@book.dev/sdk 1.60.0 → 1.64.0

package/dist/index.js

@@ -1,19 +1,23 @@
-export { emptyPageSnapshot } from './types';
+export { emptyPageSnapshot, PAGE_VISIBILITIES } from './types';
 export { API } from './routes';
 export { HttpDataClient } from './client';
-export { ForwardingClient, TunnelClient, MemoryKeyStore, mintSiteKeypair, signWithSiteKey, } from './forwarding';
+export { ForwardingClient, TunnelClient, MemoryKeyStore, mintSiteKeypair, signWithSiteKey, verifyWithSiteKey, FORWARDED_HEADER, signRosterAssertion, verifyRosterAssertion, ROSTER_ASSERTION_VERSION, ROSTER_ASSERTION_SKEW_MS, } from './forwarding';
 export { TITLE_PROPERTY_ID, SELECT_COLORS, NO_VALUE_GROUP, STATUS_GROUPS, RELATIVE_DATE_OPS, projectExports, rowValue, matchesFilter, rowMatchesCondition, applyView, viewFilterRoot, isFilterGroup, shortId, defaultDatabaseSchema, defaultView, defaultStatusOptions, removeProperty, formatNumber, formatUniqueId, numberProgress, groupRows, groupRowsBy, groupRowsByParent, PARENT_GROUP_ID, NO_PARENT_GROUP, aggregateRows, aggregateMatrix, CHART_TOTAL_SERIES, summarizeColumn, dateStart, dateEnd, parseDay, rowDateSpan, rowLocation, asLocation, dependencyGraph, syncInverseUpdates, relationSides, buildRowTree, flattenRowTree, isImageUrl, firstImageUrl, coverImageUrl, } from './database';
 export { evaluateFormula, formulaReferences, FormulaError, } from './formula';
 export { OWNER_PROPERTY_ID, VERIFICATION_PROPERTY_ID, BACKLINKS_PROPERTY_ID, THEME_PROPERTY_ID, COVER_PROPERTY_ID, FONTS_PROPERTY_ID, ICON_PROPERTY_ID, FULLWIDTH_PROPERTY_ID, SYSTEM_PAGE_PROPERTIES, isVerified, verificationExpired, isVerificationActive, makeVerification, extractMentionIds, propertiesReferencePage, } from './pageProperties';
-export { getServerUrlOverride, setServerUrlOverride, getServerTokenOverride, setServerTokenOverride, isMixedContentBlocked } from './connection';
+export { getServerUrlOverride, setServerUrlOverride, getServerTokenOverride, setServerTokenOverride, getIdentityCredential, setIdentityToken, setGuestName, getForwardingAudience, setForwardingAudience, isMixedContentBlocked } from './connection';
 export { AccountClient, AccountError, DEFAULT_ACCOUNT_URL, getAccountUrlOverride, setAccountUrlOverride, resolveAccountUrl, } from './account';
+export { guestPrincipal, localPrincipal, principalId, mintIdentityKeypair, signIdentity, decodeIdentity, verifyIdentity, principalFromClaims, unverifiedPrincipalFromClaims, } from './identity';
+export { DEFAULT_INSTANCE_CONFIG, } from './provenance';
+export { authorize, isEmailAuthoritative, } from './authorize';
 export { snapshotText, paragraphBlocks, textSnapshot, appendTextToSnapshot, appendBlocksToSnapshot } from './content';
 export { snapshotBlocks, contentHash, computeBlockMtimes, stampSnapshotMtimes, latestBlockMtime, } from './mtime';
+export { computeBlockAuthors, stampSnapshotAuthors, latestSnapshotAuthor } from './authors';
 export { pageToBookHtml, bookHtmlToPage, readBookHtmlMeta, slugify, } from './bookfile';
 export { spaceToBookFiles, parseBookFolder, SPACE_BUNDLE_FILE, } from './bookFolder';
 export { canonicalDigest, generateRegistryKeys, signPlugin, verifyPlugin, validateManifest, OPENBOOK_REGISTRY, } from './plugins';
 export { buildSampleDocument, seedSampleDocument, SAMPLE_DOCUMENT_NAME } from './sampleDocument';
 export { PAGE_TEMPLATES, instantiateTemplate } from './templates';
-export { BACKUP_VERSION, remapBundle, } from './backup';
-export { providerSettings } from './ai';
+export { BACKUP_VERSION, BACKUP_CADENCES, BACKUP_CADENCE_MS, DEFAULT_BACKUP_CONFIG, remapBundle, } from './backup';
+export { providerSettings, isPaidProvider } from './ai';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,iBAAiB,EAAC,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAC,GAAG,EAAgB,MAAM,UAAU,CAAC;AAE5C,OAAO,EAAC,cAAc,EAAC,MAAM,UAAU,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,GAKhB,MAAM,cAAc,CAAC;AAgDtB,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,QAAQ,EACR,aAAa,EACb,mBAAmB,EACnB,SAAS,EACT,cAAc,EACd,aAAa,EACb,OAAO,EACP,qBAAqB,EACrB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,cAAc,EACd,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,OAAO,EACP,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,YAAY,GAGb,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,GAExB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,qBAAqB,EAAC,MAAM,cAAc,CAAC;AAC/I,OAAO,EACL,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,GAElB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAC,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAmB,MAAM,WAAW,CAAC;AACtI,OAAO,EACL,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,OAAO,GAER,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAGlB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAMlB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAC,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAC,MAAM,kBAAkB,CAAC;AAa/F,OAAO,EAAC,cAAc,EAAE,mBAAmB,EAAoB,MAAM,aAAa,CAAC;AACnF,OAAO,EACL,cAAc,EACd,WAAW,GAKZ,MAAM,UAAU,CAAC;AAkBlB,OAAO,EAAC,gBAAgB,EAAC,MAAM,MAAM,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAC,iBAAiB,EAAE,iBAAiB,EAAC,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAC,GAAG,EAAoC,MAAM,UAAU,CAAC;AAEhE,OAAO,EAAC,cAAc,EAAC,MAAM,UAAU,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,GAQzB,MAAM,cAAc,CAAC;AAgDtB,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,QAAQ,EACR,aAAa,EACb,mBAAmB,EACnB,SAAS,EACT,cAAc,EACd,aAAa,EACb,OAAO,EACP,qBAAqB,EACrB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,cAAc,EACd,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,OAAO,EACP,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,YAAY,GAGb,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,GAExB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,YAAY,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAAC,MAAM,cAAc,CAAC;AACpP,OAAO,EACL,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,GAElB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,6BAA6B,GAY9B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,GASxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,SAAS,EACT,oBAAoB,GAOrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAC,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAmB,MAAM,WAAW,CAAC;AACtI,OAAO,EACL,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,oBAAoB,EAAC,MAAM,WAAW,CAAC;AAC1F,OAAO,EACL,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,OAAO,GAER,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAGlB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAMlB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAC,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAC,MAAM,kBAAkB,CAAC;AAc/F,OAAO,EAAC,cAAc,EAAE,mBAAmB,EAAoB,MAAM,aAAa,CAAC;AACnF,OAAO,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,WAAW,GASZ,MAAM,UAAU,CAAC;AAkBlB,OAAO,EAAC,gBAAgB,EAAE,cAAc,EAAC,MAAM,MAAM,CAAC"}

