agentic-canvas 0.13.0 → 0.14.0

package/README.md

@@ -7,7 +7,7 @@
 
 A shared whiteboard for diagrams, drawn by people and agents.
 
-> Status: 0.13.0. The board model, the agent operations, the exports, the CLI, the
+> Status: 0.14.0. The board model, the agent operations, the exports, the CLI, the
 > MCP server, a small Worker API, and live co-editing work. The CLI, the MCP server,
 > and the SDK can join a live room. A remote client calls the Worker API. A small web UI, served by the Worker, is new in 0.4.0.
 > The package exports `agentic-canvas/ui`, a board view you can mount in your own app, new in 0.5.0.
@@ -38,7 +38,7 @@ npx agentic-canvas export demo --out demo.svg
 npx agentic-canvas export demo --format png --out demo.png
 ```
 
-Other commands: `list`, `add`, `connect`, `update`, `move`, `rm`, `delete` (a whole board), and `access`, `grant`, `revoke`, `invite` (sharing, server only). Run `npx agentic-canvas --help`.
+Other commands: `list`, `add`, `connect`, `update`, `move`, `rm`, `delete` (a whole board), and `access`, `grant`, `revoke`, `invite`, `links`, `link`, `revoke-link` (sharing, server only). Run `npx agentic-canvas --help`.
 `repair` is for the owner only. It needs `CANVAS_ACTOR=human:<id>`.
 Boards live in `./.agentic-canvas` (or `--dir`, or `CANVAS_DIR`). Every write
 needs an actor in `CANVAS_ACTOR`, as `<kind>:<id>`. The operator sets it. A write
@@ -52,7 +52,7 @@ CANVAS_ACTOR=agent:helper npx agentic-canvas --dir ./boards mcp
 ```
 
 The server speaks MCP on stdio. It has one tool for each CLI command: `create_board`,
-`delete_board`, `list_boards`, `read_board`, `add_shape`, `connect`, `update_element`, `move`, `remove`, `draw_flow`, `export_svg`, `export_png`, and the sharing tools `list_access`, `grant_access`, `revoke_access`, and `create_invite`. `repair` is not a tool. Only a human operator runs it, from the CLI. The server will not start unless `CANVAS_ACTOR` is set to a valid
+`delete_board`, `list_boards`, `read_board`, `add_shape`, `connect`, `update_element`, `move`, `remove`, `draw_flow`, `export_svg`, `export_png`, and the sharing tools `list_access`, `grant_access`, `revoke_access`, `create_invite`, `list_links`, `create_link`, and `revoke_link`. `repair` is not a tool. Only a human operator runs it, from the CLI. The server will not start unless `CANVAS_ACTOR` is set to a valid
 `<kind>:<id>`. That actor stamps every write. No tool takes an actor, author, or kind, so a
 caller cannot choose who it writes as. An error comes back as a tool error with a code.
 
@@ -183,7 +183,7 @@ Roles, from least to most: `viewer`, `commenter`, `editor`, `owner`.
 |---|---|
 | viewer, commenter | Read the board, its SVG, and join its live room to read. A board has no comments yet, so a commenter reads as a viewer. |
 | editor | Also draw: add, update, move, and remove elements. |
-| owner | Also delete the board, grant and revoke roles, list access, invite, and make or revoke share links. |
+| owner | Also delete the board, grant and revoke roles, list access, invite, and list, make, or revoke share links. |
 
 A role never exceeds the scopes of the credential. An agent of an owner holds the owner's role only inside its own
 scopes: it needs `canvas:admin` to share, and `canvas:write` to draw. A caller with no role on a board gets 404, so a read or a write tells a stranger nothing. (A create with an id that is taken answers 409.) A caller with a role that is too low gets 403. `GET /boards` lists the boards you hold a role on.
