agentic-drive 0.9.0 → 0.10.0

package/dist/{chunk-R2DUVOJT.js → chunk-DB4F5EWD.js}

@@ -1,8 +1,9 @@
 // src/drive.ts
-import { EraseRefusedError, StoreConflictError, MAX_FOLDER_DEPTH, PRINCIPAL_KINDS, ROLES, SUBJECT_KINDS } from "agentic-identity";
+import { EraseRefusedError, isMachineMade, StoreConflictError, MAX_FOLDER_DEPTH, PRINCIPAL_KINDS, ROLES, SUBJECT_KINDS, hasScope } from "agentic-identity";
 var ROOT_ID = "root";
 var NODES = "drive_nodes";
 var NAMES = "drive_names";
+var ACTIVITY = "drive_activity";
 var ACTOR_KINDS = PRINCIPAL_KINDS;
 var DECIDED = /* @__PURE__ */ Symbol("decided");
 var ERROR_STATUS = Object.freeze({
@@ -131,6 +132,17 @@ function parseSubject(input) {
   return { kind: s.kind, id: s.id };
 }
 var SHARE_ERROR = /^(invalid|give an|expiresAt|expiresInMs|resource exists|the last owner)/;
+var ACTIVITY_ACTIONS = ["create", "rename", "move", "update", "share", "unshare", "delete", "restore"];
+var publicActivity = ({ owner: _owner, actorId: _actorId, subjectId: _subjectId, subjectKind: _subjectKind, ...entry }) => ({
+  ...entry,
+  actor: { id: entry.actor.id, kind: entry.principalKind === "human" ? "human" : "agent" }
+});
+var keepVia = (entry) => {
+  const via = entry.detail?.via;
+  if (via === void 0) delete entry.detail;
+  else entry.detail = { via };
+};
+var shown = (doc) => typeof doc.id === "string" && typeof doc.itemId === "string" && typeof doc.at === "number" && Number.isFinite(doc.at) && ACTIVITY_ACTIONS.includes(doc.action) && typeof doc.actor === "object" && doc.actor !== null && typeof doc.actor.id === "string" && PRINCIPAL_KINDS.includes(doc.principalKind);
 function createDrive(deps) {
   const { store, blobs } = deps;
   let last = 0;
@@ -183,6 +195,29 @@ function createDrive(deps) {
   const who = (ctx) => ({ id: ctx.actor.id, kind: ctx.actor.kind });
   const stamp = (ctx, node) => ({ createdById: node.createdById ?? node.createdBy.id, updatedBy: who(ctx), updatedById: ctx.actor.id });
   const resourceDoc = async (node, parent) => ({ id: node.id, type: "drive", parentId: await resourceOf(parent) });
+  const activityDoc = (ctx, node, action, detail) => {
+    if (!PRINCIPAL_KINDS.includes(ctx.actor.kind)) throw new DriveError("FORBIDDEN", `an actor needs a kind: ${PRINCIPAL_KINDS.join(", ")}`);
+    return {
+      id: newId(),
+      itemId: node.id,
+      owner: node.owner,
+      action,
+      actor: { id: ctx.actor.id, kind: isMachineMade(ctx.actor.kind) ? "agent" : "human" },
+      actorId: ctx.actor.id,
+      principalKind: ctx.actor.kind,
+      at: now(),
+      ...detail ? { detail } : {},
+      ...typeof detail?.subjectId === "string" ? { subjectId: detail.subjectId, subjectKind: detail.subjectKind } : {}
+    };
+  };
+  const logDoc = (ctx, node, action, detail) => {
+    const doc = activityDoc(ctx, node, action, detail);
+    return [doc.id, doc];
+  };
+  const logIn = (w, ctx, node, action, detail) => {
+    const doc = activityDoc(ctx, node, action, detail);
+    w.put(ACTIVITY, doc.id, doc);
+  };
   async function rawNode(ops, id, owner, by, withMarked = false) {
     const node = id === ROOT_ID ? rootNode(owner, by) : await ops.get(NODES, id);
     return node && (withMarked || node.purging !== true) ? node : null;
@@ -328,6 +363,7 @@ function createDrive(deps) {
       if (onConflict === "replace" && slot.node?.kind === "file" && fields.kind === "file") {
         const node2 = { ...slot.node, ...fields, updatedAt: now(), ...stamp(ctx, slot.node) };
         w.put(NODES, node2.id, node2);
