## Sharing

### Share file with user
`POST /files/:fileId/share`
Body: `{ targetEmail, canRead?: true, canWrite?: false, canDelete?: false }`
Target user must exist on EasyBits.
SDK: `eb.shareFile({ fileId, targetEmail, canRead?, canWrite?, canDelete? })`

### Generate share token (temporary public URL)
`POST /files/:fileId/share-token`
Body: `{ expiresIn?: seconds }` (default 3600, min 60, max 604800 = 7 days)
Returns: `{ url, token }` — the URL is a temporary public link to the private file.
SDK: `eb.generateShareToken(fileId, expiresIn?)`
MCP: `generate_share_token({ fileId, expiresIn? })`

### List share tokens
`GET /share-tokens?fileId=&limit=&cursor=`
Returns: `{ items: ShareToken[] }` with `expired` boolean.
SDK: `eb.listShareTokens({ fileId?, limit?, cursor? })`

### Revoke share token
`DELETE /share-tokens/:tokenId`
Deletes the token, invalidating its URL.
SDK: `eb.revokeShareToken(tokenId)`
MCP: `revoke_share_token({ tokenId })`

### List permissions
`GET /files/:fileId/permissions`
Returns: `{ items: Permission[] }`
SDK: `eb.listPermissions(fileId)`

### Revoke permission
`DELETE /permissions/:permissionId`
Removes a sharing permission. You must own the file.
SDK: `eb.revokePermission(permissionId)`
MCP: `revoke_permission({ permissionId })`