agentic-canvas 0.5.0 → 0.6.1

package/README.md

@@ -7,7 +7,7 @@
 
 A shared whiteboard for diagrams, drawn by people and agents.
 
-> Status: 0.5.0. The board model, the agent operations, the exports, the CLI, the
+> Status: 0.6.0. The board model, the agent operations, the exports, the CLI, the
 > MCP server, a small Worker API, and live co-editing work. The CLI, the MCP server,
 > and the SDK can join a live room. A remote client calls the Worker API. A small web UI, served by the Worker, is new in 0.4.0.
 > The package exports `agentic-canvas/ui`, a board view you can mount in your own app, new in 0.5.0.
@@ -279,12 +279,20 @@ Every name that each entry point exports is listed here. A name marked (type) ex
 | `FlowGraph` (type), `FlowNode` (type), `FlowEdge` (type), `Placement` (type), `DrawOptions` (type) | Types for a flow and its layout. |
 | `readBoard`, `BoardData` (type), `NodeData` (type), `EdgeData` (type) | Read a board as plain data. |
 | `toSvg(board)`, `svgToPng(svg)` | `toSvg` returns the board as SVG. `svgToPng` turns an SVG string into PNG through Chromium. |
-| `PRINCIPAL_KINDS`, `PrincipalKind` (type), `Principal` (type), `principalSchema`, `isMachineMade` | The principal kinds, the schema of a principal, and the rule that marks machine-made kinds. |
+| `PRINCIPAL_KINDS`, `PrincipalKind` (type), `Principal` (type), `principalSchema`, `isMachineMade` | The principal kinds, the schema of a principal, and the rule that marks machine-made kinds. `principalSchema` uses the identity rule below. |
 | `operatorActor(env?)`, `ActorConfigError` | Read the actor from `CANVAS_ACTOR` as `<kind>:<id>`. It throws `ActorConfigError` when the value is missing or bad. |
 | `CanvasService` | The board operations that the CLI, the MCP server and the Worker share. It takes a `Store`. |
 | `createMcpServer(service, actor)`, `runMcp(service, actor)` | Make the MCP server, or run it on stdio. |
 | `createFileStore`, `openLocalStore`, `FileStoreOptions` (type) | Stores on one local file. See `agentic-canvas/file-store`. |
 
+### Actor ids
+
+One rule names an actor in every new write, in the SDK, the CLI, the MCP server and the Worker. The kind must be
+one of `PRINCIPAL_KINDS`. The id has 1 to 128 characters from `A-Z`, `a-z`, `0-9`, `.`, `_` and `-`, and starts
+with a letter, digit, `_` or `-`. The rule comes from `parsePrincipal` in `agentic-identity`. A write with another
+id fails with `INVALID`. A board that was stored with an older, looser id (up to 200 characters) still opens. The
+old author stays on its elements. Only new writes follow the strict rule.
+
 ### `agentic-canvas/client`
 
 | Name | What it is |
@@ -327,9 +335,9 @@ The stylesheet is a separate export, `agentic-canvas/ui.css`. Load `agentic-desi
 |---|---|
 | `createApp(options?)` | Make the Hono app for the Worker. Pass `live` to turn on the live-room socket. |
 | `default` | The Worker, without live rooms. |
-| `authenticate(request, env)` | Read a bearer token from the `Authorization` header, or from a WebSocket sub-protocol. Return the actor and the role, or `null`. |
+| `authenticate(request, env)` | Read a bearer token from the `Authorization` header, or from a WebSocket sub-protocol. Return a promise of the actor and the role, or `null`. |
 | `sniffImage(bytes)` | Find the image type from the first bytes, or return `null`. The client's claim of a type is not trusted. |
-| `WS_PROTOCOL` | The sub-protocol name that carries a token on a WebSocket: `agentic-canvas.bearer`. |
+| `WS_PROTOCOL` | The sub-protocol name for a WebSocket: `agentic-canvas`. The token travels in the entry `agentic-canvas.bearer.<token in base64url>`. |
 | `WorkerEnv` (type), `AppOptions` (type), `Role` (type) | Types for the Worker bindings, the app options and the role, `editor` or `viewer`. |
 