+        logIn(w, ctx, node2, "update", { size: node2.size, hash: node2.hash });
         return { node: node2, replacedBlob: slot.node.blobKey };
       }
       if (onConflict !== "rename") throw new DriveError("NAME_TAKEN", `"${name}" already exists`);
@@ -365,6 +401,7 @@ function createDrive(deps) {
       ...fields
     };
     w.put(NODES, node.id, node);
+    logIn(w, ctx, node, "create", { name: node.name, kind: node.kind });
     w.put(NAMES, await claimId(parent.owner, parent.id, key), { nodeId: node.id, owner: parent.owner, parentId: parent.id });
     if (sharing) w.put("resources", node.id, await resourceDoc(node, parent));
     return { node, replacedBlob: null };
@@ -402,6 +439,8 @@ function createDrive(deps) {
     }
     const moved = { ...node, parentId: dest.id, name, nameKey: key, updatedAt: now(), ...stamp(ctx, node) };
     w.put(NODES, moved.id, moved);
+    if (moved.name !== node.name) logIn(w, ctx, moved, "rename", { from: node.name, to: moved.name });
+    if (moved.parentId !== node.parentId) logIn(w, ctx, moved, "move", { from: node.parentId, to: moved.parentId });
     const [from, to] = [await claimId(node.owner, node.parentId, node.nameKey), await claimId(dest.owner, dest.id, key)];
     if (from !== to) {
       if ((await ops.get(NAMES, from))?.nodeId === node.id) w.remove(NAMES, from);
@@ -438,6 +477,16 @@ function createDrive(deps) {
     if (!await can(ctx, "read", rootNode(ctx.owner, ctx.actor))) throw new DriveError("FORBIDDEN", "not allowed to read this drive");
     return rawOwnerNodes(ctx.owner, withMarked);
   }
+  async function readOwnerRoot(ctx) {
+    if (sharing && ctx.principal !== void 0 && await store.get("resources", await rootResource(ctx.owner)) === null) {
+      if ((await rawOwnerNodes(ctx.owner, true)).length === 0) {
+        if (hasScope(ctx.principal.scopes, "drive:read")) return;
+        throw new DriveError("FORBIDDEN", "not allowed to read this drive");
+      }
+      await prepare(ctx);
+    }
+    if (!await can(ctx, "read", rootNode(ctx.owner, ctx.actor))) throw new DriveError("FORBIDDEN", "not allowed to read this drive");
+  }
   function pathIn(byId, node, liveOnly) {
     const names = [];
     for (let n = node, depth = 0; depth < 1e3; depth++) {
@@ -514,6 +563,7 @@ function createDrive(deps) {
       const all = await rawOwnerNodes(owner, true);
       if (all.length === 0) {
         await finishResource(principal, await rootResource(owner));
+        for (const entry of await allWhere(store, ACTIVITY, { itemId: ROOT_ID, owner })) await store.delete(ACTIVITY, entry.id);
         return removed;
       }
       removed += await removeNodes(all, void 0, principal);
@@ -592,6 +642,7 @@ function createDrive(deps) {
       const chunk = rows.slice(i, i + size);
       for (const node of chunk) if (node.blobKey) await blobs.delete(node.blobKey);
       for (const node of chunk) await finishResource(principal, node.id);
+      for (const node of chunk) for (const entry of await allWhere(store, ACTIVITY, { itemId: node.id, owner: node.owner })) await store.delete(ACTIVITY, entry.id);
       await transact(async (tx) => {
         const held = [];
         for (const node of chunk) {
@@ -619,6 +670,30 @@ function createDrive(deps) {
     async stat(ctx, loc) {
       return resolve(store, ctx, loc);
     },
+    /**
+     * The changes made to one item, newest first: who (a person or an agent), what, and when. Anyone who may read
+     * the item may read its log. A trashed item can be named by id, so its log can be read before a restore.
