@book.dev/ui 1.60.0

package/dist/pageIcon-BWTy7hAh.js

@@ -0,0 +1,32 @@
+import { useSyncExternalStore as e } from "react";
+import { ICON_PROPERTY_ID as t } from "@book.dev/sdk";
+//#region src/lib/pageIcon.ts
+var n = "📄", r = "🏠", i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Set(), o = () => a.forEach((e) => e()), s = (e) => (a.add(e), () => a.delete(e)), c = null;
+function l(e) {
+	c = e;
+}
+var u = (e) => i.get(e) || null, d = (e) => e === "home" ? r : i.get(e) || "📄", f = (e, t) => {
+	let n = t || "";
+	i.get(e) !== n && (i.set(e, n), c?.(e, n || null), o());
+}, p = (e) => `openbook.icon.${e}`;
+function m(e) {
+	let t = !1;
+	for (let { id: n, icon: r } of e) {
+		if (!n) continue;
+		let e = r ?? "";
+		if (!e && typeof localStorage < "u") {
+			let e = localStorage.getItem(p(n));
+			if (e) {
+				localStorage.removeItem(p(n)), i.get(n) !== e && (i.set(n, e), t = !0), c?.(n, e);
+				continue;
+			}
+		}
+		i.get(n) !== e && (i.set(n, e), t = !0);
+	}
+	t && o();
+}
+function h(t) {
+	return e(s, () => d(t), () => t === "home" ? r : n);
+}
+//#endregion
+export { u as a, h as c, d as i, f as l, t as n, l as o, m as r, s, n as t };

package/dist/plugins/__tests__/host.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/plugins/__tests__/loader.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/plugins/__tests__/pagePlugin.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/plugins/api.d.ts

@@ -0,0 +1,67 @@
+import type { DataClient, PageMeta, StoredPage } from '@book.dev/sdk';
+import { type CustomBlockDef } from '../blockeditor/registry';
+/**
+ * The API handed to a plugin's `activate(api)` — the whole contract between
+ * a plugin and the app. Everything registered through it is tracked, so
+ * disabling or removing the plugin tears its contributions down cleanly.
+ *
+ * Plugins import this module as `@book.dev/plugin-sdk` (and React as
+ * `react`); both resolve to host instances, never bundled copies.
+ */
+export interface PluginBlockDef {
+    /** Block type, namespaced automatically as `<pluginId>/<type>`. */
+    type: string;
+    render: CustomBlockDef['render'];
+    slash?: CustomBlockDef['slash'];
+}
+export interface PluginCommandDef {
+    id: string;
+    title: string;
+    keywords?: string;
+    run: () => void;
+}
+export interface PluginApi {
+    /** The plugin's own manifest (id, name, version…). */
+    manifest: {
+        id: string;
+        name: string;
+        version: string;
+    };
+    /** Register a custom block (renders in documents; optional slash entry). */
+    blocks: {
+        register(def: PluginBlockDef): void;
+    };
+    /** Register a command-palette command. */
+    commands: {
+        register(def: PluginCommandDef): void;
+    };
+    /** Read and write workspace pages (integration surface). */
+    pages: {
+        list(): Promise<PageMeta[]>;
+        get(id: string): Promise<StoredPage | null>;
+        create(name: string, markdownish?: string): Promise<StoredPage>;
+    };
+    /** Plugin-scoped persistent key-value storage (per browser profile). */
+    storage: {
+        get<T = unknown>(key: string): T | undefined;
+        set(key: string, value: unknown): void;
+    };
+    /** Network access for integrations (plain fetch — same trust as live code). */
+    fetch: typeof fetch;
+}
+/** What `activate` may hand back (everything optional). */
+export interface PluginActivationResult {
+    deactivate?: () => void;
+}
+export type PluginModule = {
+    default?: (api: PluginApi) => PluginActivationResult | void;
+    activate?: (api: PluginApi) => PluginActivationResult | void;
+};
+/** Build a plugin's API instance; `disposables` collects every teardown. */
+export declare function buildPluginApi(manifest: {
+    id: string;
+    name: string;
+    version: string;
+}, client: DataClient, disposables: Array<() => void>): PluginApi;
+/** Host modules importable from plugin code. */
+export declare const hostModulesFor: (api: PluginApi) => Record<string, unknown>;

