agentic-drive 0.1.0 → 0.2.0

package/dist/{chunk-4QE7E5UQ.js → chunk-RWMBGIAS.js}

@@ -1,6 +1,6 @@
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "0.1.0" : readPackageVersion();
+var VERSION = true ? "0.2.0" : readPackageVersion();
 
 export {
   VERSION

package/dist/cli.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   VERSION
-} from "./chunk-4QE7E5UQ.js";
+} from "./chunk-RWMBGIAS.js";
 import {
   DriveError,
   buildExport,
   openLocal,
   publicNode,
   upload
-} from "./chunk-QRGKXPLX.js";
+} from "./chunk-6CWBHSJ7.js";
 
 // src/cli.ts
 import { createReadStream, realpathSync, writeFileSync } from "fs";
@@ -33,7 +33,10 @@ Commands:
   purge <id>                   Delete a trashed item for good.
   search                       Find items. Flags: --name --mime --kind --min-size --max-size --created-by-kind --limit
   export <out.zip>             Write everything you own to a zip with a JSON manifest.
-  delete-all --yes             Delete everything you own for good.
+  home [--app <name>]          List files and app documents, newest change first.
+  register <ref> <name>        Put an app document in the drive. Flag: --parent <folder>
+  forget <ref>                 Move the references to an app document to the trash.
+  delete-all --yes             Erase you for good: your drive, and what you shared or held.
   mcp                          Start the MCP server on stdio.
 
 Flags:
@@ -62,6 +65,7 @@ var options = {
   "max-size": { type: "string" },
   "created-by-kind": { type: "string" },
   limit: { type: "string" },
+  app: { type: "string" },
   yes: { type: "boolean" },
   help: { type: "boolean", short: "h" },
   version: { type: "boolean", short: "V" }
@@ -164,9 +168,22 @@ async function runCli(argv, io) {
         print({ saved: resolve(args[0]), size: zip.byteLength });
         break;
       }
+      case "home": {
+        const home = await drive.home(ctx, { app: values.app, limit: num(values.limit, "limit") });
+        print({ apps: home.apps, files: home.files, items: home.items.map((i) => ({ ...publicNode(i.node, i.path), app: i.app })) });
+        break;
+      }
+      case "register":
+        need(2, "register <ref> <name>");
+        print(publicNode(await drive.registerDocument(ctx, { ref: args[0], name: args[1], folder: values.parent })));
+        break;
+      case "forget":
+        need(1, "forget <ref>");
+        print(await drive.forgetDocument(ctx, args[0]));
+        break;
       case "delete-all":
-        if (!values.yes) throw new UsageError("delete-all removes everything you own for good. Add --yes to confirm.");
-        print(await drive.deleteAll(ctx));
+        if (!values.yes) throw new UsageError("delete-all erases you for good. Add --yes to confirm.");
+        print(await drive.erasePerson(ctx));
         break;
       case "mcp": {
         const { startMcp } = await import("./mcp.js");