+     */
+    async listActivity(ctx, loc, opts = {}) {
+      const limit = opts.limit ?? 100;
+      if (!Number.isInteger(limit) || limit < 1) throw new RangeError("limit must be an integer of 1 or more");
+      const node = loc.includes("/") ? await resolve(store, ctx, loc) : await fetch(store, ctx, loc);
+      if (!node) throw new DriveError("NOT_FOUND", `no item ${loc}`);
+      const owner = node.owner === ctx.owner;
+      const out = [];
+      for (let cursor; out.length < limit; ) {
+        const page = await store.query(ACTIVITY, { where: { itemId: node.id, owner: node.owner }, orderBy: { field: "at", direction: "desc" }, limit: Math.min(limit - out.length, 100), cursor });
+        for (const e of page.items) {
+          if (!shown(e.data)) continue;
+          const entry = publicActivity(e.data);
+          if (!owner && (entry.action === "share" || entry.action === "unshare")) keepVia(entry);
+          out.push(entry);
+        }
+        if (!page.nextCursor) break;
+        cursor = page.nextCursor;
+      }
+      return out;
+    },
     /** Live children, sorted by name. */
     async list(ctx, loc = "/") {
       const folder = await resolve(store, ctx, loc);
@@ -735,6 +810,8 @@ function createDrive(deps) {
         const t = now();
         const trashed = { ...node, trashed: true, trashedAt: t, updatedAt: t, ...stamp(ctx2, node) };
         await tx.put(NODES, node.id, trashed);
+        const entry = activityDoc(ctx2, node, "delete");
+        await tx.put(ACTIVITY, entry.id, entry);
         if (held?.nodeId === node.id) await tx.delete(NAMES, claim);
         return trashed;
       });
@@ -788,6 +865,8 @@ function createDrive(deps) {
         }
         const restored = { ...node, parentId: parent.id, name, nameKey: key, trashed: false, trashedAt: null, updatedAt: now(), ...stamp(ctx2, node) };
         await tx.put(NODES, restored.id, restored);
+        const entry = activityDoc(ctx2, restored, "restore");
+        await tx.put(ACTIVITY, entry.id, entry);
         await tx.put(NAMES, await claimId(parent.owner, parent.id, key), { nodeId: restored.id, owner: parent.owner, parentId: parent.id });
         if (sharing && parent.id !== node.parentId) await tx.put("resources", restored.id, await resourceDoc(restored, parent));
         return restored;
@@ -817,7 +896,8 @@ function createDrive(deps) {
     },
     /** Every item of the owner, trashed or not, with its original path and bytes. For export. */
     async exportData(ctx) {
-      const all = await ownerNodes(ctx);
+      await readOwnerRoot(ctx);
+      const all = await rawOwnerNodes(ctx.owner, false);
       const byId = new Map(all.map((n) => [n.id, n]));
       const out = [];
       for (const node of all.sort((a, b) => a.id < b.id ? -1 : 1)) {
@@ -938,6 +1018,7 @@ function createDrive(deps) {
         if (removed === 0 && !gone) console.error(`claimRef could not remove ${node.id} after a failed share. Purge it.`);
         throw error;
       }
+      await store.put(ACTIVITY, ...logDoc(ctx, node, "share", { subjectKind: subject.kind, subjectId: subject.id, role: claim.role }));
       return node;
     },
     /** An app deleted a document. Its references in this drive go to the trash. Returns how many. */
@@ -960,13 +1041,13 @@ function createDrive(deps) {
      * What drive holds about the person behind a call, besides their own drive (`exportData` has that). It is
      * only for the person in person: an agent gets `partial: true` and nothing else. It holds the ids of the
      * items they or their agents made or changed in other drives (no names, and nothing of the people who own
-     * them), the shares they hold, the invites they sent, and the audit entries of what they and their agents
-     * did. Invitee emails and link tokens are not in it.
+     * them), the shares they hold and the invites they sent on drive items, and the audit entries of what they and
+     * their agents did. Invitee emails and link tokens are not in it.
