agentic-canvas 0.5.0 → 0.6.0

package/README.md

@@ -7,7 +7,7 @@
 
 A shared whiteboard for diagrams, drawn by people and agents.
 
-> Status: 0.5.0. The board model, the agent operations, the exports, the CLI, the
+> Status: 0.6.0. The board model, the agent operations, the exports, the CLI, the
 > MCP server, a small Worker API, and live co-editing work. The CLI, the MCP server,
 > and the SDK can join a live room. A remote client calls the Worker API. A small web UI, served by the Worker, is new in 0.4.0.
 > The package exports `agentic-canvas/ui`, a board view you can mount in your own app, new in 0.5.0.
@@ -327,9 +327,9 @@ The stylesheet is a separate export, `agentic-canvas/ui.css`. Load `agentic-desi
 |---|---|
 | `createApp(options?)` | Make the Hono app for the Worker. Pass `live` to turn on the live-room socket. |
 | `default` | The Worker, without live rooms. |
-| `authenticate(request, env)` | Read a bearer token from the `Authorization` header, or from a WebSocket sub-protocol. Return the actor and the role, or `null`. |
+| `authenticate(request, env)` | Read a bearer token from the `Authorization` header, or from a WebSocket sub-protocol. Return a promise of the actor and the role, or `null`. |
 | `sniffImage(bytes)` | Find the image type from the first bytes, or return `null`. The client's claim of a type is not trusted. |
-| `WS_PROTOCOL` | The sub-protocol name that carries a token on a WebSocket: `agentic-canvas.bearer`. |
+| `WS_PROTOCOL` | The sub-protocol name for a WebSocket: `agentic-canvas`. The token travels in the entry `agentic-canvas.bearer.<token in base64url>`. |
 | `WorkerEnv` (type), `AppOptions` (type), `Role` (type) | Types for the Worker bindings, the app options and the role, `editor` or `viewer`. |
 
 ### `agentic-canvas/live-worker`

package/dist/{chunk-V74PWJKY.js → chunk-BIIC2DPZ.js}

@@ -5,13 +5,11 @@ import {
 import {
   CanvasError
 } from "./chunk-JCYNPYYJ.js";
-import {
-  principalSchema
-} from "./chunk-SPP6PINW.js";
 
