agentic-canvas 0.12.1 → 0.14.0

package/dist/chunk-A2F73EQJ.js

@@ -0,0 +1,188 @@
+import {
+  isBoardId,
+  isStoreId
+} from "./chunk-GLNF43N4.js";
+import {
+  CanvasError
+} from "./chunk-ZP6BLCB7.js";
+
+// src/access.ts
+import { createSharing, EraseRefusedError, hasScope, ROLES, SUBJECT_KINDS } from "agentic-identity";
+var RESOURCE_TYPE = "canvas";
+var SHARE_ROLES = ROLES.filter((r) => r !== "owner");
+var BAD_INPUT = /^(give an email or a handle|invalid handle|invalid email|invalid subject( kind "[^"]*")?|the last owner cannot be removed|expiresInMs must be .*|expiresAt must be .*|invalid role .*)$/;
+function refuse(error) {
+  if (error instanceof EraseRefusedError) throw new CanvasError("INVALID", error.message);
+  if (error instanceof Error && error.message === "forbidden") throw new CanvasError("FORBIDDEN", "you may not do this on this board");
+  if (error instanceof Error && BAD_INPUT.test(error.message)) throw new CanvasError("INVALID", error.message);
+  throw error;
+}
+var oneOf = (value, list, name) => {
+  if (typeof value !== "string" || !list.includes(value)) throw new CanvasError("INVALID", `${name} must be one of: ${list.join(", ")}`);
+  return value;
+};
+var storeId = (value, name) => {
+  if (typeof value !== "string" || !isStoreId(value)) throw new CanvasError("INVALID", `${name} must be 1 to 128 of A-Z, a-z, 0-9, _ and -, and not like __x__`);
+  return value;
+};
+var word = (value, name) => {
+  if (typeof value !== "string" || value === "") throw new CanvasError("INVALID", `${name} must be a non-empty string`);
+  return value;
+};
+var lifetime = (value, name) => {
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new CanvasError("INVALID", `${name} must be a whole number of milliseconds above 0`);
+  return value;
+};
+var CanvasAccess = class {
+  constructor(store, options = {}) {
+    this.store = store;
+    this.sharing = createSharing(store, options);
+    this.now = options.now ?? Date.now;
+  }
+  store;
+  sharing;
+  now;
+  /** A board id that the Store refuses names no board. The gate checks this for a role holder: a token of the dev list skips the gate. */
+  known(id) {
+    if (!isBoardId(id)) throw new CanvasError("NOT_FOUND", `no board "${id}"`);
+  }
+  /** Make the actor the owner of a new board. */
+  async register(ctx, id) {
+    await this.sharing.createResource(ctx, { id, type: RESOURCE_TYPE }).catch((error) => {
+      if (error instanceof Error && error.message === "resource exists") throw new CanvasError("DUPLICATE_ID", `board "${id}" already exists`);
+      if (error instanceof Error && error.message === "resource id has old audit entries") throw new CanvasError("UNAVAILABLE", "this board id was used a moment ago. Try again, or use another id");
+      return refuse(error);
+    });
+  }
+  /** Remove the sharing records of a board. Needs an owner. */
+  async unregister(ctx, id) {
+    await this.sharing.deleteResource(ctx, id).catch(refuse);
+  }
+  /** True if the board has sharing records: it was made by an identity credential. */
+  async registered(id) {
+    if (!isBoardId(id)) return false;
+    return (await this.store.get("resources", id))?.type === RESOURCE_TYPE;
+  }
+  /**
+   * True if the caller may do `action` on the board. A link token adds the role of its link. It writes an audit entry.
+   * An id that belongs to a resource of another type, in a Store shared with another app, is no board: it is denied.
+   */
+  async allowed(ctx, action, id, linkToken) {
+    if (!await this.registered(id)) return false;
+    return (await this.sharing.can(ctx, action, id, linkToken === void 0 ? {} : { linkToken })).allowed;
+  }
+  /** Throw NOT_FOUND for a caller who cannot read the board, and FORBIDDEN for one who can read it but not do `action`. */
+  async require(ctx, action, id, linkToken) {
+    if (await this.allowed(ctx, action, id, linkToken)) return;
+    if (action === "read" || !await this.allowed(ctx, "read", id, linkToken)) throw new CanvasError("NOT_FOUND", `no board "${id}"`);
+    throw new CanvasError("FORBIDDEN", `this needs the ${action === "admin" ? "owner" : "editor"} role on the board`);
+  }
+  /** The ids of the boards a person or agent holds a role on, the first 100. A credential without `canvas:read` gets none. */
+  async readable(ctx) {
+    const root = ctx.chain[0];
+    if (!root || !SUBJECT_KINDS.includes(root.kind) || !hasScope(ctx.scopes, `${RESOURCE_TYPE}:read`)) return [];
+    const ids = [];
+    let cursor;
+    for (let pages = 0; pages < 10 && ids.length < 100; pages++) {
+      const page = await this.store.query("grants", { where: { subjectKind: root.kind, subjectId: root.id }, limit: 100, ...cursor === void 0 ? {} : { cursor } });
+      for (const { data } of page.items) {
+        if (ids.length >= 100 || typeof data.resourceId !== "string" || !ROLES.includes(data.role)) continue;
+        if (await this.registered(data.resourceId)) ids.push(data.resourceId);
+      }
+      if ((cursor = page.nextCursor) === void 0) break;
+    }
+    return ids;
+  }
+  async grant(ctx, id, input) {
+    this.known(id);