      */
     async exportPerson(ctx) {
-      await need(ctx, "read", rootNode(ctx.owner, ctx.actor));
+      await readOwnerRoot(ctx);
       const subject = subjectOf(ctx);
-      if (!isInPerson(ctx)) return { subject, partial: true, authored: [], agents: [], shares: { held: [], invitesCreated: [] }, audit: [] };
+      if (!isInPerson(ctx)) return { subject, partial: true, authored: [], agents: [], shares: { held: [], invitesCreated: [] }, audit: [], activity: [] };
       const { actors, ownedAgents } = await actorsOf(store, subject.id);
       const authored = (await madeBy(store, actors)).filter((n) => n.owner !== subject.id && n.purging !== true).map((n) => ({
         id: n.id,
@@ -977,8 +1058,9 @@ function createDrive(deps) {
         updatedAt: actors.includes(n.updatedById) ? n.updatedAt : null,
         by: [...new Set([actors.includes(n.createdById) ? n.createdBy : null, actors.includes(n.updatedById) ? n.updatedBy : null].filter((a) => a !== null).map((a) => JSON.stringify(a)))].map((a) => JSON.parse(a))
       })).sort((x, y) => x.id < y.id ? -1 : 1);
+      const onDrive = async (resourceId) => typeof resourceId === "string" && (await store.get("resources", resourceId))?.type === "drive";
       const held = [];
-      for (const [actor, kind] of heldBy(subject, ownedAgents)) for (const g of await allWhere(store, "grants", { subjectId: actor, subjectKind: kind })) held.push({ subjectKind: g.data.subjectKind, subjectId: g.data.subjectId, resourceId: g.data.resourceId, role: g.data.role });
+      for (const [actor, kind] of heldBy(subject, ownedAgents)) for (const g of await allWhere(store, "grants", { subjectId: actor, subjectKind: kind })) if (await onDrive(g.data.resourceId)) held.push({ subjectKind: g.data.subjectKind, subjectId: g.data.subjectId, resourceId: g.data.resourceId, role: g.data.role });
       const agents = [];
       for (const agent of ownedAgents) {
         const items = (await rawOwnerNodes(agent, false)).map((n) => ({ id: n.id, kind: n.kind, name: n.name, size: n.size, mime: n.mime, createdAt: n.createdAt, updatedAt: n.updatedAt, trashed: n.trashed }));
@@ -988,6 +1070,7 @@ function createDrive(deps) {
       const audit = [];
       for (const actor of actors) {
         for (const i of await allWhere(store, "invites", { createdBy: actor })) {
+          if (!await onDrive(i.data.resourceId)) continue;
           invitesCreated.push({ id: i.data.id, resourceId: i.data.resourceId, role: i.data.role, expiresAt: i.data.expiresAt ?? null, accepted: i.data.acceptedAt !== void 0 });
         }
         for (const e of await allWhere(store, "audit", { principalId: actor }, { field: "at" })) {
@@ -995,7 +1078,18 @@ function createDrive(deps) {
         }
       }
       audit.sort((x, y) => x.at - y.at);
-      return { subject, partial: false, authored, agents, shares: { held, invitesCreated }, audit };
+      const activity = [];
+      for (const actor of actors) {
+        for (const e of await allWhere(store, ACTIVITY, { actorId: actor })) {
+          if (!shown(e.data)) continue;
+          const doc = e.data;
+          const entry = publicActivity(doc);
+          if (doc.owner !== subject.id && !ownedAgents.includes(doc.owner)) keepVia(entry);
+          activity.push(entry);
+        }
+      }
+      activity.sort((x, y) => x.at - y.at || (x.id < y.id ? -1 : 1));
+      return { subject, partial: false, authored, agents, shares: { held, invitesCreated }, audit, activity };
     },
     /**
      * Erases a person for good. Only the person in person may. Their drive and its shares go. So do the shares
@@ -1043,16 +1137,38 @@ function createDrive(deps) {
           }
         });
       }
+      for (const actor of actors) {
+        const mine = await allWhere(store, ACTIVITY, { actorId: actor });
+        for (let i = 0; i < mine.length; i += CHUNK) {
+          await transact(async (tx) => {
