Authenticated Page service

Reads

• GET /api/v2/me — preserved account identity and session CSRF token.
• GET /api/v2/worlds — visible Worlds, up to 48 per cursor page.
• GET /api/v2/worlds/:id — descriptor and management capabilities.
• GET /api/v2/worlds/:id/pages — visible Pages, up to 48 per cursor page.
• GET /api/v2/pages/:id — descriptor, capabilities and latest messages; before cursor for older history.
• GET /api/v2/pages/:id/descriptor — metadata without downloading history.
• GET /api/v2/pages/changes?ids=… — revisions for up to 48 visible Pages.

Commands

Commands require the existing session, expected Origin, CSRF token and stable Idempotency-Key. Structure and access changes also require the current revision. Authorization is checked inside the transaction and again before replaying a receipt.

• POST /api/v2/worlds — atomically create a World and its General Page.
• POST /api/v2/worlds/:id/pages — create a chat, collection or project Page descriptor.
• POST /api/v2/worlds/:id/members — explicitly assign or revoke a member/reader/admin.
• POST /api/v2/pages/:id/messages — send text and up to four typed widget references.
• POST /api/v2/pages/:id/grants — assign or remove Page reader/writer access.

Permissions are not presentation

World membership and explicit Page grants decide access. A reference inside a readable chat does not reveal a restricted Page. Revocation clears readable state; rejoining does not restore removed restricted grants.

chatV1 and chatbottomtoolbarV1 require page.read. Sending is optional and requires message.send. A read-only user can therefore open the same recursive chat without getting a composer.

Measured boundaries

Current new metadata routes use JSON. Existing .page/.y2k Protobuf contracts are unchanged. This initial live release does not claim a new binary protocol or WebSocket transport.

• Latest 80 messages, limited additionally to 384 KiB of serialized messages.
• 4000 text characters and four strictly typed references per send.
• One account-bound provider and one three-second batched observer poll; unchanged revisions do not reload snapshots.
• Eight retained Page presentations; hidden widget observers suspend.

Try locally

The developer playground remains an IndexedDB example with no account connection. The authenticated localhost review uses disposable accounts and the existing sign-in handlers. It is not a production signup destination.

node scripts/build-world-review.mjs --service
# Apply migrations to the isolated local review database first.
node node_modules/wrangler/bin/wrangler.js dev --config wrangler.platform-review.jsonc --local --port 8895 --persist-to /private/tmp/world-platform-review-state