 // src/worker.ts
-import { parseRegion } from "agentic-identity";
+import { hasScope, parsePrincipal, parseRegion } from "agentic-identity";
 import { createD1Store, createR2Blobs, D1_SCHEMA } from "agentic-identity/cloudflare";
+import { acceptWebSocketProtocol, principalFromWebSocketRequest } from "agentic-identity/http";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
@@ -1950,36 +1948,41 @@ function sameText(a, b) {
   for (let i = 0; i < Math.max(x.length, y.length); i++) diff |= (x[i] ?? 0) ^ (y[i] ?? 0);
   return diff === 0;
 }
-var WS_PROTOCOL = "agentic-canvas.bearer";
-function socketToken(request) {
-  if (request.headers.get("upgrade") !== "websocket") return void 0;
-  const [name, encoded, ...more] = (request.headers.get("sec-websocket-protocol") ?? "").split(",").map((p) => p.trim());
-  if (name !== WS_PROTOCOL || !encoded || more.length > 0 || !/^[A-Za-z0-9_-]+$/.test(encoded)) return void 0;
-  try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(Uint8Array.from(atob(encoded.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0)));
-  } catch {
-    return void 0;
-  }
+var WS_PROTOCOL = "agentic-canvas";
+function tokenAuth(env) {
+  return {
+    async authenticate(request) {
+      const token = /^Bearer (.+)$/.exec(request.headers.get("authorization") ?? "")?.[1];
+      if (!token || !env.CANVAS_API_TOKENS) return null;
+      let grants;
+      try {
+        grants = JSON.parse(env.CANVAS_API_TOKENS);
+      } catch {
+        return null;
+      }
+      if (typeof grants !== "object" || grants === null || Array.isArray(grants)) return null;
+      let found;
+      for (const [candidate, grant] of Object.entries(grants)) {
+        if (sameText(candidate, token) && candidate.length >= MIN_TOKEN_LENGTH) found = grant;
+      }
+      if (typeof found !== "object" || found === null) return null;
+      const { actor, kind, role = "editor" } = found;
+      let step;
+      try {
+        step = parsePrincipal({ kind, id: actor });
+      } catch {
+        return null;
+      }
+      if (step.kind === SEEDER.kind && step.id === SEEDER.id) return null;
+      if (role !== "editor" && role !== "viewer") return null;
+      return { principalId: step.id, kind: step.kind, chain: [step], scopes: role === "viewer" ? ["canvas:read"] : ["canvas:read", "canvas:write"] };
+    }
+  };
 }
-function authenticate(request, env) {
-  const token = /^Bearer (.+)$/.exec(request.headers.get("authorization") ?? "")?.[1] ?? socketToken(request);
-  if (!token || !env.CANVAS_API_TOKENS) return null;
-  let grants;
-  try {
-    grants = JSON.parse(env.CANVAS_API_TOKENS);
-  } catch {
-    return null;
-  }
-  if (typeof grants !== "object" || grants === null || Array.isArray(grants)) return null;
-  let found;
-  for (const [candidate, grant] of Object.entries(grants)) {
-    if (sameText(candidate, token) && candidate.length >= MIN_TOKEN_LENGTH) found = grant;
-  }
-  if (typeof found !== "object" || found === null) return null;
-  const { actor, kind, role = "editor" } = found;
-  const parsed = principalSchema.safeParse({ kind, id: actor });
-  const taken = parsed.success && parsed.data.kind === SEEDER.kind && parsed.data.id === SEEDER.id;
-  return parsed.success && !taken && (role === "editor" || role === "viewer") ? { actor: parsed.data, role } : null;
+async function authenticate(request, env) {
+  const found = await principalFromWebSocketRequest(request, tokenAuth(env), { protocol: WS_PROTOCOL });
+  if (found instanceof Response) return null;
+  return { actor: { kind: found.kind, id: found.principalId }, role: hasScope(found.scopes, "canvas:write") ? "editor" : "viewer" };
 }
 function sniffImage(bytes) {
   const at = (offset, ...sig) => sig.every((b, i) => bytes[offset + i] === b);
@@ -2058,7 +2061,7 @@ function createApp(options = {}) {
       return fail("NOT_CONFIGURED", 'set CANVAS_REGION to "eu", "us", or "unknown"', 503);
     }
     if (!c.env.DB || !c.env.IMAGES) return fail("NOT_CONFIGURED", "bind DB (D1) and IMAGES (R2)", 503);
-    const who = authenticate(c.req.raw, c.env);
+    const who = await authenticate(c.req.raw, c.env);
     if (!who) return fail("UNAUTHORIZED", "send a valid bearer token", 401);
     if (who.role === "viewer" && c.req.method !== "GET") return fail("FORBIDDEN", "this token is a viewer; it cannot change a board", 403);
     c.set("actor", who.actor);
@@ -2094,10 +2097,7 @@ function createApp(options = {}) {
     await saveRoom(c, true);
     const { actor, role } = c.var;
     const opened = await options.live(c.env).connect(id, c.req.raw, { principal: { id: actor.id, kind: actor.kind }, role, name: actor.id });
-    if (opened.status !== 101 || c.req.header("authorization") || !socketToken(c.req.raw)) return opened;
-    const headers = new Headers(opened.headers);
-    headers.set("sec-websocket-protocol", WS_PROTOCOL);
-    return new Response(null, { status: 101, headers, webSocket: opened.webSocket });
+    return acceptWebSocketProtocol(c.req.raw, opened, WS_PROTOCOL);
   });
   api.get("/boards/:id/state", async (c) => !options.live ? fail("NOT_FOUND", "this server hosts no live rooms", 404) : c.body(new Uint8Array(await c.var.service.state(c.req.param("id"))), 200, { "content-type": "application/octet-stream" }));
   api.post("/boards/:id/checkpoint", async (c) => {

package/dist/{chunk-VHHJIBAB.js → chunk-SIDWRC3P.js}

@@ -3,13 +3,12 @@ import {
   SHAPE_TYPES
 } from "./chunk-JCYNPYYJ.js";
 import {
-  PRINCIPAL_KINDS,
-  principalSchema
+  PRINCIPAL_KINDS
 } from "./chunk-SPP6PINW.js";
 
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "0.5.0" : readPackageVersion();
+var VERSION = true ? "0.6.0" : readPackageVersion();
 
 // src/brand.ts
 var BRAND = {
@@ -51,17 +50,19 @@ async function svgToPng(svg) {
 }
 
 // src/actor.ts
+import { parsePrincipal } from "agentic-identity";
 var ActorConfigError = class extends Error {
 };
 function operatorActor(env = process.env) {
   const raw = env.CANVAS_ACTOR;
   if (!raw) throw new ActorConfigError("the operator must set CANVAS_ACTOR=<kind>:<id>");
   const at = raw.indexOf(":");
-  const parsed = principalSchema.safeParse({ kind: raw.slice(0, at), id: raw.slice(at + 1) });
-  if (at < 0 || !parsed.success) {
+  try {
+    if (at < 0) throw new Error("no kind");
+    return parsePrincipal({ kind: raw.slice(0, at), id: raw.slice(at + 1) });
+  } catch {
     throw new ActorConfigError(`bad CANVAS_ACTOR "${raw}": use <kind>:<id>, kind is one of ${PRINCIPAL_KINDS.join(", ")}`);
   }
-  return parsed.data;
 }
 