 ### `agentic-canvas/live-worker`

package/dist/{chunk-G4YTESPS.js → chunk-66FFQMHI.js}

@@ -7,10 +7,10 @@ import {
   drawFlow,
   readBoard,
   toSvg
-} from "./chunk-JCYNPYYJ.js";
+} from "./chunk-ZSPZMGHG.js";
 import {
   principalSchema
-} from "./chunk-SPP6PINW.js";
+} from "./chunk-JOBTIAFJ.js";
 
 // src/service.ts
 import * as Y from "yjs";

package/dist/chunk-JOBTIAFJ.js

@@ -0,0 +1,19 @@
+// src/core/principal.ts
+import { PRINCIPAL_KINDS, isMachineMade, parsePrincipal } from "agentic-identity";
+import { z } from "zod";
+var principalSchema = z.object({ kind: z.string(), id: z.string() }).strict().transform((value, ctx) => {
+  try {
+    return parsePrincipal(value);
+  } catch (error) {
+    ctx.addIssue({ code: "custom", message: error instanceof Error ? error.message : "invalid principal" });
+    return z.NEVER;
+  }
+});
+var storedPrincipalSchema = z.object({ kind: z.enum(PRINCIPAL_KINDS), id: z.string().min(1).max(200) }).strict();
+
+export {
+  PRINCIPAL_KINDS,
+  isMachineMade,
+  principalSchema,
+  storedPrincipalSchema
+};

package/dist/{chunk-V74PWJKY.js → chunk-PH67TSYW.js}

@@ -1,17 +1,15 @@
 import {
   CanvasService,
   MAX_LIVE_BYTES
-} from "./chunk-G4YTESPS.js";
+} from "./chunk-66FFQMHI.js";
 import {
   CanvasError
-} from "./chunk-JCYNPYYJ.js";
-import {
-  principalSchema
-} from "./chunk-SPP6PINW.js";
+} from "./chunk-ZSPZMGHG.js";
 