+    const subject = { kind: oneOf(input.subjectKind, SUBJECT_KINDS, "subjectKind"), id: storeId(input.subjectId, "subjectId") };
+    await this.sharing.grant(ctx, id, subject, oneOf(input.role, ROLES, "role")).catch(refuse);
+    return { ok: true };
+  }
+  async revoke(ctx, id, input) {
+    this.known(id);
+    const subject = { kind: oneOf(input.subjectKind, SUBJECT_KINDS, "subjectKind"), id: storeId(input.subjectId, "subjectId") };
+    await this.sharing.revokeGrant(ctx, id, subject).catch(refuse);
+    return { ok: true };
+  }
+  /** The grants and the invites on a board. An invite never shows its email. `listLinks` lists the links, and never a token. */
+  async list(ctx, id) {
+    this.known(id);
+    const [grants, invites] = await Promise.all([this.sharing.listGrants(ctx, id, { limit: 200 }), this.sharing.listInvites(ctx, id, { limit: 200 })]).catch(refuse);
+    return { grants: grants.grants, invites: invites.invites };
+  }
+  async invite(ctx, id, input) {
+    this.known(id);
+    const role = oneOf(input.role, SHARE_ROLES, "role");
+    const expiresInMs = lifetime(input.expiresInMs, "expiresInMs");
+    const who = input.email !== void 0 ? { email: word(input.email, "email") } : input.handle !== void 0 ? { handle: word(input.handle, "handle") } : {};
+    if (input.email !== void 0 && input.handle !== void 0) throw new CanvasError("INVALID", "give an email or a handle, not both");
+    return this.sharing.createInvite(ctx, id, { role, ...who, ...expiresInMs === void 0 ? {} : { expiresInMs } }).catch(refuse);
+  }
+  /** The email comes from a verified sign-in and the handle from the agent's own record, never from the request. */
+  async accept(ctx, inviteId) {
+    if (!isStoreId(inviteId)) throw new CanvasError("FORBIDDEN", "you may not do this on this board");
+    const user = await this.store.get("users", ctx.principalId);
+    const agent = await this.store.get("principals", ctx.principalId);
+    const identity = {
+      ...user?.emailVerified === true && typeof user.email === "string" ? { email: user.email } : {},
+      ...typeof agent?.handle === "string" ? { handle: agent.handle } : {}
+    };
+    await this.sharing.acceptInvite(ctx, word(inviteId, "id"), identity).catch(refuse);
+    return { ok: true };
+  }
+  /** The token shows once. Only its hash is stored. */
+  async createLink(ctx, id, input) {
+    this.known(id);
+    const role = oneOf(input.role, SHARE_ROLES, "role");
+    const expiresInMs = lifetime(input.expiresInMs, "expiresInMs");
+    if (input.signedInOnly !== void 0 && typeof input.signedInOnly !== "boolean") throw new CanvasError("INVALID", "signedInOnly must be true or false");
+    return this.sharing.createLink(ctx, id, { role, signedInOnly: input.signedInOnly === true, ...expiresInMs === void 0 ? {} : { expiresAt: this.now() + expiresInMs } }).catch(refuse);
+  }
+  /** The links of a board. A summary never holds the token or its hash. Needs an owner. */
+  async listLinks(ctx, id) {
+    this.known(id);
+    await this.require(ctx, "admin", id);
+    const all = [];
+    let cursor;
+    let skipped = 0;
+    for (let pages = 0; pages < 10; pages++) {
+      const page = await this.store.query("links", { where: { resourceId: id }, limit: 100, ...cursor === void 0 ? {} : { cursor } });
+      for (const { id: key, data } of page.items) {
+        const expiresOk = data.expiresAt == null || typeof data.expiresAt === "number" && Number.isFinite(data.expiresAt);
+        if (data.id !== key || data.resourceId !== id || typeof data.tokenHash !== "string" || typeof data.id !== "string" || !SHARE_ROLES.includes(data.role) || !expiresOk) {
+          skipped++;
+          continue;
+        }
+        all.push({
+          id: data.id,
+          role: data.role,
+          signedInOnly: data.signedInOnly === true,
+          ...typeof data.expiresAt === "number" ? { expiresAt: data.expiresAt } : {},
+          // Any value but null means revoked, as in agentic-identity. A value that is not a time shows as 0.
+          ...data.revokedAt == null ? {} : { revokedAt: typeof data.revokedAt === "number" ? data.revokedAt : 0 }
+        });
+      }
+      if ((cursor = page.nextCursor) === void 0) break;
+    }
+    const now = this.now();
+    const live = (l) => l.revokedAt === void 0 && (l.expiresAt === void 0 || l.expiresAt > now);
+    all.sort((x, y) => Number(live(y)) - Number(live(x)) || (y.expiresAt ?? Infinity) - (x.expiresAt ?? Infinity) || x.id.localeCompare(y.id));
+    const links = all.slice(0, 200);
+    return { links, ...cursor !== void 0 || all.length > 200 ? { truncated: true } : {}, ...skipped > 0 ? { skipped } : {} };
+  }
+  /** Revoke a link of this board. A link of another board is NOT_FOUND here, even for an owner of both. */
+  async revokeLink(ctx, id, linkId) {
+    this.known(id);
+    const link = isStoreId(linkId) ? await this.store.get("links", linkId) : null;
+    if (!link || link.resourceId !== id) throw new CanvasError("NOT_FOUND", "no such link on this board");
+    await this.sharing.revokeLink(ctx, linkId).catch(refuse);
+    return { ok: true };
+  }
+};
+
+export {
+  RESOURCE_TYPE,
+  CanvasAccess
+};

