agentic-drive 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.7.0
+
+Read the breaking changes before you upgrade.
+
+### Breaking changes
+
+- **The local drive has sharing on.** `openLocal` now passes `createSharing(store)`, as the Worker does. Items made before 0.7.0 have no `resources` docs. The CLI and the `mcp` command add them once, on the first drive command that has a valid key. The `principal` and `key` commands do not do it. A project that calls `openLocal` itself must run `backfillResources(store)`, exported from the package root, once on its existing data folder. If an item has no owner or parent, the backfill stops, and drive commands fail until you fix that item.
+
+### Added
+
+- **Sharing in the CLI.** New commands: `shares`, `share`, `unshare`, `invite`, `accept-invite`, `link-create`, and `link-revoke`. They act like the HTTP routes and show in `--help`.
+- **Sharing in the MCP server.** New tools: `drive_shares`, `drive_share`, `drive_unshare`, `drive_invite`, `drive_accept_invite`, `drive_create_link`, and `drive_revoke_link`.
+- **`drive_delete_account` in the MCP server.** It erases the caller like `DELETE /account` and `delete-all`. It needs `confirm: "yes"`.
+
+## 0.6.1
+
+### Changed
+
+- **Bearer tokens are checked by the agentic-identity HTTP helper.** The Worker and the local key check now call `requirePrincipal` from `agentic-identity/http` (agentic-identity 0.6). The package no longer has its own copy of the bearer-token check in `src/auth.ts` and `src/local.ts`. A request without an `authorization` header still gets no caller, so a session cookie does not sign in. A bad key still gives 401, and `resolveToken` still throws `AuthError` with the code `UNAUTHENTICATED`.
+- **The dependency is agentic-identity 0.6.** The package now needs `agentic-identity` `^0.6.0`.
+
 ## 0.6.0
 
 ### Added

package/README.md

@@ -7,7 +7,7 @@
 
 Store, sort, and share files and folders.
 
-> Status: 0.6.0, early. The library, CLI, MCP server, and HTTP API work, with sharing in the SDK and the HTTP API.
+> Status: 0.7.0, early. The library, CLI, MCP server, and HTTP API work, with sharing in the SDK, the HTTP API, the CLI, and the MCP server.
 > A small web UI works. See [UI](#ui).
 
 ## Live demo
@@ -305,7 +305,7 @@ export default { fetch: app.fetch };
 - The D1 store checks every document a transaction read. If another Worker changed one, the transaction runs again, and after 50 tries it fails with a `BUSY` error.
 - The D1 store keeps one generic table. A busy deployment needs an expression index on `owner` and `parentId`.
 - `region: "eu"` on the D1 and R2 adapters is a promise made at deploy time. The D1 adapter refuses a query that a non-EU region served. The code cannot check where the bucket lives.
-- Sharing is on in the Worker and in the SDK (`createDrive({ sharing })`). The CLI and the MCP server work on a local drive with one owner, so they do not share yet.
+- Sharing is on in the Worker and in the SDK (`createDrive({ sharing })`). The CLI and the MCP server turn it on too. The CLI has `shares`, `share`, `unshare`, `invite`, `accept-invite`, `link-create`, and `link-revoke`. The MCP server has `drive_shares`, `drive_share`, `drive_unshare`, `drive_invite`, `drive_accept_invite`, `drive_create_link`, `drive_revoke_link`, and `drive_delete_account` (pass `confirm: "yes"`). On the first run after the upgrade, the CLI gives older local items their `resources` docs, once.
 - Drive writes the `resources` doc of each item itself, in the same transaction, because identity has no call that does it in a transaction. A drive with `sharing` off keeps no such docs. Turn sharing on at the start, or run `backfillResources` after you turn it on.
 - An invite sends no message. The caller passes the invite id on.
 - Sharing follows a path of 16 resources, the drive root included, so an item sits at most 15 folders deep. A deeper path, move, or restore fails with `TOO_DEEP`. A move or a restore of a folder spends up to 200 queries on its subfolders (never on files), once, outside the transaction, to count its height. A move up or sideways, a rename, and a file need no count. A bigger folder fails with `TOO_MANY_ITEMS`: move its parts one by one. An edit inside the folder while it moves can leave items past the cap. Nobody can then reach them, and moving the folder back up repairs it.