package/dist/provenance.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Multi-user instance policy + change provenance (OB-165). The contract the
+ * server and clients share for: the guest-access gate, the set of trusted
+ * identity issuers, and the durable per-change edit log.
+ *
+ * Design: `docs/multi-user-and-backups-2026-06.md`.
+ */
+import type { Jwks, Principal, VerifiedVia } from './identity';
+import type { MemberRole, PageVisibility } from './types';
+/** What an unauthenticated (guest) caller may do on this instance. */
+export type GuestAccess = 
+/** Guests are rejected entirely (sign-in required). */
+'off'
+/** Guests may read, but not write. */
+ | 'read'
+/** Guests may read and write (the default — same as a no-login workspace today). */
+ | 'write';
+/** An identity issuer this instance trusts (issuer-rooted federation). */
+export interface TrustedIssuerConfig {
+    /** The `iss` claim this config authorizes. */
+    issuer: string;
+    /** Where to (re)fetch the issuer's JWKS for online refresh. */
+    jwksUrl?: string;
+    /** Inline / cached JWKS — makes verification offline-capable (and is how the
+     *  dev issuer ships its key). */
+    jwks?: Jwks;
+}
+/** The instance's multi-user policy, persisted in the `settings` table. */
+export interface InstanceConfig {
+    guestAccess: GuestAccess;
+    /** The principal subject that administers this instance, once claimed. */
+    ownerSubject?: string;
+    trustedIssuers: TrustedIssuerConfig[];
+    /**
+     * This server's own audience identifier (OB-177). When set, an identity token
+     * scoped to a *different* audience is rejected, and clients should request a
+     * token bound to this value. Leave unset for the single-server model.
+     */
+    audience?: string;
+    /** Require every identity token to be audience-bound to {@link audience}
+     *  (reject unscoped tokens). Multi-server hardening. */
+    requireAudience?: boolean;
+    /**
+     * Default audience scope a page's `visibility='inherit'` resolves to at the root
+     * (OB-182 §2.4, Fork 1). Set to `'members'` (private) when the instance is
+     * claimed; an unclaimed instance never reaches the access path. Never `'inherit'`.
+     */
+    defaultVisibility?: Exclude<PageVisibility, 'inherit'>;
+    /**
+     * The ONE issuer whose `email` claim is trusted for persona / email-ACL matching
+     * (OB-182 §2.4, B1). Subject-based grants work for any {@link trustedIssuers}
+     * entry, but only a token from `emailAuthority` can satisfy an email persona or
+     * an email ACL. Must be one of {@link trustedIssuers} or every email grant
+     * silently (and safely) stops matching. Defaults to account.book.pub.
+     */
+    emailAuthority?: string;
+    /**
+     * When this instance is a MANAGED workspace (OB-199), the account workspace it
+     * is bound to. Set, the periodic roster sync projects that workspace's roster
+     * (admins / viewers + the workspace owner) into the local `members` table so
+     * `members`-scope + admin/viewer roles resolve for direct (non-edge) access too.
+     * Unset ⇒ a standalone instance; the sync is inert. Additive — absence is the
+     * pre-OB-199 single-instance behaviour. Holds non-secret COORDINATES only; the
+     * credential the instance presents to read the roster is supplied out-of-band
+     * (never persisted in policy). See {@link WorkspaceBinding}.
+     */
+    workspaceBinding?: WorkspaceBinding;
+}
+/**
+ * Binds a managed instance to an account workspace (OB-199). Non-secret
+ * coordinates only — the roster-read credential is injected at runtime, never
+ * stored here. Set by the owner (via the instance-policy route) or learned during
+ * the forwarding/claim flow.
+ */
+export interface WorkspaceBinding {
+    /** The account workspace id this instance serves. */
+    workspaceId: string;
+    /**
+     * Base URL of the account that owns the workspace (where the roster lives).
+     * Defaults to the instance `emailAuthority` (account.book.pub) when omitted.
+     */
+    accountBaseUrl?: string;
+}
+/**
+ * One entry of the account workspace roster (OB-197 contract), as consumed by the
+ * OB-199 sync. Identifies a member by a bound `subject` (`iss#sub`) and/or a
+ * persona `email`, with the workspace role. The account is the producer; the
+ * instance only reads this shape (it never writes the account).
+ */
+export interface WorkspaceRosterEntry {
+    /** Bound `iss#sub` of the member, when the account exposes it. */
+    subject?: string;
+    /** Persona email (any case; lowercased on sync). */
+    email?: string;
+    role: MemberRole;
+}
+/**
+ * The account workspace roster returned by `GET /api/workspaces/:id/members`
+ * (OB-197), as consumed by the OB-199 sync. `ownerSubject` is the workspace
+ * owner's bound subject (`iss#sub`) — admitted as an admin even when it differs
+ * from the instance's own site owner (OB-198 F2), so the workspace owner is never
+ * locked out of a workspace they own.
+ */
+export interface WorkspaceRoster {
+    workspaceId: string;
+    /** Bound `iss#sub` of the workspace owner (admitted as admin). */
+    ownerSubject?: string;
+    members: WorkspaceRosterEntry[];
+}
+export declare const DEFAULT_INSTANCE_CONFIG: InstanceConfig;
+/**
+ * Public view of the instance policy returned by `GET /api/instance` — issuer
+ * URLs only (never private JWKS material), plus the principal resolved for the
+ * *current* request, so a client can render "you are signed in as …" / "guest".
+ */
+export interface InstanceInfo {
+    guestAccess: GuestAccess;
+    ownerSubject: string | null;
+    trustedIssuers: string[];
+    /** This server's audience identifier, so a client can request an `aud`-scoped
+     *  identity token (OB-177). `null` for the single-server (unscoped) model. */
+    audience: string | null;
+    /** Whether this instance *requires* every identity token to be bound to
+     *  {@link audience} (OB-202). Lets a client short-circuit the audience-bind on
+     *  relaunch: when the server already persisted `audience==host && requireAudience`
+     *  it only needs to ensure its own token is scoped, never to relax + re-assert.
+     *  Optional: absent (e.g. a pre-OB-202 server / a test fixture) is treated as `false`. */
+    requireAudience?: boolean;
+    /** Who the server resolved you to be on this request. */
+    you: Principal;
+    /**
+     * Your active-persona roster role on this request (OB-182 §1.1), or `null` if
+     * you aren't an active member. Lets a client gate manager-only UI (the per-page
+     * Share dialog) without a per-page probe: `admin` (and the owner / loopback,
+     * derivable from {@link you} + {@link ownerSubject}) manage sharing.
+     * Optional: absent (a pre-OB-203 server / a test fixture) is treated as `null`.
+     */
+    youRole?: MemberRole | null;
+}
+/** One recorded change — a row of the append-only edit log. */
+export interface StoredEdit {
+    id: string;
+    pageId: string | null;
+    authorSubject: string;
+    authorIssuer: string;
+    authorName: string;
+    verifiedVia: VerifiedVia;
+    /** What kind of change: `page.save`, `page.create`, `page.delete`, `row.update`, … */
+    kind: string;
+    /** The signed credential that authorized it (users only). */
+    assertionKid: string | null;
+    assertionJti: string | null;
+    summary: string;
+    createdAt: string;
+}