package/dist/{chunk-EDQNA2SU.js → chunk-BKG3FXX3.js}

@@ -4,7 +4,7 @@ import {
   IMAGE_PATTERN,
   MAX_ELEMENTS,
   SHAPE_TYPES
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/core/flow.ts
 import dagre from "@dagrejs/dagre";

package/dist/{chunk-Z6KLGAFP.js → chunk-GLNF43N4.js}

@@ -4,13 +4,13 @@ import {
 import {
   drawFlow,
   toSvg
-} from "./chunk-EDQNA2SU.js";
+} from "./chunk-BKG3FXX3.js";
 import {
   Board,
   CanvasError,
   principalSchema,
   readBoard
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/service.ts
 import * as Y from "yjs";
@@ -224,6 +224,8 @@ function decodeStored(doc, id, decode) {
 
 export {
   MAX_LIVE_BYTES,
+  toBase64,
+  fromBase64,
   isStoreId,
   isBoardId,
   CanvasService

package/dist/{chunk-7EWHZCKY.js → chunk-YKUHPOQV.js}

@@ -2,11 +2,11 @@ import {
   CanvasError,
   PRINCIPAL_KINDS,
   SHAPE_TYPES
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "0.12.1" : readPackageVersion();
+var VERSION = true ? "0.14.0" : readPackageVersion();
 
 // src/brand.ts
 var BRAND = {
@@ -198,6 +198,24 @@ function createMcpServer(service, actor, sharing) {
     },
     tool(async ({ board: b, ...input }) => json(await shared().invite(b, input)))
   );
+  server.registerTool(
+    "list_links",
+    { description: "List the share links of a board, without their tokens. Needs the owner role.", inputSchema: { board }, annotations: read },
+    tool(async (a) => json(await shared().links(a.board)))
+  );
+  server.registerTool(
+    "create_link",
+    {
+      description: "Make a share link. Anyone with the token can read the board, and only read: the role does not widen a link visit. With signedInOnly, only a signed-in visitor may use it. The token shows once: keep it. The role is not owner. Needs the owner role.",
+      inputSchema: { board, role: z.enum(["viewer", "commenter", "editor"]), signedInOnly: z.boolean().optional(), expiresInMs: z.number().int().positive().optional() }
+    },
+    tool(async ({ board: b, ...input }) => json(await shared().createLink(b, input)))
+  );
+  server.registerTool(
+    "revoke_link",
+    { description: "Revoke a share link of a board. Needs the owner role.", inputSchema: { board, link: z.string() }, annotations: { destructiveHint: true } },
+    tool(async (a) => json(await shared().revokeLink(a.board, a.link)))
+  );
   return server;
 }
 async function runMcp(service, actor, sharing) {