package/dist/{chunk-ES3NZ7SX.js → chunk-EFO5PSJL.js}

@@ -1,6 +1,6 @@
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "0.6.0" : readPackageVersion();
+var VERSION = true ? "0.7.0" : readPackageVersion();
 
 export {
   VERSION

package/dist/{chunk-WJZNXLTR.js → chunk-PJQ3CRVL.js}

@@ -1346,19 +1346,94 @@ async function buildExport(drive, ctx, now = Date.now) {
 
 // src/auth.ts
 import { createStoreAuth } from "agentic-identity";
+import { requirePrincipal } from "agentic-identity/http";
 async function authenticate(request, store, now) {
-  if (!/^Bearer [A-Za-z0-9_-]{1,512}$/.test(request.headers.get("authorization") ?? "")) return null;
-  const principal = await createStoreAuth(store, now ? { now } : {}).authenticate(request);
-  return principal ? { owner: principal.chain[0].id, actor: { id: principal.principalId, kind: principal.kind }, principal } : null;
+  if (!request.headers.has("authorization")) return null;
+  const principal = await requirePrincipal(request, createStoreAuth(store, now ? { now } : {}));
+  if (principal instanceof Response) return null;
+  return { owner: principal.chain[0].id, actor: { id: principal.principalId, kind: principal.kind }, principal };
+}
+async function inviteIdentity(store, actorId) {
+  const user = await store.get("users", actorId);
+  const agent = await store.get("principals", actorId);
+  return {
+    ...user?.emailVerified === true && typeof user.email === "string" ? { email: user.email } : {},
+    ...typeof agent?.handle === "string" ? { handle: agent.handle } : {}
+  };
+}
+
+// src/migrate.ts
+var PAGE = 10;
+var isText = (v) => typeof v === "string" && v !== "";
+async function walk(store, options, fix) {
+  const { maxPages } = options;
+  if (maxPages !== void 0 && !(Number.isSafeInteger(maxPages) && maxPages > 0)) {
+    throw new Error("maxPages must be a positive whole number");
+  }
+  let fixed = 0;
+  let cursor = options.cursor;
+  for (let pages = 0; maxPages === void 0 || pages < maxPages; pages++) {
+    const page = await store.query("drive_nodes", { limit: PAGE, cursor });
+    fixed += await store.transaction(async (tx) => {
+      const items = [];
+      for (const item of page.items) {
+        const data = await tx.get("drive_nodes", item.id);
+        if (data) items.push({ id: item.id, data });
+      }
+      return fix(tx, items);
+    });
+    cursor = page.nextCursor;
+    if (!cursor) return { fixed };
+  }
+  return { fixed, nextCursor: cursor };
+}
+function backfillAuthorIds(store, options = {}) {
+  return walk(store, options, async (tx, items) => {
+    let count = 0;
+    for (const { id, data } of items) {
+      const created = data.createdBy?.id;
+      const updated = data.updatedBy?.id;
+      if (!isText(created) || !isText(updated)) {
+        throw new Error(`item ${id} has no author. Fix it before you run the backfill again.`);
+      }
+      if (data.createdById === created && data.updatedById === updated) continue;
+      await tx.put("drive_nodes", id, { ...data, createdById: created, updatedById: updated });
+      count++;
+    }
+    return count;
+  });
+}
+function backfillResources(store, options = {}) {
+  return walk(store, options, async (tx, items) => {
+    const missing = [];
+    for (const { id, data } of items) {
+      if (!isText(data.owner) || !isText(data.parentId)) {
+        throw new Error(`item ${id} has no owner or parent. Fix it before you run the backfill again.`);
+      }
+      if (await tx.get("resources", id)) continue;
+      missing.push({ id, parentId: data.parentId === ROOT_ID ? await rootResource(data.owner) : data.parentId });
+    }
+    for (const { id, parentId } of missing) await tx.put("resources", id, { id, type: "drive", parentId });
+    return missing.length;
+  });
 }
 
