@neta-art/cohub 2.6.0 → 2.7.1

package/README.md

@@ -88,3 +88,56 @@ const stop = session.subscribe({
 
 stop();
 ```
+
+## Works and the Work runtime
+
+A **Work** is a published, shareable web page hosted by Cohub. When a viewer
+opens a Work, it runs inside a Cohub-managed runtime that provides short-lived
+access tokens — no API keys required.
+
+Three runtime-only APIs are available **exclusively inside a published Work**:
+
+- `client.context()` — returns Work identity, Space identity, and current
+  permission scopes. Returns `null` outside a Work runtime.
+- `client.auth.request({ scopes, reason })` — shows the viewer a consent dialog
+  and caches a token with the approved scopes.
+- `client.work.commerce.*` — entitlement checks, credit consumption,
+  purchases.
+
+### Quick start (inside a Work)
+
+```ts
+// Browsers don't inject ENV — pass it explicitly.
+const client = createCohubClient({ env: "prod" });
+
+const ctx = await client.context();
+if (!ctx?.space?.id) throw new Error("Not inside a published Work.");
+
+const space = client.space(ctx.space.id);
+
+// Request viewer scopes from a user gesture (button click)
+await client.auth.request({
+  scopes: ["session.prompt.fullaccess", "generation.create"],
+  reason: "This Work needs to send prompts and generate images.",
+});
+```
+
+### The scope model (critical)
+
+Work permissions come in **two disjoint sets**:
+
+- **Work scopes** (read, no consent): `space.view`, `session.view`,
+  `file.view`, `taskrun.view` — granted at publish time.
+- **Viewer scopes** (action, consent-required): `session.prompt.fullaccess`,
+  `generation.create`, `user.space.list`, `user.session.list`,
+  `user.usage.read` — approved per-viewer via `auth.request()`.
+
+> **Read operations need work scopes. Action operations need viewer scopes.
+They never substitute for each other.** For example, `session.prompt.fullaccess`
+lets you send a prompt but does NOT let you read the reply — that needs
+`session.view` (a work scope). Similarly, `generation.create` lets you create
+a generation task, but polling its result needs `taskrun.view` (a work scope).
+
+For the complete API-to-scope mapping, initialization recipe, capability
+recipes, a full working example, and a pitfalls checklist, see the
+**[Work Runtime Guide](./docs/work-runtime-guide.md)**.

package/dist/chunks/http.d.ts

@@ -731,9 +731,15 @@ type SpaceSandboxAutoDestroyPolicy = {
   mode: "never";
 };
 type SpaceSandboxProvider = "cloud" | "local";
+type SandboxSpecId = "standard" | "boost" | "ultra";
 type SpaceSandboxConfig = {
   provider?: SpaceSandboxProvider;
   autoDestroy: SpaceSandboxAutoDestroyPolicy;
+  spec?: SandboxSpecId;
+  appliedSpec?: SandboxSpecId | null;
+  specPendingRestart?: boolean;
+  allowedSpec?: SandboxSpecId;
+  specs?: Record<string, unknown>;
 };
 type SpaceConfig = {
   sandbox?: SpaceSandboxConfig;
@@ -786,6 +792,7 @@ type SpaceConfigInput = {
   sandbox?: {
     provider?: SpaceSandboxProvider;
     autoDestroy?: SpaceSandboxAutoDestroyPolicy;
+    spec?: SandboxSpecId;
   };
 };
 type CreateSpaceModInput = {
@@ -808,6 +815,17 @@ type CreateSpaceInput = {
 type SpaceConfigResponse = {
   config: Required<Pick<SpaceConfig, "sandbox">>;
 };
+type SpaceConfigUpdateResponse = {