package/dist/{chunk-MVWUIBGV.js → chunk-ZP6BLCB7.js}

@@ -94,6 +94,7 @@ var isBindable = (type) => typeof type === "string" && type !== "connector" && t
 var isValidZ = (value) => typeof value === "number" && Number.isFinite(value) && Math.abs(value) <= MAX_Z;
 var clampZ = (value) => Math.min(MAX_Z, Math.max(-MAX_Z, value));
 var samePrincipal = (a, b) => a.kind === b.kind && a.id === b.id;
+var isStamp = (value, who) => typeof value === "object" && value !== null && value.kind === who.kind && value.id === who.id;
 var hasId = (e) => typeof e === "object" && e !== null && typeof e.id === "string";
 var Board = class _Board {
   doc;
@@ -348,6 +349,62 @@ var Board = class _Board {
     this.write(plan, by);
     return plan.map(([memberId]) => memberId);
   }
+  /** Every stored entry as it is, valid or not, with its key as `id`. */
+  rawElements() {
+    return [...this.elements].map(([key, entry]) => ({ ...entry instanceof Y.Map ? entry.toJSON() : {}, id: key }));
+  }
+  /**
+   * The raw stored elements that `who` made (`author`) and the ids of those that `who` last edited but did not make.
+   * It reads entries as they are, with no element checks, so a damaged entry still shows. Account export uses it.
+   */
+  stampedBy(who) {
+    const authored = [];
+    const edited = [];
+    for (const [key, entry] of this.elements) {
+      if (!(entry instanceof Y.Map)) continue;
+      if (isStamp(entry.get("author"), who)) authored.push({ ...entry.toJSON(), id: key });
+      else if (isStamp(entry.get("editedBy"), who)) edited.push(key);
+    }
+    return { authored, edited, titleBy: isStamp(this.meta.get("titleBy"), who) };
+  }
+  /**
+   * Erase `who` from the board. An element they made is deleted alone: its members go to its parent group, and a
+   * connector of someone else that was bound to it goes too, because it would be hidden. An element they only edited
+   * keeps its content, and its editor becomes `(erased)`. A title they set is cleared. Idempotent. Returns the counts.
+   */
+  eraseStamps(who, erased) {
+    const mine = /* @__PURE__ */ new Set();
+    for (const [key, entry] of this.elements) if (entry instanceof Y.Map && isStamp(entry.get("author"), who)) mine.add(key);
+    const counts = { authored: mine.size, edited: 0, dangling: 0, title: isStamp(this.meta.get("titleBy"), who) };
+    this.doc.transact(() => {
+      for (const key of mine) {
+        const parent = this.elements.get(key).get("groupId");
+        for (const [, other] of this.elements) {
+          if (other instanceof Y.Map && other.get("groupId") === key) {
+            if (typeof parent === "string") other.set("groupId", parent);
+            else other.delete("groupId");
+          }
+        }
+      }
+      mine.forEach((key) => this.elements.delete(key));
+      for (const [key, entry] of [...this.elements]) {
+        if (!(entry instanceof Y.Map)) continue;
+        const ends = [entry.get("from"), entry.get("to")];
+        if (entry.get("type") === "connector" && ends.some((e) => hasId(e) && mine.has(e.id))) {
+          this.elements.delete(key);
+          counts.dangling += 1;
+        } else if (isStamp(entry.get("editedBy"), who)) {
+          entry.set("editedBy", erased);
+          counts.edited += 1;
+        }
+      }
+      if (counts.title) {
+        this.meta.delete("title");
+        this.meta.set("titleBy", erased);
+      }
+    });
+    return counts;
+  }
   /** Delete an element. A shape takes its connectors and a group takes its members. Returns the ids removed. */
   remove(elementId) {
     this.require(elementId);

