agentic-comments 0.5.1 → 0.6.0

package/dist/worker.js

@@ -1,18 +1,19 @@
 import {
   CommentsService,
   TEXT_ROOT
-} from "./chunk-NQWRFKJ6.js";
+} from "./chunk-T77DPNIV.js";
 import {
   ACCEPT_SCOPE,
   CommentsError,
+  MODERATE_SCOPE,
   exact,
   invalid,
   stamp
-} from "./chunk-BSNBDKR2.js";
+} from "./chunk-VAVKBAHM.js";
 
 // src/worker.ts
 import { Hono } from "hono";
-import { StoreConflictError, assertRegion, isScope, parseRegion, hasScope, parsePrincipal } from "agentic-identity";
+import { StoreConflictError, assertRegion, createStoreAuth, isScope, parseRegion, hasScope, parsePrincipal } from "agentic-identity";
 import { requirePrincipal } from "agentic-identity/http";
 import { D1_SCHEMA, createD1Store } from "agentic-identity/cloudflare";
 import * as Y from "yjs";
@@ -86,7 +87,7 @@ function createTokenAuth(raw) {
   };
 }
 function actorOf(context) {
-  const scopes = hasScope(context.scopes, ADMIN) ? [ACCEPT_SCOPE] : [];
+  const scopes = hasScope(context.scopes, ADMIN) ? [ACCEPT_SCOPE, MODERATE_SCOPE] : [];
   return stamp({ kind: context.kind, name: context.principalId, scopes });
 }
 var DOCS = "comments_docs";
@@ -155,6 +156,7 @@ var STATUS = {
   INVALID_INPUT: 400,
   INVALID_ANCHOR: 400,
   NO_THREAD: 404,
+  NO_MESSAGE: 404,
   NO_SUGGESTION: 404,
   NO_DOCUMENT: 404,
   THREAD_RESOLVED: 409,
@@ -191,8 +193,28 @@ function createApp(source, options = {}) {
   });
   app2.get("/health", (c) => c.json({ ok: true, pack: "agentic-comments" }));
   app2.use("/api/v1/*", async (c, next) => {
-    const auth = typeof options.auth === "function" ? options.auth(c.env ?? {}) : options.auth ?? createTokenAuth(c.env?.AGENTIC_COMMENTS_TOKENS);
-    const context = await requirePrincipal(c.req.raw, auth, { origins: options.origins });
+    let auth;
+    if (typeof options.auth === "function") auth = options.auth(c.env ?? {});
+    else if (options.auth) auth = options.auth;
+    else {
+      const staticOn = c.env?.AGENTIC_COMMENTS_UNSAFE_STATIC_TOKENS === "1";
+      if (c.env?.AGENTIC_COMMENTS_TOKENS && !staticOn) {
+        return fail("NOT_CONFIGURED", "AGENTIC_COMMENTS_TOKENS is a dev fallback. Set AGENTIC_COMMENTS_UNSAFE_STATIC_TOKENS=1 to use it, or remove it and issue agentic-identity credentials", 503);
+      }
+      const store = (await docsOf(c)).store;
+      const auths = [createStoreAuth(store)];
+      if (staticOn) auths.push(createTokenAuth(c.env?.AGENTIC_COMMENTS_TOKENS));
+      auth = {
+        async authenticate(request) {
+          for (const each of auths) {
+            const found = await each.authenticate(request);
+            if (found) return found;
+          }
+          return null;
+        }
+      };
+    }
+    const context = await requirePrincipal(c.req.raw, auth, { origins: options.origins, scope: READ });
     if (context instanceof Response) {
       if (context.status === 401) return Response.json({ error: { code: "UNAUTHENTICATED", message: "send a valid bearer token" } }, { status: 401, headers: { "www-authenticate": "Bearer" } });
       if (context.status === 403) return fail("FORBIDDEN", "this credential may not do this", 403);
@@ -237,6 +259,14 @@ function createApp(source, options = {}) {
   for (const action of ["resolve", "reopen"]) {
     app2.post(`${doc}/threads/:id/${action}`, (c) => act(c, COMMENT, true, (s) => s[action](c.req.param("id"))));
   }
+  app2.patch(`${doc}/threads/:id/messages/:message`, async (c) => {
+    const input = await body(c);
+    return act(c, COMMENT, true, (s) => s.editMessage(c.req.param("id"), c.req.param("message"), input));
+  });
+  app2.delete(`${doc}/threads/:id/messages/:message`, (c) => act(c, COMMENT, true, (s) => s.deleteMessage(c.req.param("id"), c.req.param("message"))));
+  app2.delete(`${doc}/threads/:id`, (c) => act(c, COMMENT, true, (s) => s.deleteThread(c.req.param("id"))));
+  app2.get(`${doc}/people/:name/export`, (c) => act(c, READ, false, (s) => s.exportPerson(c.req.param("name"))));
+  app2.delete(`${doc}/people/:name`, (c) => act(c, COMMENT, true, (s) => s.erasePerson(c.req.param("name"))));
   app2.post(`${doc}/threads/:id/relocate`, (c) => act(c, WRITE, true, (s) => s.relocate(c.req.param("id"))));
   app2.get(`${doc}/suggestions`, (c) => act(c, READ, false, (s) => s.suggestions(c.req.query())));
   app2.post(`${doc}/suggestions`, async (c) => {