 // src/local.ts
 import { createHash as createHash2 } from "crypto";
 import { join as join2 } from "path";
-import { isMachineMade, isScope, issueCredential, revokeCredential } from "agentic-identity";
+import { createSharing, isMachineMade, isScope, issueCredential, revokeCredential } from "agentic-identity";
 function openLocal(dir) {
   const store = createFileStore(join2(dir, "db"));
-  return { store, drive: createDrive({ store, blobs: createFileBlobs(join2(dir, "blobs")) }) };
+  return { store, drive: createDrive({ store, blobs: createFileBlobs(join2(dir, "blobs")), sharing: createSharing(store) }) };
+}
+async function ensureSharing(store) {
+  if (await store.get("drive_meta", "sharing")) return;
+  try {
+    await backfillResources(store);
+  } catch (error) {
+    throw new Error(`the one-time sharing backfill of local items failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  await store.put("drive_meta", "sharing", { backfilledAt: Date.now() });
 }
 var AuthError = class extends Error {
   code = "UNAUTHENTICATED";
@@ -1367,8 +1442,13 @@ var NO_TOKEN = "no principal: pass --token <key> or set AGENTIC_DRIVE_TOKEN to a
 var BAD_TOKEN = "the key is not valid: it is unknown, revoked, or expired, or its principal is revoked";
 async function resolveToken(store, token) {
   if (!token) throw new AuthError(NO_TOKEN);
-  if (!/^[A-Za-z0-9_-]{1,512}$/.test(token)) throw new AuthError(BAD_TOKEN);
-  const ctx = await authenticate(new Request("http://local", { headers: { authorization: `Bearer ${token}` } }), store);
+  let request;
+  try {
+    request = new Request("http://local", { headers: { authorization: `Bearer ${token}` } });
+  } catch {
+    throw new AuthError(BAD_TOKEN);
+  }
+  const ctx = await authenticate(request, store);
   if (!ctx) throw new AuthError(BAD_TOKEN);
   return ctx;
 }
@@ -1411,7 +1491,6 @@ export {
   DEFAULT_URL_SECONDS,
   safeMime,
   parseName,
-  rootResource,
   subjectKindOf,
   parseSubject,
   createDrive,
@@ -1424,7 +1503,11 @@ export {
   readZip,
   buildExport,
   authenticate,
+  inviteIdentity,
+  backfillAuthorIds,
+  backfillResources,
   openLocal,
+  ensureSharing,
   AuthError,
   NO_TOKEN,
   resolveToken,

package/dist/cli.js

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 import {
   VERSION
-} from "./chunk-ES3NZ7SX.js";
+} from "./chunk-EFO5PSJL.js";
 import {
   AuthError,
   DriveError,
   NO_TOKEN,
   addPrincipal,
   buildExport,
+  ensureSharing,
+  inviteIdentity,
   issueKey,
   openLocal,
   publicNode,
@@ -15,13 +17,14 @@ import {
   revokeKey,
   revokePrincipal,
   upload
-} from "./chunk-WJZNXLTR.js";
+} from "./chunk-PJQ3CRVL.js";
 
 // src/cli.ts
 import { createReadStream, realpathSync, writeFileSync } from "fs";
 import { basename, join, resolve } from "path";
 import { pathToFileURL } from "url";
 import { parseArgs } from "util";
+import { ROLES, SUBJECT_KINDS } from "agentic-identity";
 var HELP = `agentic-drive ${VERSION}
 Store, sort, and share files and folders.
 
