@book.dev/sdk 1.65.1 → 1.67.0

package/dist/authors.d.ts

@@ -1,4 +1,23 @@
 import type { PageSnapshot } from './types';
+/**
+ * Compute the `[blockId, subject]` authorship for `next`. Unchanged blocks keep
+ * their prior author; changed/new blocks get `authorSubject` when it is a
+ * verified identity (a non-empty subject), and are otherwise left unattributed
+ * (an anonymous/guest edit honestly clears a block's verified author rather than
+ * falsely keeping the previous one). Returns a sparse map — only blocks with a
+ * known author — or `null` when none are attributed (so the field stays absent
+ * on single-user / unverified documents).
+ */
+/**
+ * Resolve the *verified* author subject for a **changed/new** block. Returns a
+ * non-empty subject to attribute the block, or `''`/`undefined` to leave it
+ * unattributed (an anonymous/guest edit honestly clears a block's verified
+ * author). Only consulted for changed blocks; unchanged blocks keep their prior
+ * author regardless. This is the seam that lets one snapshot carry per-block
+ * attribution from *different* principals — the server-authoritative persist path
+ * (Collab T9), where one durable checkpoint merges edits from several writers.
+ */
+export type BlockAuthorResolver = (blockId: string) => string | undefined;
 /**
  * Compute the `[blockId, subject]` authorship for `next`. Unchanged blocks keep
  * their prior author; changed/new blocks get `authorSubject` when it is a
@@ -17,6 +36,18 @@ export declare function computeBlockAuthors(prev: PageSnapshot | null | undefine
  * is attributed, so it never appears on single-user/unverified snapshots.
  */
 export declare function stampSnapshotAuthors(prev: PageSnapshot | null | undefined, next: PageSnapshot, authorSubject: string): PageSnapshot;
+/**
+ * Per-block variant of {@link stampSnapshotAuthors} for the server-authoritative
+ * persist path (Collab T9). When the SERVER persists one converged snapshot that
+ * merges edits from several principals, a single `authorSubject` would misattribute
+ * every changed block to one writer. Instead each **changed** block is attributed
+ * to `authorByBlock.get(blockId)` — the *verified* subject of the principal whose
+ * ingested update last changed that block (`''`/absent ⇒ a guest/unverified change,
+ * left unattributed). Unchanged blocks keep their prior author. So attribution
+ * reflects who actually made each change, never "the server" and never a forged
+ * writer. Idempotent when the document is unchanged.
+ */
+export declare function stampSnapshotAuthorsPerBlock(prev: PageSnapshot | null | undefined, next: PageSnapshot, authorByBlock: ReadonlyMap<string, string>): PageSnapshot;
 /**
  * The verified author of a snapshot's most-recently-changed attributed block —
  * the snapshot's "last verified editor", read on the receiving instance to

