agentic-drive 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,112 @@
+# Changelog
+
+## 0.2.0
+
+Read the breaking changes before you upgrade. The migration steps follow them.
+
+### Breaking changes
+
+- **Sign-in uses agentic-identity.** The Worker no longer reads `DRIVE_API_TOKENS`. A bearer token is now a credential in the identity store. It names a principal, and the whole delegation chain must be live. Tokens in `DRIVE_API_TOKENS` stop working when you deploy this release.
+- **The owner of a drive is the root of the principal's chain.** Before, the owner was the `owner` string of the token. Now a person's drive has the id of that person's principal.
+- **Items from before sharing need a backfill.** Sharing is on in the Worker. Each item needs a `resources` doc, and items from 0.1.0 do not have one. Until you run `backfillResources`, their owner gets `NOT_FOUND`. See the migration steps.
+- **Folders nest 15 deep, not 256, in a drive with sharing on.** The Worker turns sharing on. Sharing checks at most 16 resources on a path, the drive root included. A deeper item, move, or restore fails with `TOO_DEEP`. A local drive without sharing keeps 256. An item already deeper than 15 folders cannot be reached with sharing. Move it up in 0.1.0 before you upgrade.
+- **A locator with a `/` is a path.** A path is `/x` from the root, or `<folder id>/x` from a folder. Before, only a leading `/` made a path. Ids that the drive makes never contain `/`. A path without an id starts in the caller's own drive.
+- **Trash asks for `write`, not `delete`.** An editor can trash an item. A custom `can` hook that allowed trash only for `delete` must change.
+- **Big folders may not move.** In a drive with sharing on, a move or restore that must count the height of a folder with about 200 or more subfolders fails with `TOO_MANY_ITEMS`.
+- **Restore into another folder needs `write` on that folder.** Before, a restore checked only the item.
+- **`authenticate` has a new signature.** It was `authenticate(request, env)`. It is now `authenticate(request, store, now?)`, and it returns a promise. The `Ctx` it returns has a `principal` field.
+- **Agent tokens follow their grant scopes.** An agent used to act with the full rights of its owner in that drive. Now each action needs a scope in the agent's grant. An agent without the scope gets `FORBIDDEN`.
+- **`DELETE /account` and `delete-all` erase the person.** Before, they deleted the drive. Now they call `erasePerson`. That also deletes the drives of the person's agents that have their own identity, the shares they hold, and the invites they sent. What they made in other people's drives stays. Those items keep their kind, and the id of the person on them becomes `erased`. The result is `{ removed, grants, invites, anonymized }`. Before, it was `{ removed }`.
+- **The export manifest is version 2.** Version 2 adds `subject`, `partial`, `authored`, `agents`, `shares`, and `audit`. The item entries do not change. An agent gets `partial: true` and none of the person-level parts. A reader that accepts only version 1 must accept version 2.
+- **Items carry `createdById` and `updatedById`.** Erase and export use these top-level fields to find a person's work. Items written before 0.2.0 do not have them. Code that builds a `Node` value must set both fields.
+- **New error codes.** `CROSS_DRIVE`, `INVALID_SHARE`, and `TOO_MANY_ITEMS` are new. Export and erase also fail with `TOO_MANY_ITEMS` when a person has more than 1000 agents. Code that handles every `ErrorCode` in a `Record` or a `switch` must handle them.
+- **agentic-identity 0.3.0.** `grant` refuses to lower the last owner of a resource, which fails with `INVALID_SHARE`. `listAudit` is paged. It returns `{ entries, nextCursor }`, newest first, 50 entries a page by default and 200 at most. It used to return an array. Drive does not expose `listAudit`. Code that calls it directly must read `entries`, and must pass `nextCursor` as `cursor` to read on.
+
+### Migration
+
+Read the known limits before you move a live deployment. Run the steps in this order. The old Worker keeps writing until step 4, so the backfills in step 5 must come after the deploy.
+