package/dist/provenance.js

@@ -0,0 +1,23 @@
+/**
+ * Multi-user instance policy + change provenance (OB-165). The contract the
+ * server and clients share for: the guest-access gate, the set of trusted
+ * identity issuers, and the durable per-change edit log.
+ *
+ * Design: `docs/multi-user-and-backups-2026-06.md`.
+ */
+import { DEFAULT_ACCOUNT_URL } from './account';
+export const DEFAULT_INSTANCE_CONFIG = {
+    guestAccess: 'write',
+    // Trust account.book.pub out of the box — it's the OpenBook identity authority
+    // (the shared root that makes identities federate across instances). Only ever
+    // consulted when an `iss=account.book.pub` assertion is actually presented; the
+    // JWKS is fetched + cached lazily. Override or extend in instance settings.
+    trustedIssuers: [{ issuer: DEFAULT_ACCOUNT_URL, jwksUrl: `${DEFAULT_ACCOUNT_URL}/api/identity/jwks` }],
+    // `inherit` at the root resolves here. Private-by-default once claimed (Fork 1);
+    // an unclaimed instance short-circuits before this is ever consulted (rule 0).
+    defaultVisibility: 'members',
+    // account.book.pub is the default email-authority — the one issuer whose `email`
+    // claim drives persona / email-ACL matching (B1). It is already trusted above.
+    emailAuthority: DEFAULT_ACCOUNT_URL,
+};
+//# sourceMappingURL=provenance.js.map

package/dist/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../src/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAC,mBAAmB,EAAC,MAAM,WAAW,CAAC;AA8G9C,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,WAAW,EAAE,OAAO;IACpB,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,4EAA4E;IAC5E,cAAc,EAAE,CAAC,EAAC,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,mBAAmB,oBAAoB,EAAC,CAAC;IACpG,iFAAiF;IACjF,+EAA+E;IAC/E,iBAAiB,EAAE,SAAS;IAC5B,iFAAiF;IACjF,+EAA+E;IAC/E,cAAc,EAAE,mBAAmB;CACpC,CAAC"}

package/dist/routes.d.ts

@@ -82,7 +82,60 @@ export declare const API: {
     readonly comments: (pageId: string) => string;
     /** A single comment: `DELETE`. */
     readonly comment: (id: string) => string;
+    /**
+     * On-demand heavy database compaction (`POST`): VACUUM FULL to physically
+     * reclaim heap bloat. Embedded (PGlite) only — a server backed by external
+     * Postgres answers 409. See OB-164.
+     */
+    readonly compact: "/api/maintenance/compact";
+    /**
+     * Instance multi-user policy: `GET` returns {@link InstanceInfo} (guest
+     * policy, trusted issuer URLs, and the principal resolved for *this* request);
+     * `PUT` updates the policy (owner only).
+     */
+    readonly instance: "/api/instance";
+    /** A page's change provenance (the edit log), newest first: `GET`. */
+    readonly pageEdits: (id: string) => string;
+    /**
+     * The member roster: `GET` (list) / `POST` (invite by email or handle/subject).
+     * Instance-writer (owner/admin/loopback) only — managing or even seeing the
+     * roster is a privileged action.
+     */
+    readonly members: "/api/members";
+    /** A single roster row: `PATCH` (role/status) / `DELETE` (revoke). */
+    readonly member: (id: string) => string;
+    /**
+     * A page's per-page ACL grants: `GET` (list) / `POST` (share to an email or
+     * handle/subject) / `DELETE` (`?subject=` | `?email=` to revoke). Gated on
+     * write of the page itself (you manage sharing of pages you can write).
+     */
+    readonly pageAcl: (id: string) => string;
+    /**
+     * A page's audience-scope visibility (OB-182 §1.1): `GET` returns
+     * `{visibility}` (read-gated); `PUT` `{visibility}` sets it (write-gated — same
+     * "you manage sharing of pages you can write" rule as the ACL).
+     */
+    readonly pageVisibility: (id: string) => string;
+    /**
+     * On-demand roster sync of a managed instance: `GET` reports the binding +
+     * last-sync status; `POST` pulls the bound workspace roster from the account and
+     * reconciles it into the local roster (managed rows only). Instance-writer
+     * (owner/admin/loopback) only. The same sync also runs periodically.
+     */
+    readonly workspaceSync: "/api/workspace/sync";
+    /** Scheduled-backup policy: `GET` returns {@link BackupStatus}; `PUT` updates
+     *  the policy and returns the new status. */
+    readonly backups: "/api/backups";
+    /** Run a backup immediately: `POST` `{cadence?}` → the written file's name. */
+    readonly backupRun: "/api/backups/run";
 };
+/** Result of a {@link API.compact} run: the database's on-disk size before/after,
+ *  in bytes, and how much was reclaimed. */
+export interface CompactResult {
+    before: number;
+    after: number;
+    reclaimed: number;
+}
 /** Error body shape returned by the API for non-2xx responses. */
 export interface ApiError {
     error: string;