+  space: SpaceRecord;
+  sandbox?: {
+    resized?: boolean;
+    applying?: boolean;
+    pendingRestart?: boolean;
+    appliedSpec?: SandboxSpecId;
+    skipped?: boolean;
+    message?: string;
+  };
+};
 type CanvasDocumentRecord = {
   id: string;
   spaceId: string;
@@ -2550,9 +2568,7 @@ declare class SpaceClient {
     command: string;
   }): Promise<SpaceRunCommandResponse>;
   getConfig(): Promise<SpaceConfigResponse>;
-  updateConfig(input: SpaceConfigInput): Promise<{
-    space: SpaceRecord;
-  }>;
+  updateConfig(input: SpaceConfigInput): Promise<SpaceConfigUpdateResponse>;
   session(sessionId: string): SessionClient;
   updatePresence(meta?: Record<string, unknown> | null): Promise<void>;
   subscribe(handler: (event: WebsocketEventPayload) => void): () => void;
@@ -2838,4 +2854,4 @@ declare class CohubHttpClient {
 }
 declare const createHttpClient: (options?: CohubClientOptions) => CohubHttpClient;
 //#endregion
-export { parseAssistantMessageCommit as $, GenerationContentBlock as $i, PatchResourceLabelsInput as $n, SpaceFsFileKind as $r, BillingCreditStatus as $t, TasksApi as A, SpaceUsageResponse as Ai, CronJobRecord as An, SpaceBootstrapSource as Ar, WorkRuntimeCheckoutState as At, GenerationStreamCommitEvent as B, PublicGenerationDeclaration as Bi, JsonObject as Bn, SpaceCommerceProductCreditBenefit as Br, BatchUserProfilesResponse as Bt, WorkStatus as C, SpaceRecord as Ci, CreateInvitationResponse as Cn, SessionTurnResponse as Cr, Fetch as Ct, WorkVisibility as D, SpaceSandboxProvider as Di, CreateSpacePromptResponse as Dn, SessionTurnsPaginatedResponse as Dr, ParentBridgeTransport as Dt, WorkVersionRecord as E, SpaceSandboxConfig as Ei, CreateSpacePromptInput as En, SessionTurnWindowResponse as Er, RawHttpResponse as Et, SpaceEventName as F, UserRulesResponse as Fi, ExploreSpacesResponse as Fn, SpaceCommerceCreditsBenefit as Fr, WorkRuntimeTransport as Ft, GenerationStreamLifecycleEvent as G, assertGenerationRequestAllowedByPolicy as Gi, LabelAssignmentRecord as Gn, SpaceDefaultResponse as Gr, BillingBalanceActivityStatus as Gt, GenerationStreamEvent as H, GenerationParameterConstraint as Hi, JsonValue as Hn, SpaceConfigInput as Hr, BillingBalanceActivity as Ht, SpacesApi as I, CreateGenerationTaskRequest as Ii, GlobalSearchResponse as In, SpaceCommerceFeatureBenefit as Ir, createWorkRuntime as It, GenerationStreamSubscribeOptions as J, filterGenerationDeclarationsByPolicy as Ji, LabelResourceType as Jn, SpaceFsCompleteUploadResponse as Jr, BillingCheckoutActionState as Jt, GenerationStreamOutOfSyncEvent as K, decodeGenerationPolicy as Ki, LabelListItem as Kn, SpaceEnvInput as Kr, BillingCatalog as Kt, WebSocketConnectionState as L, CreateGenerationTaskResponse as Li, GlobalSearchResult as Ln, SpaceCommerceOrder as Lr, resolveWorkTransport as Lt, SessionSubscriptionHandlers as M, TaskRunDetailResponse as Mi, CursorPageInfo as Mn, SpaceCheckpointDetailResponse as Mr, WorkRuntimeContext as Mt, SpaceChannelBindingRecord as N, TaskRunRecord as Ni, ExploreSection as Nn, SpaceCommerceBenefit as Nr, WorkRuntimeModeConfig as Nt, WorksApi as O, SpaceSessionsResponse as Oi, CreateSpaceSessionInput as On, SpaceAccess as Or, PopupBrokerTransport as Ot, SpaceClient as P, UserProfile as Pi, ExploreSpaceItem