+The steps 3, 5, 6, and 8 run code that needs the D1 database. Run it in one one-off Worker, and delete it after the last step. The Worker checks a secret on every call, so nobody else can call it. It binds the same database as the main Worker, with the same `DRIVE_REGION`, and it has `compatibility_flags: ["nodejs_compat"]`, as the main Worker has:
+
+```js
+import { createD1Store } from "agentic-identity/cloudflare";
+import { issueCredential, parseRegion } from "agentic-identity";
+import { backfillAuthorIds, backfillResources } from "agentic-drive/worker";
+
+// Compares two strings in a time that does not depend on where they differ.
+function same(a, b) {
+  const x = new TextEncoder().encode(a);
+  const y = new TextEncoder().encode(b);
+  let diff = x.length ^ y.length;
+  for (let i = 0; i < Math.max(x.length, y.length); i++) diff |= (x[i] ?? 0) ^ (y[i] ?? 0);
+  return diff === 0;
+}
+
+// Each step takes one call. The body of a POST is JSON.
+const steps = {
+  // POST a principal document, such as { "id": "u1", "kind": "human", "scopes": ["drive:admin"] }.
+  principal: (store, body) => store.put("principals", body.id, body),
+  // Runs one page. Pass the `nextCursor` of the last call as `cursor`.
+  authors: (store, body, cursor) => backfillAuthorIds(store, { cursor, maxPages: 1 }),
+  resources: (store, body, cursor) => backfillResources(store, { cursor, maxPages: 1 }),
+  // POST { "principalId": "u1", "label": "laptop" }. The token comes back once, so send it only to your terminal.
+  token: async (store, body) => ({ token: await issueCredential(store, { principalId: body.principalId, kind: "api_key", label: body.label }) }),
+};
+
+export default {
+  async fetch(request, env) {
+    const sent = /^Bearer (.+)$/.exec(request.headers.get("authorization") ?? "")?.[1] ?? "";
+    if (!env.MIGRATE_TOKEN || !same(sent, env.MIGRATE_TOKEN)) return new Response("forbidden", { status: 403 });
+    const url = new URL(request.url);
+    const step = url.searchParams.get("step");
+    if (!Object.hasOwn(steps, step)) return new Response("unknown step", { status: 400 });
+    const body = request.method === "POST" ? await request.json() : {};
+    const store = createD1Store(env.DB, { region: parseRegion(env.DRIVE_REGION ?? "eu") });
+    return Response.json((await steps[step](store, body, url.searchParams.get("cursor") ?? undefined)) ?? { ok: true });
+  },
+};
+```
+
+Set the secret with `wrangler secret put MIGRATE_TOKEN`. Send it as `authorization: Bearer <token>` with each call.
+
+1. Check the ids. Every owner and actor id in `DRIVE_API_TOKENS` must match `^[A-Za-z0-9_-]{1,128}$`, the rule that agentic-identity 0.3.0 applies to share subjects. 0.1.0 allowed any text, such as an email address. A deployment with an id that fails this rule cannot move to 0.2.0 in this release, because there is no re-key step. Stay on 0.1.0 for it.
+2. Install the new versions: `npm install agentic-drive@0.2.0 agentic-identity@^0.3.0`.
+3. Write the principals, with the old ids. The owner of a drive is the principal id, and the old data keeps the old ids. Old tokens had no scopes. Give `drive:admin` to keep the old rights. The root principal of each owner must keep `drive:write` at least, because its first call creates the drive root. Narrow the agents, not the owner. The 0.1.0 data does not say what kind an owner is. Use `human` for a person. Use `agent` only for a machine that acts with no person. A wrong kind breaks the chains under that owner. POST each principal to `?step=principal`:
+   - An owner of kind `human` is a root `human`. Its agents are `agent_of_human`, with `parentId` set to the owner. Its `user_token` actors are `user_token`, with `parentId` set to the owner. An `agent_of_agent` sits under an `agent_of_human`. 0.1.0 recorded no parent ids, so choose one, and keep the chain to 5 links (`MAX_CHAIN_DEPTH`).
+   - An owner of kind `agent` is a root `agent`. Its actors are `agent_of_agent`, with `parentId` set to the owner. The same 5-link limit applies.
+   - A human actor who is not the owner keeps its old actor id, as a root `human`. Step 7 shares the folders with it. It keeps no path access to the owner's drive. See the known limits.