package/dist/plugins/commandRegistry.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Palette commands contributed by plugins. Same module-singleton pattern as
+ * the custom-block registry: registration works from any layer, and the
+ * palette re-reads on every change via subscription.
+ */
+export interface PluginCommand {
+    id: string;
+    title: string;
+    keywords: string;
+    run: () => void;
+    pluginId: string;
+}
+export declare function registerPluginCommand(command: PluginCommand): () => void;
+export declare const pluginCommands: () => PluginCommand[];
+export declare const subscribePluginCommands: (cb: () => void) => (() => void);

package/dist/plugins/host.d.ts

@@ -0,0 +1,32 @@
+import { type DataClient, type StoredPlugin } from '@book.dev/sdk';
+/**
+ * The plugin host: loads the workspace's enabled plugins, activates each in
+ * isolation (one plugin's crash never takes down another, or the app), and
+ * tears contributions down on disable/remove. A module singleton — the same
+ * set of plugins serves every editor on the page.
+ */
+export interface PluginStatus {
+    plugin: StoredPlugin;
+    state: 'active' | 'disabled' | 'error';
+    error?: string;
+    /** The trusted registry that vouches for this exact content, if any. */
+    verifiedBy?: string;
+}
+export declare const pluginStatuses: () => PluginStatus[];
+export declare const subscribePlugins: (cb: () => void) => (() => void);
+/** First-party key + any registries the user has chosen to trust. */
+export declare function trustedRegistryKeys(): Array<{
+    name: string;
+    publicKey: string;
+}>;
+/** Persist a user-trusted registry key (and re-verify on next sync). */
+export declare function addTrustedRegistry(name: string, publicKey: string): void;
+export declare function removeTrustedRegistry(publicKey: string): void;
+/**
+ * Reconcile the running set against the server's list: activate newly
+ * enabled plugins, dispose disabled/removed ones, verify signatures against
+ * the user's trusted keys. Safe to call repeatedly (boot + after changes).
+ */
+export declare function syncPlugins(client: DataClient): Promise<PluginStatus[]>;
+/** Dispose + re-activate one plugin (after an update/re-install). */
+export declare function reloadPlugin(id: string, client: DataClient): Promise<PluginStatus[]>;

package/dist/plugins/index.d.ts

@@ -0,0 +1,5 @@
+export { parsePluginZip, executePlugin } from './loader';
+export { buildPluginApi, type PluginApi, type PluginBlockDef, type PluginCommandDef } from './api';
+export { pluginCommands, subscribePluginCommands } from './commandRegistry';
+export { syncPlugins, reloadPlugin, pluginStatuses, subscribePlugins, trustedRegistryKeys, addTrustedRegistry, removeTrustedRegistry, type PluginStatus } from './host';
+export { pagePluginFiles, pageHasPluginManifest, pageToPluginZip, MANIFEST_FILE } from './pagePlugin';

package/dist/plugins/loader.d.ts

@@ -0,0 +1,19 @@
+import { type PluginPackage } from '@book.dev/sdk';
+/**
+ * The plugin loader: turns a zip of TypeScript source into a running module.
+ *
+ * - {@link parsePluginZip} reads `openbook.json` + every source file out of
+ *   the archive (and a `signature.json` when the registry shipped one).
+ * - {@link executePlugin} strips types with sucrase (fast, no typechecker)
+ *   and links the files with a tiny in-memory CommonJS resolver, so plugins
+ *   can be ordinary multi-file TypeScript programs. `react` and
+ *   `@book.dev/plugin-sdk` resolve to host-provided modules; anything else
+ *   must live inside the zip — plugins are self-contained by design.
+ */
+export declare function parsePluginZip(bytes: Uint8Array): PluginPackage;
+/**
+ * Execute a plugin package and return its entry module's exports. Host
+ * modules (`react`, `@book.dev/plugin-sdk`) come from `hostModules`; every
+ * other import resolves inside the package.
+ */
+export declare function executePlugin(pkg: PluginPackage, hostModules: Record<string, unknown>): Record<string, unknown>;