as Pn, SpaceCommerceBuyerProfile as Pr, WorkRuntimeRequestOptions as Pt, createSessionGenerationStreamClient as Q, parseGenerationPolicyFromEnv as Qi, ModelCatalogEntry as Qn, SpaceFsEntry as Qr, BillingCreditGrantStatus as Qt, PublicInviteApi as R, GenerationTaskResult as Ri, GlobalSearchType as Rn, SpaceCommerceProduct as Rr, AcceptInvitationResponse as Rt, WorkSessionResponse as S, SpacePublicProfile as Si, CreateInvitationInput as Sn, SessionTurnIndexResponse as Sr, CohubClientOptions as St, WorkUpdateInput as T, SpaceSandboxAutoDestroyPolicy as Ti, CreateSpaceModInput as Tn, SessionTurnStreamSnapshotResponse as Tr, HttpTransport as Tt, GenerationStreamFinalizedEvent as U, GenerationPolicy as Ui, LabelAssignmentListItem as Un, SpaceConfigResponse as Ur, BillingBalanceActivityKind as Ut, GenerationStreamErrorEvent as V, GenerationModelPolicy as Vi, JsonPrimitive as Vn, SpaceConfig as Vr, BillingAccessWarning as Vt, GenerationStreamIntermediateMessage as W, GenerationPolicyError as Wi, LabelAssignmentPageInfo as Wn, SpaceCreateResponse as Wr, BillingBalanceActivityList as Wt, GenerationStreamTurnUpdatedEvent as X, getAllowedGenerationModelIds as Xi, LabelSource as Xn, SpaceFsCreateUploadResponse as Xr, BillingConversionIntent as Xt, GenerationStreamSubscriptionHandlers as Y, findGenerationModelPolicy as Yi, LabelScopeType as Yn, SpaceFsCreateUploadInput as Yr, BillingCheckoutResult as Yt, SessionGenerationStreamClient as Z, normalizeGenerationPolicy as Zi, MeResponse as Zn, SpaceFsEncoding as Zr, BillingCreditExpiryGroup as Zt, WorkPresentationMeta as _, SpaceMember as _i, CanvasNodeRecord as _n, SessionBindingRecord as _r, PromptsApi as _t, WorkCommerceCreditConsumeResponse as a, SpaceFsReadFilesResponse as ai, BillingProductCreditBenefit as an, PublicUserProfile as ar, createSessionPatchReducer as at, WorkRecord as b, SpacePresenceSnapshot as bi, Channel as bn, SessionMessagesResponse as br, CronJobsApi as bt, WorkCommerceEntitlementsResponse as c, SpaceFsUploadEntry as ci, BillingProductPricing as cn, ReferenceAggregateResponse as cr, ReferencesApi as ct, WorkCommercePurchaseResponse as d, SpaceFsUploadPlanEntryInput as di, BillingSubscriptionHistoryStatus as dn, ReferenceQueryResponse as dr, CreatePublicAssetUploadResponse as dt, ChannelConfig as ea, SpaceFsFileResponse as ei, BillingCreditUnit as en, PatchResourceLabelsResponse as er, SessionPatchApplyInput as et, WorkAuthorizeResponse as f, SpaceFsUploadProgress as fi, BillingSubscriptionSummary as fn, ReferenceQueryableType as fr, PublicAssetMimeType as ft, WorkMeta as g, SpaceListItem as gi, CanvasNodeInput as gn, SendMessageCronJobPayload as gr, UploadPublicAssetInput as gt, WorkGetResponse as h, SpaceInvitation as hi, CanvasDocumentRecord as hn, ResourceLabelsResponse as hr, UploadChatImageAttachmentInput as ht, WorkCommerceCheckoutStatus as i, SpaceFsReadFilesInput as ii, BillingProductBillingInterval as in, PromptTemplateCatalogResponse as ir, SessionPatchStatus as it, SessionEventName as j, SpaceUsageSummary as ji, CronJobUpdatePatch as jn, SpaceChannelBindingInput as jr, WorkRuntimeCheckoutStatus as jt, UserApi as k, SpaceUsageHourlyStat as ki, CronJobPayload as kn, SpaceAccessPolicy as kr, WorkRuntimeApi as kt, WorkCommerceOrder as l, SpaceFsUploadError