@hosty-sdk/app 0.18.0 → 0.20.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * The postMessage type an embedded app sends its parent to request a fresh launch code.
+ * The postMessage type for an embedded app's authentication-required intent.
  * A frozen protocol constant: it deliberately does not track product branding (precedent:
  * the `x-docker-host-identity` header survived the docker-host→hosty rename untouched).
  * The payload carries no secret — the embedder verifies the sender before acting.
@@ -13,8 +13,8 @@ export declare function createAuthRequiredIntent(appId: string): AuthRequiredInt
 /**
  * The postMessage types of the delegated-token handshake: an embedded app page asks its embedder
  * for a short-TTL token scoped to itself, and the embedder answers with one it minted from Core.
- * Same shape of contract as the launch-code recovery above — the app cannot self-serve, because
- * minting needs the user's Core session in a first-party context, which only the embedder has.
+ * Minting a delegated token uses the embedder's first-party Core session. The app's own identity
+ * sign-in is separate: it navigates directly to Core or opens its own popup.
  *
  * The request carries no secret, so it is safe to broadcast; the answer does, so an embedder must
  * post it to the frame's own origin and never to `*`. Answering is a decision, not a reflex: the
@@ -126,8 +126,9 @@ export declare function buildCoreOpenUrl(corePublicOrigin: string | null, appId:
 /**
  * How a shell is presenting this app.
  *
- * - `embedded` — framed by the browser Shell. The shell renders navigation for this app, and a
- *   parent frame exists, so identity recovery is a `hosty:auth-required` post to it.
+ * - `embedded` — framed by the browser Shell. The shell renders navigation for this app. The
+ *   app restores its per-tab grant, tries a silent Core redirect on first load, then uses its
+ *   own Core popup when interaction is required. No credential passes through the parent.
  * - `native` — the top frame inside a native shell's web view (`apps/shell-swift`). The shell
  *   renders navigation, but there is no parent to post to, so recovery takes the standalone
  *   redirect — which is exactly the navigation that client intercepts to re-mint a launch code.
@@ -135,10 +136,9 @@ export declare function buildCoreOpenUrl(corePublicOrigin: string | null, appId:
  *   for this app, so it keeps its own.
  *
  * Two independent decisions read this one value and they do not split it the same way: chrome
- * is hidden whenever the mode is not `standalone` (`hidesAppChrome`), while the parent post
- * belongs to `embedded` alone (`decideRecoveryAction`). That asymmetry is the whole reason
- * `native` exists as its own value — calling a native web view `embedded` to get its chrome
- * hidden would send recovery to a parent that is not there.
+ * is hidden whenever the mode is not `standalone` (`hidesAppChrome`), while frame-local silent
+ * sign-in and popup recovery belong to `embedded` alone (`AppIdentityBridge`). A native web
+ * view keeps standalone recovery even though its app chrome is hidden.
  */
 export type AppLaunchMode = "embedded" | "native" | "standalone";
 /** The query parameter a shell appends to the launch URL to declare the mode. */
@@ -160,9 +160,8 @@ export declare function normalizeLaunchMode(value: unknown): AppLaunchMode | nul
  * `standalone` — a native shell's web view makes the app the top frame, so it reads as
  * `standalone`, which is why the declared `hosty_launch` parameter exists at all.
  *
- * This stays the input to the *recovery* decision, because whether a parent exists is a
- * structural fact that a declared value cannot override: a stale `embedded` would otherwise
- * post into a window with no shell listening.
+ * This stays the input to the *recovery* decision, because framing is a structural fact a
+ * declared value cannot override: a stale `embedded` must not select frame-only silent sign-in.
  */
 export declare function detectLaunchMode(win: Pick<Window, "self" | "top">): Exclude<AppLaunchMode, "native">;
 export interface LaunchModeResolution {