package/dist/authors.js

@@ -13,39 +13,45 @@
  */
 import { snapshotBlocks } from './mtime';
 /**
- * Compute the `[blockId, subject]` authorship for `next`. Unchanged blocks keep
- * their prior author; changed/new blocks get `authorSubject` when it is a
- * verified identity (a non-empty subject), and are otherwise left unattributed
- * (an anonymous/guest edit honestly clears a block's verified author rather than
- * falsely keeping the previous one). Returns a sparse map — only blocks with a
- * known author — or `null` when none are attributed (so the field stays absent
- * on single-user / unverified documents).
+ * Compute the `[blockId, subject]` authorship for `next` against `prev`. Unchanged
+ * blocks (same content hash) keep their prior author; changed/new blocks are
+ * attributed to `resolve(blockId)` when it yields a verified (non-empty) subject,
+ * and are otherwise left unattributed. Returns a sparse map — only blocks with a
+ * known author — or `null` when none are attributed (so the field stays absent on
+ * single-user / unverified documents). The single-principal
+ * {@link computeBlockAuthors} and the per-block {@link stampSnapshotAuthorsPerBlock}
+ * are both thin resolvers over this one diff.
  */
-export function computeBlockAuthors(prev, next, authorSubject) {
-    const prevBlocks = snapshotBlocks(prev);
+function computeBlockAuthorsBy(prev, next, resolve) {
     const prevHash = new Map();
-    for (const b of prevBlocks)
+    for (const b of snapshotBlocks(prev))
         prevHash.set(b.id, b.hash);
     const prevAuthor = new Map(prev?.authors ?? []);
-    const verified = authorSubject.length > 0;
     const out = [];
     for (const b of snapshotBlocks(next)) {
         const unchanged = prevHash.get(b.id) === b.hash;
-        const author = unchanged ? prevAuthor.get(b.id) ?? '' : verified ? authorSubject : '';
+        const author = unchanged ? prevAuthor.get(b.id) ?? '' : resolve(b.id) ?? '';
         if (author)
             out.push([b.id, author]);
     }
     return out.length > 0 ? out : null;
 }
 /**
- * Return `next` with its `authors` stamped relative to `prev`. `authorSubject` is
- * the request's *verified* principal subject (`iss#sub`), or `''` for an
- * unverified/guest/local write (which carries no new attribution). Idempotent
- * when the document is unchanged. Omits the `authors` key entirely when nothing
- * is attributed, so it never appears on single-user/unverified snapshots.
+ * Compute the `[blockId, subject]` authorship for `next`. Unchanged blocks keep
+ * their prior author; changed/new blocks get `authorSubject` when it is a
+ * verified identity (a non-empty subject), and are otherwise left unattributed
+ * (an anonymous/guest edit honestly clears a block's verified author rather than
+ * falsely keeping the previous one). Returns a sparse map — only blocks with a
+ * known author — or `null` when none are attributed (so the field stays absent
+ * on single-user / unverified documents).
  */
-export function stampSnapshotAuthors(prev, next, authorSubject) {
-    const authors = computeBlockAuthors(prev, next, authorSubject);
+export function computeBlockAuthors(prev, next, authorSubject) {
+    const author = authorSubject.length > 0 ? authorSubject : '';
+    return computeBlockAuthorsBy(prev, next, () => author);
+}
+/** Set `next.authors` from a computed map, or drop the key entirely when nothing
+ *  is attributed (so it never appears on single-user/unverified snapshots). */
+function withAuthors(next, authors) {
     if (!authors) {
         // Nothing attributed: drop any stale `authors` rather than carry an empty map.
         if (next.authors === undefined)
@@ -56,6 +62,30 @@ export function stampSnapshotAuthors(prev, next, authorSubject) {
     }
     return { ...next, authors };
 }
+/**
+ * Return `next` with its `authors` stamped relative to `prev`. `authorSubject` is
+ * the request's *verified* principal subject (`iss#sub`), or `''` for an
+ * unverified/guest/local write (which carries no new attribution). Idempotent
+ * when the document is unchanged. Omits the `authors` key entirely when nothing
+ * is attributed, so it never appears on single-user/unverified snapshots.
+ */
+export function stampSnapshotAuthors(prev, next, authorSubject) {
+    return withAuthors(next, computeBlockAuthors(prev, next, authorSubject));
+}
+/**
+ * Per-block variant of {@link stampSnapshotAuthors} for the server-authoritative
+ * persist path (Collab T9). When the SERVER persists one converged snapshot that
+ * merges edits from several principals, a single `authorSubject` would misattribute
+ * every changed block to one writer. Instead each **changed** block is attributed
+ * to `authorByBlock.get(blockId)` — the *verified* subject of the principal whose
+ * ingested update last changed that block (`''`/absent ⇒ a guest/unverified change,
+ * left unattributed). Unchanged blocks keep their prior author. So attribution
+ * reflects who actually made each change, never "the server" and never a forged
+ * writer. Idempotent when the document is unchanged.
+ */
+export function stampSnapshotAuthorsPerBlock(prev, next, authorByBlock) {
+    return withAuthors(next, computeBlockAuthorsBy(prev, next, (id) => authorByBlock.get(id)));
+}
 /**
  * The verified author of a snapshot's most-recently-changed attributed block —
  * the snapshot's "last verified editor", read on the receiving instance to