as li, BillingRedemptionResult as ln, ReferenceDirection as lr, SearchApi as lt, WorkDetailResponse as m, SpaceFsWriteFileInput as mi, CanvasCreateInput as mn, ReferenceResourceType as mr, PublicAssetsApi as mt, createHttpClient as n, SpaceFsPreparingFile as ni, BillingPaymentStatus as nn, PromptAccessMode as nr, SessionPatchReducer as nt, WorkCommerceCreditConsumeStatus as o, SpaceFsTreeResponse as oi, BillingProductDisplay as on, ReferenceAggregateGroup as or, SessionAccessApi as ot, WorkCreateInput as p, SpaceFsUploadResponse as pi, CanvasBootstrapResponse as pn, ReferenceRecord as pr, PublicAssetPurpose as pt, GenerationStreamStateEvent as q, encodeGenerationPolicy as qi, LabelRecord as qn, SpaceFsCompleteUploadInput as qr, BillingCatalogProduct as qt, WorkCommerceApi as r, SpaceFsReadFilesError as ri, BillingPluginStatus as rn, PromptTemplateCatalogEntry as rr, SessionPatchState as rt, WorkCommerceEntitlement as s, SpaceFsUploadDestination as si, BillingProductKind as sn, ReferenceAggregateGroupBy as sr, ReferenceResourceSelector as st, CohubHttpClient as t, DiscordChannelConfig as ta, SpaceFsMoveInput as ti, BillingHistoryPagination as tn, Permission as tr, SessionPatchApplyResult as tt, WorkCommerceProductResolveResponse as u, SpaceFsUploadPlanEntry as ui, BillingSubscriptionHistoryList as un, ReferenceKind as ur, CreatePublicAssetUploadInput as ut, WorkPublicOwnerRecord as v, SpaceMeta as vi, CanvasSemanticOp as vn, SessionMessageResponse as vr, ModelsApi as vt, WorkTargetType as w, SpaceRole as wi, CreateSpaceInput as wn, SessionTurnSignedUrlsResponse as wr, HttpError as wt, WorkResolveResponse as x, SpacePresenceUser as xi, CheckpointRecord as xn, SessionRecord as xr, ChannelsApi as xt, WorkPublicSpaceRecord as y, SpaceModListItem as yi, CanvasTransactionInput as yn, SessionMessagesPaginatedResponse as yr, GenerationsApi as yt, AssistantMessageCommit as z, ListGenerationModelsResponse as zi, InvitationDetail as zn, SpaceCommerceProductBenefitBinding as zr, ApiError as zt };
+export { parseAssistantMessageCommit as $, normalizeGenerationPolicy as $i, PatchResourceLabelsInput as $n, SpaceFsEncoding as $r, BillingCreditStatus as $t, TasksApi as A, SpaceSessionsResponse as Ai, CronJobRecord as An, SpaceAccessPolicy as Ar, WorkRuntimeCheckoutState as At, GenerationStreamCommitEvent as B, GenerationTaskResult as Bi, JsonObject as Bn, SpaceCommerceProductBenefitBinding as Br, BatchUserProfilesResponse as Bt, WorkStatus as C, SpacePresenceUser as Ci, CreateInvitationResponse as Cn, SessionTurnIndexResponse as Cr, Fetch as Ct, WorkVisibility as D, SpaceSandboxAutoDestroyPolicy as Di, CreateSpacePromptResponse as Dn, SessionTurnWindowResponse as Dr, ParentBridgeTransport as Dt, WorkVersionRecord as E, SpaceRole as Ei, CreateSpacePromptInput as En, SessionTurnStreamSnapshotResponse as Er, RawHttpResponse as Et, SpaceEventName as F, TaskRunRecord as Fi, ExploreSpacesResponse as Fn, SpaceCommerceBuyerProfile as Fr, WorkRuntimeTransport as Ft, GenerationStreamLifecycleEvent as G, GenerationPolicy as Gi, LabelAssignmentRecord as Gn, SpaceConfigUpdateResponse as Gr, BillingBalanceActivityStatus as Gt, GenerationStreamEvent as H, PublicGenerationDeclaration as Hi, JsonValue as Hn, SpaceConfig as Hr, BillingBalanceActivity