+            for (const e of mine.slice(i, i + CHUNK)) await tx.put(ACTIVITY, e.id, { ...e.data, actorId: ERASED, actor: { ...e.data.actor, id: ERASED } });
+          });
+        }
+      }
+      for (const [actor, kind] of heldBy(subjectOf(ctx), ownedAgents)) {
+        for (const e of await allWhere(store, ACTIVITY, { subjectId: actor, subjectKind: kind })) {
+          await store.put(ACTIVITY, e.id, { ...e.data, subjectId: ERASED, detail: { ...e.data.detail, subjectId: ERASED } });
+        }
+      }
       return { removed, grants, invites, anonymized: todo.length };
     },
     /** Gives a person or an agent a role on an item and everything under it. Only an owner may. */
     async shareWith(ctx, loc, subject, role) {
-      const resource = await resourceOf(await resolve(store, ctx, loc));
-      await viaSharing(ctx, (s, p) => s.grant(p, resource, parseSubject(subject), role));
+      const node = await resolve(store, ctx, loc);
+      const resource = await resourceOf(node);
+      const target = parseSubject(subject);
+      const entry = logDoc(ctx, node, "share", { subjectKind: target.kind, subjectId: target.id, role });
+      await viaSharing(ctx, (s, p) => s.grant(p, resource, target, role));
+      await store.put(ACTIVITY, ...entry);
     },
     async unshare(ctx, loc, subject) {
-      const resource = await resourceOf(await resolve(store, ctx, loc));
-      await viaSharing(ctx, (s, p) => s.revokeGrant(p, resource, parseSubject(subject)));
+      const node = await resolve(store, ctx, loc);
+      const resource = await resourceOf(node);
+      const target = parseSubject(subject);
+      const entry = logDoc(ctx, node, "unshare", { subjectKind: target.kind, subjectId: target.id });
+      const held = (await allWhere(store, "grants", { resourceId: resource, subjectId: target.id, subjectKind: target.kind })).length > 0;
+      await viaSharing(ctx, (s, p) => s.revokeGrant(p, resource, target));
+      if (held) await store.put(ACTIVITY, ...entry);
     },
     /** Invite by `email` (a person) or `handle` (an agent). The invite lasts `expiresInMs`, if given. It sends no message. */
     async invite(ctx, loc, input) {
@@ -1061,7 +1177,16 @@ function createDrive(deps) {
     },
     /** `identity` is the verified email of a person, or the handle of an agent. */
     async acceptInvite(ctx, inviteId, identity) {
+      const invite = await store.get("invites", inviteId);
+      const node = typeof invite?.resourceId === "string" ? await store.get(NODES, invite.resourceId) : null;
+      const subjectKind = node && (ctx.actor.kind === "human" || ctx.actor.kind === "agent") ? subjectKindOf(ctx.actor.kind) : null;
+      const roleOf = async () => node && subjectKind ? (await allWhere(store, "grants", { resourceId: node.id, subjectId: ctx.actor.id, subjectKind }))[0]?.data.role ?? null : null;
+      const before = await roleOf();
       await viaSharing(ctx, (s, p) => s.acceptInvite(p, inviteId, identity));
+      const after = await roleOf();
+      if (node && subjectKind && after !== null && after !== before) {
+        await store.put(ACTIVITY, ...logDoc(ctx, node, "share", { subjectKind, subjectId: ctx.actor.id, role: after, via: "invite" }));
+      }
     },
     /** The token comes back once. Only its hash is stored. */
     async createLink(ctx, loc, input) {
@@ -1111,9 +1236,10 @@ function createDrive(deps) {
       throw error;
     }
   }
-  async function prepare(ctx) {
+  async function prepare(ctx, create = true) {
     if (!sharing || ctx.principal === void 0) return;
     if (ctx.principal.chain[0]?.id !== ctx.owner) throw new DriveError("FORBIDDEN", "the caller does not own this drive");
+    if (!create) return;
     const id = await rootResource(ctx.owner);
     if ((await store.get("resources", id))?.type === "drive") return;
     try {
@@ -1121,203 +1247,13 @@ function createDrive(deps) {
     } catch {
     }
   }
-  const guarded = (call) => async (ctx, ...args) => {
-    await prepare(ctx);