package/dist/authors.js.map

@@ -1 +1 @@
-{"version":3,"file":"authors.js","sourceRoot":"","sources":["../src/authors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAC,cAAc,EAAC,MAAM,SAAS,CAAC;AAGvC;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqC,EACrC,IAAkB,EAClB,aAAqB;IAErB,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAiB,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAE1C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAqC,EACrC,IAAkB,EAClB,aAAqB;IAErB,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,+EAA+E;QAC/E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,IAAI,GAAG,EAAC,GAAG,IAAI,EAAC,CAAC;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqC;IACxE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAiB,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC;YACvD,SAAS,GAAG,GAAG,CAAC;YAChB,aAAa,GAAG,OAAO,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,8EAA8E;IAC9E,OAAO,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;AAChE,CAAC"}
+{"version":3,"file":"authors.js","sourceRoot":"","sources":["../src/authors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAC,cAAc,EAAC,MAAM,SAAS,CAAC;AAuBvC;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAC5B,IAAqC,EACrC,IAAkB,EAClB,OAA4B;IAE5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAiB,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAEhE,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC5E,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqC,EACrC,IAAkB,EAClB,aAAqB;IAErB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;+EAC+E;AAC/E,SAAS,WAAW,CAAC,IAAkB,EAAE,OAAuC;IAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,+EAA+E;QAC/E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,IAAI,GAAG,EAAC,GAAG,IAAI,EAAC,CAAC;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAqC,EACrC,IAAkB,EAClB,aAAqB;IAErB,OAAO,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAqC,EACrC,IAAkB,EAClB,aAA0C;IAE1C,OAAO,WAAW,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqC;IACxE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAiB,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC;YACvD,SAAS,GAAG,GAAG,CAAC;YAChB,aAAa,GAAG,OAAO,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,8EAA8E;IAC9E,OAAO,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;AAChE,CAAC"}

package/dist/backup.d.ts

@@ -86,9 +86,11 @@ export interface BackupStatus {
 /**
  * Pure: re-key a bundle for copy-mode import. Mints a fresh id for every page and
  * database, remaps every internal reference (`parentId`, `databaseId`,
- * `hostedDatabaseId`, a database's `pageId`, and `@`-mention `data-page-id`s
- * embedded in block HTML), and returns the rewritten pages/databases plus the
- * `oldId → newId` map. References to pages outside the bundle are left as-is.
+ * `hostedDatabaseId`, a database's `pageId`, and `@`-mentions — both the EditorJS
+ * HTML form (`data-page-id`) and the block-doc run form (an `m` attr, the shape
+ * the block-native editor and importers emit)), and returns the rewritten
+ * pages/databases plus the `oldId → newId` map. References to pages outside the
+ * bundle are left as-is.
  * Unit-tested; the store layer adds DB-aware name de-duplication on top.
  */
 export declare function remapBundle(pages: StoredPage[], databases: StoredDatabase[], newId: () => string): {

package/dist/backup.js

@@ -17,9 +17,11 @@ export const DEFAULT_BACKUP_CONFIG = {
 /**
  * Pure: re-key a bundle for copy-mode import. Mints a fresh id for every page and
  * database, remaps every internal reference (`parentId`, `databaseId`,
- * `hostedDatabaseId`, a database's `pageId`, and `@`-mention `data-page-id`s
- * embedded in block HTML), and returns the rewritten pages/databases plus the
- * `oldId → newId` map. References to pages outside the bundle are left as-is.
+ * `hostedDatabaseId`, a database's `pageId`, and `@`-mentions — both the EditorJS
+ * HTML form (`data-page-id`) and the block-doc run form (an `m` attr, the shape
+ * the block-native editor and importers emit)), and returns the rewritten
+ * pages/databases plus the `oldId → newId` map. References to pages outside the
+ * bundle are left as-is.
  * Unit-tested; the store layer adds DB-aware name de-duplication on top.
  */
 export function remapBundle(pages, databases, newId) {
@@ -32,7 +34,13 @@ export function remapBundle(pages, databases, newId) {
     const remapMentions = (data) => {
         let json = JSON.stringify(data);
         for (const [oldId, nid] of Object.entries(idMap)) {
+            // EditorJS HTML mention: `data-page-id=\"id\"` (the inner quotes are escaped
+            // because the HTML lives inside a JSON string value once serialised).
             json = json.split(`data-page-id=\\"${oldId}\\"`).join(`data-page-id=\\"${nid}\\"`);
+            // Block-doc mention run: an `m` attr (`{"a":{"m":"id"}}`) — structured JSON,
+            // so the quotes are plain. Anchored on the exact bundle id (a unique token),
+            // so it never rewrites an unrelated value.
+            json = json.split(`"m":"${oldId}"`).join(`"m":"${nid}"`);
         }
         return JSON.parse(json);
     };