@@ -197,6 +197,7 @@ HTTP routes, under `/api/v1/canvas`. Each needs a bearer token, except the link
 | `DELETE /boards/:id/grants?subjectKind=&subjectId=` | Owner. Revoke. The last owner cannot be removed. |
 | `POST /boards/:id/invites` | Owner. Body `{ role, email }` or `{ role, handle }`, and optional `expiresInMs`. The role is not `owner`. Returns `{ id }`. |
 | `POST /invites/accept` | Body `{ id }`. The caller must be the person (verified email) or the agent (handle) the invite names. |
+| `GET /boards/:id/links` | Owner. The links of the board: `{ id, role, signedInOnly, expiresAt?, revokedAt? }`. No token. Up to 200, and `truncated: true` if there are more. `skipped` counts damaged records left out. |
 | `POST /boards/:id/links` | Owner. Body `{ role, signedInOnly?, expiresInMs? }`. Returns `{ id, token }`. The token shows once. |
 | `DELETE /boards/:id/links/:link` | Owner. Revoke a link of this board. |
 | `GET /shared/:id` and `GET /shared/:id/svg` | No bearer token needed. Send the link token in `x-link-token`. Read only. |
@@ -212,6 +213,9 @@ await canvas.grant("demo", { subjectKind: "agent", subjectId: "helper", role: "e
 await canvas.invite("demo", { role: "viewer", email: "ada@example.com", expiresInMs: 86_400_000 });
 const { grants, invites } = await canvas.access("demo"); // an invite shows no email
 await canvas.revoke("demo", { subjectKind: "agent", subjectId: "helper" });
+const link = await canvas.createLink("demo", { role: "viewer", expiresInMs: 86_400_000 }); // link.token shows once
+const { links } = await canvas.links("demo"); // no tokens
+await canvas.revokeLink("demo", link.id);
 ```
 
 ```sh
@@ -220,11 +224,14 @@ npx agentic-canvas access demo
 npx agentic-canvas grant demo agent:helper --role editor
 npx agentic-canvas invite demo --role viewer --handle helper --expires-in-ms 86400000
 npx agentic-canvas revoke demo agent:helper
+npx agentic-canvas link demo --role viewer --expires-in-ms 86400000   # prints the token once
+npx agentic-canvas links demo
+npx agentic-canvas revoke-link demo <link-id>
 ```
 
-With `CANVAS_SERVER` set, `npx agentic-canvas mcp` serves `list_access`, `grant_access`, `revoke_access`, and `create_invite` as well.
+With `CANVAS_SERVER` set, `npx agentic-canvas mcp` serves `list_access`, `grant_access`, `revoke_access`, `create_invite`, `list_links`, `create_link`, and `revoke_link` as well.
 Each prints or returns the server's JSON. A refusal has the server's code, such as `NOT_FOUND`, `FORBIDDEN`, or `INVALID`.
-Share links and invite acceptance stay on the HTTP API.
+Invite acceptance stays on the HTTP API.
 
 A live MCP server with an admin token can share boards: an agent that holds it can grant `owner` and revoke grants. Give an agent a token with `canvas:write` only, unless it must share.
 
@@ -461,7 +468,7 @@ old author stays on its elements. Only new writes follow the strict rule.
 |---|---|
 | `createClient(options)`, `CanvasApiError` | The remote client. See Remote client above. |
 | `parseSubject(text)` | Reads `human:<id>` or `agent:<id>` as `{ subjectKind, subjectId }`. It throws a `TypeError` for any other text. |
-| `BoardSharing` (type), `BoardRole` (type), `SubjectKind` (type), `Subject` (type), `BoardGrant` (type), `BoardInvite` (type), `InviteInput` (type) | Types for sharing. |
+| `BoardSharing` (type), `BoardRole` (type), `SubjectKind` (type), `Subject` (type), `BoardGrant` (type), `BoardInvite` (type), `InviteInput` (type), `BoardLink` (type), `LinkInput` (type) | Types for sharing. |