 // src/worker.ts
-import { parseRegion } from "agentic-identity";
+import { hasScope, parsePrincipal, parseRegion } from "agentic-identity";
 import { createD1Store, createR2Blobs, D1_SCHEMA } from "agentic-identity/cloudflare";
+import { acceptWebSocketProtocol, principalFromWebSocketRequest } from "agentic-identity/http";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
@@ -1950,36 +1948,41 @@ function sameText(a, b) {
   for (let i = 0; i < Math.max(x.length, y.length); i++) diff |= (x[i] ?? 0) ^ (y[i] ?? 0);
   return diff === 0;
 }
-var WS_PROTOCOL = "agentic-canvas.bearer";
-function socketToken(request) {
-  if (request.headers.get("upgrade") !== "websocket") return void 0;
-  const [name, encoded, ...more] = (request.headers.get("sec-websocket-protocol") ?? "").split(",").map((p) => p.trim());
-  if (name !== WS_PROTOCOL || !encoded || more.length > 0 || !/^[A-Za-z0-9_-]+$/.test(encoded)) return void 0;
-  try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(Uint8Array.from(atob(encoded.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0)));
-  } catch {
-    return void 0;
-  }
+var WS_PROTOCOL = "agentic-canvas";
+function tokenAuth(env) {
+  return {
+    async authenticate(request) {
+      const token = /^Bearer (.+)$/.exec(request.headers.get("authorization") ?? "")?.[1];
+      if (!token || !env.CANVAS_API_TOKENS) return null;
+      let grants;
+      try {
+        grants = JSON.parse(env.CANVAS_API_TOKENS);
+      } catch {
+        return null;
+      }
+      if (typeof grants !== "object" || grants === null || Array.isArray(grants)) return null;
+      let found;
+      for (const [candidate, grant] of Object.entries(grants)) {
+        if (sameText(candidate, token) && candidate.length >= MIN_TOKEN_LENGTH) found = grant;
+      }
+      if (typeof found !== "object" || found === null) return null;
+      const { actor, kind, role = "editor" } = found;
+      let step;
+      try {
+        step = parsePrincipal({ kind, id: actor });
+      } catch {
+        return null;
+      }
+      if (step.kind === SEEDER.kind && step.id === SEEDER.id) return null;
+      if (role !== "editor" && role !== "viewer") return null;
+      return { principalId: step.id, kind: step.kind, chain: [step], scopes: role === "viewer" ? ["canvas:read"] : ["canvas:read", "canvas:write"] };
+    }
+  };
 }
-function authenticate(request, env) {
-  const token = /^Bearer (.+)$/.exec(request.headers.get("authorization") ?? "")?.[1] ?? socketToken(request);
-  if (!token || !env.CANVAS_API_TOKENS) return null;
-  let grants;
-  try {
-    grants = JSON.parse(env.CANVAS_API_TOKENS);
-  } catch {
-    return null;
-  }
-  if (typeof grants !== "object" || grants === null || Array.isArray(grants)) return null;
-  let found;
-  for (const [candidate, grant] of Object.entries(grants)) {
-    if (sameText(candidate, token) && candidate.length >= MIN_TOKEN_LENGTH) found = grant;
-  }
-  if (typeof found !== "object" || found === null) return null;
-  const { actor, kind, role = "editor" } = found;
-  const parsed = principalSchema.safeParse({ kind, id: actor });
-  const taken = parsed.success && parsed.data.kind === SEEDER.kind && parsed.data.id === SEEDER.id;
-  return parsed.success && !taken && (role === "editor" || role === "viewer") ? { actor: parsed.data, role } : null;
+async function authenticate(request, env) {
+  const found = await principalFromWebSocketRequest(request, tokenAuth(env), { protocol: WS_PROTOCOL });
+  if (found instanceof Response) return null;
+  return { actor: { kind: found.kind, id: found.principalId }, role: hasScope(found.scopes, "canvas:write") ? "editor" : "viewer" };
 }
 function sniffImage(bytes) {
   const at = (offset, ...sig) => sig.every((b, i) => bytes[offset + i] === b);
@@ -2058,7 +2061,7 @@ function createApp(options = {}) {
       return fail("NOT_CONFIGURED", 'set CANVAS_REGION to "eu", "us", or "unknown"', 503);
     }
     if (!c.env.DB || !c.env.IMAGES) return fail("NOT_CONFIGURED", "bind DB (D1) and IMAGES (R2)", 503);
-    const who = authenticate(c.req.raw, c.env);
+    const who = await authenticate(c.req.raw, c.env);
     if (!who) return fail("UNAUTHORIZED", "send a valid bearer token", 401);
     if (who.role === "viewer" && c.req.method !== "GET") return fail("FORBIDDEN", "this token is a viewer; it cannot change a board", 403);
     c.set("actor", who.actor);
@@ -2094,10 +2097,7 @@ function createApp(options = {}) {
     await saveRoom(c, true);
     const { actor, role } = c.var;
     const opened = await options.live(c.env).connect(id, c.req.raw, { principal: { id: actor.id, kind: actor.kind }, role, name: actor.id });
-    if (opened.status !== 101 || c.req.header("authorization") || !socketToken(c.req.raw)) return opened;
-    const headers = new Headers(opened.headers);
-    headers.set("sec-websocket-protocol", WS_PROTOCOL);
-    return new Response(null, { status: 101, headers, webSocket: opened.webSocket });
+    return acceptWebSocketProtocol(c.req.raw, opened, WS_PROTOCOL);
   });
   api.get("/boards/:id/state", async (c) => !options.live ? fail("NOT_FOUND", "this server hosts no live rooms", 404) : c.body(new Uint8Array(await c.var.service.state(c.req.param("id"))), 200, { "content-type": "application/octet-stream" }));
   api.post("/boards/:id/checkpoint", async (c) => {

package/dist/{chunk-VHHJIBAB.js → chunk-VFJJGXTK.js}

@@ -1,15 +1,14 @@
 import {
   CanvasError,
   SHAPE_TYPES
-} from "./chunk-JCYNPYYJ.js";
+} from "./chunk-ZSPZMGHG.js";
 import {
-  PRINCIPAL_KINDS,
-  principalSchema
-} from "./chunk-SPP6PINW.js";
+  PRINCIPAL_KINDS
+} from "./chunk-JOBTIAFJ.js";
 
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "0.5.0" : readPackageVersion();
+var VERSION = true ? "0.6.1" : readPackageVersion();
 
 // src/brand.ts
 var BRAND = {
@@ -51,17 +50,19 @@ async function svgToPng(svg) {
 }
 