package/dist/drive-DKOs1FyM.d.ts

@@ -0,0 +1,325 @@
+import * as agentic_identity from 'agentic-identity';
+import { PrincipalContext, Store, Blobs, createSharing, Role } from 'agentic-identity';
+
+declare const ROOT_ID = "root";
+declare const ACTOR_KINDS: readonly ["human", "agent_of_human", "agent_of_agent", "agent", "user_token"];
+type ActorKind = (typeof ACTOR_KINDS)[number];
+type Actor = {
+    id: string;
+    kind: ActorKind;
+};
+/**
+ * `owner` is the drive's owner, and the root of the caller's chain. `actor` is who acts for them.
+ * `principal` is the resolved caller. Drive needs it to check roles when `sharing` is set.
+ */
+type Ctx = {
+    owner: string;
+    actor: Actor;
+    principal?: PrincipalContext;
+};
+/** `delete` is for the owner only: purge and erase. Trash needs `write`. */
+type Action = "read" | "write" | "delete";
+type Sharing = ReturnType<typeof createSharing>;
+/** The seam for access. With `sharing`, the default is a role check through agentic-identity. */
+type Can = (ctx: Ctx, action: Action, node: Node) => boolean | Promise<boolean>;
+type Node = {
+    id: string;
+    owner: string;
+    parentId: string;
+    kind: "folder" | "file" | "ref";
+    name: string;
+    nameKey: string;
+    size: number;
+    mime: string | null;
+    hash: string | null;
+    /** A typed reference such as `docs:<id>`. Set when kind is "ref". */
+    ref: string | null;
+    blobKey: string | null;
+    createdAt: number;
+    updatedAt: number;
+    createdBy: Actor;
+    updatedBy: Actor;
+    /** The ids of `createdBy` and `updatedBy`, at the top level so a store can find what a person made. */
+    createdById: string;
+    updatedById: string;
+    trashed: boolean;
+    trashedAt: number | null;
+    /** Set while a purge deletes the item. Nothing can see or change it then. */
+    purging: boolean;
+};
+type ErrorCode = "NOT_FOUND" | "NAME_TAKEN" | "BLOB_EXISTS" | "INVALID_NAME" | "INVALID_PATH" | "INVALID_REF" | "NOT_A_FOLDER" | "NOT_A_FILE" | "MOVE_INTO_SELF" | "TOO_DEEP" | "PARENT_GONE" | "TRASHED" | "NOT_TRASHED" | "IS_ROOT" | "FORBIDDEN" | "BLOB_MISSING" | "TOO_LARGE" | "INVALID_EXPIRY" | "BUSY" | "CROSS_DRIVE" | "INVALID_SHARE" | "TOO_MANY_ITEMS";
+declare class DriveError extends Error {
+    readonly code: ErrorCode;
+    constructor(code: ErrorCode, message: string);
+}
+interface SearchQuery {
+    /** Part of the name. Case and Unicode form do not matter. */
+    name?: string;
+    /** An exact type, or a family such as `image/*`. */
+    mime?: string;
+    kind?: Node["kind"];
+    minSize?: number;
+    maxSize?: number;
+    /** Items first made by this kind of actor, such as `agent_of_human`. */
+    createdByKind?: ActorKind;
+    /** Only references to documents of this app, such as `docs`. */
+    app?: string;
+    /** At most this many results. Defaults to 100. */
+    limit?: number;
+}
+type OnConflict = "fail" | "rename" | "replace";
+interface DriveDeps {
+    store: Store;
+    blobs: Blobs;
+    now?: () => number;
+    newId?: () => string;
+    can?: Can;
+    /** Turns on roles. Folders and files register as resources, and `can()` decides every request. Make it on the same `store`. */
+    sharing?: Sharing;
+    /** Most parent steps any ancestor walk takes. A walk that hits it fails closed. */
+    maxDepth?: number;
+    /** Called with a blob key that no node points at and that could not be deleted. */
+    onOrphan?: (key: string, error: unknown) => void;
+}
+type Drive = ReturnType<typeof createDrive>;
+/** Validates a name. Names are NFC-normalized. Two names clash when their keys match. */
+declare function parseName(raw: string): {
+    name: string;
+    key: string;
+};
+declare function createDrive(deps: DriveDeps): {
+    stat(ctx: Ctx, loc: string): Promise<Node>;
+    /** Live children, sorted by name. */
+    list(ctx: Ctx, loc?: string): Promise<Node[]>;
+    mkdir(ctx: Ctx, path: string, opts?: {
+        parents?: boolean;
+    }): Promise<Node>;
+    /**
+     * Stores one blob and one node. The blob is written first. The new node commits before
+     * any old blob goes. A failed old-blob delete leaves an orphan and never undoes the commit.
+     */
+    putFile(ctx: Ctx, path: string, data: Uint8Array, opts?: {
+        mime?: string;
+        parents?: boolean;
+        onConflict?: OnConflict;
+    }): Promise<Node>;
+    /** A reference points at a document in another app, such as `docs:<id>`. */
+    putRef(ctx: Ctx, path: string, ref: string, opts?: {
+        parents?: boolean;