 | `ClientOptions` (type), `CallOptions` (type), `CanvasClient` (type), `ShapeInput` (type), `ConnectorInput` (type), `ShapePatch` (type), `ConnectorPatch` (type), `ImageInfo` (type), `ApiErrorCode` (type) | Types for the client. `ApiErrorCode` adds the client's own codes, such as `NETWORK`, to `ErrorCode`. |
 
 ### `agentic-canvas/file-store`

package/dist/account.js

@@ -1,6 +1,6 @@
 import {
   RESOURCE_TYPE
-} from "./chunk-LMSMUGBF.js";
+} from "./chunk-A2F73EQJ.js";
 import {
   fromBase64,
   isBoardId,

package/dist/{chunk-4PY5SN2N.js → chunk-5QUL3URJ.js}

@@ -1,6 +1,6 @@
 import {
   CanvasAccess
-} from "./chunk-LMSMUGBF.js";
+} from "./chunk-A2F73EQJ.js";
 import {
   CanvasService,
   MAX_LIVE_BYTES
@@ -2254,6 +2254,7 @@ function createApp(options = {}) {
     return c.json(done);
   });
   api.post("/boards/:id/invites", async (c) => c.json(await c.var.access.invite(c.var.caller.principal, c.req.param("id"), await jsonBody(c)), 201));
+  api.get("/boards/:id/links", async (c) => c.json(await c.var.access.listLinks(c.var.caller.principal, c.req.param("id"))));
   api.post("/boards/:id/links", async (c) => c.json(await c.var.access.createLink(c.var.caller.principal, c.req.param("id"), await jsonBody(c)), 201));
   api.delete("/boards/:id/links/:link", async (c) => c.json(await c.var.access.revokeLink(c.var.caller.principal, c.req.param("id"), c.req.param("link"))));
   api.post("/invites/accept", async (c) => c.json(await c.var.access.accept(c.var.caller.principal, text((await jsonBody(c)).id, "id"))));

package/dist/{chunk-LMSMUGBF.js → chunk-A2F73EQJ.js}

@@ -106,7 +106,7 @@ var CanvasAccess = class {
     await this.sharing.revokeGrant(ctx, id, subject).catch(refuse);
     return { ok: true };
   }
-  /** The grants and the invites on a board. An invite never shows its email. Links are not listed: a token shows once. */
+  /** The grants and the invites on a board. An invite never shows its email. `listLinks` lists the links, and never a token. */
   async list(ctx, id) {
     this.known(id);
     const [grants, invites] = await Promise.all([this.sharing.listGrants(ctx, id, { limit: 200 }), this.sharing.listInvites(ctx, id, { limit: 200 })]).catch(refuse);
@@ -140,6 +140,38 @@ var CanvasAccess = class {
     if (input.signedInOnly !== void 0 && typeof input.signedInOnly !== "boolean") throw new CanvasError("INVALID", "signedInOnly must be true or false");
     return this.sharing.createLink(ctx, id, { role, signedInOnly: input.signedInOnly === true, ...expiresInMs === void 0 ? {} : { expiresAt: this.now() + expiresInMs } }).catch(refuse);
   }
+  /** The links of a board. A summary never holds the token or its hash. Needs an owner. */
+  async listLinks(ctx, id) {
+    this.known(id);
+    await this.require(ctx, "admin", id);
+    const all = [];
+    let cursor;
+    let skipped = 0;
+    for (let pages = 0; pages < 10; pages++) {
+      const page = await this.store.query("links", { where: { resourceId: id }, limit: 100, ...cursor === void 0 ? {} : { cursor } });
+      for (const { id: key, data } of page.items) {
+        const expiresOk = data.expiresAt == null || typeof data.expiresAt === "number" && Number.isFinite(data.expiresAt);
+        if (data.id !== key || data.resourceId !== id || typeof data.tokenHash !== "string" || typeof data.id !== "string" || !SHARE_ROLES.includes(data.role) || !expiresOk) {
+          skipped++;
+          continue;
+        }
+        all.push({
+          id: data.id,
+          role: data.role,
+          signedInOnly: data.signedInOnly === true,
+          ...typeof data.expiresAt === "number" ? { expiresAt: data.expiresAt } : {},
+          // Any value but null means revoked, as in agentic-identity. A value that is not a time shows as 0.