package/dist/index.js

@@ -4,7 +4,7 @@
 // This is the single source of truth for the Hosty app-session contract described in
 // docker-host docs/features/hosty-app-sdk/feature.md and docs/features/auth-session-lifecycle/feature.md.
 /**
- * The postMessage type an embedded app sends its parent to request a fresh launch code.
+ * The postMessage type for an embedded app's authentication-required intent.
  * A frozen protocol constant: it deliberately does not track product branding (precedent:
  * the `x-docker-host-identity` header survived the docker-host→hosty rename untouched).
  * The payload carries no secret — the embedder verifies the sender before acting.
@@ -16,8 +16,8 @@ export function createAuthRequiredIntent(appId) {
 /**
  * The postMessage types of the delegated-token handshake: an embedded app page asks its embedder
  * for a short-TTL token scoped to itself, and the embedder answers with one it minted from Core.
- * Same shape of contract as the launch-code recovery above — the app cannot self-serve, because
- * minting needs the user's Core session in a first-party context, which only the embedder has.
+ * Minting a delegated token uses the embedder's first-party Core session. The app's own identity
+ * sign-in is separate: it navigates directly to Core or opens its own popup.
  *
  * The request carries no secret, so it is safe to broadcast; the answer does, so an embedder must
  * post it to the frame's own origin and never to `*`. Answering is a decision, not a reflex: the
@@ -152,9 +152,8 @@ export function normalizeLaunchMode(value) {
  * `standalone` — a native shell's web view makes the app the top frame, so it reads as
  * `standalone`, which is why the declared `hosty_launch` parameter exists at all.
  *
- * This stays the input to the *recovery* decision, because whether a parent exists is a
- * structural fact that a declared value cannot override: a stale `embedded` would otherwise
- * post into a window with no shell listening.
+ * This stays the input to the *recovery* decision, because framing is a structural fact a
+ * declared value cannot override: a stale `embedded` must not select frame-only silent sign-in.
  */
 export function detectLaunchMode(win) {
     try {
@@ -241,7 +240,8 @@ export function decideRecoveryAction(input) {
     }
     // expired / not-present — the recoverable pair.
     //
-    // `embedded` is the only mode with a parent to ask. `native` deliberately falls through to the
+    // `embedded` selects app-owned interactive recovery after the bridge's silent first-load path.
+    // `native` deliberately falls through to the
     // redirect beside `standalone`: a native shell's web view has no parent, and the redirect to
     // Core's `/open` is the navigation that client watches for to re-mint a launch code. Adding a
     // mode must never quietly add a case here — a mode that cannot reach a shell has to redirect.