+        onConflict?: OnConflict;
+    }): Promise<Node>;
+    read(ctx: Ctx, loc: string): Promise<{
+        node: Node;
+        data: Uint8Array;
+        contentType?: string;
+    }>;
+    /**
+     * A time-limited URL to fetch the bytes. The URL signs an attachment header and the stored
+     * type, so the link holder cannot change how the bytes are served. Trashing an item does
+     * not revoke a link already issued.
+     */
+    downloadUrl(ctx: Ctx, loc: string, expiresInSeconds?: number): Promise<string>;
+    move(ctx: Ctx, src: string, destLoc: string, opts?: {
+        name?: string;
+        onConflict?: OnConflict;
+    }): Promise<Node>;
+    rename(ctx: Ctx, loc: string, name: string): Promise<Node>;
+    /** Hides an item and, for a folder, everything under it. Nothing else changes. */
+    trash(ctx: Ctx, loc: string): Promise<Node>;
+    /** Items trashed on their own, newest first. */
+    listTrash(ctx: Ctx): Promise<Node[]>;
+    /** Puts a trashed item back. It needs a live parent folder. */
+    restore(ctx: Ctx, id: string, opts?: {
+        parentId?: string;
+        onConflict?: OnConflict;
+    }): Promise<Node>;
+    /** Live items that match every field given, sorted by path. */
+    search(ctx: Ctx, q?: SearchQuery): Promise<{
+        node: Node;
+        path: string;
+    }[]>;
+    /** Every item of the owner, trashed or not, with its original path and bytes. For export. */
+    exportData(ctx: Ctx): Promise<{
+        node: Node;
+        path: string;
+        data: Uint8Array | null;
+        missing: boolean;
+    }[]>;
+    /** Deletes every item and blob of the owner for good. Only the owner may do this, never an agent for them. A failed call can run again. */
+    deleteAll(ctx: Ctx): Promise<{
+        removed: number;
+    }>;
+    /** Deletes a trashed item for good, with everything under it and all their bytes. */
+    purge(ctx: Ctx, id: string): Promise<{
+        removed: number;
+    }>;
+    /**
+     * What the home view shows: every file and every reference to an app's document, newest change first.
+     * `apps` counts references per app, and `files` counts plain files, before `app` and `limit` apply.
+     */
+    home(ctx: Ctx, q?: {
+        app?: string;
+        limit?: number;
+    }): Promise<{
+        items: {
+            node: Node;
+            path: string;
+            app: string | null;
+        }[];
+        apps: Record<string, number>;
+        files: number;
+    }>;
+    /**
+     * An app puts one of its documents in this drive, as a reference such as `docs:<id>`. A document that is
+     * already in the drive comes back as it is, so an app can register again. The reference sits in `folder`
+     * (a path or a folder id, "/" by default) under `name`, and gets a free name when that one is taken.
+     */
+    registerDocument(ctx: Ctx, input: {
+        ref: string;
+        name: string;
+        folder?: string;
+    }): Promise<Node>;
+    /** An app deleted a document. Its references in this drive go to the trash. Returns how many. */
+    forgetDocument(ctx: Ctx, ref: string): Promise<{
+        trashed: number;
+    }>;
+    /**
+     * What drive holds about the person behind a call, besides their own drive (`exportData` has that). It is
+     * only for the person in person: an agent gets `partial: true` and nothing else. It holds the ids of the
+     * items they or their agents made or changed in other drives (no names, and nothing of the people who own
+     * them), the shares they hold, the invites they sent, and the audit entries of what they and their agents
+     * did. Invitee emails and link tokens are not in it.
+     */
+    exportPerson(ctx: Ctx): Promise<{
+        subject: {
+            id: string;
+            kind: "human" | "agent_of_human" | "agent_of_agent" | "agent" | "user_token" | null;
+        };
+        partial: boolean;
+        authored: {
+            id: string;
+            kind: "folder" | "file" | "ref";
+            created: boolean;
+            updated: boolean;
+            createdAt: number | null;
+            updatedAt: number | null;
+            by: any[];
+        }[];
+        agents: {
+            id: string;
+            items: {
+                id: string;
+                kind: "folder" | "file" | "ref";
+                name: string;
+                size: number;
+                mime: string | null;
+                createdAt: number;
+                updatedAt: number;
+                trashed: boolean;
+            }[];
+        }[];