@@ -43,6 +46,13 @@ Commands:
   home [--app <name>]          List files and app documents, newest change first.
   register <ref> <name>        Put an app document in the drive. Flag: --parent <folder>
   forget <ref>                 Move the references to an app document to the trash.
+  shares <path|id>             Show who can reach an item, and by which links and invites. Owner only.
+  share <path|id> <subject>    Give a role to a person or agent. Flags: --role <r> --subject-kind <human|agent>
+  unshare <path|id> <subject>  Take a role away. Flag: --subject-kind <human|agent>
+  invite <path|id>             Invite by --email (a person) or --handle (an agent). Flags: --role <r> --expires-in-ms <n>. Sends no message.
+  accept-invite <id>           Accept an invite that names your verified email or agent handle.
+  link-create <path|id>        Make a share link. The token shows once. Flags: --role <r> --expires-in-ms <n> --signed-in-only
+  link-revoke <id>             Stop a share link.
   delete-all --yes             Erase you for good: your drive, and what you shared or held.
   principal add <id>           Make a person, or an agent with --of <person>. Flag: --scope <s> (repeat). No key needed.
   principal revoke <id>        Stop a principal, and every agent below it. No key needed.
@@ -57,12 +67,13 @@ Flags:
                       The key names a principal, found through agentic-identity. The drive belongs to
                       the person at the top of that principal's chain. An agent key marks items as
                       made by a machine. If the key is missing or not valid, the command exits with 3.
+  --role <r>          share: owner, editor, commenter, or viewer. invite and link-create: editor, commenter, or viewer.
   --on-conflict <m>   fail, rename, or replace
   -p, --parents       Create missing parent folders
 