as Ht, SpacesApi as I, UserProfile as Ii, GlobalSearchResponse as In, SpaceCommerceCreditsBenefit as Ir, createWorkRuntime as It, GenerationStreamSubscribeOptions as J, decodeGenerationPolicy as Ji, LabelResourceType as Jn, SpaceEnvInput as Jr, BillingCheckoutActionState as Jt, GenerationStreamOutOfSyncEvent as K, GenerationPolicyError as Ki, LabelListItem as Kn, SpaceCreateResponse as Kr, BillingCatalog as Kt, WebSocketConnectionState as L, UserRulesResponse as Li, GlobalSearchResult as Ln, SpaceCommerceFeatureBenefit as Lr, resolveWorkTransport as Lt, SessionSubscriptionHandlers as M, SpaceUsageResponse as Mi, CursorPageInfo as Mn, SpaceChannelBindingInput as Mr, WorkRuntimeContext as Mt, SpaceChannelBindingRecord as N, SpaceUsageSummary as Ni, ExploreSection as Nn, SpaceCheckpointDetailResponse as Nr, WorkRuntimeModeConfig as Nt, WorksApi as O, SpaceSandboxConfig as Oi, CreateSpaceSessionInput as On, SessionTurnsPaginatedResponse as Or, PopupBrokerTransport as Ot, SpaceClient as P, TaskRunDetailResponse as Pi, ExploreSpaceItem as Pn, SpaceCommerceBenefit as Pr, WorkRuntimeRequestOptions as Pt, createSessionGenerationStreamClient as Q, getAllowedGenerationModelIds as Qi, ModelCatalogEntry as Qn, SpaceFsCreateUploadResponse as Qr, BillingCreditGrantStatus as Qt, PublicInviteApi as R, CreateGenerationTaskRequest as Ri, GlobalSearchType as Rn, SpaceCommerceOrder as Rr, AcceptInvitationResponse as Rt, WorkSessionResponse as S, SpacePresenceSnapshot as Si, CreateInvitationInput as Sn, SessionRecord as Sr, CohubClientOptions as St, WorkUpdateInput as T, SpaceRecord as Ti, CreateSpaceModInput as Tn, SessionTurnSignedUrlsResponse as Tr, HttpTransport as Tt, GenerationStreamFinalizedEvent as U, GenerationModelPolicy as Ui, LabelAssignmentListItem as Un, SpaceConfigInput as Ur, BillingBalanceActivityKind as Ut, GenerationStreamErrorEvent as V, ListGenerationModelsResponse as Vi, JsonPrimitive as Vn, SpaceCommerceProductCreditBenefit as Vr, BillingAccessWarning as Vt, GenerationStreamIntermediateMessage as W, GenerationParameterConstraint as Wi, LabelAssignmentPageInfo as Wn, SpaceConfigResponse as Wr, BillingBalanceActivityList as Wt, GenerationStreamTurnUpdatedEvent as X, filterGenerationDeclarationsByPolicy as Xi, LabelSource as Xn, SpaceFsCompleteUploadResponse as Xr, BillingConversionIntent as Xt, GenerationStreamSubscriptionHandlers as Y, encodeGenerationPolicy as Yi, LabelScopeType as Yn, SpaceFsCompleteUploadInput as Yr, BillingCheckoutResult as Yt, SessionGenerationStreamClient as Z, findGenerationModelPolicy as Zi, MeResponse as Zn, SpaceFsCreateUploadInput as Zr, BillingCreditExpiryGroup as Zt, WorkPresentationMeta as _, SpaceInvitation as _i, CanvasNodeRecord as _n, SendMessageCronJobPayload as _r, PromptsApi as _t, WorkCommerceCreditConsumeResponse as a, SpaceFsReadFilesError as ai, BillingProductCreditBenefit as an, PublicUserProfile as ar, createSessionPatchReducer as at, WorkRecord as b, SpaceMeta as bi, Channel as bn, SessionMessagesPaginatedResponse as br, CronJobsApi as bt, WorkCommerceEntitlementsResponse as c, SpaceFsTreeResponse as ci, BillingProductPricing as cn, ReferenceAggregateResponse as cr, ReferencesApi as ct, WorkCommercePurchaseResponse as d, SpaceFsUploadError as