package/dist/install-react.js

@@ -64,7 +64,7 @@ export function InstallDialog({ client, source, onClose, onInstalled }) {
         else
             popup?.close();
     };
-    return _jsxs("dialog", { ref: dialog, className: "hosty-install", "aria-labelledby": titleId, onCancel: event => { event.preventDefault(); onClose(); }, children: [_jsx("style", { children: styles }), _jsxs("header", { children: [_jsx("h2", { id: titleId, children: "Install app" }), _jsx("button", { type: "button", onClick: onClose, "aria-label": "Close installation", children: "\u00D7" })] }), _jsx("p", { children: "Prepare the installation here, then confirm it securely in Hosty Core." }), !source?.feedsUrl && !source?.manifestPath && _jsxs("form", { onSubmit: event => { event.preventDefault(); void review(); }, children: [_jsxs("label", { children: ["Manifest, app directory, or URL", _jsx("input", { value: manifestPath, onChange: event => { setManifestPath(event.target.value); flow.clearReview(); }, required: true, disabled: busy || frozen })] }), _jsx("button", { disabled: busy || frozen || !manifestPath.trim(), children: "Review" })] }), busy && _jsx("p", { role: "status", children: "Preparing installation\u2026" }), error && _jsxs("div", { role: "alert", children: [_jsx("p", { children: error }), !frozen && _jsx("button", { type: "button", disabled: busy, onClick: () => void review(), children: "Retry review" })] }), plan && _jsxs("form", { onSubmit: event => { event.preventDefault(); void submit(); }, children: [_jsxs("h3", { children: [plan.displayName, " ", _jsx("small", { children: plan.targetVersion })] }), plan.description && _jsx("p", { children: plan.description }), _jsxs("label", { children: ["Runtime", _jsx("select", { value: plan.targetRuntime, disabled: busy || frozen, onChange: event => void review(event.target.value), children: (plan.runtimeProfiles ?? [{ key: plan.targetRuntime, type: plan.targetRuntimeType }]).map(runtime => _jsxs("option", { value: runtime.key, children: [runtime.key, " (", runtime.type, ")"] }, runtime.key)) })] }), plan.targetRuntimeType === "localCommand" && _jsx("p", { className: "warning", children: "This runtime runs commands directly on your host, outside a container. Only install code you trust." }), plan.system && _jsx("p", { className: "warning", children: "This is a system app. Only host administrators can open it." }), !!plan.requestedRoles?.length && _jsxs("section", { children: [_jsx("h3", { children: "Requested provider roles" }), _jsx("ul", { children: plan.requestedRoles.map(role => _jsx("li", { children: plan.roleDescriptions?.[role] ?? role }, role)) })] }), !!plan.corePermissions?.length && _jsxs("section", { children: [_jsx("h3", { children: "Requested Core permissions" }), _jsx("ul", { children: plan.corePermissions.map(permission => _jsx("li", { children: plan.permissionDescriptions?.[permission] ?? permission }, permission)) })] }), plan.settings.map(setting => _jsxs("label", { children: [setting.label || setting.key, setting.required ? " (required)" : "", setting.type === "boolean" && !setting.secret
+    return _jsxs("dialog", { ref: dialog, className: "hosty-install", "aria-labelledby": titleId, onCancel: event => { event.preventDefault(); onClose(); }, children: [_jsx("style", { children: styles }), _jsxs("header", { children: [_jsx("h2", { id: titleId, children: "Install app" }), _jsx("button", { type: "button", onClick: onClose, "aria-label": "Close installation", children: "\u00D7" })] }), _jsx("p", { children: "Prepare the installation here, then confirm it securely in Hosty Core." }), !source?.feedsUrl && !source?.manifestPath && _jsxs("form", { onSubmit: event => { event.preventDefault(); void review(); }, children: [_jsxs("label", { children: ["Manifest, app directory, or URL", _jsx("input", { value: manifestPath, onChange: event => { setManifestPath(event.target.value); flow.clearReview(); }, required: true, disabled: busy || frozen })] }), _jsx("button", { disabled: busy || frozen || !manifestPath.trim(), children: "Review" })] }), busy && _jsx("p", { role: "status", children: "Preparing installation\u2026" }), error && _jsxs("div", { role: "alert", children: [_jsx("p", { children: error }), !frozen && _jsx("button", { type: "button", disabled: busy, onClick: () => void review(), children: "Retry review" })] }), plan && _jsxs("form", { onSubmit: event => { event.preventDefault(); void submit(); }, children: [_jsxs("h3", { children: [plan.displayName, " ", _jsx("small", { children: plan.targetVersion })] }), plan.description && _jsx("p", { children: plan.description }), _jsxs("label", { children: ["Runtime", _jsx("select", { value: plan.targetRuntime, disabled: busy || frozen, onChange: event => void review(event.target.value), children: (plan.runtimeProfiles ?? [{ key: plan.targetRuntime, type: plan.targetRuntimeType }]).map(runtime => _jsxs("option", { value: runtime.key, children: [runtime.key, " (", runtime.type, ")"] }, runtime.key)) })] }), plan.targetRuntimeType === "localCommand" && _jsx("p", { className: "warning", children: "This runtime runs commands directly on your host, outside a container. Only install code you trust." }), plan.system && _jsx("p", { className: "warning", children: "This is a system app. User access is controlled by Hosty assignments." }), !!plan.requestedRoles?.length && _jsxs("section", { children: [_jsx("h3", { children: "Requested provider roles" }), _jsx("ul", { children: plan.requestedRoles.map(role => _jsx("li", { children: plan.roleDescriptions?.[role] ?? role }, role)) })] }), !!plan.corePermissions?.length && _jsxs("section", { children: [_jsx("h3", { children: "Requested Core permissions" }), _jsx("ul", { children: plan.corePermissions.map(permission => _jsx("li", { children: plan.permissionDescriptions?.[permission] ?? permission }, permission)) })] }), plan.settings.map(setting => _jsxs("label", { children: [setting.label || setting.key, setting.required ? " (required)" : "", setting.type === "boolean" && !setting.secret
                                 ? _jsx("input", { type: "checkbox", checked: ["true", "1", "yes", "on", "enabled"].includes((settings[setting.key] ?? "").toLowerCase()), disabled: busy || frozen, onChange: event => setSettings(current => ({ ...current, [setting.key]: String(event.target.checked) })) })
                                 : setting.type === "select" && setting.options?.length && !setting.secret
                                     ? _jsxs("select", { value: settings[setting.key] ?? "", disabled: busy || frozen, onChange: event => setSettings(current => ({ ...current, [setting.key]: event.target.value })), children: [_jsx("option", { value: "", children: "Select a value" }), setting.options.map(option => _jsx("option", { value: option.value, children: option.label }, option.value))] })