 Exit codes: 0 done, 1 error, 2 bad usage, 3 no principal or an invalid key.
 `;
-var COMMANDS = ["ls", "stat", "mkdir", "upload", "download", "mv", "rm", "trash", "restore", "purge", "search", "export", "home", "register", "forget", "delete-all", "mcp", "principal", "key"];
+var COMMANDS = ["ls", "stat", "mkdir", "upload", "download", "mv", "rm", "trash", "restore", "purge", "search", "export", "home", "register", "forget", "shares", "share", "unshare", "invite", "accept-invite", "link-create", "link-revoke", "delete-all", "mcp", "principal", "key"];
 var UsageError = class extends Error {
 };
 var options = {
@@ -81,18 +92,35 @@ var options = {
   "min-size": { type: "string" },
   "max-size": { type: "string" },
   "created-by-kind": { type: "string" },
+  role: { type: "string" },
+  "subject-kind": { type: "string" },
+  email: { type: "string" },
+  handle: { type: "string" },
+  "expires-in-ms": { type: "string" },
+  "signed-in-only": { type: "boolean" },
   limit: { type: "string" },
   app: { type: "string" },
   yes: { type: "boolean" },
   help: { type: "boolean", short: "h" },
   version: { type: "boolean", short: "V" }
 };
+function lifetime(value, flag) {
+  if (value === void 0) return void 0;
+  const n = Number(value);
+  if (value.trim() === "" || !Number.isSafeInteger(n) || n <= 0) throw new UsageError(`--${flag} needs a whole number above 0`);
+  return n;
+}
 function num(value, flag) {
   if (value === void 0) return void 0;
   const n = Number(value);
   if (!Number.isFinite(n) || n < 0) throw new UsageError(`--${flag} needs a number of 0 or more`);
   return n;
 }
+var LINK_ROLES = ROLES.filter((r) => r !== "owner");
+function pick(value, allowed, flag) {
+  if (value === void 0 || !allowed.includes(value)) throw new UsageError(`--${flag} needs ${allowed.join(", ")}`);
+  return value;
+}
 async function runCli(argv, io) {
   try {
     const { values, positionals } = parseArgs({ args: argv, options, allowPositionals: true, strict: true });
@@ -119,6 +147,7 @@ async function runCli(argv, io) {
       throw new UsageError("usage: agentic-drive principal add <id> [--of <person>] [--scope <s>] | principal revoke <id> | key issue <principal> | key revoke <key>");
     }
     const ctx = await resolveToken(store, token);
+    await ensureSharing(store);
     const onConflict = values["on-conflict"];
     if (onConflict && !["fail", "rename", "replace"].includes(onConflict)) throw new UsageError("--on-conflict needs fail, rename, or replace");
     const print = (value) => io.out(JSON.stringify(value));
@@ -207,13 +236,58 @@ async function runCli(argv, io) {
         need(1, "forget <ref>");
         print(await drive.forgetDocument(ctx, args[0]));
         break;
+      case "shares":
+        need(1, "shares <path|id>");
+        print(await drive.shares(ctx, args[0]));
+        break;
+      case "share":
+        need(2, "share <path|id> <subject> --role <r> --subject-kind <human|agent>");
+        await drive.shareWith(ctx, args[0], { kind: pick(values["subject-kind"], SUBJECT_KINDS, "subject-kind"), id: args[1] }, pick(values.role, ROLES, "role"));
+        print({ ok: true });
+        break;
+      case "unshare":
+        need(2, "unshare <path|id> <subject> --subject-kind <human|agent>");
+        await drive.unshare(ctx, args[0], { kind: pick(values["subject-kind"], SUBJECT_KINDS, "subject-kind"), id: args[1] });
+        print({ ok: true });
+        break;
+      case "invite": {
+        need(1, "invite <path|id> --role <r> (--email <e> | --handle <h>)");
+        const expiresInMs = lifetime(values["expires-in-ms"], "expires-in-ms");
+        print(await drive.invite(ctx, args[0], {
+          role: pick(values.role, LINK_ROLES, "role"),
+          ...values.email === void 0 ? {} : { email: values.email },
+          ...values.handle === void 0 ? {} : { handle: values.handle },
+          ...expiresInMs === void 0 ? {} : { expiresInMs }
+        }));
+        break;
+      }
+      case "accept-invite":
+        need(1, "accept-invite <id>");
+        await drive.acceptInvite(ctx, args[0], await inviteIdentity(store, ctx.actor.id));
+        print({ ok: true });
+        break;
+      case "link-create": {
+        need(1, "link-create <path|id> --role <r>");
+        const expiresInMs = lifetime(values["expires-in-ms"], "expires-in-ms");
+        print(await drive.createLink(ctx, args[0], {
+          role: pick(values.role, LINK_ROLES, "role"),
+          signedInOnly: values["signed-in-only"] === true,
+          ...expiresInMs === void 0 ? {} : { expiresAt: Date.now() + expiresInMs }
+        }));
+        break;
+      }
+      case "link-revoke":
+        need(1, "link-revoke <id>");
+        await drive.revokeLink(ctx, args[0]);
+        print({ ok: true });
+        break;
       case "delete-all":
         if (!values.yes) throw new UsageError("delete-all erases you for good. Add --yes to confirm.");
         print(await drive.erasePerson(ctx));
         break;
       case "mcp": {
         const { startMcp } = await import("./mcp.js");
-        await startMcp({ drive, ctx, exportDir: join(dir, "exports") });
+        await startMcp({ drive, ctx, exportDir: join(dir, "exports"), store });
         return 0;
       }
       default:

package/dist/index.d.ts

@@ -51,7 +51,7 @@ declare function writeZip(entries: ZipEntry[], at: number): Uint8Array;
 /** Reads a zip made by `writeZip`. It checks every CRC. */
 declare function readZip(bytes: Uint8Array): Map<string, Uint8Array>;
 