+          ...data.revokedAt == null ? {} : { revokedAt: typeof data.revokedAt === "number" ? data.revokedAt : 0 }
+        });
+      }
+      if ((cursor = page.nextCursor) === void 0) break;
+    }
+    const now = this.now();
+    const live = (l) => l.revokedAt === void 0 && (l.expiresAt === void 0 || l.expiresAt > now);
+    all.sort((x, y) => Number(live(y)) - Number(live(x)) || (y.expiresAt ?? Infinity) - (x.expiresAt ?? Infinity) || x.id.localeCompare(y.id));
+    const links = all.slice(0, 200);
+    return { links, ...cursor !== void 0 || all.length > 200 ? { truncated: true } : {}, ...skipped > 0 ? { skipped } : {} };
+  }
   /** Revoke a link of this board. A link of another board is NOT_FOUND here, even for an owner of both. */
   async revokeLink(ctx, id, linkId) {
     this.known(id);

package/dist/{chunk-AI5NWPEW.js → chunk-YKUHPOQV.js}

@@ -6,7 +6,7 @@ import {
 
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "0.13.0" : readPackageVersion();
+var VERSION = true ? "0.14.0" : readPackageVersion();
 
 // src/brand.ts
 var BRAND = {
@@ -198,6 +198,24 @@ function createMcpServer(service, actor, sharing) {
     },
     tool(async ({ board: b, ...input }) => json(await shared().invite(b, input)))
   );
+  server.registerTool(
+    "list_links",
+    { description: "List the share links of a board, without their tokens. Needs the owner role.", inputSchema: { board }, annotations: read },
+    tool(async (a) => json(await shared().links(a.board)))
+  );
+  server.registerTool(
+    "create_link",
+    {
+      description: "Make a share link. Anyone with the token can read the board, and only read: the role does not widen a link visit. With signedInOnly, only a signed-in visitor may use it. The token shows once: keep it. The role is not owner. Needs the owner role.",
+      inputSchema: { board, role: z.enum(["viewer", "commenter", "editor"]), signedInOnly: z.boolean().optional(), expiresInMs: z.number().int().positive().optional() }
+    },
+    tool(async ({ board: b, ...input }) => json(await shared().createLink(b, input)))
+  );
+  server.registerTool(
+    "revoke_link",
+    { description: "Revoke a share link of a board. Needs the owner role.", inputSchema: { board, link: z.string() }, annotations: { destructiveHint: true } },
+    tool(async (a) => json(await shared().revokeLink(a.board, a.link)))
+  );
   return server;
 }
 async function runMcp(service, actor, sharing) {

package/dist/cli.js

@@ -5,7 +5,7 @@ import {
   operatorActor,
   runMcp,
   svgToPng
-} from "./chunk-AI5NWPEW.js";
+} from "./chunk-YKUHPOQV.js";
 import {
   openLocalStore
 } from "./chunk-NRLF6MGR.js";
@@ -100,6 +100,9 @@ function createClient(options) {
     grant: (id, input, o) => json("POST", `/boards/${seg(id)}/grants`, input, o),
     revoke: (id, { subjectKind, subjectId }, o) => json("DELETE", `/boards/${seg(id)}/grants?subjectKind=${seg(subjectKind)}&subjectId=${seg(subjectId)}`, void 0, o),
     invite: (id, input, o) => json("POST", `/boards/${seg(id)}/invites`, input, o),
+    links: (id, o) => json("GET", `/boards/${seg(id)}/links`, void 0, o),
+    createLink: (id, input, o) => json("POST", `/boards/${seg(id)}/links`, input, o),
+    revokeLink: (id, linkId, o) => json("DELETE", `/boards/${seg(id)}/links/${seg(linkId)}`, void 0, o),
     uploadImage: async (data, o) => parse(await send("POST", "/images", { body: data, contentType: "application/octet-stream" }, o), o),
     getImage: async (id, o) => {
       const response = await send("GET", `/images/${seg(id)}`, {}, o);
@@ -135,6 +138,9 @@ Commands:
   grant <board> <human|agent>:<id> --role <viewer|commenter|editor|owner>  Server only. Give a role. Owner.
   revoke <board> <human|agent>:<id>        Server only. Take a role back. Owner.
   invite <board> --role <viewer|commenter|editor> --email <e> | --handle <h> [--expires-in-ms <n>]  Server only. Owner.
+  links <board>                            Server only. List the share links, without tokens. Owner.
