sbuilder-platform-api

The Store Builder platform silently skips publishing a page that has no saved draft and still answers 200. The sb_publish tool guards against this by asserting the page came back in the response and projecting the returned rows.

Agent keys prefixed wbk_ can upload via /api/media on current deployments, with POST /api/v1/media as a fallback door for older servers. The uploadMedia client retries the partner surface before blaming the key's scopes.

Yes, the platform's realtime gate gives a wbk_ bearer the same access as a session, gated on the member.read scope through the key's delegated principal. Older client-side refusals of agent keys on the socket have been removed.

The Store Builder wire protocol caps frames by kind: ops and snap frames may reach 4 MiB, but every other kind is capped at 64 KiB. Exceeding the cap closes the socket with StatusMessageTooBig, so large batches must be split.

The platform renames colliding slugs by suffixing -1, -2, and so on rather than refusing the request. The create call answers 200 with a slug the caller never requested, so links authored to the original slug will be dead.

The session access token lives roughly 15 minutes and rotates. Consumers must call Session.token() per use because it is a getter; capturing the string once replays an expired token, and socket auth failures are silent since onopen still fires.