+  const guarded = (call, create = true) => async (ctx, ...args) => {
+    await prepare(ctx, create);
     return call(ctx, ...args);
   };
   const open = /* @__PURE__ */ new Set(["openShared", "listShared", "readShared"]);
-  return Object.fromEntries(Object.entries(api).map(([name, call]) => [name, open.has(name) ? call : guarded(call)]));
-}
-
-// src/upload.ts
-var DEFAULT_MAX_BYTES = 25 * 1024 * 1024;
-var SIGNATURES = [
-  [[137, 80, 78, 71, 13, 10, 26, 10], "image/png"],
-  [[255, 216, 255], "image/jpeg"],
-  [[71, 73, 70, 56], "image/gif"],
-  [[37, 80, 68, 70, 45], "application/pdf"],
-  [[80, 75, 3, 4], "application/zip"],
-  [[31, 139], "application/gzip"]
-];
-function sniffMime(head) {
-  const hit = SIGNATURES.find(([sig]) => sig.every((byte, i) => head[i] === byte));
-  if (hit) return hit[1];
-  const isWebp = [..."RIFF"].every((c, i) => head[i] === c.charCodeAt(0)) && [..."WEBP"].every((c, i) => head[8 + i] === c.charCodeAt(0));
-  return isWebp ? "image/webp" : null;
-}
-function looksLikeText(head) {
-  if (head.includes(0)) return false;
-  for (let cut = 0; cut < 4 && cut <= head.length; cut++) {
-    try {
-      new TextDecoder("utf-8", { fatal: true }).decode(head.subarray(0, head.length - cut));
-      return true;
-    } catch {
-      continue;
-    }
-  }
-  return false;
-}
-async function* iterate(source) {
-  if (Symbol.asyncIterator in source) {
-    yield* source;
-    return;
-  }
-  const reader = source.getReader();
-  try {
-    for (; ; ) {
-      const { done, value } = await reader.read();
-      if (done) return;
-      yield value;
-    }
-  } finally {
-    reader.releaseLock();
-  }
-}
-async function upload(drive, ctx, path, source, opts = {}) {
-  const max = opts.maxBytes ?? DEFAULT_MAX_BYTES;
-  const parts = [];
-  let size = 0;
-  for await (const chunk of iterate(source)) {
-    size += chunk.byteLength;
-    if (size > max) throw new DriveError("TOO_LARGE", `upload is over the limit of ${max} bytes`);
-    parts.push(chunk);
-  }
-  const data = new Uint8Array(size);
-  for (let at = 0, i = 0; i < parts.length; at += parts[i].byteLength, i++) data.set(parts[i], at);
-  const head = data.subarray(0, 512);
-  const mime = sniffMime(head) ?? (opts.mime !== void 0 ? safeMime(opts.mime) : looksLikeText(head) ? "text/plain" : "application/octet-stream");
-  return drive.putFile(ctx, path, data, { mime, parents: opts.parents, onConflict: opts.onConflict });
-}
-
-// src/zip.ts
-var CRC_TABLE = Array.from({ length: 256 }, (_, n) => {
-  let c = n;
-  for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
-  return c >>> 0;
-});
-function crc32(data) {
-  let crc = 4294967295;
-  for (const byte of data) crc = CRC_TABLE[(crc ^ byte) & 255] ^ crc >>> 8;
-  return (crc ^ 4294967295) >>> 0;
-}
-function safeEntryName(name) {
-  if (name === "" || /[\\\u0000]/.test(name) || name.startsWith("/") || /^[a-zA-Z]:/.test(name)) return false;
-  return name.split("/").every((part) => part !== "" && part !== "." && part !== "..");
-}
-function writeZip(entries, at) {
-  for (const { name } of entries) if (!safeEntryName(name)) throw new Error(`zip: unsafe entry name ${JSON.stringify(name)}`);
-  const d = new Date(at);
-  const time = d.getUTCHours() << 11 | d.getUTCMinutes() << 5 | d.getUTCSeconds() >> 1;
-  const date = Math.max(d.getUTCFullYear(), 1980) - 1980 << 9 | d.getUTCMonth() + 1 << 5 | d.getUTCDate();
-  const parts = [];
-  const central = [];
-  let offset = 0;
-  const u16 = (v, o, n) => v.setUint16(o, n, true);
-  const u32 = (v, o, n) => v.setUint32(o, n, true);
-  for (const entry of entries) {
-    const name = new TextEncoder().encode(entry.name);
-    const crc = crc32(entry.data);
-    if (entry.data.byteLength >= 4294967295 || offset >= 4294967295 || entries.length >= 65535) throw new Error("zip: export is too large for a plain zip");
-    const local = new DataView(new ArrayBuffer(30));
-    u32(local, 0, 67324752);
-    u16(local, 4, 20);
-    u16(local, 6, 2048);
