@neta-art/cohub 2.3.0 → 2.5.0

package/dist/index.js

@@ -97,10 +97,10 @@ var UsersApi = class {
 };
 //#endregion
 //#region src/work-runtime.ts
-const isBrowser = () => typeof window !== "undefined" && typeof window.parent !== "undefined";
-const hasParent = () => isBrowser() && window.parent !== window;
+const isBrowser$1 = () => typeof window !== "undefined" && typeof window.parent !== "undefined";
+const hasParent = () => isBrowser$1() && window.parent !== window;
 const getParentOrigin = () => {
-	if (!isBrowser()) return null;
+	if (!isBrowser$1()) return null;
 	const ancestorOrigin = window.location.ancestorOrigins?.[0];
 	if (typeof ancestorOrigin === "string" && ancestorOrigin) return ancestorOrigin;
 	try {
@@ -109,84 +109,258 @@ const getParentOrigin = () => {
 		return null;
 	}
 };
-let trustedParentOrigin = null;
-const request = (message, timeoutMs = 1200, retryIntervalMs) => {
-	if (!hasParent()) return Promise.resolve(null);
-	const requestId = globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`;
-	return new Promise((resolve, reject) => {
-		let retryTimer = null;
-		const parentOrigin = trustedParentOrigin ?? getParentOrigin();
-		const postRequest = () => {
-			try {
-				window.parent.postMessage({
-					...message,
-					requestId
-				}, parentOrigin ?? "*");
-			} catch {
+const generateRequestId = () => globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`;
+/**
+* Bridge-mode transport: posts messages to `window.parent` (the Cohub host
+* embedding the work in an iframe) and listens for the matching reply.
+* Behaviorally identical to the previous module-level `request()` helper.
+*/
+var ParentBridgeTransport = class {
+	trustedParentOrigin = null;
+	request(message, options) {
+		const timeoutMs = options?.timeoutMs ?? 1200;
+		const retryIntervalMs = options?.retryIntervalMs;
+		if (!hasParent()) return Promise.resolve(null);
+		const requestId = generateRequestId();
+		return new Promise((resolve, reject) => {
+			let retryTimer = null;
+			const parentOrigin = this.trustedParentOrigin ?? getParentOrigin();
+			const postRequest = () => {
+				try {
+					window.parent.postMessage({
+						...message,
+						requestId
+					}, parentOrigin ?? "*");
+				} catch {
+					return;
+				}
+			};
+			const cleanup = () => {
+				clearTimeout(timer);
+				if (retryTimer) clearInterval(retryTimer);
+				window.removeEventListener("message", onMessage);
+			};
+			const timer = setTimeout(() => {
+				cleanup();
+				resolve(null);
+			}, timeoutMs);
+			const onMessage = (event) => {
+				if (event.source !== window.parent) return;
+				if (parentOrigin && event.origin !== parentOrigin) return;
+				const data = event.data;
+				if (!data || data.requestId !== requestId) return;
+				cleanup();
+				this.trustedParentOrigin = event.origin;
+				if (data.type === "cohub.work.error") {
+					reject(new Error(data.message));
+					return;
+				}
+				resolve(data);
+			};
+			window.addEventListener("message", onMessage);
+			postRequest();
+			if (retryIntervalMs) retryTimer = setInterval(postRequest, retryIntervalMs);
+		});
+	}
+};
+/**
+* Broker-mode transport for standalone-deployed works. Opens a popup window to
+* the Cohub auth broker page, performs a ready-handshake, sends the request via
+* postMessage, and resolves with the broker's response. The popup is closed
+* after a single request is fulfilled (one-shot, per §7.2 of the plan).
+*
+* Non-interactive messages (`context`, `checkout-state`) are answered locally
+* without opening a popup — the work already knows its own workId, and
+* checkout state is not available on the work's own origin in broker mode.