package/dist/cli.js

@@ -5,18 +5,18 @@ import {
   operatorActor,
   runMcp,
   svgToPng
-} from "./chunk-7EWHZCKY.js";
+} from "./chunk-YKUHPOQV.js";
 import {
   openLocalStore
 } from "./chunk-NRLF6MGR.js";
 import {
   CanvasService
-} from "./chunk-Z6KLGAFP.js";
+} from "./chunk-GLNF43N4.js";
 import "./chunk-NWQED42L.js";
-import "./chunk-EDQNA2SU.js";
+import "./chunk-BKG3FXX3.js";
 import {
   CanvasError
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/cli.ts
 import { readFileSync, writeFileSync } from "fs";
@@ -100,6 +100,9 @@ function createClient(options) {
     grant: (id, input, o) => json("POST", `/boards/${seg(id)}/grants`, input, o),
     revoke: (id, { subjectKind, subjectId }, o) => json("DELETE", `/boards/${seg(id)}/grants?subjectKind=${seg(subjectKind)}&subjectId=${seg(subjectId)}`, void 0, o),
     invite: (id, input, o) => json("POST", `/boards/${seg(id)}/invites`, input, o),
+    links: (id, o) => json("GET", `/boards/${seg(id)}/links`, void 0, o),
+    createLink: (id, input, o) => json("POST", `/boards/${seg(id)}/links`, input, o),
+    revokeLink: (id, linkId, o) => json("DELETE", `/boards/${seg(id)}/links/${seg(linkId)}`, void 0, o),
     uploadImage: async (data, o) => parse(await send("POST", "/images", { body: data, contentType: "application/octet-stream" }, o), o),
     getImage: async (id, o) => {
       const response = await send("GET", `/images/${seg(id)}`, {}, o);
@@ -135,6 +138,9 @@ Commands:
   grant <board> <human|agent>:<id> --role <viewer|commenter|editor|owner>  Server only. Give a role. Owner.
   revoke <board> <human|agent>:<id>        Server only. Take a role back. Owner.
   invite <board> --role <viewer|commenter|editor> --email <e> | --handle <h> [--expires-in-ms <n>]  Server only. Owner.
+  links <board>                            Server only. List the share links, without tokens. Owner.
+  link <board> --role <viewer|commenter|editor> [--signed-in-only] [--expires-in-ms <n>]  Server only. Make a share link. Prints the token once. Owner.
+  revoke-link <board> <link-id>            Server only. Revoke a share link. Owner.
   mcp                                      Serve these as MCP tools on stdio. Needs CANVAS_ACTOR.
 
 Live mode: set CANVAS_SERVER=<worker url> and CANVAS_TOKEN=<bearer token>. Every command then runs in the live room of
@@ -168,6 +174,7 @@ var flags = {
   email: { type: "string" },
   handle: { type: "string" },
   "expires-in-ms": { type: "string" },
+  "signed-in-only": { type: "boolean" },
   out: { type: "string" },
   drop: { type: "string", multiple: true },
   help: { type: "boolean" },
@@ -293,6 +300,17 @@ async function run(argv) {
       const expiresInMs = num(v["expires-in-ms"]);
       return print(await sharing().invite(board, { role: v.role, email: v.email, handle: v.handle, ...expiresInMs === void 0 ? {} : { expiresInMs } }));
     }
+    case "links":
+      need(1, "<board>");
+      return print(await sharing().links(board));
+    case "link": {
+      need(1, "<board> --role <role> [--signed-in-only] [--expires-in-ms <n>]");
+      const expiresInMs = num(v["expires-in-ms"]);
+      return print(await sharing().createLink(board, { role: v.role, ...v["signed-in-only"] ? { signedInOnly: true } : {}, ...expiresInMs === void 0 ? {} : { expiresInMs } }));
+    }
+    case "revoke-link":
+      need(2, "<board> <link-id>");
+      return print(await sharing().revokeLink(board, rest[0]));
     case "mcp":
       need(0, "");
       return runMcp(service, actor(), server ? sharing() : void 0);

package/dist/{client-Dyd30StF.d.ts → client-BKTZ1pM5.d.ts}

@@ -1,4 +1,4 @@
-import { a as BoardData, c as ShapeType, S as Shape, E as Endpoint, C as Connector } from './read-UIJlrkwx.js';
+import { a as BoardData, c as ShapeType, S as Shape, E as Endpoint, C as Connector } from './read-DeS2Zaz8.js';
 import { PrincipalKind } from 'agentic-identity';
 