package/dist/routes.js

@@ -85,5 +85,55 @@ export const API = {
     comments: (pageId) => `/api/pages/${encodeURIComponent(pageId)}/comments`,
     /** A single comment: `DELETE`. */
     comment: (id) => `/api/comments/${encodeURIComponent(id)}`,
+    /**
+     * On-demand heavy database compaction (`POST`): VACUUM FULL to physically
+     * reclaim heap bloat. Embedded (PGlite) only — a server backed by external
+     * Postgres answers 409. See OB-164.
+     */
+    compact: '/api/maintenance/compact',
+    // ── Multi-user (identity, policy, provenance) — OB-165 ───────────────────────
+    /**
+     * Instance multi-user policy: `GET` returns {@link InstanceInfo} (guest
+     * policy, trusted issuer URLs, and the principal resolved for *this* request);
+     * `PUT` updates the policy (owner only).
+     */
+    instance: '/api/instance',
+    /** A page's change provenance (the edit log), newest first: `GET`. */
+    pageEdits: (id) => `/api/pages/${encodeURIComponent(id)}/edits`,
+    // ── Sharing: roster invites + per-page ACL — OB-191 ──────────────────────────
+    /**
+     * The member roster: `GET` (list) / `POST` (invite by email or handle/subject).
+     * Instance-writer (owner/admin/loopback) only — managing or even seeing the
+     * roster is a privileged action.
+     */
+    members: '/api/members',
+    /** A single roster row: `PATCH` (role/status) / `DELETE` (revoke). */
+    member: (id) => `/api/members/${encodeURIComponent(id)}`,
+    /**
+     * A page's per-page ACL grants: `GET` (list) / `POST` (share to an email or
+     * handle/subject) / `DELETE` (`?subject=` | `?email=` to revoke). Gated on
+     * write of the page itself (you manage sharing of pages you can write).
+     */
+    pageAcl: (id) => `/api/pages/${encodeURIComponent(id)}/acl`,
+    /**
+     * A page's audience-scope visibility (OB-182 §1.1): `GET` returns
+     * `{visibility}` (read-gated); `PUT` `{visibility}` sets it (write-gated — same
+     * "you manage sharing of pages you can write" rule as the ACL).
+     */
+    pageVisibility: (id) => `/api/pages/${encodeURIComponent(id)}/visibility`,
+    // ── Managed workspace: instance ↔ workspace roster sync — OB-199 ─────────────
+    /**
+     * On-demand roster sync of a managed instance: `GET` reports the binding +
+     * last-sync status; `POST` pulls the bound workspace roster from the account and
+     * reconciles it into the local roster (managed rows only). Instance-writer
+     * (owner/admin/loopback) only. The same sync also runs periodically.
+     */
+    workspaceSync: '/api/workspace/sync',
+    // ── Scheduled backups — OB-166 ───────────────────────────────────────────────
+    /** Scheduled-backup policy: `GET` returns {@link BackupStatus}; `PUT` updates
+     *  the policy and returns the new status. */
+    backups: '/api/backups',
+    /** Run a backup immediately: `POST` `{cadence?}` → the written file's name. */
+    backupRun: '/api/backups/run',
 };
 //# sourceMappingURL=routes.js.map