+*/
+var PopupBrokerTransport = class {
+	brokerOrigin;
+	workId;
+	constructor(config) {
+		this.brokerOrigin = config.brokerOrigin;
+		this.workId = config.workId;
+	}
+	request(message, options) {
+		if (message.type === "cohub.work.context") return Promise.resolve({
+			type: "cohub.work.context.result",
+			context: {
+				work: {
+					id: this.workId,
+					slug: "",
+					url: null
+				},
+				space: { id: "" },
+				permissions: {
+					scopes: [],
+					workScopes: [],
+					viewerScopes: []
+				}
+			}
+		});
+		if (message.type === "cohub.work.checkout-state") return Promise.resolve({
+			type: "cohub.work.checkout-state.result",
+			status: null,
+			orderId: null
+		});
+		const timeoutMs = options?.timeoutMs ?? 12e4;
+		const requestId = generateRequestId();
+		return new Promise((resolve, reject) => {
+			if (typeof window === "undefined" || typeof window.open !== "function") {
+				resolve(null);
 				return;
 			}
-		};
-		const cleanup = () => {
-			clearTimeout(timer);
-			if (retryTimer) clearInterval(retryTimer);
-			window.removeEventListener("message", onMessage);
-		};
-		const timer = setTimeout(() => {
-			cleanup();
-			resolve(null);
-		}, timeoutMs);
-		const onMessage = (event) => {
-			if (event.source !== window.parent) return;
-			if (parentOrigin && event.origin !== parentOrigin) return;
-			const data = event.data;
-			if (!data || data.requestId !== requestId) return;
-			cleanup();
-			trustedParentOrigin = event.origin;
-			if (data.type === "cohub.work.error") {
-				reject(new Error(data.message));
+			const workOrigin = window.location.origin;
+			const brokerUrl = `${this.brokerOrigin}/work-auth?work=${encodeURIComponent(this.workId)}&origin=${encodeURIComponent(workOrigin)}`;
+			const popup = window.open(brokerUrl, "cohub-work-auth", "popup,width=480,height=640");
+			if (!popup) {
+				reject(/* @__PURE__ */ new Error("Failed to open authorization window. Please allow popups for this site."));
 				return;
 			}
-			resolve(data);
-		};
-		window.addEventListener("message", onMessage);
-		postRequest();
-		if (retryIntervalMs) retryTimer = setInterval(postRequest, retryIntervalMs);
-	});
+			let ready = false;
+			let settled = false;
+			let timer = null;
+			let closeChecker = null;
+			const finish = (fn) => {
+				if (settled) return;
+				settled = true;
+				if (timer) clearTimeout(timer);
+				if (closeChecker) clearInterval(closeChecker);
+				window.removeEventListener("message", onMessage);
+				try {
+					popup.close();
+				} catch {}
+				fn();
+			};
+			timer = setTimeout(() => {
+				finish(() => {
+					if (!ready) reject(/* @__PURE__ */ new Error("Authorization window did not respond in time."));
+					else resolve(null);
+				});
+			}, timeoutMs);
+			const onMessage = (event) => {
+				if (event.source !== popup) return;
+				if (event.origin !== this.brokerOrigin) return;
+				const data = event.data;
+				if (!data) return;
+				if (data.type === "cohub.work.broker.ready" && !ready) {
+					ready = true;
+					try {
+						popup.postMessage({
+							...message,
+							requestId
+						}, this.brokerOrigin);
+					} catch {
+						finish(() => reject(/* @__PURE__ */ new Error("Failed to send request to authorization window.")));
+					}
+					return;
+				}
+				if (data.requestId !== requestId) return;
+				finish(() => {
+					if (data.type === "cohub.work.error") {
+						reject(new Error(data.message));
+						return;
+					}
+					resolve(data);
+				});
+			};
+			window.addEventListener("message", onMessage);
+			closeChecker = setInterval(() => {
+				if (popup.closed) finish(() => {
+					if (!ready) reject(/* @__PURE__ */ new Error("Authorization window was closed."));
+					else resolve(null);
+				});
+			}, 500);
+		});
+	}
 };
+const TOKEN_STORAGE_PREFIX = "cohub:work-token";
 var WorkRuntimeApi = class {
 	token = null;
+	transport;
+	tokenStorageKey;
+	constructor(transport = new ParentBridgeTransport(), workId) {