package/dist/plugins/pagePlugin.d.ts

@@ -0,0 +1,21 @@
+import * as Y from 'yjs';
+/**
+ * A page can BE a plugin: every named, non-live code block is a file in the
+ * package — name a block `openbook.json` for the manifest, `src/index.ts`
+ * for the entry, and export the page as an installable zip. Live blocks'
+ * names are reactive outputs, not filenames, so they stay out.
+ */
+export declare const MANIFEST_FILE = "openbook.json";
+/** Named, non-live code blocks in document order → path → content. */
+export declare function pagePluginFiles(doc: Y.Doc): Map<string, string>;
+/** Does this page carry a plugin manifest block? Gates the export menu item. */
+export declare const pageHasPluginManifest: (doc: Y.Doc) => boolean;
+/**
+ * Zip the page's plugin files — the same layout {@link parsePluginZip}
+ * installs, so export → install round-trips. Throws with a human-readable
+ * reason when the manifest is malformed or the entry file is missing.
+ */
+export declare function pageToPluginZip(doc: Y.Doc): {
+    filename: string;
+    bytes: Uint8Array;
+};

package/dist/providers/AccountProvider.d.ts

@@ -0,0 +1,67 @@
+import React, { PropsWithChildren } from 'react';
+/**
+ * Signs the app in to account.book.pub via the deep-link flow and keeps the
+ * user's settings synced there (the account service stores settings only; the
+ * data server stays single-tenant and untouched).
+ *
+ * Sign-in: open `/api/connect` in the browser (desktop in the system browser,
+ * web in a popup); the account service runs OAuth, mints a one-shot device
+ * token, and redirects back — to the desktop's `openbook://auth-callback` deep
+ * link, or the web shell's `/account/callback` page, which both hand the token
+ * here. The token is then a bearer for `/api/settings`.
+ *
+ * Sync: pull on connect / app open (remote wins), then push the
+ * `{preferences, workspaces}` blob on local change (debounced, last-writer-wins).
+ */
+export type AccountStatus = 'disconnected' | 'connecting' | 'syncing' | 'connected' | 'error';
+interface AccountContextValue {
+    status: AccountStatus;
+    connected: boolean;
+    /** The device bearer token, for same-app account API calls (e.g. forwarding's
+     *  POST /api/sites). Null when disconnected. Treat as a secret. */
+    token: string | null;
+    /** The label this device registers under (shown in the account dashboard). */
+    deviceName: string;
+    /** ISO timestamp of the last successful server sync, or null. */
+    lastSyncedAt: string | null;
+    /** A human-readable error from the last failed action, or null. */
+    error: string | null;
+    /** The account service base URL (for an "open dashboard" link). */
+    accountUrl: string;
+    /** Start the deep-link sign-in flow. */
+    signIn: () => void;
+    /** Complete sign-in from a manually pasted code — the dev/fallback path for when
+     *  the `openbook://` deep link can't fire (the user dismisses the "open app?"
+     *  prompt and pastes the code instead). Accepts a bare token or the whole
+     *  `openbook://auth-callback#token=…` URL. */
+    submitCode: (raw: string) => void;
+    /** Abandon a pending sign-in (returns to disconnected when not yet connected). */
+    cancel: () => void;
+    /** Forget the local token (does not revoke it server-side — do that in the dashboard). */
+    signOut: () => void;
+    /** Pull-then-push a reconciliation now. */
+    syncNow: () => void;
+}
+/** Cross-window handoff (web): the callback page hands the minted token to the
+ *  running app over this BroadcastChannel (popup case) or localStorage key
+ *  (same-tab fallback). Exported so the web `/account/callback` page reuses the
+ *  exact contract. */
+export declare const ACCOUNT_CHANNEL = "openbook.account";
+export declare const ACCOUNT_HANDOFF_KEY = "openbook.account.handoff";
+/**
+ * Deliver a token from a web callback page to the running app. A popup posts on
+ * the BroadcastChannel (the opener can't be relied on cross-origin); a same-tab
+ * fallback writes the localStorage key the app reads on its next load.
+ */
+export declare function handoffAccountToken(token: string, state: string, mode: 'broadcast' | 'storage'): void;
+/**
+ * Pull a device token out of a manually pasted value, so the user can paste
+ * whatever they managed to copy: a bare token, the full
+ * `openbook://auth-callback#token=…&state=…` URL the browser tried to open, a
+ * web `…/account/callback#token=…` URL, or just a `#token=…` fragment. Returns
+ * the token, or null when nothing usable is found.
+ */
+export declare function extractToken(raw: string): string | null;
+export declare const AccountProvider: React.FC<PropsWithChildren<unknown>>;
+export declare const useAccount: () => AccountContextValue;
+export {};