package/dist/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,MAAM,EAAE,SAAS;IACjB,kDAAkD;IAClD,KAAK,EAAE,YAAY;IACnB,oFAAoF;IACpF,IAAI,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,EAAE;IACpE,wFAAwF;IACxF,cAAc,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,aAAa;IACzF,+DAA+D;IAC/D,aAAa,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,YAAY;IACvF,wEAAwE;IACxE,WAAW,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,UAAU;IACnF,qFAAqF;IACrF,QAAQ,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,OAAO;IAC7E,kFAAkF;IAClF,WAAW,EAAE,aAAa;IAC1B,4EAA4E;IAC5E,WAAW,EAAE,aAAa;IAC1B,gFAAgF;IAChF,KAAK,EAAE,YAAY;IACnB,8EAA8E;IAC9E,SAAS,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,EAAE;IACzE,iEAAiE;IACjE,MAAM,EAAE,aAAa;IACrB,6DAA6D;IAC7D,UAAU,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,SAAS;IACjF;;;;;OAKG;IACH,IAAI,EAAE,WAAW;IAEjB,8EAA8E;IAC9E,8DAA8D;IAC9D,SAAS,EAAE,gBAAgB;IAC3B,mEAAmE;IACnE,QAAQ,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,EAAE;IAC5E,4EAA4E;IAC5E,YAAY,EAAE,CAAC,MAAc,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,MAAM,CAAC,WAAW;IAC7F,oEAAoE;IACpE,YAAY,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,OAAO;IACrF,sDAAsD;IACtD,iBAAiB,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,aAAa;IAChG,mGAAmG;IACnG,WAAW,EAAE,CAAC,EAAU,EAAE,KAAa,EAAU,EAAE,CACjD,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,SAAS,kBAAkB,CAAC,KAAK,CAAC,EAAE;IAC9E,gFAAgF;IAChF,cAAc,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,SAAS;IAEzF,8EAA8E;IAC9E,kFAAkF;IAClF,QAAQ,EAAE,gBAAgB;IAC1B,8EAA8E;IAC9E,QAAQ,EAAE,gBAAgB;IAC1B,+CAA+C;IAC/C,OAAO,EAAE,eAAe;IACxB,0EAA0E;IAC1E,QAAQ,EAAE,gBAAgB;IAC1B,yEAAyE;IACzE,UAAU,EAAE,kBAAkB;IAC9B,qEAAqE;IACrE,OAAO,EAAE,eAAe;IACxB,4EAA4E;IAC5E,UAAU,EAAE,kBAAkB;IAC9B,wEAAwE;IACxE,eAAe,EAAE,yBAAyB;IAC1C,sHAAsH;IACtH,SAAS,EAAE,iBAAiB;IAC5B,mFAAmF;IACnF,QAAQ,EAAE,gBAAgB;IAC1B,mCAAmC;IACnC,OAAO,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,EAAE;IACvE,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,gBAAgB,EAAE,EAAE;IAE5C,gFAAgF;IAChF,uFAAuF;IACvF,WAAW,EAAE,CAAC,MAAc,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,MAAM,CAAC,cAAc;IAC/F,2EAA2E;IAC3E,UAAU,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,EAAE,CAAC,EAAE;IAChF,mGAAmG;IACnG,QAAQ,EAAE,CAAC,MAAc,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,MAAM,CAAC,WAAW;IACzF,kCAAkC;IAClC,OAAO,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,iBAAiB,kBAAkB,CAAC,EAAE,CAAC,EAAE;CAClE,CAAC"}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,MAAM,EAAE,SAAS;IACjB,kDAAkD;IAClD,KAAK,EAAE,YAAY;IACnB,oFAAoF;IACpF,IAAI,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,EAAE;IACpE,wFAAwF;IACxF,cAAc,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,aAAa;IACzF,+DAA+D;IAC/D,aAAa,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,YAAY;IACvF,wEAAwE;IACxE,WAAW,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,UAAU;IACnF,qFAAqF;IACrF,QAAQ,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,OAAO;IAC7E,kFAAkF;IAClF,WAAW,EAAE,aAAa;IAC1B,4EAA4E;IAC5E,WAAW,EAAE,aAAa;IAC1B,gFAAgF;IAChF,KAAK,EAAE,YAAY;IACnB,8EAA8E;IAC9E,SAAS,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,EAAE;IACzE,iEAAiE;IACjE,MAAM,EAAE,aAAa;IACrB,6DAA6D;IAC7D,UAAU,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,SAAS;IACjF;;;;;OAKG;IACH,IAAI,EAAE,WAAW;IAEjB,8EAA8E;IAC9E,8DAA8D;IAC9D,SAAS,EAAE,gBAAgB;IAC3B,mEAAmE;IACnE,QAAQ,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,EAAE;IAC5E,4EAA4E;IAC5E,YAAY,EAAE,CAAC,MAAc,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,MAAM,CAAC,WAAW;IAC7F,oEAAoE;IACpE,YAAY,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,OAAO;IACrF,sDAAsD;IACtD,iBAAiB,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,aAAa;IAChG,mGAAmG;IACnG,WAAW,EAAE,CAAC,EAAU,EAAE,KAAa,EAAU,EAAE,CACjD,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,SAAS,kBAAkB,CAAC,KAAK,CAAC,EAAE;IAC9E,gFAAgF;IAChF,cAAc,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,SAAS;IAEzF,8EAA8E;IAC9E,kFAAkF;IAClF,QAAQ,EAAE,gBAAgB;IAC1B,8EAA8E;IAC9E,QAAQ,EAAE,gBAAgB;IAC1B,+CAA+C;IAC/C,OAAO,EAAE,eAAe;IACxB,0EAA0E;IAC1E,QAAQ,EAAE,gBAAgB;IAC1B,yEAAyE;IACzE,UAAU,EAAE,kBAAkB;IAC9B,qEAAqE;IACrE,OAAO,EAAE,eAAe;IACxB,4EAA4E;IAC5E,UAAU,EAAE,kBAAkB;IAC9B,wEAAwE;IACxE,eAAe,EAAE,yBAAyB;IAC1C,sHAAsH;IACtH,SAAS,EAAE,iBAAiB;IAC5B,mFAAmF;IACnF,QAAQ,EAAE,gBAAgB;IAC1B,mCAAmC;IACnC,OAAO,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,EAAE;IACvE,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,gBAAgB,EAAE,EAAE;IAE5C,gFAAgF;IAChF,uFAAuF;IACvF,WAAW,EAAE,CAAC,MAAc,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,MAAM,CAAC,cAAc;IAC/F,2EAA2E;IAC3E,UAAU,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,EAAE,CAAC,EAAE;IAChF,mGAAmG;IACnG,QAAQ,EAAE,CAAC,MAAc,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,MAAM,CAAC,WAAW;IACzF,kCAAkC;IAClC,OAAO,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,iBAAiB,kBAAkB,CAAC,EAAE,CAAC,EAAE;IAE1E;;;;OAIG;IACH,OAAO,EAAE,0BAA0B;IAEnC,gFAAgF;IAChF;;;;OAIG;IACH,QAAQ,EAAE,eAAe;IACzB,sEAAsE;IACtE,SAAS,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,QAAQ;IAE/E,gFAAgF;IAChF;;;;OAIG;IACH,OAAO,EAAE,cAAc;IACvB,sEAAsE;IACtE,MAAM,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;IACxE;;;;OAIG;IACH,OAAO,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,MAAM;IAC3E;;;;OAIG;IACH,cAAc,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,aAAa;IAEzF,gFAAgF;IAChF;;;;;OAKG;IACH,aAAa,EAAE,qBAAqB;IAEpC,gFAAgF;IAChF;iDAC6C;IAC7C,OAAO,EAAE,cAAc;IACvB,+EAA+E;IAC/E,SAAS,EAAE,kBAAkB;CACrB,CAAC"}