+		this.transport = transport;
+		this.tokenStorageKey = workId ? `${TOKEN_STORAGE_PREFIX}:${workId}` : null;
+		this.token = this.readStoredToken();
+	}
+	readStoredToken() {
+		if (!this.tokenStorageKey || typeof localStorage === "undefined") return null;
+		try {
+			return localStorage.getItem(this.tokenStorageKey);
+		} catch {
+			return null;
+		}
+	}
+	writeStoredToken(token) {
+		if (!this.tokenStorageKey || typeof localStorage === "undefined") return;
+		try {
+			if (token) localStorage.setItem(this.tokenStorageKey, token);
+			else localStorage.removeItem(this.tokenStorageKey);
+		} catch {}
+	}
 	async context() {
-		return (await request({ type: "cohub.work.context" }, 8e3, 250))?.context ?? null;
+		return (await this.transport.request({ type: "cohub.work.context" }, {
+			timeoutMs: 8e3,
+			retryIntervalMs: 250
+		}))?.context ?? null;
 	}
 	async getAccessToken(options) {
 		if (this.token && !options?.forceRefresh) return this.token;
-		const response = await request({
+		if (options?.forceRefresh) {
+			this.token = null;
+			this.writeStoredToken(null);
+		}
+		const response = await this.transport.request({
 			type: "cohub.work.token",
 			forceRefresh: Boolean(options?.forceRefresh)
-		}, 2e4);
+		}, { timeoutMs: 2e4 });
 		this.token = response?.token ?? null;
+		this.writeStoredToken(this.token);
 		return this.token;
 	}
 	async requestAuthorization(input) {
-		const response = await request({
+		const response = await this.transport.request({
 			type: "cohub.work.authorize",
 			scopes: input.scopes,
 			reason: input.reason
-		}, 12e4);
+		}, { timeoutMs: 12e4 });
 		this.token = response?.token ?? null;
+		this.writeStoredToken(this.token);
 		return Boolean(this.token);
 	}
 	async purchase(input) {
-		return (await request({
+		return (await this.transport.request({
 			type: "cohub.work.purchase",
 			productKey: input.productKey
-		}, 12e4))?.checkout ?? null;
+		}, { timeoutMs: 12e4 }))?.checkout ?? null;
 	}
 	async checkoutState() {
-		return await request({ type: "cohub.work.checkout-state" }, 8e3, 250) ?? null;
+		return await this.transport.request({ type: "cohub.work.checkout-state" }, {
+			timeoutMs: 8e3,
+			retryIntervalMs: 250
+		}) ?? null;
 	}
 };
-const createWorkRuntime = () => new WorkRuntimeApi();
+/**
+* Resolves the appropriate transport based on the work mode configuration.
+* Auto-detection: inside an iframe → bridge; standalone with broker config →
+* broker; otherwise → bridge (returns null for non-work contexts).
+*/
+function resolveWorkTransport(config) {
+	const explicitMode = config?.mode;
+	const brokerOrigin = config?.brokerOrigin;
+	const workId = config?.workId;
+	const hasBrokerConfig = Boolean(brokerOrigin && workId);
+	const createBroker = () => brokerOrigin && workId ? new PopupBrokerTransport({
+		brokerOrigin,
+		workId
+	}) : new ParentBridgeTransport();
+	if (explicitMode === "bridge") return new ParentBridgeTransport();
+	if (explicitMode === "broker") return createBroker();
+	if (typeof window !== "undefined" && window.parent !== window) return new ParentBridgeTransport();
+	return hasBrokerConfig ? createBroker() : new ParentBridgeTransport();
+}
+const createWorkRuntime = (transport, workId) => new WorkRuntimeApi(transport, workId);
 //#endregion
 //#region src/client.ts
 var CohubClient = class {
@@ -214,7 +388,8 @@ var CohubClient = class {
 	workRuntime;
 	constructor(options = {}) {
 		const apiBaseUrl = resolveApiBaseUrl(options);
-		this.workRuntime = createWorkRuntime();
+		const workTransport = resolveWorkTransport(options.work);
+		this.workRuntime = createWorkRuntime(workTransport, options.work?.workId);
 		const getAccessToken = options.getAccessToken ?? ((tokenOptions) => this.workRuntime.getAccessToken(tokenOptions));
 		const resolvedOptions = {
 			...options,
@@ -340,6 +515,414 @@ var CohubClient = class {
 };
 const createCohubClient = (options) => new CohubClient(options);