+        shares: {
+            held: {
+                subjectId: unknown;
+                resourceId: unknown;
+                role: unknown;
+            }[];
+            invitesCreated: {
+                id: unknown;
+                resourceId: unknown;
+                role: unknown;
+                expiresAt: unknown;
+                accepted: boolean;
+            }[];
+        };
+        audit: {
+            at: unknown;
+            action: unknown;
+            resourceId: unknown;
+            outcome: unknown;
+            principalId: unknown;
+            principalKind: unknown;
+            machineMade: unknown;
+        }[];
+    }>;
+    /**
+     * Erases a person for good. Only the person in person may. Their drive and its shares go. So do the shares
+     * they hold and the invites they or their agents sent, on drive items only: the grants of other apps stay for
+     * those apps and for identity. What they or their agents made in other drives stays, because it belongs to
+     * those drives: the id becomes "erased", and the kind stays, so machine-made work keeps its label. The audit
+     * trail stays: it holds ids and kinds only. A failed call can run again.
+     */
+    erasePerson(ctx: Ctx): Promise<{
+        removed: number;
+        grants: number;
+        invites: number;
+        anonymized: number;
+    }>;
+    /** Gives a person or an agent a role on an item and everything under it. Only an owner may. */
+    shareWith(ctx: Ctx, loc: string, subjectId: string, role: Role): Promise<void>;
+    unshare(ctx: Ctx, loc: string, subjectId: string): Promise<void>;
+    /** Invite by `email` (a person) or `handle` (an agent). The invite lasts `expiresInMs`, if given. It sends no message. */
+    invite(ctx: Ctx, loc: string, input: {
+        role: Role;
+        email?: string;
+        handle?: string;
+        expiresInMs?: number;
+    }): Promise<{
+        id: string;
+    }>;
+    /** `identity` is the verified email of a person, or the handle of an agent. */
+    acceptInvite(ctx: Ctx, inviteId: string, identity: {
+        email?: string;
+        handle?: string;
+    }): Promise<void>;
+    /** The token comes back once. Only its hash is stored. */
+    createLink(ctx: Ctx, loc: string, input: {
+        role: Role;
+        expiresAt?: number;
+        signedInOnly?: boolean;
+    }): Promise<{
+        id: string;
+        token: string;
+    }>;
+    revokeLink(ctx: Ctx, linkId: string): Promise<void>;
+    /** Who can reach an item, and by which links and invites. Only an owner may look. Link tokens are never shown. */
+    shares(ctx: Ctx, loc: string): Promise<{
+        grants: {
+            subjectId: agentic_identity.Json;
+            role: agentic_identity.Json;
+        }[];
+        links: {
+            id: agentic_identity.Json;
+            role: agentic_identity.Json;
+            signedInOnly: boolean;
+            expiresAt: string | number | boolean | agentic_identity.Json[] | {
+                [key: string]: agentic_identity.Json;
+            } | null;
+            revoked: boolean;
+        }[];
+        invites: {
+            id: agentic_identity.Json;
+            role: agentic_identity.Json;
+            email: string | number | boolean | agentic_identity.Json[] | {
+                [key: string]: agentic_identity.Json;
+            } | null;
+            handle: string | number | boolean | agentic_identity.Json[] | {
+                [key: string]: agentic_identity.Json;
+            } | null;
+            expiresAt: string | number | boolean | agentic_identity.Json[] | {
+                [key: string]: agentic_identity.Json;
+            } | null;
+            accepted: boolean;
+        }[];
+    }>;
+    openShared: (principal: PrincipalContext | null, id: string, linkToken?: string) => Promise<Node>;
+    /** Live children of a folder that a link visitor or a signed-in person may read, sorted by name. */
+    listShared(principal: PrincipalContext | null, id: string, linkToken?: string): Promise<Node[]>;
+    readShared(principal: PrincipalContext | null, id: string, linkToken?: string): Promise<{
+        node: Node;
+        data: Uint8Array;
+        contentType?: string;
+    }>;
+};
+
+export { type ActorKind as A, type Ctx as C, type Drive as D, type ErrorCode as E, type Node as N, type OnConflict as O, ROOT_ID as R, type SearchQuery as S, type Actor as a, ACTOR_KINDS as b, type Action as c, type Can as d, type DriveDeps as e, DriveError as f, createDrive as g, parseName as p };