 /** Options for every call. */
@@ -43,6 +43,23 @@ interface BoardGrant {
     role: BoardRole;
     [field: string]: unknown;
 }
+/** A share link of a board. It never shows the token: the token shows once, when the link is made. */
+interface BoardLink {
+    id: string;
+    role: Exclude<BoardRole, "owner">;
+    signedInOnly: boolean;
+    expiresAt?: number;
+    /** Set once the link is revoked. Test it with `!== undefined`: a damaged record shows as 0, and 0 is falsy. */
+    revokedAt?: number;
+}
+interface LinkInput {
+    /** Not `owner`: only a grant makes an owner. */
+    role: Exclude<BoardRole, "owner">;
+    /** Only a signed-in visitor may use the link. */
+    signedInOnly?: boolean;
+    /** How long the link lives, in milliseconds. */
+    expiresInMs?: number;
+}
 /** An open invite. It never shows the email. */
 interface BoardInvite {
     id: string;
@@ -133,6 +150,21 @@ interface CanvasClient {
     invite(id: string, input: InviteInput, options?: CallOptions): Promise<{
         id: string;
     }>;
+    /** The share links of a board, without their tokens, up to 200. `truncated` is set if there are more. `skipped` counts damaged records left out. Needs the owner role. */
+    links(id: string, options?: CallOptions): Promise<{
+        links: BoardLink[];
+        truncated?: true;
+        skipped?: number;
+    }>;
+    /** Make a share link. The token comes back once and is never stored. Needs the owner role. */
+    createLink(id: string, input: LinkInput, options?: CallOptions): Promise<{
+        id: string;
+        token: string;
+    }>;
+    /** Revoke a share link. Needs the owner role. */
+    revokeLink(id: string, linkId: string, options?: CallOptions): Promise<{
+        ok: true;
+    }>;
     uploadImage(bytes: Uint8Array | ArrayBuffer | Blob, options?: CallOptions): Promise<ImageInfo>;
     /** The bytes of a stored image, and its content type. */
     getImage(id: string, options?: CallOptions): Promise<{
@@ -148,6 +180,6 @@ interface CanvasClient {
     }>;
 }
 /** What the CLI and the MCP server need to share a board. Sharing lives on the server, so it needs a client. */
-type BoardSharing = Pick<CanvasClient, "access" | "grant" | "revoke" | "invite">;
+type BoardSharing = Pick<CanvasClient, "access" | "grant" | "revoke" | "invite" | "links" | "createLink" | "revokeLink">;
 
 export type { BoardSharing as B, CanvasClient as C };

package/dist/client.d.ts

@@ -114,6 +114,23 @@ interface BoardGrant {
     role: BoardRole;
     [field: string]: unknown;
 }
+/** A share link of a board. It never shows the token: the token shows once, when the link is made. */
+interface BoardLink {
+    id: string;
+    role: Exclude<BoardRole, "owner">;
+    signedInOnly: boolean;
+    expiresAt?: number;
+    /** Set once the link is revoked. Test it with `!== undefined`: a damaged record shows as 0, and 0 is falsy. */
+    revokedAt?: number;
+}
+interface LinkInput {
+    /** Not `owner`: only a grant makes an owner. */
+    role: Exclude<BoardRole, "owner">;
+    /** Only a signed-in visitor may use the link. */
+    signedInOnly?: boolean;
+    /** How long the link lives, in milliseconds. */
+    expiresInMs?: number;
+}
 /** An open invite. It never shows the email. */
 interface BoardInvite {
     id: string;
@@ -214,6 +231,21 @@ interface CanvasClient {
     invite(id: string, input: InviteInput, options?: CallOptions): Promise<{
         id: string;
     }>;
+    /** The share links of a board, without their tokens, up to 200. `truncated` is set if there are more. `skipped` counts damaged records left out. Needs the owner role. */
+    links(id: string, options?: CallOptions): Promise<{
+        links: BoardLink[];
+        truncated?: true;
+        skipped?: number;
+    }>;
+    /** Make a share link. The token comes back once and is never stored. Needs the owner role. */
+    createLink(id: string, input: LinkInput, options?: CallOptions): Promise<{
+        id: string;
+        token: string;
+    }>;
+    /** Revoke a share link. Needs the owner role. */
+    revokeLink(id: string, linkId: string, options?: CallOptions): Promise<{
+        ok: true;
+    }>;
     uploadImage(bytes: Uint8Array | ArrayBuffer | Blob, options?: CallOptions): Promise<ImageInfo>;
     /** The bytes of a stored image, and its content type. */
     getImage(id: string, options?: CallOptions): Promise<{
@@ -229,9 +261,9 @@ interface CanvasClient {
     }>;
 }
 /** What the CLI and the MCP server need to share a board. Sharing lives on the server, so it needs a client. */
-type BoardSharing = Pick<CanvasClient, "access" | "grant" | "revoke" | "invite">;
+type BoardSharing = Pick<CanvasClient, "access" | "grant" | "revoke" | "invite" | "links" | "createLink" | "revokeLink">;
 /** `kind:id` of a person or an agent, as the CLI and the tools write it. */
 declare function parseSubject(text: string): Subject;
 declare function createClient(options: ClientOptions): CanvasClient;
 