 //#endregion
+//#region src/work-grant-cache.ts
+const STORAGE_PREFIX = "cohub:work-grants";
+const CACHE_VERSION = 1;
+const MAX_AGE_MS = 336 * 60 * 60 * 1e3;
+function isBrowser() {
+	return typeof localStorage !== "undefined";
+}
+function storageKey(userUuid, workId) {
+	return `${STORAGE_PREFIX}:${encodeURIComponent(userUuid)}:${encodeURIComponent(workId)}:v${CACHE_VERSION}`;
+}
+function userPrefix(userUuid) {
+	return `${STORAGE_PREFIX}:${encodeURIComponent(userUuid)}:`;
+}
+function isPermissionArray(value) {
+	return Array.isArray(value) && value.every((v) => typeof v === "string");
+}
+function isCachedWorkGrant(value) {
+	if (!value || typeof value !== "object") return false;
+	const record = value;
+	return record.version === CACHE_VERSION && typeof record.userUuid === "string" && typeof record.workId === "string" && isPermissionArray(record.scopes) && typeof record.updatedAt === "number";
+}
+function readEntry(userUuid, workId) {
+	if (!isBrowser()) return null;
+	const key = storageKey(userUuid, workId);
+	try {
+		const raw = localStorage.getItem(key);
+		if (!raw) return null;
+		const parsed = JSON.parse(raw);
+		if (!isCachedWorkGrant(parsed) || parsed.userUuid !== userUuid || parsed.workId !== workId) {
+			localStorage.removeItem(key);
+			return null;
+		}
+		if (Date.now() - parsed.updatedAt > MAX_AGE_MS) {
+			localStorage.removeItem(key);
+			return null;
+		}
+		return parsed;
+	} catch {
+		try {
+			localStorage.removeItem(key);
+		} catch {}
+		return null;
+	}
+}
+/**
+* Returns true when the viewer has previously granted every requested scope
+* for this work, allowing a silent re-authorization.
+*/
+function hasGrantedWorkScopes(userUuid, workId, scopes) {
+	if (!userUuid || !workId || scopes.length === 0) return false;
+	const entry = readEntry(userUuid, workId);
+	if (!entry) return false;
+	const granted = new Set(entry.scopes);
+	return scopes.every((scope) => granted.has(scope));
+}
+/**
+* Records the granted scopes for a work, merged with any previously granted
+* scopes so a growing permission set stays covered.
+*/
+function setGrantedWorkScopes(userUuid, workId, scopes) {
+	if (!userUuid || !workId || scopes.length === 0) return;
+	const existing = readEntry(userUuid, workId);
+	const entry = {
+		version: CACHE_VERSION,
+		userUuid,
+		workId,
+		scopes: Array.from(new Set([...existing?.scopes ?? [], ...scopes])),
+		updatedAt: Date.now()
+	};
+	if (!isBrowser()) return;
+	try {
+		localStorage.setItem(storageKey(userUuid, workId), JSON.stringify(entry));
+	} catch {}
+}
+/**
+* Clears cached grants. Pass a workId to clear a single work, or omit it to
+* clear every cached grant for the user (used on sign-out).
+*/
+function clearGrantedWorkScopes(userUuid, workId) {
+	if (!isBrowser() || !userUuid) return;
+	try {
+		if (workId) {
+			localStorage.removeItem(storageKey(userUuid, workId));
+			return;
+		}
+		const prefix = userPrefix(userUuid);
+		for (let i = localStorage.length - 1; i >= 0; i -= 1) {
+			const key = localStorage.key(i);
+			if (key?.startsWith(prefix)) localStorage.removeItem(key);
+		}
+	} catch {}
+}
+//#endregion
+//#region src/work-bridge-core.ts
+function readTokenResponse(value) {
+	if (!value || typeof value !== "object") return null;
+	const token = value.token;
+	return typeof token === "string" && token ? token : null;
+}
+function clonePermissionScopes(scopes) {
+	return Array.from(scopes ?? []).filter((scope) => typeof scope === "string");
+}
+/**
+* Framework-agnostic work bridge host core — message handling, work session
+* token minting, authorization (with silent re-grant cache), and
+* purchase/checkout flow — without any rendering or reactive primitives.
+*
+* Both the Cohub iframe host (WorkSurface, Svelte) and the standalone broker
+* page compose this with their own transport-specific reply and auth
+* dependencies. External hosts (e.g. Neta-Studio in React) can do the same.