 // src/actor.ts
+import { parsePrincipal } from "agentic-identity";
 var ActorConfigError = class extends Error {
 };
 function operatorActor(env = process.env) {
   const raw = env.CANVAS_ACTOR;
   if (!raw) throw new ActorConfigError("the operator must set CANVAS_ACTOR=<kind>:<id>");
   const at = raw.indexOf(":");
-  const parsed = principalSchema.safeParse({ kind: raw.slice(0, at), id: raw.slice(at + 1) });
-  if (at < 0 || !parsed.success) {
+  try {
+    if (at < 0) throw new Error("no kind");
+    return parsePrincipal({ kind: raw.slice(0, at), id: raw.slice(at + 1) });
+  } catch {
     throw new ActorConfigError(`bad CANVAS_ACTOR "${raw}": use <kind>:<id>, kind is one of ${PRINCIPAL_KINDS.join(", ")}`);
   }
-  return parsed.data;
 }
 
 // src/mcp.ts

package/dist/{chunk-JCYNPYYJ.js → chunk-ZSPZMGHG.js}

@@ -1,7 +1,8 @@
 import {
   isMachineMade,
-  principalSchema
-} from "./chunk-SPP6PINW.js";
+  principalSchema,
+  storedPrincipalSchema
+} from "./chunk-JOBTIAFJ.js";
 
 // src/core/board.ts
 import { randomUUID } from "crypto";
@@ -58,8 +59,8 @@ var stampFields = {
   id,
   z: z.number().finite().min(-MAX_Z).max(MAX_Z),
   groupId: id.optional(),
-  author: principalSchema,
-  editedBy: principalSchema
+  author: storedPrincipalSchema,
+  editedBy: storedPrincipalSchema
 };
 var storedShape = z.object({ ...stampFields, type: z.enum(SHAPE_TYPES), x: coord, y: coord, w: size, h: size, text, fill: color.optional(), stroke: color.optional(), src: imageSrc.optional() }).refine((s) => s.type === "image" === (s.src !== void 0), { message: "src is required for image shapes and allowed on no other type" });
 var storedConnector = z.object({
@@ -129,7 +130,7 @@ var Board = class _Board {
     return value.success ? value.data : "";
   }
   get titleBy() {
-    const value = principalSchema.safeParse(this.meta.get("titleBy"));
+    const value = storedPrincipalSchema.safeParse(this.meta.get("titleBy"));
     return value.success ? value.data : void 0;
   }
   setTitle(title, actor) {

package/dist/cli.js

@@ -5,18 +5,18 @@ import {
   operatorActor,
   runMcp,
   svgToPng
-} from "./chunk-VHHJIBAB.js";
+} from "./chunk-VFJJGXTK.js";
 import {
   openLocalStore
 } from "./chunk-UKST5A57.js";
 import {
   CanvasService
-} from "./chunk-G4YTESPS.js";
+} from "./chunk-66FFQMHI.js";
 import "./chunk-NWQED42L.js";
 import {
   CanvasError
-} from "./chunk-JCYNPYYJ.js";
-import "./chunk-SPP6PINW.js";
+} from "./chunk-ZSPZMGHG.js";
+import "./chunk-JOBTIAFJ.js";
 
 // src/cli.ts
 import { readFileSync, writeFileSync } from "fs";

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import { E as ErrorCode, a as BoardData, c as ShapeType, S as Shape, d as Endpoint, C as Connector } from './read-BupIJSPJ.js';
+import { E as ErrorCode, a as BoardData, c as ShapeType, S as Shape, d as Endpoint, C as Connector } from './read-CeWoSAAy.js';
 import { PrincipalKind } from 'agentic-identity';
 import 'yjs';
 import 'zod';

package/dist/embed.d.ts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { CanvasClient } from './client.js';
 import { PrincipalKind } from 'agentic-identity';
-import './read-BupIJSPJ.js';
+import './read-CeWoSAAy.js';
 import 'yjs';
 import 'zod';
 

package/dist/embed.js

@@ -1,6 +1,6 @@
 import {
   PRINCIPAL_KINDS
-} from "./chunk-SPP6PINW.js";
+} from "./chunk-JOBTIAFJ.js";
 
 // ui/embed.tsx
 import { ToastProvider, TooltipProvider } from "agentic-design/react";
@@ -228,11 +228,11 @@ function Failure({ message, retry }) {
 