+4. Deploy the 0.2.0 Worker. From this point, nobody can sign in until step 6.
+5. Run the backfills once the old Worker has stopped writing. Call `?step=authors`, then `?step=resources`, and pass each `nextCursor` as `cursor`. Stop when a call returns no `nextCursor`. A second run of either step changes nothing. If a call fails, run it again with the last cursor that worked. A damaged item stops a step. Fix or delete that item, then run it again.
+6. Issue a bearer token for each owner: POST `{ "principalId": "u1", "label": "..." }` to `?step=token`. Give it to the owner. The token is shown only once. Then make one call as each owner, for example `GET /api/v1/drive/items?path=/`. That call creates the drive's root, which the items inherit their access from. Until a person makes it, an agent without `drive:write` that calls first gets `NOT_FOUND`.
+7. Share with each human actor that is not the owner. As the owner, share the root `/` and each folder that the actor used. Use the role `owner`, which keeps its old rights. Before that, share each folder with the owner as `owner`, so that the last-owner rule still leaves an owner when the actor's grant changes later. Do this after step 6, because a share needs the item's `resources` doc and the drive root.
+8. Issue the tokens for the agents and the other human actors: POST to `?step=token` for each, and give them out.
+9. Remove the secrets: `npx wrangler secret delete DRIVE_API_TOKENS`, and delete the one-off Worker.
+10. If your code calls `authenticate`, await it and pass the store: `await authenticate(request, store)`.
+11. Tell your users that `DELETE /account?confirm=yes` and `agentic-drive delete-all --yes` now erase their agents and their shares too. Neither can be undone.
+
+Known limits of this release:
+
+- **OIDC sign-in gets a new id.** agentic-identity gives an OIDC person the id `u_` plus a hash of the issuer and the subject. That id is not the old owner string. A person who signs in through OIDC does not see a drive made under the old owner string. Use bearer tokens for those drives until a re-key step ships.
+- **There is no re-key step.** This release does not move items from one owner id to another. Keep the old ids as principal ids, as step 3 does.
+- **An id that fails the share rule blocks the upgrade.** See step 1.
+- **Old items keep the kind they had in 0.1.0.** New items carry the kind of their new principal, which can differ, as step 3 shows. So a search by `--created-by-kind` sees the old and the new work under different kinds.
+- **A human who is not the owner has no path access to the owner's drive.** Its paths resolve in its own drive. It reaches the owner's items by id, once they are shared with it.
+
+### Added
+
+- App documents. An app puts a document in the drive with `registerDocument`. `forgetDocument` moves every reference to it to the trash. `home` lists files and app documents together. `search` takes an `app` filter.
+- Sharing with roles (`viewer`, `commenter`, `editor`, `owner`). Invites by email or handle, share links with an optional expiry, and a signed-in-only option.
+- `exportPerson`, `erasePerson`, `backfillAuthorIds`, and `backfillResources`. The two backfills are exported from `agentic-drive` and `agentic-drive/worker`.
+- HTTP: `GET /home`, `POST /documents`, `DELETE /documents`, and the `/shares`, `/invites`, `/links`, and `/shared` routes.
+- CLI: `home`, `register`, and `forget`.
+- MCP: `drive_home`, `drive_register_document`, and `drive_forget_document`.
+
+### Changed
+
+- CLI `delete-all` erases the person, not only the drive. See the breaking changes.
+- The package builds before it is packed (`prepack`). The tarball holds the built files, the docs, and this changelog. The publish workflow passes `--ignore-scripts`, so it packs the `dist/` that its build step made. Keep that build step before publish.
+- The publish workflow runs the build, the typecheck, and the tests on Node 22 with no `--if-present`, as CI does. Both workflows set `WRANGLER_SEND_METRICS` to `false`.
+
+## 0.1.0
+
+- First release. A drive of files and folders, with uploads to R2, search, export, hard delete, the CLI, the MCP server, and the Worker API.

