ts
 import * as Y from "yjs";
 var SEEDER = { kind: "agent", id: "canvas-room" };
@@ -2171,7 +2028,7 @@ async function identify(request, env, store) {
   const found = await principalFromWebSocketRequest(request, auth, { protocol: WS_PROTOCOL, scope: "canvas:read" });
   if (failure() !== void 0) throw failure();
   if (found instanceof Response) return null;
-  return { actor: { kind: found.kind, id: found.principalId }, role: hasScope2(found.scopes, "canvas:write") ? "editor" : "viewer", principal: found, dev: dev() };
+  return { actor: { kind: found.kind, id: found.principalId }, role: hasScope(found.scopes, "canvas:write") ? "editor" : "viewer", principal: found, dev: dev() };
 }
 var svgResponse = (svg) => new Response(svg, { headers: { "content-type": "image/svg+xml", "x-content-type-options": "nosniff", "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; img-src data:" } });
 function sniffImage(bytes) {
@@ -2397,6 +2254,7 @@ function createApp(options = {}) {
     return c.json(done);
   });
   api.post("/boards/:id/invites", async (c) => c.json(await c.var.access.invite(c.var.caller.principal, c.req.param("id"), await jsonBody(c)), 201));
+  api.get("/boards/:id/links", async (c) => c.json(await c.var.access.listLinks(c.var.caller.principal, c.req.param("id"))));
   api.post("/boards/:id/links", async (c) => c.json(await c.var.access.createLink(c.var.caller.principal, c.req.param("id"), await jsonBody(c)), 201));
   api.delete("/boards/:id/links/:link", async (c) => c.json(await c.var.access.revokeLink(c.var.caller.principal, c.req.param("id"), c.req.param("link"))));
   api.post("/invites/accept", async (c) => c.json(await c.var.access.accept(c.var.caller.principal, text((await jsonBody(c)).id, "id"))));