 // ui/presence.ts
 import { SyncClient } from "agentic-realtime/client";
-var WS_PROTOCOL = "agentic-canvas.bearer";
+var WS_PROTOCOL = "agentic-canvas";
 var b64url = (text) => btoa(String.fromCharCode(...new TextEncoder().encode(text))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 var bearerSocket = (token) => class extends WebSocket {
   constructor(url) {
-    super(url, [WS_PROTOCOL, b64url(token)]);
+    super(url, [WS_PROTOCOL, `${WS_PROTOCOL}.bearer.${b64url(token)}`]);
   }
 };
 function roomUrl(baseUrl, board) {

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { B as Board, P as Principal } from './read-BupIJSPJ.js';
-export { a as BoardData, b as CanvasElement, e as CanvasError, C as Connector, f as EdgeData, d as Endpoint, E as ErrorCode, G as Group, M as MAX_ELEMENTS, g as MAX_TEXT, N as NodeData, h as SHAPE_TYPES, S as Shape, c as ShapeType, p as principalSchema, r as readBoard } from './read-BupIJSPJ.js';
-import { B as BoardAccess } from './service-CR4-r1yx.js';
-export { C as CanvasService, D as DrawOptions, F as FlowEdge, a as FlowGraph, b as FlowNode, M as MAX_FLOW_EDGES, c as MAX_FLOW_NODES, P as Placement, d as drawFlow, l as layoutFlow, p as parseFlow } from './service-CR4-r1yx.js';
+import { B as Board, P as Principal } from './read-CeWoSAAy.js';
+export { a as BoardData, b as CanvasElement, e as CanvasError, C as Connector, f as EdgeData, d as Endpoint, E as ErrorCode, G as Group, M as MAX_ELEMENTS, g as MAX_TEXT, N as NodeData, h as SHAPE_TYPES, S as Shape, c as ShapeType, p as principalSchema, r as readBoard } from './read-CeWoSAAy.js';
+import { B as BoardAccess } from './service-Ckz-3qhK.js';
+export { C as CanvasService, D as DrawOptions, F as FlowEdge, a as FlowGraph, b as FlowNode, M as MAX_FLOW_EDGES, c as MAX_FLOW_NODES, P as Placement, d as drawFlow, l as layoutFlow, p as parseFlow } from './service-Ckz-3qhK.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 export { FileStoreOptions, createFileStore, openLocalStore } from './store-file.js';
 export { PRINCIPAL_KINDS, PrincipalKind, isMachineMade } from 'agentic-identity';

package/dist/index.js

@@ -6,14 +6,14 @@ import {
   operatorActor,
   runMcp,
   svgToPng
-} from "./chunk-VHHJIBAB.js";
+} from "./chunk-VFJJGXTK.js";
 import {
   createFileStore,
   openLocalStore
 } from "./chunk-UKST5A57.js";
 import {
   CanvasService
-} from "./chunk-G4YTESPS.js";
+} from "./chunk-66FFQMHI.js";
 import "./chunk-NWQED42L.js";
 import {
   Board,
@@ -28,12 +28,12 @@ import {
   parseFlow,
   readBoard,
   toSvg
-} from "./chunk-JCYNPYYJ.js";
+} from "./chunk-ZSPZMGHG.js";
 import {
   PRINCIPAL_KINDS,
   isMachineMade,
   principalSchema
-} from "./chunk-SPP6PINW.js";
+} from "./chunk-JOBTIAFJ.js";
 export {
   ActorConfigError,
   BRAND,

package/dist/live-worker.d.ts

@@ -5,10 +5,10 @@ import 'agentic-identity';
 import 'agentic-realtime';
 import 'agentic-identity/cloudflare';
 import 'hono';
-import './read-BupIJSPJ.js';
+import './read-CeWoSAAy.js';
 import 'yjs';
 import 'zod';
-import './service-CR4-r1yx.js';
+import './service-Ckz-3qhK.js';
 
 type Namespace = Parameters<typeof createDurableObjectRealtime>[0];
 interface LiveEnv extends WorkerEnv {

package/dist/live-worker.js

@@ -1,12 +1,12 @@
 import {
   createApp
-} from "./chunk-V74PWJKY.js";
-import "./chunk-G4YTESPS.js";
+} from "./chunk-PH67TSYW.js";
+import "./chunk-66FFQMHI.js";
 import "./chunk-NWQED42L.js";
 import {
   CanvasError
-} from "./chunk-JCYNPYYJ.js";
-import "./chunk-SPP6PINW.js";
+} from "./chunk-ZSPZMGHG.js";
+import "./chunk-JOBTIAFJ.js";
 