+*/
+function createWorkBridgeCore(config) {
+	const { work, reply, getCheckoutState, getAccessToken, getViewerUuid } = config;
+	const apiOrigin = config.apiOrigin;
+	const isBackground = config.isBackground ?? false;
+	const onStateChange = config.onStateChange;
+	let workToken = null;
+	const state = {
+		authOpen: false,
+		pendingAuth: null,
+		authError: null,
+		authSaving: false,
+		purchaseOpen: false,
+		pendingPurchase: null,
+		purchaseError: null,
+		purchaseSaving: false
+	};
+	function notify() {
+		onStateChange?.({ ...state });
+	}
+	const pendingPurchaseStorageKey = `cohub-work-purchase:${work.id}`;
+	async function isCurrentViewerWorkOwner() {
+		const viewerUuid = await getViewerUuid();
+		return Boolean(viewerUuid && viewerUuid === work.userUuid);
+	}
+	async function ensureBaseToken(forceRefresh = false) {
+		if (workToken && !forceRefresh) return workToken;
+		const userToken = await getAccessToken({ forceRefresh });
+		if (!userToken) {
+			await config.requestSignIn(typeof location !== "undefined" ? location.pathname : "/");
+			return null;
+		}
+		const response = await fetch(`${apiOrigin}/api/works/${work.id}/session`, {
+			method: "POST",
+			headers: { Authorization: `Bearer ${userToken}` }
+		});
+		if (!response.ok) throw new Error("Failed to create work session.");
+		const token = readTokenResponse(await response.json());
+		if (!token) throw new Error("Invalid work session response.");
+		workToken = token;
+		return workToken;
+	}
+	async function authorize(scopes) {
+		const userToken = await getAccessToken();
+		if (!userToken) {
+			await config.requestSignIn(typeof location !== "undefined" ? location.pathname : "/");
+			return null;
+		}
+		const response = await fetch(`${apiOrigin}/api/works/${work.id}/authorize`, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${userToken}`,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({ scopes })
+		});
+		if (!response.ok) throw new Error((await response.json().catch(() => null))?.message ?? "Authorization failed.");
+		const token = readTokenResponse(await response.json());
+		if (!token) throw new Error("Invalid work authorization response.");
+		workToken = token;
+		return workToken;
+	}
+	function writePendingPurchase(input) {
+		if (typeof sessionStorage === "undefined") return;
+		try {
+			sessionStorage.setItem(pendingPurchaseStorageKey, JSON.stringify({
+				...input,
+				at: Date.now()
+			}));
+		} catch {}
+	}
+	function readPendingPurchase() {
+		if (typeof sessionStorage === "undefined") return null;
+		try {
+			const raw = sessionStorage.getItem(pendingPurchaseStorageKey);
+			if (!raw) return null;
+			const parsed = JSON.parse(raw);
+			return typeof parsed.orderId === "string" && typeof parsed.productKey === "string" && typeof parsed.at === "number" ? {
+				orderId: parsed.orderId,
+				productKey: parsed.productKey,
+				at: parsed.at
+			} : null;
+		} catch {
+			return null;
+		}
+	}
+	function clearPendingPurchase() {
+		if (typeof sessionStorage === "undefined") return;
+		try {
+			sessionStorage.removeItem(pendingPurchaseStorageKey);
+		} catch {}
+	}
+	async function createPurchase(productKey) {
+		const userToken = await getAccessToken();
+		if (!userToken) {
+			await config.requestSignIn(typeof location !== "undefined" ? location.pathname + location.search + location.hash : "/");
+			return null;
+		}
+		const response = await fetch(`${apiOrigin}/api/works/${work.id}/commerce/purchase`, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${userToken}`,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({ productKey })
+		});
+		if (!response.ok) throw new Error((await response.json().catch(() => null))?.message ?? "Purchase failed.");
+		return (await response.json()).checkout ?? null;
+	}
+	async function handleMessage(event) {
+		const data = event.data;