package/dist/backup.js.map

@@ -1 +1 @@
-{"version":3,"file":"backup.js","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAgDhC,MAAM,CAAC,MAAM,eAAe,GAA6B,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAE3G,iDAAiD;AACjD,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IAC1B,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IAC/B,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IACjC,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CAClC,CAAC;AAgBF,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,OAAO,EAAE,KAAK;IACd,GAAG,EAAE,IAAI;IACT,QAAQ,EAAE,EAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAC;IAClE,IAAI,EAAE,EAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAC;IACnD,OAAO,EAAE,EAAE;CACZ,CAAC;AAmBF;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,KAAmB,EACnB,SAA2B,EAC3B,KAAmB;IAEnB,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC;IAC7C,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,CAAC,IAAwB,EAAsB,EAAE;QACrE,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;IAChD,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,GAAG,CAAC;QACJ,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QACpE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QAC5E,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI;QACpG,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;KAC5B,CAAC,CAAC,CAAC;IACJ,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAC,CAAC,CAAC,CAAC;IACzG,OAAO,EAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAgDhC,MAAM,CAAC,MAAM,eAAe,GAA6B,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAE3G,iDAAiD;AACjD,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IAC1B,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IAC/B,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IACjC,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CAClC,CAAC;AAgBF,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,OAAO,EAAE,KAAK;IACd,GAAG,EAAE,IAAI;IACT,QAAQ,EAAE,EAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAC;IAClE,IAAI,EAAE,EAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAC;IACnD,OAAO,EAAE,EAAE;CACZ,CAAC;AAmBF;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,KAAmB,EACnB,SAA2B,EAC3B,KAAmB;IAEnB,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC;IAC7C,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,CAAC,IAAwB,EAAsB,EAAE;QACrE,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,6EAA6E;YAC7E,sEAAsE;YACtE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,CAAC;YACnF,6EAA6E;YAC7E,6EAA6E;YAC7E,2CAA2C;YAC3C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;IAChD,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,GAAG,CAAC;QACJ,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QACpE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QAC5E,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI;QACpG,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;KAC5B,CAAC,CAAC,CAAC;IACJ,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAC,CAAC,CAAC,CAAC;IACzG,OAAO,EAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAC,CAAC;AAC/D,CAAC"}