 // src/live-worker.ts
 import { parseRegion } from "agentic-identity";

package/dist/live.d.ts

@@ -1,9 +1,9 @@
-import { B as Board, P as Principal, a as BoardData, S as Shape, C as Connector, b as CanvasElement } from './read-BupIJSPJ.js';
+import { B as Board, P as Principal, a as BoardData, S as Shape, C as Connector, b as CanvasElement } from './read-CeWoSAAy.js';
 import { Peer } from 'agentic-realtime/client';
-import { B as BoardAccess, D as DrawOptions } from './service-CR4-r1yx.js';
+import { B as BoardAccess, D as DrawOptions } from './service-Ckz-3qhK.js';
 import 'yjs';
-import 'zod';
 import 'agentic-identity';
+import 'zod';
 
 interface LiveOptions {
     /** The Worker address, such as `https://canvas.example.com`. */

package/dist/live.js

@@ -4,12 +4,11 @@ import {
   drawFlow,
   readBoard,
   toSvg
-} from "./chunk-JCYNPYYJ.js";
-import {
-  principalSchema
-} from "./chunk-SPP6PINW.js";
+} from "./chunk-ZSPZMGHG.js";
+import "./chunk-JOBTIAFJ.js";
 
 // src/live.ts
+import { parsePrincipal } from "agentic-identity";
 import { SyncClient } from "agentic-realtime/client";
 var CODES = ["INVALID", "DUPLICATE_ID", "NOT_FOUND", "BAD_REFERENCE", "LIMIT", "UNAVAILABLE", "FORBIDDEN"];
 var base = (server) => server.replace(/\/$/, "") + "/api/v1/canvas";
@@ -33,9 +32,13 @@ async function whoAmI(server, token) {
   const response = await call(server, token, "/me");
   if (!response.ok) throw await refusal(response, "the server refused the token");
   const { actor, kind, role } = await json(response);
-  const principal = principalSchema.safeParse({ kind, id: actor });
-  if (!principal.success || role !== "editor" && role !== "viewer") throw new CanvasError("INVALID", "the server sent an identity this client does not know");
-  return { actor: principal.data, role };
+  let principal;
+  try {
+    principal = parsePrincipal({ kind, id: actor });
+  } catch {
+  }
+  if (!principal || role !== "editor" && role !== "viewer") throw new CanvasError("INVALID", "the server sent an identity this client does not know");
+  return { actor: principal, role };
 }
 var LiveBoard = class _LiveBoard {
   constructor(board, me, client, id, options, refusedAtStart) {

package/dist/{read-BupIJSPJ.d.ts → read-CeWoSAAy.d.ts}

@@ -1,17 +1,31 @@
 import * as Y from 'yjs';
+import { PrincipalKind } from 'agentic-identity';
 import { z } from 'zod';
 
-declare const principalSchema: z.ZodObject<{
-    kind: z.ZodEnum<["human", "agent_of_human", "agent_of_agent", "agent", "user_token"]>;
+/**
+ * The actor of a new write. The rule is the identity kernel's `parsePrincipal`: a known kind, and an id of 1 to 128
+ * characters from A-Z, a-z, 0-9, ".", "_" and "-". The Worker, the CLI and the SDK all use it.
+ */
+declare const principalSchema: z.ZodEffects<z.ZodObject<{
+    kind: z.ZodString;
     id: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    kind: "human" | "agent_of_human" | "agent_of_agent" | "agent" | "user_token";
+    kind: string;
     id: string;
 }, {
-    kind: "human" | "agent_of_human" | "agent_of_agent" | "agent" | "user_token";
+    kind: string;
+    id: string;
+}>, {
+    kind: PrincipalKind;
+    id: string;
+}, {
+    kind: string;
     id: string;
 }>;
-type Principal = z.infer<typeof principalSchema>;
+type Principal = {
+    kind: PrincipalKind;
+    id: string;
+};
 