di, BillingSubscriptionHistoryStatus as dn, ReferenceQueryResponse as dr, CreatePublicAssetUploadResponse as dt, parseGenerationPolicyFromEnv as ea, SpaceFsEntry as ei, BillingCreditUnit as en, PatchResourceLabelsResponse as er, SessionPatchApplyInput as et, WorkAuthorizeResponse as f, SpaceFsUploadPlanEntry as fi, BillingSubscriptionSummary as fn, ReferenceQueryableType as fr, PublicAssetMimeType as ft, WorkMeta as g, SpaceFsWriteFileInput as gi, CanvasNodeInput as gn, SandboxSpecId as gr, UploadPublicAssetInput as gt, WorkGetResponse as h, SpaceFsUploadResponse as hi, CanvasDocumentRecord as hn, ResourceLabelsResponse as hr, UploadChatImageAttachmentInput as ht, WorkCommerceCheckoutStatus as i, SpaceFsPreparingFile as ii, BillingProductBillingInterval as in, PromptTemplateCatalogResponse as ir, SessionPatchStatus as it, SessionEventName as j, SpaceUsageHourlyStat as ji, CronJobUpdatePatch as jn, SpaceBootstrapSource as jr, WorkRuntimeCheckoutStatus as jt, UserApi as k, SpaceSandboxProvider as ki, CronJobPayload as kn, SpaceAccess as kr, WorkRuntimeApi as kt, WorkCommerceOrder as l, SpaceFsUploadDestination as li, BillingRedemptionResult as ln, ReferenceDirection as lr, SearchApi as lt, WorkDetailResponse as m, SpaceFsUploadProgress as mi, CanvasCreateInput as mn, ReferenceResourceType as mr, PublicAssetsApi as mt, createHttpClient as n, ChannelConfig as na, SpaceFsFileResponse as ni, BillingPaymentStatus as nn, PromptAccessMode as nr, SessionPatchReducer as nt, WorkCommerceCreditConsumeStatus as o, SpaceFsReadFilesInput as oi, BillingProductDisplay as on, ReferenceAggregateGroup as or, SessionAccessApi as ot, WorkCreateInput as p, SpaceFsUploadPlanEntryInput as pi, CanvasBootstrapResponse as pn, ReferenceRecord as pr, PublicAssetPurpose as pt, GenerationStreamStateEvent as q, assertGenerationRequestAllowedByPolicy as qi, LabelRecord as qn, SpaceDefaultResponse as qr, BillingCatalogProduct as qt, WorkCommerceApi as r, DiscordChannelConfig as ra, SpaceFsMoveInput as ri, BillingPluginStatus as rn, PromptTemplateCatalogEntry as rr, SessionPatchState as rt, WorkCommerceEntitlement as s, SpaceFsReadFilesResponse as si, BillingProductKind as sn, ReferenceAggregateGroupBy as sr, ReferenceResourceSelector as st, CohubHttpClient as t, GenerationContentBlock as ta, SpaceFsFileKind as ti, BillingHistoryPagination as tn, Permission as tr, SessionPatchApplyResult as tt, WorkCommerceProductResolveResponse as u, SpaceFsUploadEntry as ui, BillingSubscriptionHistoryList as un, ReferenceKind as ur, CreatePublicAssetUploadInput as ut, WorkPublicOwnerRecord as v, SpaceListItem as vi, CanvasSemanticOp as vn, SessionBindingRecord as vr, ModelsApi as vt, WorkTargetType as w, SpacePublicProfile as wi, CreateSpaceInput as wn, SessionTurnResponse as wr, HttpError as wt, WorkResolveResponse as x, SpaceModListItem as xi, CheckpointRecord as xn, SessionMessagesResponse as xr, ChannelsApi as xt, WorkPublicSpaceRecord as y, SpaceMember as yi, CanvasTransactionInput as yn, SessionMessageResponse as yr, GenerationsApi as yt, AssistantMessageCommit as z, CreateGenerationTaskResponse as zi, InvitationDetail as zn, SpaceCommerceProduct as zr, ApiError as zt };

package/dist/chunks/http.js

@@ -2613,4 +2613,4 @@ var CohubHttpClient = class {
 };