package/dist/index.d.ts

@@ -1,6 +1,7 @@
-import { O as OnConflict, D as Drive, C as Ctx, N as Node, A as ActorKind, a as Actor } from './drive-DRQ8LiHl.js';
-export { b as ACTOR_KINDS, c as Action, d as Can, e as DriveDeps, f as DriveError, E as ErrorCode, R as ROOT_ID, S as SearchQuery, g as createDrive, p as parseName } from './drive-DRQ8LiHl.js';
+import { O as OnConflict, D as Drive, C as Ctx, N as Node, A as ActorKind, a as Actor } from './drive-DKOs1FyM.js';
+export { b as ACTOR_KINDS, c as Action, d as Can, e as DriveDeps, f as DriveError, E as ErrorCode, R as ROOT_ID, S as SearchQuery, g as createDrive, p as parseName } from './drive-DKOs1FyM.js';
 import { AdapterOptions, Blobs, Store } from 'agentic-identity';
+export { B as BackfillOptions, a as BackfillResult, b as backfillAuthorIds, c as backfillResources } from './migrate-B79gRPMu.js';
 
 declare const VERSION: string;
 
@@ -33,8 +34,11 @@ interface UploadOptions {
 declare function upload(drive: Drive, ctx: Ctx, path: string, source: AsyncIterable<Uint8Array> | ReadableStream<Uint8Array>, opts?: UploadOptions): Promise<Node>;
 
 /**
- * Everything one owner has, as a zip. `manifest.json` lists each item with its
- * metadata and, for a file, the entry that holds its bytes. Trashed items are included and flagged.
+ * Everything one owner has, as a zip. `manifest.json` names the person (id and kind), lists each item with its
+ * metadata and, for a file, the entry that holds its bytes, and adds what the person made in other drives, the
+ * shares they hold, the invites they sent, and the audit entries of what they did. Only the person in person gets
+ * those parts, and the items of their agents that have an identity of their own (no bytes). For an agent the
+ * manifest says `partial: true`. Trashed items are included and flagged.
  * Entries are named by item id, never by file name. A file whose bytes are gone is marked `missing`.
  */
 declare function buildExport(drive: Drive, ctx: Ctx, now?: () => number): Promise<Uint8Array>;
@@ -76,6 +80,8 @@ declare function publicNode(node: Node, path?: string): {
     updatedAt: number;
     createdBy: Actor;
     updatedBy: Actor;
+    createdById: string;
+    updatedById: string;
     trashed: boolean;
     trashedAt: number | null;
 } | {
@@ -92,6 +98,8 @@ declare function publicNode(node: Node, path?: string): {
     updatedAt: number;
     createdBy: Actor;
     updatedBy: Actor;
+    createdById: string;
+    updatedById: string;
     trashed: boolean;
     trashedAt: number | null;
     path: string;

package/dist/index.js

@@ -1,6 +1,10 @@
 import {
   VERSION
-} from "./chunk-4QE7E5UQ.js";
+} from "./chunk-RWMBGIAS.js";
+import {
+  backfillAuthorIds,
+  backfillResources
+} from "./chunk-3LISWG7H.js";
 import {
   ACTOR_KINDS,
   DEFAULT_MAX_BYTES,
@@ -17,13 +21,15 @@ import {
   sniffMime,
   upload,
   writeZip
-} from "./chunk-QRGKXPLX.js";
+} from "./chunk-6CWBHSJ7.js";
 export {
   ACTOR_KINDS,
   DEFAULT_MAX_BYTES,
   DriveError,
   ROOT_ID,
   VERSION,
+  backfillAuthorIds,
+  backfillResources,
   buildExport,
   createDrive,
   createFileBlobs,

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { D as Drive, C as Ctx } from './drive-DRQ8LiHl.js';
+import { D as Drive, C as Ctx } from './drive-DKOs1FyM.js';
 import 'agentic-identity';
 
 declare function createMcpServer(drive: Drive, ctx: Ctx, exportDir: string): McpServer;

package/dist/mcp.js

@@ -1,13 +1,13 @@
 import {
   VERSION
-} from "./chunk-4QE7E5UQ.js";
+} from "./chunk-RWMBGIAS.js";
 import {
   ACTOR_KINDS,
   DriveError,
   buildExport,
   publicNode,
   upload
-} from "./chunk-QRGKXPLX.js";
+} from "./chunk-6CWBHSJ7.js";
 
 // src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -16,7 +16,7 @@ import { mkdirSync, writeFileSync } from "fs";
 import { join } from "path";
 import { z } from "zod";
 var conflict = z.enum(["fail", "rename", "replace"]).optional();
-var loc = z.string().describe('A path that starts with "/", or an item id.');
+var loc = z.string().describe('A path, such as "/x" or "<folder id>/x", or an item id.');
 var ok = (value) => ({ content: [{ type: "text", text: JSON.stringify(value) }] });
 function failure(error) {
   if (!(error instanceof DriveError)) throw error;
@@ -69,6 +69,23 @@ function createMcpServer(drive, ctx, exportDir) {
     async (q) => (await drive.search(ctx, q)).map((r) => publicNode(r.node, r.path)),
     { readOnlyHint: true }
   );
+  tool(
+    "drive_home",
+    "List files and app documents together, newest change first. Pass `app` (such as docs) to see one app's documents.",
+    { app: z.string().optional(), limit: z.number().int().min(1).optional() },
+    async ({ app, limit }) => {
+      const home = await drive.home(ctx, { app, limit });
+      return { apps: home.apps, files: home.files, items: home.items.map((i) => ({ ...publicNode(i.node, i.path), app: i.app })) };
+    },
+    { readOnlyHint: true }
+  );
+  tool(
+    "drive_register_document",
+    "Put an app document in the drive, as a reference such as docs:<id>. A document that is already there comes back as it is.",
+    { ref: z.string(), name: z.string(), folder: z.string().optional() },
+    async ({ ref, name, folder }) => publicNode(await drive.registerDocument(ctx, { ref, name, folder }))
+  );
+  tool("drive_forget_document", "Move every reference to an app document to the trash.", { ref: z.string() }, async ({ ref }) => drive.forgetDocument(ctx, ref));
   tool(
     "drive_export",
     "Write everything the owner has to a new zip file in the export folder. Give a plain file name that ends in .zip. It never overwrites a file.",