+  link <board> --role <viewer|commenter|editor> [--signed-in-only] [--expires-in-ms <n>]  Server only. Make a share link. Prints the token once. Owner.
+  revoke-link <board> <link-id>            Server only. Revoke a share link. Owner.
   mcp                                      Serve these as MCP tools on stdio. Needs CANVAS_ACTOR.
 
 Live mode: set CANVAS_SERVER=<worker url> and CANVAS_TOKEN=<bearer token>. Every command then runs in the live room of
@@ -168,6 +174,7 @@ var flags = {
   email: { type: "string" },
   handle: { type: "string" },
   "expires-in-ms": { type: "string" },
+  "signed-in-only": { type: "boolean" },
   out: { type: "string" },
   drop: { type: "string", multiple: true },
   help: { type: "boolean" },
@@ -293,6 +300,17 @@ async function run(argv) {
       const expiresInMs = num(v["expires-in-ms"]);
       return print(await sharing().invite(board, { role: v.role, email: v.email, handle: v.handle, ...expiresInMs === void 0 ? {} : { expiresInMs } }));
     }
+    case "links":
+      need(1, "<board>");
+      return print(await sharing().links(board));
+    case "link": {
+      need(1, "<board> --role <role> [--signed-in-only] [--expires-in-ms <n>]");
+      const expiresInMs = num(v["expires-in-ms"]);
+      return print(await sharing().createLink(board, { role: v.role, ...v["signed-in-only"] ? { signedInOnly: true } : {}, ...expiresInMs === void 0 ? {} : { expiresInMs } }));
+    }
+    case "revoke-link":
+      need(2, "<board> <link-id>");
+      return print(await sharing().revokeLink(board, rest[0]));
     case "mcp":
       need(0, "");
       return runMcp(service, actor(), server ? sharing() : void 0);

package/dist/{client-DBb1jpxl.d.ts → client-BKTZ1pM5.d.ts}

@@ -43,6 +43,23 @@ interface BoardGrant {
     role: BoardRole;
     [field: string]: unknown;
 }
+/** A share link of a board. It never shows the token: the token shows once, when the link is made. */
+interface BoardLink {
+    id: string;
+    role: Exclude<BoardRole, "owner">;
+    signedInOnly: boolean;
+    expiresAt?: number;
+    /** Set once the link is revoked. Test it with `!== undefined`: a damaged record shows as 0, and 0 is falsy. */
+    revokedAt?: number;
+}
+interface LinkInput {
+    /** Not `owner`: only a grant makes an owner. */
+    role: Exclude<BoardRole, "owner">;
+    /** Only a signed-in visitor may use the link. */
+    signedInOnly?: boolean;
+    /** How long the link lives, in milliseconds. */
+    expiresInMs?: number;
+}
 /** An open invite. It never shows the email. */
 interface BoardInvite {
     id: string;
@@ -133,6 +150,21 @@ interface CanvasClient {
     invite(id: string, input: InviteInput, options?: CallOptions): Promise<{
         id: string;
     }>;
+    /** The share links of a board, without their tokens, up to 200. `truncated` is set if there are more. `skipped` counts damaged records left out. Needs the owner role. */
+    links(id: string, options?: CallOptions): Promise<{
+        links: BoardLink[];
+        truncated?: true;
+        skipped?: number;
+    }>;
+    /** Make a share link. The token comes back once and is never stored. Needs the owner role. */
+    createLink(id: string, input: LinkInput, options?: CallOptions): Promise<{
+        id: string;
+        token: string;
+    }>;
+    /** Revoke a share link. Needs the owner role. */
+    revokeLink(id: string, linkId: string, options?: CallOptions): Promise<{
+        ok: true;
+    }>;
     uploadImage(bytes: Uint8Array | ArrayBuffer | Blob, options?: CallOptions): Promise<ImageInfo>;
     /** The bytes of a stored image, and its content type. */