 const createHttpClient = (options) => new CohubHttpClient(options);
 //#endregion
-export { GenerationsApi as C, ModelsApi as S, ChannelsApi as T, SessionAccessApi as _, UserApi as a, PublicAssetsApi as b, SpacesApi as c, createSessionGenerationStreamClient as d, parseAssistantMessageCommit as f, HttpTransport as g, HttpError as h, WorksApi as i, PublicInviteApi as l, createSessionPatchReducer as m, createHttpClient as n, TasksApi as o, SessionPatchReducer as p, WorkCommerceApi as r, SpaceClient as s, CohubHttpClient as t, SessionGenerationStreamClient as u, ReferencesApi as v, CronJobsApi as w, PromptsApi as x, SearchApi as y };
+export { ModelsApi as C, ChannelsApi as E, PromptsApi as S, CronJobsApi as T, ensureRealtimeConnected as _, UserApi as a, SearchApi as b, SpacesApi as c, createSessionGenerationStreamClient as d, parseAssistantMessageCommit as f, HttpTransport as g, HttpError as h, WorksApi as i, PublicInviteApi as l, createSessionPatchReducer as m, createHttpClient as n, TasksApi as o, SessionPatchReducer as p, WorkCommerceApi as r, SpaceClient as s, CohubHttpClient as t, SessionGenerationStreamClient as u, SessionAccessApi as v, GenerationsApi as w, PublicAssetsApi as x, ReferencesApi as y };

package/dist/chunks/websocket.d.ts

@@ -545,6 +545,29 @@ type SessionTurnFinalizedEvent = {
     turn: RealtimeTurnRecord;
   };
 };
+type SessionTurnNotifyEvent = {
+  id: string;
+  timestamp: number;
+  domain: "session";
+  type: "session.turn.notify";
+  requestId?: string | null;
+  spaceId: string;
+  sessionId: string;
+  payload: {
+    spaceId: string;
+    sessionId: string;
+    turnId: string;
+    status: SessionTurnRecord["status"];
+    finishReason?: SessionTurnSummary["finishReason"] | null;
+    userPreview: string | null;
+    durationMs: number | null;
+    stepCount: number | null;
+    sequence: number | null;
+    provider: string | null;
+    model: string | null;
+    completedAt: string | null;
+  };
+};
 type SessionMessagePersistedEvent = {
   id: string;
   timestamp: number;
@@ -709,7 +732,7 @@ type LabelAssignmentsUpdatedEvent = {
     affectedLabelIds: string[];
   };
 };
-type RealtimeServerEvent = SystemReadyEvent | SystemAuthOkEvent | SystemRequestErrorEvent | SystemPongEvent | SystemAckOkEvent | SystemSubscribeOkEvent | SystemSubscribeErrorEvent | SessionCreatedEvent | SessionUpdatedEvent | SessionRequestAcceptedEvent | SessionRequestErrorEvent | SessionTurnCreatedEvent | SessionTurnPatchEvent | SessionTurnErrorEvent | SessionTurnLifecycleEvent | SessionTurnUpdatedEvent | SessionTurnFinalizedEvent | SessionMessagePersistedEvent | SpaceFsChangedEvent | SpacePortsChangedEvent | SpacePresenceUpdatedEvent | CanvasTransactionAppliedEvent | CanvasTransactionAckEvent | CanvasTransactionErrorEvent | TaskCreatedEvent | TaskUpdatedEvent | LabelAssignmentsUpdatedEvent;
+type RealtimeServerEvent = SystemReadyEvent | SystemAuthOkEvent | SystemRequestErrorEvent | SystemPongEvent | SystemAckOkEvent | SystemSubscribeOkEvent | SystemSubscribeErrorEvent | SessionCreatedEvent | SessionUpdatedEvent | SessionRequestAcceptedEvent | SessionRequestErrorEvent | SessionTurnCreatedEvent | SessionTurnPatchEvent | SessionTurnErrorEvent | SessionTurnLifecycleEvent | SessionTurnUpdatedEvent | SessionTurnFinalizedEvent | SessionTurnNotifyEvent | SessionMessagePersistedEvent | SpaceFsChangedEvent | SpacePortsChangedEvent | SpacePresenceUpdatedEvent | CanvasTransactionAppliedEvent | CanvasTransactionAckEvent | CanvasTransactionErrorEvent | TaskCreatedEvent | TaskUpdatedEvent | LabelAssignmentsUpdatedEvent;