-    u16(local, 8, 0);
-    u16(local, 10, time);
-    u16(local, 12, date);
-    u32(local, 14, crc);
-    u32(local, 18, entry.data.byteLength);
-    u32(local, 22, entry.data.byteLength);
-    u16(local, 26, name.length);
-    u16(local, 28, 0);
-    const head = new DataView(new ArrayBuffer(46));
-    u32(head, 0, 33639248);
-    u16(head, 4, 20);
-    u16(head, 6, 20);
-    u16(head, 8, 2048);
-    u16(head, 10, 0);
-    u16(head, 12, time);
-    u16(head, 14, date);
-    u32(head, 16, crc);
-    u32(head, 20, entry.data.byteLength);
-    u32(head, 24, entry.data.byteLength);
-    u16(head, 28, name.length);
-    u32(head, 42, offset);
-    parts.push(new Uint8Array(local.buffer), name, entry.data);
-    central.push(new Uint8Array(head.buffer), name);
-    offset += 30 + name.length + entry.data.byteLength;
-  }
-  const size = central.reduce((n, p) => n + p.byteLength, 0);
-  const end = new DataView(new ArrayBuffer(22));
-  u32(end, 0, 101010256);
-  u16(end, 8, entries.length);
-  u16(end, 10, entries.length);
-  u32(end, 12, size);
-  u32(end, 16, offset);
-  const all = [...parts, ...central, new Uint8Array(end.buffer)];
-  const out = new Uint8Array(all.reduce((n, p) => n + p.byteLength, 0));
-  let at2 = 0;
-  for (const p of all) {
-    out.set(p, at2);
-    at2 += p.byteLength;
-  }
-  return out;
-}
-function readZip(bytes) {
-  const v = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-  let end = bytes.byteLength - 22;
-  while (end >= 0 && v.getUint32(end, true) !== 101010256) end--;
-  if (end < 0) throw new Error("zip: no end signature");
-  const count = v.getUint16(end + 10, true);
-  const out = /* @__PURE__ */ new Map();
-  for (let i = 0, at = v.getUint32(end + 16, true); i < count; i++) {
-    if (v.getUint32(at, true) !== 33639248) throw new Error("zip: bad central signature");
-    if (v.getUint16(at + 10, true) !== 0) throw new Error("zip: compressed entries are not supported");
-    const crc = v.getUint32(at + 16, true);
-    const size = v.getUint32(at + 24, true);
-    const nameLen = v.getUint16(at + 28, true);
-    const local = v.getUint32(at + 42, true);
-    const name = new TextDecoder().decode(bytes.subarray(at + 46, at + 46 + nameLen));
-    if (v.getUint32(local, true) !== 67324752) throw new Error("zip: bad local signature");
-    const start = local + 30 + v.getUint16(local + 26, true) + v.getUint16(local + 28, true);
-    const data = bytes.slice(start, start + size);
-    if (crc32(data) !== crc) throw new Error(`zip: crc mismatch in ${name}`);
-    out.set(name, data);
-    at += 46 + nameLen + v.getUint16(at + 30, true) + v.getUint16(at + 32, true);
-  }
-  return out;
-}
-
-// src/export.ts
-async function buildExport(drive, ctx, now = Date.now) {
-  const entries = [];
-  const items = (await drive.exportData(ctx)).map(({ node, path, data, missing }) => {
-    const file = data ? `files/${node.id}` : null;
-    if (data && file) entries.push({ name: file, data });
-    return {
-      id: node.id,
-      owner: node.owner,
-      path,
-      parentId: node.parentId,
-      kind: node.kind,
-      name: node.name,
-      size: node.size,
-      mime: node.mime,
-      hash: node.hash,
-      ref: node.ref,
-      createdAt: node.createdAt,
-      updatedAt: node.updatedAt,
-      createdBy: node.createdBy,
-      updatedBy: node.updatedBy,
-      trashed: node.trashed,
-      trashedAt: node.trashedAt,
-      file,
-      ...missing ? { missing: true } : {}
-    };
-  });
-  const person = await drive.exportPerson(ctx);
-  const manifest = { format: "agentic-drive-export", version: 2, exportedAt: now(), owner: ctx.owner, subject: person.subject, partial: person.partial, items, authored: person.authored, agents: person.agents, shares: person.shares, audit: person.audit };
-  return writeZip([{ name: "manifest.json", data: new TextEncoder().encode(JSON.stringify(manifest, null, 2)) }, ...entries], now());
+  const reads = /* @__PURE__ */ new Set(["exportData", "exportPerson"]);