+		if (!data?.requestId) return;
+		try {
+			if (data.type === "cohub.work.context") {
+				const workScopes = clonePermissionScopes(work.workScopes);
+				reply(data.requestId, {
+					type: "cohub.work.context.result",
+					context: {
+						work: {
+							id: work.id,
+							slug: work.slug,
+							url: typeof location !== "undefined" ? location.href : ""
+						},
+						space: { id: work.spaceId },
+						permissions: {
+							scopes: workScopes,
+							workScopes,
+							viewerScopes: []
+						}
+					}
+				});
+			}
+			if (data.type === "cohub.work.token") {
+				const token = await ensureBaseToken(Boolean(data.forceRefresh));
+				reply(data.requestId, {
+					type: "cohub.work.token.result",
+					token
+				});
+			}
+			if (data.type === "cohub.work.checkout-state") {
+				const pending = readPendingPurchase();
+				const checkoutState = getCheckoutState();
+				const orderId = checkoutState.orderId ?? pending?.orderId ?? null;
+				if (checkoutState.status && checkoutState.orderId) clearPendingPurchase();
+				reply(data.requestId, {
+					type: "cohub.work.checkout-state.result",
+					status: checkoutState.status,
+					orderId
+				});
+			}
+			if (data.type === "cohub.work.purchase") {
+				const productKey = typeof data.productKey === "string" ? data.productKey.trim() : "";
+				if (!productKey) {
+					reply(data.requestId, {
+						type: "cohub.work.error",
+						message: "Product key is required."
+					});
+					return;
+				}
+				state.pendingPurchase = {
+					requestId: data.requestId,
+					productKey
+				};
+				state.purchaseError = null;
+				state.purchaseOpen = true;
+				notify();
+			}
+			if (data.type === "cohub.work.authorize") {
+				const allowedViewerScopes = clonePermissionScopes(work.allowedViewerScopes);
+				const scopes = clonePermissionScopes(data.scopes).filter((scope) => allowedViewerScopes.includes(scope));
+				if (scopes.length === 0) {
+					reply(data.requestId, {
+						type: "cohub.work.error",
+						message: "No allowed scopes requested."
+					});
+					return;
+				}
+				if (isBackground && await isCurrentViewerWorkOwner()) {
+					const token = await authorize(scopes);
+					reply(data.requestId, {
+						type: "cohub.work.authorize.result",
+						token
+					});
+					return;
+				}
+				const viewerUuid = await getViewerUuid();
+				if (viewerUuid && hasGrantedWorkScopes(viewerUuid, work.id, scopes)) try {
+					const token = await authorize(scopes);
+					reply(data.requestId, {
+						type: "cohub.work.authorize.result",
+						token
+					});
+					return;
+				} catch {
+					clearGrantedWorkScopes(viewerUuid, work.id);
+				}
+				state.pendingAuth = {
+					requestId: data.requestId,
+					scopes,
+					reason: data.reason
+				};
+				state.authError = null;
+				state.authOpen = true;
+				notify();
+			}
+		} catch (error) {
+			reply(data.requestId, {
+				type: "cohub.work.error",
+				message: error instanceof Error ? error.message : "Request failed."
+			});
+		}
+	}
+	function cancelAuth() {
+		if (state.authSaving) return;
+		if (!state.pendingAuth) return;
+		reply(state.pendingAuth.requestId, {
+			type: "cohub.work.authorize.result",
+			token: null
+		});
+		state.authOpen = false;
+		state.pendingAuth = null;
+		state.authError = null;
+		state.authSaving = false;
+		notify();
+	}
+	function cancelPurchase() {
+		if (state.purchaseSaving) return;
+		if (!state.pendingPurchase) return;
+		reply(state.pendingPurchase.requestId, {
+			type: "cohub.work.purchase.result",
+			checkout: null
+		});
+		state.purchaseOpen = false;
+		state.purchaseError = null;
+		state.pendingPurchase = null;
+		state.purchaseSaving = false;
+		notify();
+	}
+	async function confirmPurchase() {
+		if (!state.pendingPurchase || state.purchaseSaving) return;
+		state.purchaseSaving = true;
+		state.purchaseError = null;