package/dist/install.d.ts

@@ -47,11 +47,61 @@ export interface InstallationSource {
     planDigest?: string;
     /** Review permission declarations and optional grants for this installed app, without reinstalling it. */
     permissionsAppId?: string;
+    /** Request removal of this installed app. Core freezes these options for its confirmation page. */
+    removeAppId?: string;
+    removalOptions?: {
+        deleteRuntimeState?: boolean;
+        deleteData?: boolean;
+        deleteBackups?: boolean;
+        deleteSource?: boolean;
+        ignoreRuntimeErrors?: boolean;
+    };
+    hostPathChange?: {
+        kind: "source-override";
+        appId: string;
+        source: {
+            path: string;
+            commit?: string;
+        };
+    } | {
+        kind: "app-mounts";
+        appId: string;
+        mounts: {
+            mounts: {
+                key: string;
+                label?: string | null;
+                hostPath?: string | null;
+                globalMountName?: string | null;
+            }[];
+        };
+    } | {
+        kind: "global-mount";
+        globalMount: {
+            name: string;
+            hostPath: string;
+            mode?: string;
+            description?: string | null;
+        };
+    };
+    /** Personal source selection requires apps.sources as well as apps.install and Core review. */
+    sourceConnections?: {
+        manifestConnectionId?: string;
+        gitConnectionId?: string;
+        clearManifestConnection?: boolean;
+        clearGitConnection?: boolean;
+    };
 }
 export interface InstallationRequest {
     id: string;
     status: "draft" | "pending" | "executing" | "succeeded" | "denied" | "failed";
     plan: InstallPlan | null;
+    updatePlan?: {
+        appId: string;
+        displayName: string;
+        targetVersion: string;
+        targetRuntime: string;
+        changes: string[];
+    } | null;
     permissionPlan?: {
         appId: string;
         displayName: string;
@@ -61,13 +111,24 @@ export interface InstallationRequest {
         acceptedRequired?: string[];
         acceptedOptional?: string[];
     } | null;
+    removalPlan?: {
+        appId: string;
+        displayName: string;
+        version: string;
+        options: NonNullable<InstallationSource["removalOptions"]>;
+    } | null;
+    hostPathPlan?: {
+        change: InstallationSource["hostPathChange"];
+        displayName: string;
+        details: string[];
+    } | null;
     approvalUrl: string;
     expiresAt: string;
     error?: string | null;
 }
 export interface InstallationClient {
     prepare(source: InstallationSource): Promise<InstallationRequest>;
-    submit(id: string, settings: Record<string, string | null>, autostart: boolean, optionalPermissions?: string[]): Promise<InstallationRequest>;
+    submit(id: string, settings: Record<string, string | null>, autostart: boolean): Promise<InstallationRequest>;
     status(id: string): Promise<InstallationRequest>;
 }
 export declare class InstallationError extends Error {