-export { type ApiErrorCode, type BoardGrant, type BoardInvite, type BoardRole, type BoardSharing, type CallOptions, CanvasApiError, type CanvasClient, type ClientOptions, type ConnectorInput, type ConnectorPatch, type ImageInfo, type InviteInput, type ShapeInput, type ShapePatch, type Subject, type SubjectKind, createClient, parseSubject };
+export { type ApiErrorCode, type BoardGrant, type BoardInvite, type BoardLink, type BoardRole, type BoardSharing, type CallOptions, CanvasApiError, type CanvasClient, type ClientOptions, type ConnectorInput, type ConnectorPatch, type ImageInfo, type InviteInput, type LinkInput, type ShapeInput, type ShapePatch, type Subject, type SubjectKind, createClient, parseSubject };

package/dist/client.js

@@ -76,6 +76,9 @@ function createClient(options) {
     grant: (id, input, o) => json("POST", `/boards/${seg(id)}/grants`, input, o),
     revoke: (id, { subjectKind, subjectId }, o) => json("DELETE", `/boards/${seg(id)}/grants?subjectKind=${seg(subjectKind)}&subjectId=${seg(subjectId)}`, void 0, o),
     invite: (id, input, o) => json("POST", `/boards/${seg(id)}/invites`, input, o),
+    links: (id, o) => json("GET", `/boards/${seg(id)}/links`, void 0, o),
+    createLink: (id, input, o) => json("POST", `/boards/${seg(id)}/links`, input, o),
+    revokeLink: (id, linkId, o) => json("DELETE", `/boards/${seg(id)}/links/${seg(linkId)}`, void 0, o),
     uploadImage: async (data, o) => parse(await send("POST", "/images", { body: data, contentType: "application/octet-stream" }, o), o),
     getImage: async (id, o) => {
       const response = await send("GET", `/images/${seg(id)}`, {}, o);

package/dist/embed.d.ts

@@ -1,9 +1,10 @@
 import * as react from 'react';
-import { C as CanvasClient } from './client-Dyd30StF.js';
+import { C as CanvasClient } from './client-BKTZ1pM5.js';
 import { PrincipalKind } from 'agentic-identity';
 import { SyncClient, Status } from 'agentic-realtime/client';
 import * as Y from 'yjs';
-import './read-UIJlrkwx.js';
+import './read-DeS2Zaz8.js';
+import './principal-blhsFbdS.js';
 import 'zod';
 
 /** The presence of a room: who is here. A `SyncClient` of agentic-realtime has these. */

package/dist/embed.js

@@ -3,7 +3,7 @@ import {
   PRINCIPAL_KINDS,
   principalSchema,
   readBoard
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // ui/embed.tsx
 import { ToastProvider, TooltipProvider } from "agentic-design/react";