-/** The drive and the store behind it, both kept in `dir`. The store holds the principals and keys too. */
+/** The drive and the store behind it, both kept in `dir`. The store holds the principals and keys too. Sharing is on, as in the Worker. */
 declare function openLocal(dir: string): {
     drive: Drive;
     store: Store;

package/dist/index.js

@@ -1,10 +1,6 @@
 import {
   VERSION
-} from "./chunk-ES3NZ7SX.js";
-import {
-  backfillAuthorIds,
-  backfillResources
-} from "./chunk-BXFK3QXK.js";
+} from "./chunk-EFO5PSJL.js";
 import {
   ACTOR_KINDS,
   AuthError,
@@ -12,6 +8,8 @@ import {
   DriveError,
   ROOT_ID,
   addPrincipal,
+  backfillAuthorIds,
+  backfillResources,
   buildExport,
   createDrive,
   createFileBlobs,
@@ -29,7 +27,7 @@ import {
   subjectKindOf,
   upload,
   writeZip
-} from "./chunk-WJZNXLTR.js";
+} from "./chunk-PJQ3CRVL.js";
 export {
   ACTOR_KINDS,
   AuthError,

package/dist/mcp.d.ts

@@ -1,12 +1,13 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { D as Drive, C as Ctx } from './drive-BtRyexUP.js';
-import 'agentic-identity';
+import { Store } from 'agentic-identity';
 
-declare function createMcpServer(drive: Drive, ctx: Ctx, exportDir: string): McpServer;
+declare function createMcpServer(drive: Drive, ctx: Ctx, exportDir: string, store: Store): McpServer;
 declare function startMcp(deps: {
     drive: Drive;
     ctx: Ctx;
     exportDir: string;
+    store: Store;
 }): Promise<void>;
 
 export { createMcpServer, startMcp };

package/dist/mcp.js

@@ -1,13 +1,14 @@
 import {
   VERSION
-} from "./chunk-ES3NZ7SX.js";
+} from "./chunk-EFO5PSJL.js";
 import {
   ACTOR_KINDS,
   DriveError,
   buildExport,
+  inviteIdentity,
   publicNode,
   upload
-} from "./chunk-WJZNXLTR.js";
+} from "./chunk-PJQ3CRVL.js";
 