package/dist/install.js

@@ -1,3 +1,4 @@
+import { appFetch } from "./browser-auth.js";
 export class InstallationError extends Error {
     status;
     code;
@@ -9,7 +10,7 @@ export class InstallationError extends Error {
 }
 export function createInstallationClient(options = {}) {
     const base = (options.baseUrl ?? "/api/hosty/installations").replace(/\/$/, "");
-    const request = options.request ?? ((url, body, method = "POST") => fetch(url, {
+    const request = options.request ?? ((url, body, method = "POST") => appFetch(url, {
         method, credentials: "same-origin", cache: "no-store",
         headers: { "Content-Type": "application/json" },
         body: body === undefined ? undefined : JSON.stringify(body),
@@ -25,7 +26,7 @@ export function createInstallationClient(options = {}) {
     }
     return {
         prepare: source => call("", source),
-        submit: (id, settings, autostart, optionalPermissions) => call(`/${encodeURIComponent(id)}/submit`, { settings, autostart, ...(optionalPermissions === undefined ? {} : { optionalPermissions }) }),
+        submit: (id, settings, autostart) => call(`/${encodeURIComponent(id)}/submit`, { settings, autostart }),
         status: id => call(`/${encodeURIComponent(id)}`, undefined, "GET"),
     };
 }

package/dist/permission-types.d.ts

@@ -0,0 +1,7 @@
+import type { AppPermissionState } from "./providers.js";
+export type PermissionNoticeState = {
+    hostRole: string | null;
+    appId: string;
+    corePublicOrigin: string | null;
+    permissions: AppPermissionState | null;
+};

package/dist/permission-types.js

@@ -0,0 +1 @@
+export {};

package/dist/permissions-react.d.ts

@@ -0,0 +1,4 @@
+/** App-owned GET endpoint authenticates the viewer and calls readOwnPermissionNotice. */
+export declare function MissingPermissionsNotice({ endpoint }: {
+    endpoint?: string;
+}): import("react").JSX.Element | null;

package/dist/permissions-react.js

@@ -0,0 +1,48 @@
+"use client";
+import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
+import { useEffect, useState } from "react";
+import { appFetch } from "./browser-auth.js";
+import { permissionNotice, requestPermissionReview } from "./permissions.js";
+/** App-owned GET endpoint authenticates the viewer and calls readOwnPermissionNotice. */
+export function MissingPermissionsNotice({ endpoint = "/api/hosty/permissions" }) {
+    const [state, setState] = useState(null);
+    const [dismissed, setDismissed] = useState(false);
+    const [pending, setPending] = useState(false);
+    useEffect(() => {
+        const controller = new AbortController();
+        let loading = false;
+        const refresh = async () => {
+            if (loading)
+                return;
+            loading = true;
+            try {
+                const response = await appFetch(endpoint, { cache: "no-store", signal: controller.signal });
+                if (!response.ok) {
+                    setState(null);
+                    return;
+                }
+                const next = await response.json();
+                if (!controller.signal.aborted) {
+                    setState(next);
+                    if (!permissionNotice(next))
+                        setPending(false);
+                }
+            }
+            catch { /* A transient failure must not erase a known setup warning. */ }
+            finally {
+                loading = false;
+            }
+        };
+        void refresh();
+        window.addEventListener("focus", refresh);
+        const timer = pending ? window.setInterval(refresh, 2000) : undefined;
+        return () => { controller.abort(); window.removeEventListener("focus", refresh); window.clearInterval(timer); };
+    }, [endpoint, pending]);
+    const kind = state && permissionNotice(state);
+    if (dismissed || !kind || !state)
+        return null;
+    return _jsxs("section", { "data-hosty-activity-control": true, role: "alert", "aria-label": "Required permissions", style: { border: "1px solid currentColor", padding: 12, margin: 8, borderRadius: 8, color: "#c2410c" }, children: [kind === "unsupported"
+                ? _jsxs("p", { children: ["Core does not support required permissions: ", state.permissions.unsupportedRequired.join(", "), ". Update the app or Core."] })
+                : _jsx("p", { children: "This app needs required permissions. Operations using them are unavailable until approval." }), kind === "missing" && state.permissions?.reviewAvailable !== false && state.corePublicOrigin &&
+                _jsx("button", { type: "button", onClick: () => { requestPermissionReview(state); setPending(true); }, children: "Request permissions" }), pending && _jsx("p", { children: "Review permissions in Core, then return here. You can leave this app installed without approving." }), _jsx("button", { type: "button", onClick: () => { setDismissed(true); setPending(false); }, style: { marginLeft: 12 }, children: "Dismiss" })] });
+}