package/README.md

@@ -7,8 +7,8 @@
 
 Store, sort, and share files and folders.
 
-> Status: early (0.1.0). The library, CLI, MCP server, and HTTP API work.
-> Sharing and the web UI are not built yet.
+> Status: early. The library, CLI, MCP server, and HTTP API work, with sharing in the SDK and the HTTP API.
+> The web UI is not built yet.
 
 ## Install
 
@@ -51,7 +51,6 @@ A Cloudflare Worker (Hono) serves `/api/v1/drive` and mirrors the CLI. It uses D
 through the shared adapters of `agentic-identity`.
 
 ```sh
-npx wrangler secret put DRIVE_API_TOKENS   # {"<token of 32+ characters>":{"owner":"u1","actor":"u1","kind":"human"}}
 npx wrangler secret put DRIVE_URL_SECRET   # 32 bytes or more. It signs download URLs.
 npx wrangler secret put DRIVE_PUBLIC_URL   # The origin of the Worker, such as https://drive.example.com
 npx wrangler deploy
@@ -60,7 +59,17 @@ curl -H "authorization: Bearer <token>" "$URL/api/v1/drive/items?path=/"
 
 Routes: `GET /items`, `GET /stat`, `POST /folders`, `PUT /files`, `GET /files`, `GET /url`,
 `POST /move`, `POST /trash`, `GET /trash`, `POST /restore`, `POST /purge`, `GET /search`,
-`GET /export`, `DELETE /account?confirm=yes`. Without `DRIVE_API_TOKENS`, every request gets 401.
+`GET /export`, `DELETE /account?confirm=yes`, `GET /home`, `POST /documents`, `DELETE /documents?ref=`.
+Sign in with a bearer token from agentic-identity. The token is a credential in the `credentials` collection of
+the same D1 database, and it names a principal in `principals`. The Worker resolves the whole delegation chain on
+every request. A missing, expired, or revoked credential, or a revoked or expired principal (or one above it), gets 401.
+A session cookie is refused: only a bearer token counts. An agent acts in its owner's drive with the narrower scopes of its grant.
+Scopes are `drive:read`, `drive:write`, and `drive:admin`.
+
+Sharing routes: `GET /shares?path=`, `POST /shares`, `DELETE /shares?path=&subjectId=`, `POST /invites`,
+`POST /invites/accept`, `POST /links`, `DELETE /links?id=`. A link visitor reads with the header
+`x-link-token` on `GET /shared/:id`, `GET /shared/:id/items`, and `GET /shared/:id/content`.
+Name a shared item by its id. A path can start at a folder id: `<folder id>/notes/a.txt`.
 Without `DRIVE_URL_SECRET` or `DRIVE_PUBLIC_URL`, every request gets 503.
 Create the R2 bucket with `--jurisdiction eu` and the D1 database with `--location weur`.
 The Worker declares region `eu` and refuses a D1 query that a non-EU region served. `DRIVE_REGION=unknown` turns this off for local runs.
@@ -73,16 +82,24 @@ The Worker declares region `eu` and refuses a D1 query that a non-EU region serv
 - Names compare without regard to case or Unicode form. A clash fails, or renames, or replaces.
 - Each item records its size, type, owner, and who made and last changed it, with the actor kind.
 - Storage sits behind the `Store` and `Blobs` ports of `agentic-identity`. Tests use its memory adapters. The CLI uses a local file adapter that passes the same contract suites. The Worker uses its D1 and R2 adapters.
+- Roles: viewer, commenter, editor, owner. A role on a folder reaches everything under it, and follows an item that moves. Identity decides every request through `can()`, which also writes the audit entry. A caller who cannot read an item gets `NOT_FOUND`. A caller who can read it but not change it gets `FORBIDDEN`. Editors write and trash. An item takes the roles of its new folder, so moving an item into a folder where the caller is owner needs owner on the item. Only owners share, purge, and read the share list.
+- Share by person or agent id, by invite (an email for a person, a handle for an agent), or by link with a role, an expiry, and an optional sign-in. The SDK calls are `shareWith`, `unshare`, `invite`, `acceptInvite`, `createLink`, `revokeLink`, `shares`, `openShared`, `listShared`, and `readShared`.
 - Two live items never share a name in one folder. A claim document holds each name. It is written in the same transaction as the item, and it is deleted when the item goes to the trash.
 - `upload()` reads a stream with a size cap, finds the type from the first bytes, and stores a SHA-256 hash.
 - `downloadUrl()` returns a signed URL. The URL signs an attachment header with the file name and the stored type. The Worker verifies it and serves the bytes with those headers, so the link holder cannot change how the bytes are served. A link lasts 15 minutes by default and 1 hour at most. Trashing a file does not revoke a link already issued.
 - `search()` finds live items by name, type, kind, size, and who made them.
-- `buildExport()` writes everything one owner has to a zip with a `manifest.json`. Trashed items are flagged. Entries are named by item id. A file whose bytes are gone is marked `missing`.
-- `deleteAll()` deletes all items and bytes of one owner for good. Only the owner can call it.
-- A `can()` hook decides who may read, write, or delete. The default allows the owner only.
+- App documents: an app calls `registerDocument({ ref: "docs:<id>", name, folder })` to put a document in the drive, and `forgetDocument(ref)` when it deletes the document. `home({ app })` lists files and every app's documents together, newest change first, with a count per app. `search({ app })` filters the same way. The CLI has `home`, `register`, and `forget`. The MCP server has `drive_home`, `drive_register_document`, and `drive_forget_document`.
+- `buildExport()` writes everything one person has to a zip with a `manifest.json` (format version 2). It names the person by id and kind. It lists the person's own items (trashed ones are flagged, and a file whose bytes are gone is marked `missing`). For the person in person it also lists the ids of what they or their agents made or changed in other drives (no names, and nothing of the people who own them), the shares they hold, the invites they sent, and the audit entries of what they and their agents did. An agent gets `partial: true` and none of that. Invitee emails and link tokens are never in it. Entries are named by item id.