 // src/mcp.ts

package/dist/cli.js

@@ -5,7 +5,7 @@ import {
   operatorActor,
   runMcp,
   svgToPng
-} from "./chunk-VHHJIBAB.js";
+} from "./chunk-SIDWRC3P.js";
 import {
   openLocalStore
 } from "./chunk-UKST5A57.js";

package/dist/embed.js

@@ -228,11 +228,11 @@ function Failure({ message, retry }) {
 
 // ui/presence.ts
 import { SyncClient } from "agentic-realtime/client";
-var WS_PROTOCOL = "agentic-canvas.bearer";
+var WS_PROTOCOL = "agentic-canvas";
 var b64url = (text) => btoa(String.fromCharCode(...new TextEncoder().encode(text))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 var bearerSocket = (token) => class extends WebSocket {
   constructor(url) {
-    super(url, [WS_PROTOCOL, b64url(token)]);
+    super(url, [WS_PROTOCOL, `${WS_PROTOCOL}.bearer.${b64url(token)}`]);
   }
 };
 function roomUrl(baseUrl, board) {

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   operatorActor,
   runMcp,
   svgToPng
-} from "./chunk-VHHJIBAB.js";
+} from "./chunk-SIDWRC3P.js";
 import {
   createFileStore,
   openLocalStore

package/dist/live-worker.js

@@ -1,6 +1,6 @@
 import {
   createApp
-} from "./chunk-V74PWJKY.js";
+} from "./chunk-BIIC2DPZ.js";
 import "./chunk-G4YTESPS.js";
 import "./chunk-NWQED42L.js";
 import {

package/dist/live.js

@@ -5,11 +5,10 @@ import {
   readBoard,
   toSvg
 } from "./chunk-JCYNPYYJ.js";
-import {
-  principalSchema
-} from "./chunk-SPP6PINW.js";
+import "./chunk-SPP6PINW.js";
 
 // src/live.ts
+import { parsePrincipal } from "agentic-identity";
 import { SyncClient } from "agentic-realtime/client";
 var CODES = ["INVALID", "DUPLICATE_ID", "NOT_FOUND", "BAD_REFERENCE", "LIMIT", "UNAVAILABLE", "FORBIDDEN"];
 var base = (server) => server.replace(/\/$/, "") + "/api/v1/canvas";
@@ -33,9 +32,13 @@ async function whoAmI(server, token) {
   const response = await call(server, token, "/me");
   if (!response.ok) throw await refusal(response, "the server refused the token");
   const { actor, kind, role } = await json(response);
-  const principal = principalSchema.safeParse({ kind, id: actor });
-  if (!principal.success || role !== "editor" && role !== "viewer") throw new CanvasError("INVALID", "the server sent an identity this client does not know");
-  return { actor: principal.data, role };
+  let principal;
+  try {
+    principal = parsePrincipal({ kind, id: actor });
+  } catch {
+  }
+  if (!principal || role !== "editor" && role !== "viewer") throw new CanvasError("INVALID", "the server sent an identity this client does not know");
+  return { actor: principal, role };
 }
 var LiveBoard = class _LiveBoard {
   constructor(board, me, client, id, options, refusedAtStart) {

package/dist/worker.d.ts

@@ -40,13 +40,13 @@ interface AppOptions {
     /** Makes the live-room server from the Worker bindings. Without it, the ws route answers 404. */
     live?: (env: WorkerEnv) => Realtime;
 }
-/** A browser cannot set a header on a WebSocket. It offers the token as the sub-protocols `agentic-canvas.bearer` and the token in base64url. */
-declare const WS_PROTOCOL = "agentic-canvas.bearer";
+/** A browser cannot set a header on a WebSocket. It offers the sub-protocols `agentic-canvas` and `agentic-canvas.bearer.<token in base64url>`. */
+declare const WS_PROTOCOL = "agentic-canvas";
 /** The principal and role for a bearer token, or null. The kind is never defaulted: a grant without a valid kind gets null. */
-declare function authenticate(request: Request, env: WorkerEnv): {
+declare function authenticate(request: Request, env: WorkerEnv): Promise<{
     actor: Principal;
     role: Role;
-} | null;
+} | null>;
 /** The image types we accept, found by their first bytes. The client's claim of a type is not trusted. */
 declare function sniffImage(bytes: Uint8Array): string | null;
 declare function createApp(options?: AppOptions): Hono<App>;

package/dist/worker.js

@@ -4,7 +4,7 @@ import {
   createApp,
   sniffImage,
   worker_default
-} from "./chunk-V74PWJKY.js";
+} from "./chunk-BIIC2DPZ.js";
 import "./chunk-G4YTESPS.js";
 import "./chunk-NWQED42L.js";
 import "./chunk-JCYNPYYJ.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-canvas",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "A shared whiteboard for diagrams, drawn by people and agents.",
   "keywords": [
     "whiteboard",
@@ -81,7 +81,7 @@
     "@dagrejs/dagre": "^3.1.3",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "agentic-design": "^0.2.0",
-    "agentic-identity": "^0.5.0",
+    "agentic-identity": "^0.6.0",
     "agentic-realtime": "^0.3.0",
     "yjs": "^13.6.0",
     "zod": "^3.25.0"