package/dist/permissions-server.d.ts

@@ -0,0 +1,6 @@
+import { type ProviderServerOptions } from "@hosty-sdk/app/providers/server";
+import type { PermissionNoticeState } from "./permission-types.js";
+/** Server-only: pass the role from an authenticated session, never from request input. */
+export declare function readOwnPermissionNotice(hostRole: string | null, options?: ProviderServerOptions & {
+    corePublicOrigin?: string | null;
+}, signal?: AbortSignal): Promise<PermissionNoticeState>;

package/dist/permissions-server.js

@@ -0,0 +1,13 @@
+import { ProviderClient } from "@hosty-sdk/app/providers/server";
+/** Server-only: pass the role from an authenticated session, never from request input. */
+export async function readOwnPermissionNotice(hostRole, options = {}, signal) {
+    const state = {
+        hostRole,
+        appId: options.appId ?? process.env.HOSTY_APP_ID ?? "",
+        corePublicOrigin: options.corePublicOrigin ?? process.env.HOSTY_CORE_PUBLIC_ORIGIN ?? null,
+        permissions: null,
+    };
+    if (hostRole === "host.admin")
+        state.permissions = await new ProviderClient(options).permissions(signal);
+    return state;
+}

package/dist/permissions.d.ts

@@ -0,0 +1,8 @@
+import type { PermissionNoticeState } from "./permission-types.js";
+export type { PermissionNoticeState } from "./permission-types.js";
+export declare const PERMISSION_REVIEW_REQUEST = "hosty:request-permission-review";
+/** No optional declaration, or declaration alone, confers authority. */
+export declare function permissionNotice(state: PermissionNoticeState): "missing" | "unsupported" | null;
+export declare function permissionReviewUrl(corePublicOrigin: string, appId: string): string;
+/** Invoke synchronously from a user click. The embedder determines the app from its frame. */
+export declare function requestPermissionReview(state: PermissionNoticeState, browser?: Pick<Window, "parent" | "open">): void;

package/dist/permissions.js

@@ -0,0 +1,25 @@
+export const PERMISSION_REVIEW_REQUEST = "hosty:request-permission-review";
+/** No optional declaration, or declaration alone, confers authority. */
+export function permissionNotice(state) {
+    if (state.hostRole !== "host.admin" || !state.permissions)
+        return null;
+    const p = state.permissions;
+    if (p.unsupportedRequired?.length)
+        return "unsupported";
+    return p.required.some(name => !p.granted.includes(name)) ? "missing" : null;
+}
+export function permissionReviewUrl(corePublicOrigin, appId) {
+    const core = new URL(corePublicOrigin);
+    if (!["http:", "https:"].includes(core.protocol) || core.username || core.password)
+        throw new Error("Invalid Core origin");
+    return new URL(`/install/permissions/${encodeURIComponent(appId)}`, core.origin).href;
+}
+/** Invoke synchronously from a user click. The embedder determines the app from its frame. */
+export function requestPermissionReview(state, browser = window) {
+    if (permissionNotice(state) !== "missing" || state.permissions?.reviewAvailable === false || !state.corePublicOrigin)
+        return;
+    if (browser.parent !== browser)
+        browser.parent.postMessage({ type: PERMISSION_REVIEW_REQUEST }, "*");
+    else
+        browser.open(permissionReviewUrl(state.corePublicOrigin, state.appId), "_blank", "noopener,noreferrer");
+}