     getImage(id: string, options?: CallOptions): Promise<{
@@ -148,6 +180,6 @@ interface CanvasClient {
     }>;
 }
 /** What the CLI and the MCP server need to share a board. Sharing lives on the server, so it needs a client. */
-type BoardSharing = Pick<CanvasClient, "access" | "grant" | "revoke" | "invite">;
+type BoardSharing = Pick<CanvasClient, "access" | "grant" | "revoke" | "invite" | "links" | "createLink" | "revokeLink">;
 
 export type { BoardSharing as B, CanvasClient as C };

package/dist/client.d.ts

@@ -114,6 +114,23 @@ interface BoardGrant {
     role: BoardRole;
     [field: string]: unknown;
 }
+/** A share link of a board. It never shows the token: the token shows once, when the link is made. */
+interface BoardLink {
+    id: string;
+    role: Exclude<BoardRole, "owner">;
+    signedInOnly: boolean;
+    expiresAt?: number;
+    /** Set once the link is revoked. Test it with `!== undefined`: a damaged record shows as 0, and 0 is falsy. */
+    revokedAt?: number;
+}
+interface LinkInput {
+    /** Not `owner`: only a grant makes an owner. */
+    role: Exclude<BoardRole, "owner">;
+    /** Only a signed-in visitor may use the link. */
+    signedInOnly?: boolean;
+    /** How long the link lives, in milliseconds. */
+    expiresInMs?: number;
+}
 /** An open invite. It never shows the email. */
 interface BoardInvite {
     id: string;
@@ -214,6 +231,21 @@ interface CanvasClient {
     invite(id: string, input: InviteInput, options?: CallOptions): Promise<{
         id: string;
     }>;
+    /** The share links of a board, without their tokens, up to 200. `truncated` is set if there are more. `skipped` counts damaged records left out. Needs the owner role. */
+    links(id: string, options?: CallOptions): Promise<{
+        links: BoardLink[];
+        truncated?: true;
+        skipped?: number;
+    }>;
+    /** Make a share link. The token comes back once and is never stored. Needs the owner role. */
+    createLink(id: string, input: LinkInput, options?: CallOptions): Promise<{
+        id: string;
+        token: string;
+    }>;
+    /** Revoke a share link. Needs the owner role. */
+    revokeLink(id: string, linkId: string, options?: CallOptions): Promise<{
+        ok: true;
+    }>;
     uploadImage(bytes: Uint8Array | ArrayBuffer | Blob, options?: CallOptions): Promise<ImageInfo>;
     /** The bytes of a stored image, and its content type. */
     getImage(id: string, options?: CallOptions): Promise<{
@@ -229,9 +261,9 @@ interface CanvasClient {
     }>;
 }
 /** What the CLI and the MCP server need to share a board. Sharing lives on the server, so it needs a client. */
-type BoardSharing = Pick<CanvasClient, "access" | "grant" | "revoke" | "invite">;
+type BoardSharing = Pick<CanvasClient, "access" | "grant" | "revoke" | "invite" | "links" | "createLink" | "revokeLink">;
 /** `kind:id` of a person or an agent, as the CLI and the tools write it. */
 declare function parseSubject(text: string): Subject;
 declare function createClient(options: ClientOptions): CanvasClient;
 
-export { type ApiErrorCode, type BoardGrant, type BoardInvite, type BoardRole, type BoardSharing, type CallOptions, CanvasApiError, type CanvasClient, type ClientOptions, type ConnectorInput, type ConnectorPatch, type ImageInfo, type InviteInput, type ShapeInput, type ShapePatch, type Subject, type SubjectKind, createClient, parseSubject };
+export { type ApiErrorCode, type BoardGrant, type BoardInvite, type BoardLink, type BoardRole, type BoardSharing, type CallOptions, CanvasApiError, type CanvasClient, type ClientOptions, type ConnectorInput, type ConnectorPatch, type ImageInfo, type InviteInput, type LinkInput, type ShapeInput, type ShapePatch, type Subject, type SubjectKind, createClient, parseSubject };