package/dist/suggestions.d.ts

@@ -34,8 +34,23 @@ export interface CommentRun {
         a?: string;
     };
 }
+import type { VerifiedVia } from './identity';
 /** Who authored a suggestion or comment. */
 export type SuggestionAuthorKind = 'ai' | 'human';
+/**
+ * Server-stamped author identity (OB-165) carried alongside the display
+ * `authorName`. Unlike `authorName` (a label the client supplies), these come
+ * from the request's *verified* principal, so they're the authoritative "who".
+ * Absent on rows written before multi-user, or by an unauthenticated path.
+ */
+export interface AuthoredIdentity {
+    /** The principal's stable subject (`iss#sub`, or `guest:<name>`). */
+    authorSubject?: string;
+    /** The issuer that vouched for a verified author (empty for guests). */
+    authorIssuer?: string;
+    /** How the author was established (`jws` / `guest` / `unverified` / `local`). */
+    authorVerified?: VerifiedVia;
+}
 /** The change a suggestion proposes — mirrors the agent write-tool kinds. */
 export type SuggestionKind = 'replace-text' | 'set-cell' | 'insert' | 'delete' | 'set-theme';
 /** Lifecycle of a suggestion. */
@@ -60,7 +75,7 @@ export interface SuggestionTarget {
     propertyId?: string;
 }
 /** A persisted, reviewable proposed change to a page. */
-export interface StoredSuggestion {
+export interface StoredSuggestion extends AuthoredIdentity {
     id: string;
     pageId: string;
     authorKind: SuggestionAuthorKind;
@@ -100,7 +115,7 @@ export interface SuggestionUpdate {
     status?: SuggestionStatus;
 }
 /** A threaded comment on a suggestion, or a standalone comment on a block. */
-export interface StoredComment {
+export interface StoredComment extends AuthoredIdentity {
     id: string;
     pageId: string;
     /** The suggestion this comment belongs to (a review-thread comment). */