package/dist/migrate-B79gRPMu.d.ts

@@ -0,0 +1,29 @@
+import { Store } from 'agentic-identity';
+
+type BackfillOptions = {
+    /** Where the last call stopped. Pass the `nextCursor` it returned. */
+    cursor?: string;
+    /** How many pages this call runs. The default runs them all. */
+    maxPages?: number;
+};
+type BackfillResult = {
+    fixed: number;
+    nextCursor?: string;
+};
+/**
+ * Items made before drive kept `createdById` and `updatedById` have no such fields, so an export or an erase
+ * cannot find what a person made in other drives. It sets the two fields from `createdBy` and `updatedBy`. It
+ * changes nothing else. Run it on the store once, after the old Worker has stopped writing. It returns how
+ * many items it fixed, and `nextCursor` while items remain.
+ */
+declare function backfillAuthorIds(store: Store, options?: BackfillOptions): Promise<BackfillResult>;
+/**
+ * Items made before sharing was on have no `resources` doc. With sharing on, their owner gets NOT_FOUND. This
+ * writes the doc of each such item, with the parent a new item gets: its folder, or the drive root. An item
+ * that has a doc is left alone, so a second run changes nothing. A damaged item stops the run, because a doc
+ * with a guessed parent would give access that nobody granted. Run it after the old Worker has stopped
+ * writing, and before the new Worker serves the drive.
+ */
+declare function backfillResources(store: Store, options?: BackfillOptions): Promise<BackfillResult>;
+
+export { type BackfillOptions as B, type BackfillResult as a, backfillAuthorIds as b, backfillResources as c };

package/dist/worker.d.ts

@@ -1,17 +1,12 @@
 import { Hono } from 'hono';
 import { D1Like, R2Like } from 'agentic-identity/cloudflare';
-import { C as Ctx, D as Drive } from './drive-DRQ8LiHl.js';
-import 'agentic-identity';
+import { Store } from 'agentic-identity';
+import { C as Ctx, D as Drive } from './drive-DKOs1FyM.js';
+export { B as BackfillOptions, a as BackfillResult, b as backfillAuthorIds, c as backfillResources } from './migrate-B79gRPMu.js';
 
 interface WorkerEnv {
     DB: D1Like;
     FILES: R2Like;
-    /**
-     * JSON: `{ "<token>": { "owner": "u1", "actor": "u1", "kind": "human" } }`. A token is at least 32 characters.
-     * Every grant needs an owner, an actor id, and an actor kind. A token with a missing or bad part gets 401.
-     * Without the secret, every request fails with 401.
-     */
-    DRIVE_API_TOKENS?: string;
     DRIVE_MAX_BYTES?: string;
     /** The origin of this Worker, such as `https://drive.example.com`. Signed download URLs start with it. */
     DRIVE_PUBLIC_URL?: string;
@@ -23,11 +18,16 @@ type App = {
     Bindings: WorkerEnv;
     Variables: {
         drive: Drive;
+        store: Store;
         ctx: Ctx;
     };
 };
-/** The seam for sign-in. A later release swaps this for agentic-identity. */
-declare function authenticate(request: Request, env: WorkerEnv): Ctx | null;
+/**
+ * The caller behind a bearer token, resolved by the store-backed Auth of agentic-identity: the credential
+ * names a principal, and the whole delegation chain must be live. Only a bearer token counts. A session
+ * cookie is refused, because no check of the request origin stands behind it here. Any problem gives null.
+ */
+declare function authenticate(request: Request, store: Store, now?: () => number): Promise<Ctx | null>;
 declare function createApp(): Hono<App>;
 declare const _default: {
     fetch: (request: Request, env: WorkerEnv, ctx: unknown) => Response | Promise<Response>;