 // src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -15,7 +16,12 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { mkdirSync, writeFileSync } from "fs";
 import { join } from "path";
 import { z } from "zod";
+import { ROLES, SUBJECT_KINDS } from "agentic-identity";
 var conflict = z.enum(["fail", "rename", "replace"]).optional();
+var role = z.enum(ROLES);
+var linkRole = z.enum(ROLES.filter((r) => r !== "owner"));
+var subjectKind = z.enum(SUBJECT_KINDS);
+var lifetime = z.number().int().positive().optional().describe("How long it lasts, in milliseconds.");
 var loc = z.string().describe('A path, such as "/x" or "<folder id>/x", or an item id.');
 var ok = (value) => ({ content: [{ type: "text", text: JSON.stringify(value) }] });
 function failure(error) {
@@ -23,7 +29,7 @@ function failure(error) {
   return { isError: true, content: [{ type: "text", text: JSON.stringify({ error: { code: error.code, message: error.message } }) }] };
 }
 var EXPORT_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}\.zip$/;
-function createMcpServer(drive, ctx, exportDir) {
+function createMcpServer(drive, ctx, exportDir, store) {
   const server = new McpServer({ name: "agentic-drive", version: VERSION });
   const tool = (name, description, shape, run, annotations = {}) => server.registerTool(name, { description, inputSchema: shape, annotations }, (async (args) => {
     try {
@@ -86,6 +92,44 @@ function createMcpServer(drive, ctx, exportDir) {
     async ({ ref, name, folder }) => publicNode(await drive.registerDocument(ctx, { ref, name, folder }))
   );
   tool("drive_forget_document", "Move every reference to an app document to the trash.", { ref: z.string() }, async ({ ref }) => drive.forgetDocument(ctx, ref));
+  tool("drive_shares", "Show who can reach an item, and by which links and invites. Only an owner may look. Link tokens are never shown.", { path: loc }, async ({ path }) => drive.shares(ctx, path), { readOnlyHint: true });
+  tool(
+    "drive_share",
+    "Give a person or an agent a role on an item. A folder role passes down.",
+    { path: loc, subjectKind, subjectId: z.string(), role },
+    async ({ path, subjectKind: subjectKind2, subjectId, role: role2 }) => (await drive.shareWith(ctx, path, { kind: subjectKind2, id: subjectId }, role2), { ok: true })
+  );
+  tool(
+    "drive_unshare",
+    "Take a role away from a person or an agent on an item.",
+    { path: loc, subjectKind, subjectId: z.string() },
+    async ({ path, subjectKind: subjectKind2, subjectId }) => (await drive.unshare(ctx, path, { kind: subjectKind2, id: subjectId }), { ok: true }),
+    { destructiveHint: true }
+  );
+  tool(
+    "drive_invite",
+    "Invite by `email` (a person) or `handle` (an agent). It sends no message. The id comes back.",
+    { path: loc, role: linkRole, email: z.string().optional(), handle: z.string().optional(), expiresInMs: lifetime },
+    async ({ path, role: role2, email, handle, expiresInMs }) => drive.invite(ctx, path, { role: role2, ...email === void 0 ? {} : { email }, ...handle === void 0 ? {} : { handle }, ...expiresInMs === void 0 ? {} : { expiresInMs } })
+  );
+  tool("drive_accept_invite", "Accept an invite that names you by verified email or by agent handle.", { id: z.string() }, async ({ id }) => (await drive.acceptInvite(ctx, id, await inviteIdentity(store, ctx.actor.id)), { ok: true }));
+  tool(
+    "drive_create_link",
+    "Make a share link for an item. The token comes back once.",
+    { path: loc, role: linkRole, expiresInMs: lifetime, signedInOnly: z.boolean().optional() },
+    async ({ path, role: role2, expiresInMs, signedInOnly }) => drive.createLink(ctx, path, { role: role2, signedInOnly: signedInOnly === true, ...expiresInMs === void 0 ? {} : { expiresAt: Date.now() + expiresInMs } })
+  );
+  tool("drive_revoke_link", "Stop a share link.", { id: z.string() }, async ({ id }) => (await drive.revokeLink(ctx, id), { ok: true }), { destructiveHint: true });
+  tool(
+    "drive_delete_account",
+    'Erase the caller for good: the drive, and what they shared or held. Only a person can. Pass confirm: "yes".',
+    { confirm: z.string() },
+    async ({ confirm }) => {
+      if (confirm !== "yes") throw new DriveError("INVALID_PATH", 'pass confirm: "yes" to erase you for good: your drive, and what you shared or held');
+      return drive.erasePerson(ctx);
+    },
+    { destructiveHint: true }
+  );
   tool(
     "drive_export",
     "Write everything the owner has to a new zip file in the export folder. Give a plain file name that ends in .zip. It never overwrites a file.",
@@ -108,7 +152,7 @@ function createMcpServer(drive, ctx, exportDir) {
   return server;
 }
 async function startMcp(deps) {
-  await createMcpServer(deps.drive, deps.ctx, deps.exportDir).connect(new StdioServerTransport());
+  await createMcpServer(deps.drive, deps.ctx, deps.exportDir, deps.store).connect(new StdioServerTransport());
 }
 export {
   createMcpServer,

package/dist/worker.js

@@ -1,18 +1,17 @@
-import {
-  backfillAuthorIds,
-  backfillResources
-} from "./chunk-BXFK3QXK.js";
 import {
   DEFAULT_MAX_BYTES,
   DEFAULT_URL_SECONDS,
   DriveError,
   authenticate,
+  backfillAuthorIds,
+  backfillResources,
   buildExport,
   createDrive,
+  inviteIdentity,
   publicNode,
   safeMime,
   upload
-} from "./chunk-WJZNXLTR.js";
+} from "./chunk-PJQ3CRVL.js";
 