+- `erasePerson()` erases a person for good, and only the person in person can call it (the CLI `delete-all` and `DELETE /account` call it). It deletes their drive with all its shares, the shares they hold, and the invites they or their agents sent, on drive items only: the grants of other apps stay for those apps and for identity. What they or their agents made in other drives stays, because it belongs to those drives: the id becomes `erased`, and the kind stays, so machine-made work keeps its label. Agents are found through the `principals` collection, as identity finds them: an agent with its own identity names the person as `ownerId`, and a delegated agent names its parent. An agent with its own identity belongs to the person, and so does its drive: erase deletes it, and the export lists its items (no bytes). A person with more than 1000 agents cannot be erased here: the call fails and deletes nothing more. The audit trail stays: it holds ids and kinds only. A failed call can run again. `deleteAll()` is the drive part alone.
+- A `can()` hook decides who may read, write, or delete. Without `sharing`, the default allows the owner only.
 
 ## Limits
 
+- Erase does not delete what identity keeps about the person: their principal, credentials, and sign-in record. Identity erases those. An invite that names only an email, sent by someone else, stays until it expires.
+- Items made before drive kept `createdById` and `updatedById` have no such fields, so an export or an erase cannot find them. Run `backfillAuthorIds(store, { maxPages: 1 })` on a store of that age, once the old Worker has stopped writing. Each call runs `maxPages` pages of 10 items, and returns a `nextCursor` while items remain. Pass the cursor to the next call until none is returned. Without `maxPages`, one call runs every page, which can exceed a Worker's query cap on a large store.
+- There are no retention settings yet, and no per-workspace export. An export covers one person.
+- `registerDocument` makes one item per document in a drive. Two calls at the same moment can make two.
+
 - Drive reads the `store_docs` table in D1 and `store.jsonl` in the CLI folder. It does not read older layouts. There is no import and no claim backfill.
 - Uploads buffer the stream in memory up to the cap. The default cap is 25 MiB.
 - Local file blobs return a `file:` URL that nothing serves or checks.
@@ -91,7 +108,7 @@ The Worker declares region `eu` and refuses a D1 query that a non-EU region serv
 - A claimed type that a browser would run (HTML, SVG, scripts) is stored as `application/octet-stream`.
 - The file adapters allow one process at a time.
 - The MCP `drive_export` tool writes a new `.zip` into `<dir>/exports` and never overwrites a file. It takes a plain file name, not a path.
-- A purge or an erase works in chunks of 25 items, and each chunk commits. A Worker call has a cap on database queries, so a very large tree can need several calls. A failed or cut-off call leaves marked items hidden, and the same call finishes the job.
+- A purge or an erase works in chunks of 25 items (10 with sharing on), and each chunk commits. A Worker call has a cap on database queries, so a very large tree can need several calls. A failed or cut-off call leaves marked items hidden, and the same call finishes the job.
 - Hard delete removes blobs first and then rows. If a blob delete fails, the call throws and the same call can run again.
 - The export holds every file in memory. A very large drive needs a streaming export, which is not built yet.
 - The zip export stores entries without compression and has no Zip64 support.
@@ -99,10 +116,13 @@ The Worker declares region `eu` and refuses a D1 query that a non-EU region serv
 - The D1 store checks every document a transaction read. If another Worker changed one, the transaction runs again, and after 50 tries it fails with a `BUSY` error.
 - The D1 store keeps one generic table. A busy deployment needs an expression index on `owner` and `parentId`.
 - `region: "eu"` on the D1 and R2 adapters is a promise made at deploy time. The D1 adapter refuses a query that a non-EU region served. The code cannot check where the bucket lives.
-- Every API token is at least 32 characters. Its grant names an owner, an actor id, and an actor kind. A grant with a missing part gets 401.
-- Tokens in `DRIVE_API_TOKENS` are a stopgap for sign-in. OIDC comes with agentic-identity.
-- No sharing or roles yet. Roles come from agentic-identity.
-
+- Sharing is on in the Worker and in the SDK (`createDrive({ sharing })`). The CLI and the MCP server work on a local drive with one owner, so they do not share yet.
+- Drive writes the `resources` doc of each item itself, in the same transaction, because identity has no call that does it in a transaction. A drive with `sharing` off keeps no such docs. Turn sharing on at the start, or run `backfillResources` after you turn it on.
+- An invite sends no message. The caller passes the invite id on.
+- Sharing follows a path of 16 resources, the drive root included, so an item sits at most 15 folders deep. A deeper path, move, or restore fails with `TOO_DEEP`. A move or a restore of a folder spends up to 200 queries on its subfolders (never on files), once, outside the transaction, to count its height. A move up or sideways, a rename, and a file need no count. A bigger folder fails with `TOO_MANY_ITEMS`: move its parts one by one. An edit inside the folder while it moves can leave items past the cap. Nobody can then reach them, and moving the folder back up repairs it.
+- Every access check writes one audit row, and a transaction that runs again writes its rows again. The audit holds ids and kinds only: no emails and no content.
+- Data made before sharing has no `resources` docs, so its owner gets `NOT_FOUND`. Run `backfillResources(store, { maxPages: 1 })` on that store, paged the same way, once the old Worker has stopped writing. See CHANGELOG.md for the order of the upgrade steps.
+- A person who is not an owner cannot move an item into their own drive: the move fails with `CROSS_DRIVE`.
 ## Develop
 