package/dist/index.d.ts

@@ -1,9 +1,11 @@
-import { B as Board, P as Principal } from './read-UIJlrkwx.js';
-export { a as BoardData, b as CanvasElement, d as CanvasError, C as Connector, e as EdgeData, E as Endpoint, f as ErrorCode, G as Group, M as MAX_ELEMENTS, g as MAX_TEXT, N as NodeData, h as SHAPE_TYPES, S as Shape, c as ShapeType, p as principalSchema, r as readBoard } from './read-UIJlrkwx.js';
-import { B as BoardAccess } from './service-ojpxVNVl.js';
-export { C as CanvasService, D as DrawOptions, F as FlowEdge, a as FlowGraph, b as FlowNode, M as MAX_FLOW_EDGES, c as MAX_FLOW_NODES, P as Placement, d as drawFlow, l as layoutFlow, p as parseFlow } from './service-ojpxVNVl.js';
+import { B as Board } from './read-DeS2Zaz8.js';
+export { a as BoardData, b as CanvasElement, d as CanvasError, C as Connector, e as EdgeData, E as Endpoint, f as ErrorCode, G as Group, M as MAX_ELEMENTS, g as MAX_TEXT, N as NodeData, h as SHAPE_TYPES, S as Shape, c as ShapeType, r as readBoard } from './read-DeS2Zaz8.js';
+import { P as Principal } from './principal-blhsFbdS.js';
+export { p as principalSchema } from './principal-blhsFbdS.js';
+import { B as BoardAccess } from './service-BNEH2Z12.js';
+export { C as CanvasService, D as DrawOptions, F as FlowEdge, a as FlowGraph, b as FlowNode, M as MAX_FLOW_EDGES, c as MAX_FLOW_NODES, P as Placement, d as drawFlow, l as layoutFlow, p as parseFlow } from './service-BNEH2Z12.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { B as BoardSharing } from './client-Dyd30StF.js';
+import { B as BoardSharing } from './client-BKTZ1pM5.js';
 export { FileStoreOptions, createFileStore, openLocalStore } from './store-file.js';
 export { PRINCIPAL_KINDS, PrincipalKind, isMachineMade } from 'agentic-identity';
 import 'yjs';

package/dist/index.js

@@ -6,14 +6,14 @@ import {
   operatorActor,
   runMcp,
   svgToPng
-} from "./chunk-7EWHZCKY.js";
+} from "./chunk-YKUHPOQV.js";
 import {
   createFileStore,
   openLocalStore
 } from "./chunk-NRLF6MGR.js";
 import {
   CanvasService
-} from "./chunk-Z6KLGAFP.js";
+} from "./chunk-GLNF43N4.js";
 import "./chunk-NWQED42L.js";
 import {
   MAX_FLOW_EDGES,
@@ -22,7 +22,7 @@ import {
   layoutFlow,
   parseFlow,
   toSvg
-} from "./chunk-EDQNA2SU.js";
+} from "./chunk-BKG3FXX3.js";
 import {
   Board,
   CanvasError,
@@ -33,7 +33,7 @@ import {
   isMachineMade,
   principalSchema,
   readBoard
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 export {
   ActorConfigError,
   BRAND,

package/dist/live-worker.d.ts

@@ -5,10 +5,11 @@ import 'agentic-identity';
 import 'agentic-realtime';
 import 'agentic-identity/cloudflare';
 import 'hono';
-import './read-UIJlrkwx.js';
-import 'yjs';
+import './principal-blhsFbdS.js';
 import 'zod';
-import './service-ojpxVNVl.js';
+import './service-BNEH2Z12.js';
+import './read-DeS2Zaz8.js';
+import 'yjs';
 
 type Namespace = Parameters<typeof createDurableObjectRealtime>[0];
 interface LiveEnv extends WorkerEnv {

package/dist/live-worker.js

@@ -1,12 +1,13 @@
 import {
   createApp
-} from "./chunk-5II2WZIL.js";
-import "./chunk-Z6KLGAFP.js";
+} from "./chunk-5QUL3URJ.js";
+import "./chunk-A2F73EQJ.js";
+import "./chunk-GLNF43N4.js";
 import "./chunk-NWQED42L.js";
-import "./chunk-EDQNA2SU.js";
+import "./chunk-BKG3FXX3.js";
 import {
   CanvasError
-} from "./chunk-MVWUIBGV.js";
+} from "./chunk-ZP6BLCB7.js";
 
 // src/live-worker.ts
 import { parseRegion } from "agentic-identity";

package/dist/live.d.ts

@@ -1,6 +1,7 @@
-import { B as Board, P as Principal, a as BoardData, S as Shape, C as Connector, b as CanvasElement } from './read-UIJlrkwx.js';
+import { B as Board, a as BoardData, S as Shape, C as Connector, b as CanvasElement } from './read-DeS2Zaz8.js';
 import { Peer } from 'agentic-realtime/client';
-import { B as BoardAccess, D as DrawOptions } from './service-ojpxVNVl.js';
+import { B as BoardAccess, D as DrawOptions } from './service-BNEH2Z12.js';
+import { P as Principal } from './principal-blhsFbdS.js';
 import 'yjs';
 import 'agentic-identity';
 import 'zod';