package/dist/client.d.ts

@@ -115,6 +115,79 @@ export interface DataClient {
     subscribePage(id: string, handlers: PageSubscription): () => void;
     /** Subscribe to live page-list updates. Returns an unsubscribe fn. */
     subscribePages(onList: (pages: PageMeta[]) => void): () => void;
+    /**
+     * Subscribe to the live stream's *reconnect* signal (Collab T7): fires after the SSE
+     * stream drops and successfully **reopens** (the OB-132/OB-283 resync signal), so a
+     * caller can run a tight catch-up — the relay re-does its state-vector `/sync`
+     * handshake, the awareness provider re-announces presence — instead of waiting out the
+     * coarser page-*snapshot* resync (≤ snapshot-rate). Trailing-debounced against a
+     * flapping connection. It does NOT fire on the FIRST connect (the one-shot handshakes
+     * cover that) nor in poll-mode (no live SSE ⇒ convergence stays at snapshot-rate, the
+     * existing graceful degrade). Returns an unsubscribe fn; a transport with no live
+     * stream (the in-webview client) never fires it.
+     */
+    subscribeReconnect(onReconnect: () => void): () => void;
+    /**
+     * Relay one incremental Yjs update for a page to other open editors. `update` is
+     * the base64 CRDT bytes; `clientId` is the author's `Y.Doc` id so the author's
+     * own echo can be dropped. Ephemeral — never persisted (durability stays with
+     * {@link savePage}'s debounced snapshot).
+     */
+    postPageUpdate(id: string, update: string, clientId: number): Promise<void>;
+    /**
+     * Subscribe to a page's incremental Yjs updates. `onUpdate` fires with the base64
+     * CRDT bytes + the author's `clientId`. Returns an unsubscribe fn.
+     */
+    subscribePageUpdates(id: string, onUpdate: (update: string, clientId: number) => void): () => void;
+    /**
+     * Late-joiner handshake: send the local doc's base64 state vector, receive the
+     * base64 update carrying exactly the ops this client is missing (or `null` when
+     * the server has nothing newer than the snapshot the client already loaded). This
+     * is how a client joining mid-session converges to the CURRENT doc.
+     */
+    syncPageUpdates(id: string, stateVector: string): Promise<string | null>;
+    /**
+     * Publish this client's presence (cursor / selection) as a base64
+     * `y-protocols/awareness` update. **Read-gated** (a viewer appears present), and
+     * the server **re-stamps the identity** (name/colour) from the verified principal
+     * — what's in the body is never trusted for who-you-are. Ephemeral: never
+     * persisted, never in the edit log.
+     */
+    postPageAwareness(id: string, update: string, clientId: number): Promise<void>;
+    /**
+     * Subscribe to a page's awareness updates (other clients' presence). `onUpdate`
+     * fires with the base64 awareness bytes + the author's `clientId` (so the author
+     * drops its own echo). Returns an unsubscribe fn. Ephemeral — not resynced on
+     * reconnect; the periodic awareness refresh + the on-connect snapshot recover it.
+     */
+    subscribePageAwareness(id: string, onUpdate: (update: string, clientId: number) => void): () => void;
+    /**
+     * Current presence snapshot for a late joiner (Collab T4): the base64 awareness
+     * updates of everyone currently present (already identity-stamped), so a client
+     * connecting mid-session sees who's here at once rather than waiting out the next
+     * awareness refresh. Read-gated. Empty when nobody else is present.
+     */
+    syncPageAwareness(id: string): Promise<string[]>;
+    /**
+     * Upload binary `bytes` (e.g. an image's file bytes) to the content-addressed
+     * asset store, ref'd to `pageId` — a page the caller can write, whose read-gate
+     * the asset inherits so it's immediately reachable. Resolves `{id}`, the
+     * SHA-256 content hash; a byte-identical re-upload dedups to the same id. The
+     * image block persists only this `id`, never the bytes, so the CRDT stays small.
+     */
+    putAsset(bytes: Uint8Array, mime: string, pageId: string): Promise<{
+        id: string;
+    }>;
+    /**
+     * Fetch an asset's bytes + mime by content-hash `id`, or `null` when it's
+     * missing or the caller can read no page that references it (read-gated — an
+     * absent and an unreadable asset answer alike, so there's no existence oracle).
+     * The image block resolves this to an object URL for `<img src>`.
+     */
+    getAsset(id: string): Promise<{
+        bytes: Uint8Array;
+        mime: string;
+    } | null>;
     /** Create a database for a host page. */
     createDatabase(input: DatabaseInput): Promise<StoredDatabase>;
     /** Fetch a database by id, or `null` if it does not exist. */
@@ -232,6 +305,36 @@ export interface LiveSourceLike {
     }) => void): void;
     close(): void;
 }
+/**
+ * How long to wait for the `EventSource`'s first `open` before deciding the
+ * stream is structurally dead and falling back to polling. The *.book.pub
+ * forwarding tunnel buffers the never-ending SSE body in release builds and