package/dist/providers/ConfirmProvider.d.ts

@@ -0,0 +1,30 @@
+import React from 'react';
+export interface ConfirmOptions {
+    /** Bold heading, e.g. "Move page to trash?". */
+    title: string;
+    /** Supporting line under the title. */
+    description?: string;
+    /** Confirm button label (default "Confirm"). */
+    confirmText?: string;
+    /** Cancel button label (default "Cancel"). */
+    cancelText?: string;
+    /** Render the confirm button in the destructive (red) style. */
+    destructive?: boolean;
+    /** Notice mode: a lone acknowledge button (for errors — there's nothing to cancel). */
+    hideCancel?: boolean;
+}
+type ConfirmFn = (options: ConfirmOptions) => Promise<boolean>;
+/**
+ * Promise-based confirmation dialog: `const confirm = useConfirm()` then
+ * `if (!(await confirm({title: '…'}))) return;`. A drop-in for `window.confirm`
+ * that actually works in the desktop WKWebView shell, where the native
+ * `window.confirm` returns false without ever showing a dialog and so silently
+ * aborts the action. Renders one in-app Radix dialog shared by every caller;
+ * all controls are native `<button>`s so clicks fire in WKWebView.
+ */
+export declare function ConfirmProvider({ children }: {
+    children: React.ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+/** Access the promise-based confirm dialog. Throws outside a {@link ConfirmProvider}. */
+export declare function useConfirm(): ConfirmFn;
+export {};

package/dist/providers/ForwardingProvider.d.ts

@@ -0,0 +1,23 @@
+import React, { PropsWithChildren } from 'react';
+import { type TunnelStatus } from '@book.dev/sdk';
+/** Combined provisioning/tunnel status. `idle` = never started this session. */
+export type ForwardingStatus = TunnelStatus | 'idle';
+interface ForwardingContextValue {
+    /** The host can forward (desktop with keychain + IPC fetch). */
+    supported: boolean;
+    /** The user's on/off intent (persisted). */
+    enabled: boolean;
+    /** Live tunnel status. */
+    status: ForwardingStatus;
+    /** The assigned `<prefix>.book.pub` host, once known. */
+    host: string | null;
+    busy: boolean;
+    error: string | null;
+    /** Turn forwarding on: claim the address (sign-in first if needed) + dial out. */
+    enable: () => Promise<void>;
+    /** Turn forwarding off: drop the tunnel but keep the site key (stable address). */
+    disable: () => void;
+}
+export declare const ForwardingProvider: React.FC<PropsWithChildren>;
+export declare const useForwarding: () => ForwardingContextValue;
+export {};

package/dist/providers/HudProvider.d.ts

@@ -0,0 +1,9 @@
+import React, { PropsWithChildren } from 'react';
+import { HudProps } from '@/lib/hud';
+export interface HudContext {
+    hud: HudProps;
+    setHud: React.Dispatch<HudProps | ((draft: HudProps) => HudProps)>;
+}
+export declare const HudContext: React.Context<HudContext>;
+export declare const useHud: () => HudContext;
+export declare const HudProvider: React.FC<PropsWithChildren<unknown>>;

package/dist/providers/I18nProvider.d.ts

@@ -0,0 +1,23 @@
+import React from 'react';
+import { LOCALES, type Locale, type TKey } from '@/i18n';
+interface I18nContextValue {
+    locale: Locale;
+    setLocale: (locale: Locale) => void;
+    t: (key: TKey, vars?: Record<string, string | number>) => string;
+    locales: typeof LOCALES;
+}
+/**
+ * Provides the current display locale + a reactive `t`. Persists the choice and
+ * keeps the module-level locale (used by non-React `t` callers) in sync so the
+ * whole app — React and not — renders in the same language this render.
+ *
+ * SSR note: the first render (server and the client's hydration pass) is always
+ * `'en'` so the two agree — reading localStorage/navigator during the initial
+ * render would make the client diverge from the server-rendered HTML and trip a
+ * hydration mismatch. The persisted/browser locale is adopted right after mount;
+ * a non-English user briefly sees English (one frame), the standard tradeoff for
+ * localStorage-backed i18n under SSR.
+ */
+export declare const I18nProvider: React.FC<React.PropsWithChildren<unknown>>;
+export declare const useTranslation: () => I18nContextValue;
+export {};