+		notify();
+		try {
+			const checkout = await createPurchase(state.pendingPurchase.productKey);
+			reply(state.pendingPurchase.requestId, {
+				type: "cohub.work.purchase.result",
+				checkout
+			});
+			if (checkout && typeof checkout === "object") {
+				const next = checkout;
+				if (typeof next.orderId === "string" && typeof next.productKey === "string") writePendingPurchase({
+					orderId: next.orderId,
+					productKey: next.productKey
+				});
+				const url = next.checkoutUrl;
+				if (next.checkoutUsable === true && typeof url === "string" && url) window.location.href = url;
+			}
+			state.purchaseOpen = false;
+			state.pendingPurchase = null;
+		} catch (error) {
+			state.purchaseError = error instanceof Error ? error.message : "Purchase failed.";
+		} finally {
+			state.purchaseSaving = false;
+			notify();
+		}
+	}
+	async function confirmAuth() {
+		if (!state.pendingAuth || state.authSaving) return;
+		state.authError = null;
+		state.authSaving = true;
+		notify();
+		try {
+			const token = await authorize(state.pendingAuth.scopes);
+			setGrantedWorkScopes(await getViewerUuid(), work.id, state.pendingAuth.scopes);
+			reply(state.pendingAuth.requestId, {
+				type: "cohub.work.authorize.result",
+				token
+			});
+			state.authOpen = false;
+			state.pendingAuth = null;
+		} catch (error) {
+			state.authError = error instanceof Error ? error.message : "Authorization failed.";
+		} finally {
+			state.authSaving = false;
+			notify();
+		}
+	}
+	return {
+		getState: () => ({ ...state }),
+		handleMessage,
+		confirmAuth,
+		cancelAuth,
+		confirmPurchase,
+		cancelPurchase
+	};
+}
+//#endregion
 //#region src/http-error.ts
 function isHttpErrorCode(error, code) {
 	return error instanceof HttpError && error.code === code;
@@ -576,4 +1159,4 @@ function filterGenerationDeclarationsByPolicy(declarations, policy) {
 	});
 }
 //#endregion
-export { BillingApi, COHUB_ENVIRONMENTS, CohubClient, CohubHttpClient, GenerationPolicyError, HttpError, ReferencesApi, SessionGenerationStreamClient, SessionPatchReducer, UsersApi, VoiceApi, VoiceInputClient, WebsocketClient, WorkCommerceApi, WorkRuntimeApi, WorksApi, assertGenerationRequestAllowedByPolicy, createCohubClient, createHttpClient, createSessionGenerationStreamClient, createSessionPatchReducer, createVoiceInputClient, createWebsocketClient, createWorkRuntime, decodeGenerationPolicy, encodeGenerationPolicy, filterGenerationDeclarationsByPolicy, findGenerationModelPolicy, getAllowedGenerationModelIds, isHttpErrorCode, normalizeBaseUrl, normalizeGenerationPolicy, normalizeVoiceInputWebsocketUrl, normalizeWebsocketUrl, parseAssistantMessageCommit, parseGenerationPolicyFromEnv, resolveApiBaseUrl, resolveCohubEnvironment, resolveVoiceInputWebsocketUrl, resolveWebsocketUrl };
+export { BillingApi, COHUB_ENVIRONMENTS, CohubClient, CohubHttpClient, GenerationPolicyError, HttpError, ParentBridgeTransport, PopupBrokerTransport, ReferencesApi, SessionGenerationStreamClient, SessionPatchReducer, UsersApi, VoiceApi, VoiceInputClient, WebsocketClient, WorkCommerceApi, WorkRuntimeApi, WorksApi, assertGenerationRequestAllowedByPolicy, clearGrantedWorkScopes, createCohubClient, createHttpClient, createSessionGenerationStreamClient, createSessionPatchReducer, createVoiceInputClient, createWebsocketClient, createWorkBridgeCore, createWorkRuntime, decodeGenerationPolicy, encodeGenerationPolicy, filterGenerationDeclarationsByPolicy, findGenerationModelPolicy, getAllowedGenerationModelIds, hasGrantedWorkScopes, isHttpErrorCode, normalizeBaseUrl, normalizeGenerationPolicy, normalizeVoiceInputWebsocketUrl, normalizeWebsocketUrl, parseAssistantMessageCommit, parseGenerationPolicyFromEnv, resolveApiBaseUrl, resolveCohubEnvironment, resolveVoiceInputWebsocketUrl, resolveWebsocketUrl, resolveWorkTransport, setGrantedWorkScopes };