 ```sh

package/SKILL.md

@@ -20,6 +20,6 @@ await drive.mkdir(me, "/notes");
 
 ## Rules
 
-- A path starts with `/`. Any other locator is an id.
+- A locator with a `/` is a path: `/x` from the root, or `<folder id>/x` from a folder. Any other locator is an id.
 - Trash before purge.
 - Report a `DriveError` as a failure.

package/dist/chunk-3LISWG7H.js

@@ -0,0 +1,65 @@
+import {
+  ROOT_ID,
+  rootResource
+} from "./chunk-6CWBHSJ7.js";
+
+// src/migrate.ts
+var PAGE = 10;
+var isText = (v) => typeof v === "string" && v !== "";
+async function walk(store, options, fix) {
+  const { maxPages } = options;
+  if (maxPages !== void 0 && !(Number.isSafeInteger(maxPages) && maxPages > 0)) {
+    throw new Error("maxPages must be a positive whole number");
+  }
+  let fixed = 0;
+  let cursor = options.cursor;
+  for (let pages = 0; maxPages === void 0 || pages < maxPages; pages++) {
+    const page = await store.query("drive_nodes", { limit: PAGE, cursor });
+    fixed += await store.transaction(async (tx) => {
+      const items = [];
+      for (const item of page.items) {
+        const data = await tx.get("drive_nodes", item.id);
+        if (data) items.push({ id: item.id, data });
+      }
+      return fix(tx, items);
+    });
+    cursor = page.nextCursor;
+    if (!cursor) return { fixed };
+  }
+  return { fixed, nextCursor: cursor };
+}
+function backfillAuthorIds(store, options = {}) {
+  return walk(store, options, async (tx, items) => {
+    let count = 0;
+    for (const { id, data } of items) {
+      const created = data.createdBy?.id;
+      const updated = data.updatedBy?.id;
+      if (!isText(created) || !isText(updated)) {
+        throw new Error(`item ${id} has no author. Fix it before you run the backfill again.`);
+      }
+      if (data.createdById === created && data.updatedById === updated) continue;
+      await tx.put("drive_nodes", id, { ...data, createdById: created, updatedById: updated });
+      count++;
+    }
+    return count;
+  });
+}
+function backfillResources(store, options = {}) {
+  return walk(store, options, async (tx, items) => {
+    const missing = [];
+    for (const { id, data } of items) {
+      if (!isText(data.owner) || !isText(data.parentId)) {
+        throw new Error(`item ${id} has no owner or parent. Fix it before you run the backfill again.`);
+      }
+      if (await tx.get("resources", id)) continue;
+      missing.push({ id, parentId: data.parentId === ROOT_ID ? await rootResource(data.owner) : data.parentId });
+    }
+    for (const { id, parentId } of missing) await tx.put("resources", id, { id, type: "drive", parentId });
+    return missing.length;
+  });
+}
+
+export {
+  backfillAuthorIds,
+  backfillResources
+};