package/dist/providers/NavigationProvider.d.ts

@@ -0,0 +1,89 @@
+import React, { PropsWithChildren } from 'react';
+import { type PageMeta } from '@book.dev/sdk';
+import { type NewViewTarget } from './PlatformLibraryProvider';
+import type { Pane, PaneId } from './windowModel';
+export type { Pane, PaneId, WindowState } from './windowModel';
+export interface NavigationContextValue {
+    /** All top-level pages, most-recently-updated first (database rows excluded). */
+    pages: PageMeta[];
+    /** The page in the focused pane of this window. */
+    currentPageId: string | null;
+    /** The page in the PRIMARY (left) pane — what side panes (the assistant,
+     *  review, dataflow) act on, regardless of which pane is focused. */
+    primaryPageId: string | null;
+    loading: boolean;
+    error: string | null;
+    /** Whether tabs live inside the window (a custom titlebar tab bar). */
+    inWindowTabs: boolean;
+    /** The window's tabs, each with the page it shows. */
+    tabs: {
+        id: string;
+        pageId: string;
+    }[];
+    /** The active tab's id. */
+    activeTabId: string;
+    /** Activate a tab. */
+    selectTab: (tabId: string) => void;
+    /** Close a tab (the window keeps at least one). */
+    closeTab: (tabId: string) => void;
+    /** The panes shown by the active tab (the primary, plus the secondary when split). */
+    panes: Pane[];
+    /** The focused pane id. */
+    focusedPaneId: PaneId;
+    /** Whether the active tab is currently split. */
+    splitOpen: boolean;
+    /** Mark a pane focused (e.g. on click). */
+    focusPane: (pane: PaneId) => void;
+    /** Open a page beside the current one in the split pane. */
+    openInSplit: (id: string) => void;
+    /** Close the split pane. */
+    closeSplit: () => void;
+    /** Close a pane (secondary collapses the split; primary promotes the secondary). */
+    closePane: (pane: PaneId) => void;
+    /** Open a page in a new tab or window (in-window tab + OS window on desktop, browser tab/window on web). */
+    openInNew: (id: string, target: NewViewTarget) => void;
+    /** Create a fresh blank page and open it in a new tab or window. */
+    newPageIn: (target: NewViewTarget) => Promise<void>;
+    /** Remove this window's view of a page (used when a row/subpage is deleted). */
+    closePage: (id: string) => void;
+    /** A display title for any page id, including open subpages not in `pages`. */
+    pageLabel: (id: string) => string;
+    /** Seed a known title for a page (e.g. a database row being opened). */
+    setPageHint: (id: string, name: string | null) => void;
+    /** Navigate the focused pane to a page. */
+    selectPage: (id: string) => void;
+    /** Navigate (and focus) a SPECIFIC pane, regardless of which is focused. All
+     *  link / sidebar / breadcrumb navigation targets the primary pane; the side
+     *  pane stays put as a reference and changes only via "open in split". */
+    selectPageInPane: (id: string, pane: PaneId) => void;
+    goBack: () => void;
+    goForward: () => void;
+    canGoBack: boolean;
+    canGoForward: boolean;
+    /** Create a new page (optionally named, optionally nested) and open it. Returns its id. */
+    createPage: (name?: string | null, parentId?: string | null) => Promise<string>;
+    /** Create a host page that contains a fresh database (optionally nested), and open it. */
+    createDatabasePage: (parentId?: string | null) => Promise<string>;
+    /**
+     * Create a child page nested under `parentId` without navigating to it (used
+     * by the inline subpage blocks). `kind: 'database'` also attaches a database.
+     * Returns the new page's id.
+     */
+    createSubpage: (parentId: string, kind?: 'page' | 'database') => Promise<string>;
+    /** Duplicate a page (its content, name, and icon) as a sibling, then open it. */
+    duplicatePage: (id: string) => Promise<void>;
+    /** Delete a page; closes its panes and falls back if nothing remains open. */
+    deletePage: (id: string) => Promise<void>;
+    /** Rename a page (name only). */
+    renamePage: (id: string, name: string | null) => Promise<void>;
+    /**
+     * Reorder / re-nest a page in the sidebar tree: set its parent (`null` = top
+     * level) and the new ordered list of sibling ids under that parent (including
+     * this page). Drives drag-to-reorder and drag-to-nest.
+     */
+    movePage: (id: string, parentId: string | null, orderedIds: string[]) => Promise<void>;
+    /** Re-list pages from the store. */
+    reload: () => Promise<PageMeta[]>;
+}
+export declare const useNavigation: () => NavigationContextValue;
+export declare const NavigationProvider: React.FC<PropsWithChildren<unknown>>;