+  return Object.fromEntries(Object.entries(api).map(([name, call]) => [name, open.has(name) ? call : guarded(call, !reads.has(name))]));
 }
 
 // src/auth.ts
@@ -1398,7 +1334,7 @@ function backfillResources(store, options = {}) {
 import { createHash } from "crypto";
 import { existsSync } from "fs";
 import { join } from "path";
-import { createSharing, isMachineMade, isScope, issueCredential, revokeCredential } from "agentic-identity";
+import { createSharing, isMachineMade as isMachineMade2, isScope, issueCredential, revokeCredential } from "agentic-identity";
 import { createFileBlobs, createFileStore } from "agentic-identity/file";
 function openLocal(dir, opts = {}) {
   if (!opts.beforeImport && existsSync(join(dir, "db", "store.jsonl")) && !existsSync(join(dir, "store.json"))) {
@@ -1462,8 +1398,8 @@ async function revokeKey(store, token) {
 }
 function publicNode(node, path) {
   const { nameKey: _nameKey, blobKey: _blobKey, purging: _purging, ...rest } = node;
-  const shown = { ...rest, machineMade: isMachineMade(node.createdBy.kind) };
-  return path === void 0 ? shown : { path, ...shown };
+  const shown2 = { ...rest, machineMade: isMachineMade2(node.createdBy.kind) };
+  return path === void 0 ? shown2 : { path, ...shown2 };
 }
 
 export {
@@ -1477,12 +1413,6 @@ export {
   subjectKindOf,
   parseSubject,
   createDrive,
-  DEFAULT_MAX_BYTES,
-  sniffMime,
-  upload,
-  writeZip,
-  readZip,
-  buildExport,
   authenticate,
   inviteIdentity,
   backfillAuthorIds,

package/dist/chunk-ECVUDAHL.js

@@ -0,0 +1,49 @@
+import {
+  DriveError,
+  publicNode
+} from "./chunk-DB4F5EWD.js";
+
+// src/account.ts
+var plain = (value) => JSON.parse(JSON.stringify(value));
+function check(subject, deps) {
+  const { drive, ctx } = deps ?? {};
+  if (typeof drive?.exportData !== "function" || typeof drive.exportPerson !== "function" || typeof drive.erasePerson !== "function" || typeof ctx !== "object" || ctx === null) throw new TypeError("driveAccount needs deps.drive and deps.ctx");
+  const known = subject?.kind === "human" || subject?.kind === "agent";
+  if (typeof subject?.id !== "string" || subject.id.trim() === "" || !known) throw new TypeError("subject needs an id and a kind of human or agent");
+  if (ctx.owner !== subject.id || ctx.actor?.id !== subject.id || ctx.actor.kind !== subject.kind) throw new DriveError("FORBIDDEN", "context does not match the subject");
+  const p = ctx.principal;
+  if (p !== void 0 && (p?.principalId !== subject.id || p.kind !== subject.kind || p.chain?.length !== 1 || p.chain[0]?.id !== subject.id || p.chain[0]?.kind !== subject.kind)) throw new DriveError("FORBIDDEN", "context does not match the subject");
+}
+var b64 = (data) => {
+  let bin = "";
+  for (let i = 0; i < data.length; i += 32768) bin += String.fromCharCode(...data.subarray(i, i + 32768));
+  return btoa(bin);
+};
+var driveAccount = {
+  id: "drive",
+  async exportAccount(subject, deps) {
+    check(subject, deps);
+    const { drive, ctx } = deps;
+    const person = await drive.exportPerson(ctx);
+    if (person.partial && subject.kind === "human") throw new DriveError("FORBIDDEN", "the person's export is partial");
+    const items = (await drive.exportData(ctx)).map(({ node, path, data, missing }) => ({ ...publicNode(node, path), data: data ? b64(data) : null, ...missing ? { missing: true } : {} }));
+    return {
+      items: plain(items),
+      authored: plain(person.authored),
+      agents: plain(person.agents),
+      grants: plain(person.shares.held),
+      invites: plain(person.shares.invitesCreated),
+      audit: plain(person.audit),
+      activity: plain(person.activity)
+    };
+  },
+  async eraseAccount(subject, deps) {
+    check(subject, deps);
+    const { removed, grants, invites, anonymized } = await deps.drive.erasePerson(deps.ctx);
+    return { items: removed, grants, invites, anonymized };
+  }
+};
+
+export {
+  driveAccount
+};