 type ErrorCode = "INVALID" | "DUPLICATE_ID" | "NOT_FOUND" | "BAD_REFERENCE" | "LIMIT" | "UNAVAILABLE" | "FORBIDDEN";
 declare class CanvasError extends Error {

package/dist/{service-CR4-r1yx.d.ts → service-Ckz-3qhK.d.ts}

@@ -1,4 +1,4 @@
-import { c as ShapeType, B as Board, P as Principal, a as BoardData, S as Shape, C as Connector, b as CanvasElement } from './read-BupIJSPJ.js';
+import { c as ShapeType, B as Board, P as Principal, a as BoardData, S as Shape, C as Connector, b as CanvasElement } from './read-CeWoSAAy.js';
 import { Store } from 'agentic-identity';
 
 declare const MAX_FLOW_NODES = 500;

package/dist/worker.d.ts

@@ -2,8 +2,8 @@ import { Blobs } from 'agentic-identity';
 import { Realtime } from 'agentic-realtime';
 import { D1Like, R2Like } from 'agentic-identity/cloudflare';
 import { Hono } from 'hono';
-import { P as Principal } from './read-BupIJSPJ.js';
-import { C as CanvasService } from './service-CR4-r1yx.js';
+import { P as Principal } from './read-CeWoSAAy.js';
+import { C as CanvasService } from './service-Ckz-3qhK.js';
 import 'yjs';
 import 'zod';
 
@@ -40,13 +40,13 @@ interface AppOptions {
     /** Makes the live-room server from the Worker bindings. Without it, the ws route answers 404. */
     live?: (env: WorkerEnv) => Realtime;
 }
-/** A browser cannot set a header on a WebSocket. It offers the token as the sub-protocols `agentic-canvas.bearer` and the token in base64url. */
-declare const WS_PROTOCOL = "agentic-canvas.bearer";
+/** A browser cannot set a header on a WebSocket. It offers the sub-protocols `agentic-canvas` and `agentic-canvas.bearer.<token in base64url>`. */
+declare const WS_PROTOCOL = "agentic-canvas";
 /** The principal and role for a bearer token, or null. The kind is never defaulted: a grant without a valid kind gets null. */
-declare function authenticate(request: Request, env: WorkerEnv): {
+declare function authenticate(request: Request, env: WorkerEnv): Promise<{
     actor: Principal;
     role: Role;
-} | null;
+} | null>;
 /** The image types we accept, found by their first bytes. The client's claim of a type is not trusted. */
 declare function sniffImage(bytes: Uint8Array): string | null;
 declare function createApp(options?: AppOptions): Hono<App>;

package/dist/worker.js

@@ -4,11 +4,11 @@ import {
   createApp,
   sniffImage,
   worker_default
-} from "./chunk-V74PWJKY.js";
-import "./chunk-G4YTESPS.js";
+} from "./chunk-PH67TSYW.js";
+import "./chunk-66FFQMHI.js";
 import "./chunk-NWQED42L.js";
-import "./chunk-JCYNPYYJ.js";
-import "./chunk-SPP6PINW.js";
+import "./chunk-ZSPZMGHG.js";
+import "./chunk-JOBTIAFJ.js";
 export {
   WS_PROTOCOL,
   authenticate,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-canvas",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "A shared whiteboard for diagrams, drawn by people and agents.",
   "keywords": [
     "whiteboard",
@@ -81,7 +81,7 @@
     "@dagrejs/dagre": "^3.1.3",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "agentic-design": "^0.2.0",
-    "agentic-identity": "^0.5.0",
+    "agentic-identity": "^0.6.0",
     "agentic-realtime": "^0.3.0",
     "yjs": "^13.6.0",
     "zod": "^3.25.0"

package/dist/chunk-SPP6PINW.js

@@ -1,10 +0,0 @@
-// src/core/principal.ts
-import { PRINCIPAL_KINDS, isMachineMade } from "agentic-identity";
-import { z } from "zod";
-var principalSchema = z.object({ kind: z.enum(PRINCIPAL_KINDS), id: z.string().min(1).max(200) }).strict();
-
-export {
-  PRINCIPAL_KINDS,
-  isMachineMade,
-  principalSchema
-};