package/dist/client.js

@@ -76,6 +76,9 @@ function createClient(options) {
     grant: (id, input, o) => json("POST", `/boards/${seg(id)}/grants`, input, o),
     revoke: (id, { subjectKind, subjectId }, o) => json("DELETE", `/boards/${seg(id)}/grants?subjectKind=${seg(subjectKind)}&subjectId=${seg(subjectId)}`, void 0, o),
     invite: (id, input, o) => json("POST", `/boards/${seg(id)}/invites`, input, o),
+    links: (id, o) => json("GET", `/boards/${seg(id)}/links`, void 0, o),
+    createLink: (id, input, o) => json("POST", `/boards/${seg(id)}/links`, input, o),
+    revokeLink: (id, linkId, o) => json("DELETE", `/boards/${seg(id)}/links/${seg(linkId)}`, void 0, o),
     uploadImage: async (data, o) => parse(await send("POST", "/images", { body: data, contentType: "application/octet-stream" }, o), o),
     getImage: async (id, o) => {
       const response = await send("GET", `/images/${seg(id)}`, {}, o);

package/dist/embed.d.ts

@@ -1,5 +1,5 @@
 import * as react from 'react';
-import { C as CanvasClient } from './client-DBb1jpxl.js';
+import { C as CanvasClient } from './client-BKTZ1pM5.js';
 import { PrincipalKind } from 'agentic-identity';
 import { SyncClient, Status } from 'agentic-realtime/client';
 import * as Y from 'yjs';

package/dist/index.d.ts

@@ -5,7 +5,7 @@ export { p as principalSchema } from './principal-blhsFbdS.js';
 import { B as BoardAccess } from './service-BNEH2Z12.js';
 export { C as CanvasService, D as DrawOptions, F as FlowEdge, a as FlowGraph, b as FlowNode, M as MAX_FLOW_EDGES, c as MAX_FLOW_NODES, P as Placement, d as drawFlow, l as layoutFlow, p as parseFlow } from './service-BNEH2Z12.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { B as BoardSharing } from './client-DBb1jpxl.js';
+import { B as BoardSharing } from './client-BKTZ1pM5.js';
 export { FileStoreOptions, createFileStore, openLocalStore } from './store-file.js';
 export { PRINCIPAL_KINDS, PrincipalKind, isMachineMade } from 'agentic-identity';
 import 'yjs';

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   operatorActor,
   runMcp,
   svgToPng
-} from "./chunk-AI5NWPEW.js";
+} from "./chunk-YKUHPOQV.js";
 import {
   createFileStore,
   openLocalStore

package/dist/live-worker.js

@@ -1,7 +1,7 @@
 import {
   createApp
-} from "./chunk-4PY5SN2N.js";
-import "./chunk-LMSMUGBF.js";
+} from "./chunk-5QUL3URJ.js";
+import "./chunk-A2F73EQJ.js";
 import "./chunk-GLNF43N4.js";
 import "./chunk-NWQED42L.js";
 import "./chunk-BKG3FXX3.js";

package/dist/worker.d.ts

@@ -1,4 +1,4 @@
-import { Store, PrincipalContext, Action, Grant, InviteSummary, Blobs } from 'agentic-identity';
+import { Store, PrincipalContext, Action, Grant, InviteSummary, Role as Role$1, Blobs } from 'agentic-identity';
 import { Realtime } from 'agentic-realtime';
 import { D1Like, R2Like } from 'agentic-identity/cloudflare';
 import { Hono } from 'hono';
@@ -8,6 +8,14 @@ import 'zod';
 import './read-DeS2Zaz8.js';
 import 'yjs';
 
+/** A share link without its token. `revokedAt` is set once the link is revoked. */
+interface LinkSummary {
+    id: string;
+    role: Exclude<Role$1, "owner">;
+    signedInOnly: boolean;
+    expiresAt?: number;
+    revokedAt?: number;
+}
 /**
  * Who may do what on a board. A board is an identity resource of type `canvas`. The roles, the grants, the invites,
  * and the links are those of agentic-identity: this class checks input and maps its failures to `CanvasError`.