package/dist/providers-server.d.ts

@@ -1,5 +1,5 @@
-import { AssistantClient } from "./assistant.js";
-import { type AppPermissionState, type ProviderDescriptor, type ProviderInvocation, type ProviderKind, type SpeechCapabilities, type SpeechResult } from "./providers.js";
+import { AssistantClient } from "@hosty-sdk/app/assistant";
+import { type AppPermissionState, type ProviderDescriptor, type ProviderInvocation, type ProviderKind, type SpeechCapabilities, type SpeechResult } from "@hosty-sdk/app/providers";
 export type ProviderServerOptions = {
     appId?: string;
     coreOrigin?: string;

package/dist/providers-server.js

@@ -1,5 +1,5 @@
-import { AssistantClient } from "./assistant.js";
-import { ProviderError } from "./providers.js";
+import { AssistantClient } from "@hosty-sdk/app/assistant";
+import { ProviderError } from "@hosty-sdk/app/providers";
 /** Server-only provider client. Its app service token must never be sent to a browser or provider. */
 export class ProviderClient {
     appId;

package/dist/providers.d.ts

@@ -15,6 +15,8 @@ export type AppPermissionState = {
     optional: string[];
     granted: string[];
     reviewAvailable?: boolean;
+    unsupportedRequired?: string[];
+    status?: string;
 };
 export type ProviderInvocation = {
     callerAppId: string;

package/dist/react.d.ts

@@ -34,6 +34,8 @@ export type AppIdentityBridgeState = {
     kind: "signin";
     openUrl: string | null;
     embedded: boolean;
+    signIn?: () => void;
+    error?: string;
 } | {
     kind: "denied";
 } | {
@@ -48,15 +50,17 @@ export interface AppIdentityBridgeProps {
     appCodePath?: string;
     /** Optional app-owned rendering, including loading and active content. Recovery remains SDK-owned. */
     renderState?: (state: AppIdentityBridgeState) => ReactNode;
+    children?: ReactNode;
 }
 /**
  * Mount once at the top of the root layout body. On first load it consumes a `?code` from
  * the URL (exchanging it for the identity cookie), then probes the session and runs the
- * recovery decision: silent `hosty:auth-required` to the Shell when embedded, a once-per-tab
+ * recovery decision: a silent first-load Core navigation followed by an app-owned popup
+ * when embedded, a once-per-tab
  * redirect through Core `/open` when standalone, and cards only in fallback/terminal states
  * — never a login UI while recovery is still running.
  */
-export declare function AppIdentityBridge({ probePath, appCodePath, renderState, }?: AppIdentityBridgeProps): string | number | bigint | boolean | import("react").JSX.Element | Iterable<ReactNode> | Promise<string | number | bigint | boolean | import("react").ReactPortal | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | Iterable<ReactNode> | null | undefined> | null | undefined;
+export declare function AppIdentityBridge({ probePath, appCodePath, renderState, children, }?: AppIdentityBridgeProps): string | number | bigint | boolean | Iterable<ReactNode> | Promise<string | number | bigint | boolean | import("react").ReactPortal | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | Iterable<ReactNode> | null | undefined> | import("react").JSX.Element | null | undefined;
 export interface HostThemeBridgeProps {
     /**
      * Whether the operating system decides the theme while no shell has spoken — `true` unless the
@@ -85,3 +89,5 @@ export interface HostThemeBridgeProps {
  * choice is not overruled by the OS.
  */
 export declare function HostThemeBridge({ followSystem, onTheme }?: HostThemeBridgeProps): null;
+export { MissingPermissionsNotice } from "./permissions-react.js";
+export { AppActivityBridge } from "./activity-react.js";