package/dist/providers/PlatformLibraryProvider.d.ts

@@ -0,0 +1,107 @@
+import React, { PropsWithChildren } from 'react';
+import type { BookFolderFile, FetchLike, KeyStore, ServerControls } from '@book.dev/sdk';
+/** Where to open a page: a new tab or a separate new window. */
+export type NewViewTarget = 'tab' | 'window';
+/**
+ * How the host handles new tabs/windows. The desktop sets `inWindow` so a "new
+ * tab" becomes an in-window tab (a custom tab bar in the titlebar) and supplies
+ * `openWindow` for a separate OS window. The web shell leaves this undefined, so
+ * the UI falls back to `window.open` — a real browser tab or a popup window.
+ */
+export interface TabsPlatform {
+    /** Tabs live inside the window (custom titlebar tab bar) rather than as OS tabs. */
+    inWindow?: boolean;
+    /** Open `pageId` in a separate OS window. */
+    openWindow: (pageId: string) => void;
+}
+/**
+ * The window-management buttons a frameless window must draw itself. The
+ * desktop supplies these on Windows/Linux (where the window has no native title
+ * bar); macOS keeps its native traffic lights, so it leaves this undefined and
+ * the UI draws no custom controls.
+ */
+export interface WindowControls {
+    minimize: () => void;
+    toggleMaximize: () => void;
+    close: () => void;
+    /**
+     * Observe the maximized state (to show maximize vs restore). Calls back with
+     * the current value immediately and on every change; returns an unsubscribe.
+     */
+    watchMaximized?: (cb: (maximized: boolean) => void) => () => void;
+}
+/**
+ * How the host completes account.book.pub's deep-link sign-in. The desktop sets
+ * a custom-scheme `redirectUri` (`openbook://auth-callback`), opens the browser
+ * itself, and delivers the minted token back through the OS deep-link
+ * (`onCallback`). The web shell leaves this undefined: it falls back to an
+ * `${origin}/account/callback` popup that hands the token back same-origin.
+ */
+export interface AccountPlatform {
+    /** The OAuth callback URI the account service redirects back to. Omit on web
+     *  (the provider defaults to `${origin}/account/callback`). */
+    redirectUri?: string;
+    /** Open the sign-in URL in the system browser. Omit on web (defaults to a popup). */
+    openSignIn?: (url: string) => void;
+    /** Subscribe to deep-link callbacks carrying the minted token; returns an
+     *  unsubscribe. Desktop only — web receives the token via its callback page. */
+    onCallback?: (cb: (params: {
+        token: string;
+        state: string;
+    }) => void) => () => void;
+}
+/**
+ * How the host reads/writes an on-disk book folder (the human-readable
+ * `<book>/<page>.html` layout, lossless `openbook.space.json` sidecar). The
+ * desktop supplies a native dialog + filesystem implementation; the web shell
+ * leaves this undefined and the UI falls back to the File System Access API
+ * (with a zip download/upload fallback for browsers that lack it).
+ */
+export interface BookFolderPlatform {
+    /** Write an exported book folder to a host-chosen location. Resolves a summary
+     *  (`location` to show the user, `count` of pages written), or `null` if the
+     *  user cancelled. */
+    export(files: BookFolderFile[]): Promise<{
+        location: string;
+        count: number;
+    } | null>;
+    /** Read a host-chosen book folder back into files, or `null` if cancelled. */
+    import?(): Promise<BookFolderFile[] | null>;
+}
+/**
+ * How the host persists the forwarding site identity. Forwarding to *.book.pub
+ * needs the Ed25519 device private key kept in the OS keychain, which only the
+ * native shell can reach — so the desktop supplies a keychain-backed
+ * {@link KeyStore} and the web shell leaves this undefined (forwarding is a
+ * desktop-only affordance; the web app *is* the cloud).
+ */
+export interface ForwardingPlatform {
+    keyStore: KeyStore;
+    /**
+     * The `fetch` the forwarding tunnel uses to serve inbound requests against the
+     * local data server. On the desktop this is the IPC transport, so forwarded
+     * traffic reaches the portless local server without opening a TCP port. Omit to
+     * fall back to a normal `fetch` against a real `localOrigin`.
+     */
+    localFetch?: FetchLike;
+}
+/**
+ * Capabilities the host platform provides to the UI. The Tauri desktop app
+ * supplies `serverControls` (inspect/publish the local server), `bookFolder`
+ * (native folder export/import), `forwarding` (keychain for *.book.pub),
+ * `tabs` (in-window tabs), `windowControls` (frameless min/max/close on
+ * Windows/Linux), and `account` (deep-link sign-in); the web shell leaves these
+ * undefined and the UI falls back to browser behaviour.
+ */
+export interface PlatformLibrary {
+    serverControls?: ServerControls;
+    bookFolder?: BookFolderPlatform;
+    forwarding?: ForwardingPlatform;
+    tabs?: TabsPlatform;
+    windowControls?: WindowControls;
+    account?: AccountPlatform;
+}
+export declare const usePlatformLibrary: () => PlatformLibrary;
+export declare const PlatformLibraryProvider: React.FC<PropsWithChildren<{
+    value?: PlatformLibrary;
+}>>;