package/llms.txt

@@ -7,6 +7,7 @@ Keywords: comments,threads,mentions,suggestions,annotations,collaboration,agents
 - SDK: import { Comments, Suggestions, textAnchor } from "agentic-comments". The host calls stamp(); an agent never does.
 - Plain text anchors: import { createAnchor, resolveAnchor, mapRange } from "agentic-comments/anchor". No Yjs. resolveAnchor maps through edits, then falls back to quote + context, else orphaned.
 - Threads live on a Yjs document and merge across replicas.
+- Lifecycle: comments.editMessage, deleteMessage, deleteThread, exportPerson, erasePerson (and the same on the CLI, MCP, HTTP API, and client). Only the author may change their own messages; comments:moderate may change anyone's.
 - Events: new Notifications(comments, suggestions).subscribe(listener). Ids only, never text.
 - CLI: agentic-comments <command>. MCP: agentic-comments mcp. Both use a local store file.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-comments",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Comment threads and suggestions anchored to any content, from people and agents.",
   "keywords": [
     "comments",
@@ -76,7 +76,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.32.2",
-    "agentic-identity": "^0.6.0",
+    "agentic-identity": "^0.7.0",
     "hono": "^4.13.14",
     "zod": "^3.25.76"
   },

package/dist/errors-CNgWMVQT.d.ts

@@ -1,7 +0,0 @@
-type CommentsErrorCode = "INVALID_AUTHOR" | "INVALID_INPUT" | "INVALID_ANCHOR" | "NO_THREAD" | "THREAD_RESOLVED" | "CORRUPT" | "NO_SUGGESTION" | "FORBIDDEN" | "ALREADY_DECIDED" | "APPLY_FAILED" | "RELOCATE_FAILED" | "STORE_MISSING" | "STORE_EXISTS" | "STORE_CORRUPT" | "STORE_LOCKED" | "STORE_FULL" | "NO_DOCUMENT" | "DOCUMENT_EXISTS" | "CONFLICT" | "MISCONFIGURED" | "USAGE";
-declare class CommentsError extends Error {
-    readonly code: CommentsErrorCode;
-    constructor(code: CommentsErrorCode, message: string);
-}
-
-export { type CommentsErrorCode as C, CommentsError as a };

package/dist/mcp-XUV3RPOO.js

@@ -1,11 +0,0 @@
-import {
-  createMcpServer,
-  startMcp
-} from "./chunk-TFRLOBJW.js";
-import "./chunk-REFQNIEP.js";
-import "./chunk-NQWRFKJ6.js";
-import "./chunk-BSNBDKR2.js";
-export {
-  createMcpServer,
-  startMcp
-};