 // src/worker.ts
 import { Hono } from "hono";
@@ -255,12 +254,7 @@ function createApp(options = {}) {
   });
   api.post("/invites/accept", async (c) => {
     const id = str((await body(c)).id, "id");
-    const user = await c.var.store.get("users", c.var.ctx.actor.id);
-    const agent = await c.var.store.get("principals", c.var.ctx.actor.id);
-    await c.var.drive.acceptInvite(c.var.ctx, id, {
-      ...user?.emailVerified === true && typeof user.email === "string" ? { email: user.email } : {},
-      ...typeof agent?.handle === "string" ? { handle: agent.handle } : {}
-    });
+    await c.var.drive.acceptInvite(c.var.ctx, id, await inviteIdentity(c.var.store, c.var.ctx.actor.id));
     return c.json({ ok: true });
   });
   api.post("/links", async (c) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-drive",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Store, sort, and share files and folders.",
   "keywords": [
     "drive",
@@ -73,7 +73,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.0",
     "agentic-design": "^0.1.0",
-    "agentic-identity": "^0.4.0",
+    "agentic-identity": "^0.6.0",
     "hono": "^4.13.14",
     "zod": "^3.25.0"
   },

package/dist/chunk-BXFK3QXK.js

@@ -1,65 +0,0 @@
-import {
-  ROOT_ID,
-  rootResource
-} from "./chunk-WJZNXLTR.js";
-
-// src/migrate.ts
-var PAGE = 10;
-var isText = (v) => typeof v === "string" && v !== "";
-async function walk(store, options, fix) {
-  const { maxPages } = options;
-  if (maxPages !== void 0 && !(Number.isSafeInteger(maxPages) && maxPages > 0)) {
-    throw new Error("maxPages must be a positive whole number");
-  }
-  let fixed = 0;
-  let cursor = options.cursor;
-  for (let pages = 0; maxPages === void 0 || pages < maxPages; pages++) {
-    const page = await store.query("drive_nodes", { limit: PAGE, cursor });
-    fixed += await store.transaction(async (tx) => {
-      const items = [];
-      for (const item of page.items) {
-        const data = await tx.get("drive_nodes", item.id);
-        if (data) items.push({ id: item.id, data });
-      }
-      return fix(tx, items);
-    });
-    cursor = page.nextCursor;
-    if (!cursor) return { fixed };
-  }
-  return { fixed, nextCursor: cursor };
-}
-function backfillAuthorIds(store, options = {}) {
-  return walk(store, options, async (tx, items) => {
-    let count = 0;
-    for (const { id, data } of items) {
-      const created = data.createdBy?.id;
-      const updated = data.updatedBy?.id;
-      if (!isText(created) || !isText(updated)) {
-        throw new Error(`item ${id} has no author. Fix it before you run the backfill again.`);
-      }
-      if (data.createdById === created && data.updatedById === updated) continue;
-      await tx.put("drive_nodes", id, { ...data, createdById: created, updatedById: updated });
-      count++;
-    }
-    return count;
-  });
-}
-function backfillResources(store, options = {}) {
-  return walk(store, options, async (tx, items) => {
-    const missing = [];
-    for (const { id, data } of items) {
-      if (!isText(data.owner) || !isText(data.parentId)) {
-        throw new Error(`item ${id} has no owner or parent. Fix it before you run the backfill again.`);
-      }
-      if (await tx.get("resources", id)) continue;
-      missing.push({ id, parentId: data.parentId === ROOT_ID ? await rootResource(data.owner) : data.parentId });
-    }
-    for (const { id, parentId } of missing) await tx.put("resources", id, { id, type: "drive", parentId });
-    return missing.length;
-  });
-}
-
-export {
-  backfillAuthorIds,
-  backfillResources
-};