package/dist/types.d.ts

@@ -31,6 +31,15 @@ export interface PageSnapshot {
      * written before the feature shipped (treated as "unknown — assume changed").
      */
     mtimes?: Array<[string, string]>;
+    /**
+     * `[blockId, subject]` pairs — the *verified* author (`iss#sub`) who last
+     * changed each block, a sparse map carried with the snapshot so an edit is
+     * still correctly attributed after it syncs to another instance (OB-170). The
+     * server stamps it on write from the request's verified principal; only
+     * verified identities appear (guest/local/unverified edits are not recorded
+     * here). Absent on single-user / unverified documents. See sdk `authors.ts`.
+     */
+    authors?: Array<[string, string]>;
 }
 /** An empty snapshot, for initializing a brand-new page. */
 export declare const emptyPageSnapshot: () => PageSnapshot;
@@ -96,6 +105,88 @@ export interface PageInput {
      */
     parentId?: string | null;
 }
+/**
+ * Sharing & access model (OB-188; contract docs/sharing-access-contract-spike-OB-182.md).
+ * These are the data-model types behind migration 0011 — the roster row, the
+ * per-page ACL row, and the per-page visibility scope. The *authorization* layer
+ * (`authorize()` in §1.1) is OB-189 and is intentionally NOT defined here.
+ */
+/**
+ * Per-page audience scope (OB-182 §1.1). `inherit` resolves up the **parent**
+ * chain for an ordinary page (or, for a database row, via the database host page)
+ * down to `InstanceConfig.defaultVisibility` at the root. The other four are the
+ * fixed audience scopes: `public` (anyone, incl. anonymous), `authenticated` (any
+ * signed-in jws user), `members` (active roster members), `restricted`
+ * (owner/admin/ACL only).
+ */
+export type PageVisibility = 'inherit' | 'public' | 'authenticated' | 'members' | 'restricted';
+/** Alias for {@link PageVisibility} (the OB-188 directive's shorthand name). */
+export type Visibility = PageVisibility;
+/** Every {@link PageVisibility} value, in escalating-privacy order — the source of
+ *  truth for server-side validation and the share dialog's scope picker. */
+export declare const PAGE_VISIBILITIES: readonly PageVisibility[];
+/** The two OSS roster roles (OB-182): `admin` = full access, `viewer` = locked
+ *  read-only. (Contract §1.1 names this union `Role`.) */
+export type MemberRole = 'admin' | 'viewer';
+/**
+ * Lifecycle of a roster row (OB-182 §2.1). `invited` = an email persona not yet
+ * claimed by a signed-in subject; `active` = bound + live; `suspended` = retained
+ * but grants nothing. Only `active` rows resolve to a role at request time (S3).
+ */
+export type MemberStatus = 'invited' | 'active' | 'suspended';
+/**
+ * Where a roster row came from (OB-199). `local` = a locally-issued invite (the
+ * OB-191 path); `managed` = projected from the bound account workspace's roster by
+ * the periodic sync. The two coexist: the managed sync only ever touches `managed`
+ * rows, so a local invite is never clobbered (and vice-versa).
+ */
+export type MemberSource = 'local' | 'managed';
+/** Per-page ACL grant level (OB-182 §1.1). */
+export type AclLevel = 'read' | 'write';
+/**
+ * One roster row — the data-server-native `members` table (OB-182 §2.1). A row is
+ * either an EMAIL PERSONA (`email` set, `subject` NULL until claimed on sign-in)
+ * or a SUBJECT/handle MEMBER (`subject` set, `email` NULL). One account `subject`
+ * may back several persona rows — one per verified email — each its own member
+ * with its own role. `issuer` PINS the email-authority for a persona so a federated
+ * issuer can never satisfy an `account.book.pub`-scoped grant (B1).
+ */
+export interface Member {
+    id: string;
+    /** Bound `iss#sub`; `null` until an email persona is claimed. */
+    subject: string | null;
+    /** Persona email (lowercased); `null` for a subject/handle member. */
+    email: string | null;
+    /** The pinned email-authority issuer for a persona (B1). */
+    issuer: string;
+    role: MemberRole;
+    status: MemberStatus;
+    /**
+     * Provenance of the row (OB-199): `local` for a locally-issued invite (OB-191),
+     * `managed` for a row projected from the bound workspace roster. Defaults to
+     * `local`; the managed sync only ever writes/removes `managed` rows.
+     * Optional: absent (a pre-OB-199 row / a test fixture) is treated as `local`.
+     */
+    source?: MemberSource;
+    /** The principal subject that issued the invite, if any. */
+    invitedBy: string | null;
+    createdAt: string;
+}
+/**
+ * One per-page ACL grant — a row of the `page_acl` table (OB-182 §2.3). Exactly
+ * one grantee key is set: `subject` (a grantee already bound to any trusted issuer)
+ * XOR `email` (a grantee by persona email, lowercased). An email grant MUST pin an
+ * `issuer` (the email-authority — B1).
+ */
+export interface PageAcl {
+    pageId: string;
+    subject: string | null;
+    email: string | null;
+    issuer: string | null;
+    level: AclLevel;
+    invitedBy: string | null;
+    createdAt: string;
+}
 /** Status of a desktop install's local server. */
 export interface ServerInfo {
     /** Whether the local server is currently running. */

package/dist/types.js

@@ -13,4 +13,13 @@ export const emptyPageSnapshot = () => ({
     values: [],
     names: [],
 });
+/** Every {@link PageVisibility} value, in escalating-privacy order — the source of
+ *  truth for server-side validation and the share dialog's scope picker. */
+export const PAGE_VISIBILITIES = [
+    'inherit',
+    'public',
+    'authenticated',
+    'members',
+    'restricted',
+];
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4BH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAiB,EAAE,CAAC,CAAC;IACpD,QAAQ,EAAE,EAAC,MAAM,EAAE,EAAE,EAAC;IACtB,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE;CACV,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAqCH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAiB,EAAE,CAAC,CAAC;IACpD,QAAQ,EAAE,EAAC,MAAM,EAAE,EAAE,EAAC;IACtB,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE;CACV,CAAC,CAAC;AAuFH;4EAC4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAA8B;IAC1D,SAAS;IACT,QAAQ;IACR,eAAe;IACf,SAAS;IACT,YAAY;CACb,CAAC"}

package/package.json

@@ -1,7 +1,12 @@
 {
   "name": "@book.dev/sdk",
-  "version": "1.60.0",
+  "version": "1.64.0",
   "description": "Shared OpenBook types and HTTP client used by the server, desktop, and web.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/eliotlim/OpenBook.git",
+    "directory": "packages/sdk"
+  },
   "publishConfig": {
     "access": "public"
   },