+ * forwards nothing, so a tunneled browser sees neither `open` nor any event;
+ * this bound caps how long it stays dark before polling takes over. Loopback
+ * (dev) and any future-fixed transport open well inside this window and so
+ * never poll. Exported for tests; not re-exported from the package index.
+ */
+export declare const LIVE_OPEN_GRACE_MS = 8000;
+/**
+ * How often poll-mode re-fetches every open subscription once the SSE stream is
+ * deemed dead — the interval within which a tunneled client sees writes.
+ */
+export declare const LIVE_POLL_INTERVAL_MS = 4000;
+/**
+ * Number of `error`s (with no intervening `open`) that trip poll-mode early,
+ * before {@link LIVE_OPEN_GRACE_MS} elapses — e.g. a connection that is refused
+ * or fails immediately rather than hanging.
+ */
+export declare const LIVE_POLL_AFTER_ERRORS = 3;
+/**
+ * Trailing-debounce window for the {@link LiveStream} reconnect signal (Collab T7). A
+ * flapping connection can `error`/`open` repeatedly; coalescing the reopens into a single
+ * notification — fired once the stream has stayed open this long — keeps a caller's
+ * re-handshake from storming the relay. Short relative to a snapshot save, so the
+ * post-reconnect catch-up is still far tighter than the snapshot-rate fallback. Exported
+ * for tests; not re-exported from the package index.
+ */
+export declare const LIVE_RECONNECT_DEBOUNCE_MS = 300;
 /** Options for swapping {@link HttpDataClient}'s transport (desktop IPC). */
 export interface HttpDataClientOptions {
     /** Replacement for the global `fetch` (e.g. tunnel requests over host IPC). */
@@ -302,6 +405,52 @@ export declare class HttpDataClient implements DataClient {
     compact(): Promise<CompactResult>;
     subscribePage(id: string, handlers: PageSubscription): () => void;
     subscribePages(onList: (pages: PageMeta[]) => void): () => void;
+    /** Reopen-after-drop reconnect signal (Collab T7) — tight post-reconnect catch-up. */
+    subscribeReconnect(onReconnect: () => void): () => void;
+    /** Relay one incremental Yjs update (Collab T1); ephemeral, no store write. */
+    postPageUpdate(id: string, update: string, clientId: number): Promise<void>;
+    subscribePageUpdates(id: string, onUpdate: (update: string, clientId: number) => void): () => void;
+    /** Late-joiner sync handshake (Collab T1): state vector in, missing ops out. */
+    syncPageUpdates(id: string, stateVector: string): Promise<string | null>;
+    /** Publish ephemeral presence (Collab T4); read-gated, identity server-stamped. */
+    postPageAwareness(id: string, update: string, clientId: number): Promise<void>;
+    subscribePageAwareness(id: string, onUpdate: (update: string, clientId: number) => void): () => void;
+    /** Current presence snapshot for a late joiner (Collab T4). */
+    syncPageAwareness(id: string): Promise<string[]>;
+    /**
+     * Upload asset bytes and ref them to `pageId`. The body is base64-JSON
+     * (`{data, mime}`) rather than raw binary DELIBERATELY: the desktop IPC bridge
+     * (`tauriFetch`) corrupts raw binary / stream request bodies, so base64 keeps
+     * the upload byte-exact on BOTH the web-http and desktop-IPC transports.
+     */
+    putAsset(bytes: Uint8Array, mime: string, pageId: string): Promise<{
+        id: string;
+    }>;
+    /**
+     * Fetch an asset by content-hash id, decoding the base64-JSON variant
+     * (`?encoding=base64`) — again to stay byte-safe over the desktop IPC bridge,
+     * which corrupts raw binary responses. `null` on 404 (missing or read-gated).
+     *
+     * A5 decision — base64 single-shot over the desktop's `tauriFetch`, NOT the
+     * streaming `tauriStreamFetch` (which stays tunnel-only): assets are capped at
+     * 10 MiB, and `getAsset` must materialize the FULL bytes anyway (its consumer
+     * wraps them in a `Blob`/object-URL), so streaming buys no client-side memory
+     * win — it would only spare the server a whole-asset base64 pass. Wiring it would
+     * mean threading a second transport through this one `fetchImpl` abstraction for a
+     * bounded (~13 MiB transient) payload — cost > benefit. Buffered base64-JSON is
+     * the right call at this cap; revisit only if the cap is ever raised materially.
+     *
+     * `cache: 'no-store'` keeps this byte-exact across all three transports (IPC
+     * base64, web, tunnel) — it never relies on the browser HTTP cache, so it holds
+     * the object-URL in-app instead. The server's content-addressed `ETag`/304 (A5)
+     * still shortcuts a browser's OWN cache-revalidation for any DIRECT `<img src>`
+     * fetch of the asset URL (notably through a *.book.pub tunnel, where the browser
+     * caches the first response), which is a separate, non-`no-store` code path.
+     */
+    getAsset(id: string): Promise<{
+        bytes: Uint8Array;
+        mime: string;
+    } | null>;
     createDatabase(input: DatabaseInput): Promise<StoredDatabase>;
     getDatabase(id: string): Promise<StoredDatabase | null>;
     getPageDatabase(pageId: string): Promise<StoredDatabase | null>;