@@ -51,7 +59,7 @@ declare class CanvasAccess {
     }): Promise<{
         ok: true;
     }>;
-    /** The grants and the invites on a board. An invite never shows its email. Links are not listed: a token shows once. */
+    /** The grants and the invites on a board. An invite never shows its email. `listLinks` lists the links, and never a token. */
     list(ctx: PrincipalContext, id: string): Promise<{
         grants: Grant[];
         invites: InviteSummary[];
@@ -77,6 +85,12 @@ declare class CanvasAccess {
         id: string;
         token: string;
     }>;
+    /** The links of a board. A summary never holds the token or its hash. Needs an owner. */
+    listLinks(ctx: PrincipalContext, id: string): Promise<{
+        links: LinkSummary[];
+        truncated?: true;
+        skipped?: number;
+    }>;
     /** Revoke a link of this board. A link of another board is NOT_FOUND here, even for an owner of both. */
     revokeLink(ctx: PrincipalContext, id: string, linkId: string): Promise<{
         ok: true;

package/dist/worker.js

@@ -5,8 +5,8 @@ import {
   identify,
   sniffImage,
   worker_default
-} from "./chunk-4PY5SN2N.js";
-import "./chunk-LMSMUGBF.js";
+} from "./chunk-5QUL3URJ.js";
+import "./chunk-A2F73EQJ.js";
 import "./chunk-GLNF43N4.js";
 import "./chunk-NWQED42L.js";
 import "./chunk-BKG3FXX3.js";

package/llms.txt

@@ -6,11 +6,11 @@ Keywords: whiteboard,canvas,diagrams,drawing,collaboration,agents,mcp,cli.
 
 - SDK: import { Board, drawFlow, readBoard, toSvg } from "agentic-canvas".
 - Exports: the README "Exports" section lists every name of each entry point: agentic-canvas, /client, /file-store, /live, /worker and /live-worker.
-- CLI: agentic-canvas new|list|read|add|connect|update|move|rm|delete|flow|export, and with CANVAS_SERVER: access|grant|revoke|invite. MCP tools for sharing: list_access, grant_access, revoke_access, create_invite.
+- CLI: agentic-canvas new|list|read|add|connect|update|move|rm|delete|flow|export, and with CANVAS_SERVER: access|grant|revoke|invite|links|link|revoke-link. MCP tools for sharing: list_access, grant_access, revoke_access, create_invite, list_links, create_link, revoke_link.
 - UI: the Worker serves a web UI at its root (run `npm run build`, then `wrangler dev`). A person signs in with a bearer token: an agentic-identity credential (scope canvas:write or canvas:read). A static CANVAS_API_TOKENS list works only with CANVAS_UNSAFE_STATIC_TOKENS=1 (dev).
 - Live: set CANVAS_SERVER and CANVAS_TOKEN, and the CLI and `agentic-canvas mcp` edit the board in its live room.
 - SDK: import { LiveBoard, LiveService } from "agentic-canvas/live".
-- SDK: import { createClient, CanvasApiError } from "agentic-canvas/client". It calls the Worker API with fetch. Methods: me, listBoards, createBoard, readBoard, deleteBoard, exportSvg, addShape, addConnector, drawFlow, update, move, remove, access, grant, revoke, invite, uploadImage, getImage, state, checkpoint. A failure throws CanvasApiError with `code` and `status`. No retries.
+- SDK: import { createClient, CanvasApiError } from "agentic-canvas/client". It calls the Worker API with fetch. Methods: me, listBoards, createBoard, readBoard, deleteBoard, exportSvg, addShape, addConnector, drawFlow, update, move, remove, access, grant, revoke, invite, links, createLink, revokeLink, uploadImage, getImage, state, checkpoint. A failure throws CanvasApiError with `code` and `status`. No retries.
 - UI: import { mount } from "agentic-canvas/ui"; import "agentic-canvas/ui.css" (with agentic-design/styles.css). mount(element, { boardId, client, principal: { kind, name, role, id? }, readOnly?, room?: { baseUrl, token } }) (or host: { doc, presence?, status?, onStatus? } instead of client and room; in host mode id (default name) must be letters, digits, . _ -, to edit the app's own Yjs document with no HTTP call) renders the board and returns { update(options), unmount() }. BoardEditor is the same as a React component. React 19 is a peer dependency.
 
 ## Docs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-canvas",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "A shared whiteboard for diagrams, drawn by people and agents.",
   "keywords": [
     "whiteboard",