package/dist/providers/PreferencesProvider.d.ts

@@ -0,0 +1,47 @@
+import React from 'react';
+import type { FeatureVisibility } from '@/lib/aiFeatures';
+/** A user's identity within the app. Cosmetic today (local-first, no accounts). */
+export interface ProfilePreferences {
+    name: string;
+    displayName: string;
+    /** Avatar emoji. Empty = derive a lettered (initials) avatar from the name. */
+    avatar: string;
+    /** Avatar image as a small data URL. Takes precedence over the emoji. */
+    avatarImage: string;
+    bio: string;
+}
+/** General behavior toggles that aren't layout (those live in the HUD). */
+export interface GeneralPreferences {
+    /** Ask before moving a page to the trash. Default true (today's behavior). */
+    confirmOnTrash: boolean;
+    /** Spellcheck the editor while typing. */
+    spellcheck: boolean;
+}
+export interface Preferences {
+    profile: ProfilePreferences;
+    general: GeneralPreferences;
+    /** How AI entry points surface in menus, keyed by feature id. A missing entry
+     *  defaults to 'recommended' (see lib/aiFeatures). */
+    features: Record<string, FeatureVisibility>;
+}
+export declare const DEFAULT_PREFERENCES: Preferences;
+/** A nested partial — every key optional, recursively — for `update(patch)`. */
+type DeepPartial<T> = {
+    [K in keyof T]?: T[K] extends object ? DeepPartial<T[K]> : T[K];
+};
+interface PreferencesContextValue {
+    preferences: Preferences;
+    /** Shallow-merge a patch per section (one level of nesting), then persist. */
+    update: (patch: DeepPartial<Preferences>) => void;
+}
+export declare const PREFERENCES_STORAGE_KEY = "openbook.preferences";
+/**
+ * Durable, local-only user preferences (profile + behavior toggles), persisted
+ * to localStorage. SSR-safe: the first render (server + the client's hydration
+ * pass) uses the defaults so the two agree, and the stored values are adopted in
+ * a post-mount effect — reading localStorage during the initial render would
+ * diverge from the server HTML and trip a hydration mismatch.
+ */
+export declare const PreferencesProvider: React.FC<React.PropsWithChildren<unknown>>;
+export declare const usePreferences: () => PreferencesContextValue;
+export {};

package/dist/providers/ThemeProvider.d.ts

@@ -0,0 +1,26 @@
+import React from 'react';
+import { type AppearanceOptions, type Theme } from '@/lib/themes';
+export type ColorScheme = 'light' | 'dark';
+export type ColorMode = ColorScheme | 'system';
+export type ThemeProviderProps = {
+    children: React.ReactNode;
+    defaultColorMode?: ColorMode;
+    storageKey?: string;
+};
+type ThemeProviderState = {
+    colorScheme: ColorScheme;
+    mode: ColorMode;
+    setMode: (theme: ColorMode) => void;
+    /** The full appearance choice (accent + tint + intensity + sidebar). */
+    appearance: AppearanceOptions;
+    /** Shallow-merge a patch into the appearance and persist it. */
+    setAppearance: (patch: Partial<AppearanceOptions>) => void;
+    /** The active named color theme (palette). Shorthand for `appearance.themeId`. */
+    themeId: string;
+    setThemeId: (id: string) => void;
+    /** All available color themes. */
+    themes: Theme[];
+};
+export declare function ThemeProvider({ children, defaultColorMode, storageKey, ...props }: ThemeProviderProps): import("react/jsx-runtime").JSX.Element;
+export declare const useTheme: () => ThemeProviderState;
+export {};