 //#endregion
 //#region src/websocket.d.ts
 type WebsocketEventPayload = ChannelEnvelope;

package/dist/http.d.ts

@@ -1,3 +1,3 @@
 import { C as ContentBlock, _ as SessionForkRecord, b as SessionTurnIndexItem, h as MessageRecord, x as SessionTurnRecord, y as SessionTurnSegmentRecord } from "./chunks/websocket.js";
-import { $i as GenerationContentBlock, $n as PatchResourceLabelsInput, $r as SpaceFsFileKind, $t as BillingCreditStatus, Ai as SpaceUsageResponse, An as CronJobRecord, Ar as SpaceBootstrapSource, Bi as PublicGenerationDeclaration, Bn as JsonObject, Br as SpaceCommerceProductCreditBenefit, Bt as BatchUserProfilesResponse, Ci as SpaceRecord, Cn as CreateInvitationResponse, Cr as SessionTurnResponse, Ct as Fetch, Di as SpaceSandboxProvider, Dn as CreateSpacePromptResponse, Dr as SessionTurnsPaginatedResponse, Ei as SpaceSandboxConfig, En as CreateSpacePromptInput, Er as SessionTurnWindowResponse, Fi as UserRulesResponse, Fn as ExploreSpacesResponse, Fr as SpaceCommerceCreditsBenefit, Gn as LabelAssignmentRecord, Gr as SpaceDefaultResponse, Gt as BillingBalanceActivityStatus, Hn as JsonValue, Hr as SpaceConfigInput, Ht as BillingBalanceActivity, Ii as CreateGenerationTaskRequest, In as GlobalSearchResponse, Ir as SpaceCommerceFeatureBenefit, Jn as LabelResourceType, Jr as SpaceFsCompleteUploadResponse, Jt as BillingCheckoutActionState, Kn as LabelListItem, Kr as SpaceEnvInput, Kt as BillingCatalog, Li as CreateGenerationTaskResponse, Ln as GlobalSearchResult, Lr as SpaceCommerceOrder, Mi as TaskRunDetailResponse, Mn as CursorPageInfo, Mr as SpaceCheckpointDetailResponse, Ni as TaskRunRecord, Nn as ExploreSection, Nr as SpaceCommerceBenefit, Oi as SpaceSessionsResponse, On as CreateSpaceSessionInput, Or as SpaceAccess, Pi as UserProfile, Pn as ExploreSpaceItem, Pr as SpaceCommerceBuyerProfile, Qn as ModelCatalogEntry, Qr as SpaceFsEntry, Qt as BillingCreditGrantStatus, Ri as GenerationTaskResult, Rn as GlobalSearchType, Rr as SpaceCommerceProduct, Rt as AcceptInvitationResponse, Si as SpacePublicProfile, Sn as CreateInvitationInput, Sr as SessionTurnIndexResponse, St as CohubClientOptions, Ti as SpaceSandboxAutoDestroyPolicy, Tn as CreateSpaceModInput, Tr as SessionTurnStreamSnapshotResponse, Tt as HttpTransport, Ui as GenerationPolicy, Un as LabelAssignmentListItem, Ur as SpaceConfigResponse, Ut as BillingBalanceActivityKind, Vn as JsonPrimitive, Vr as SpaceConfig, Vt as BillingAccessWarning, Wn as LabelAssignmentPageInfo, Wr as SpaceCreateResponse, Wt as BillingBalanceActivityList, Xn as LabelSource, Xr as SpaceFsCreateUploadResponse, Xt as BillingConversionIntent, Yn as LabelScopeType, Yr as SpaceFsCreateUploadInput, Yt as BillingCheckoutResult, Zn as MeResponse, Zr as SpaceFsEncoding, Zt as BillingCreditExpiryGroup, _i as SpaceMember, _n as CanvasNodeRecord, _r as SessionBindingRecord, ai as SpaceFsReadFilesResponse, an as BillingProductCreditBenefit, ar as PublicUserProfile, bi as SpacePresenceSnapshot, bn as Channel, br as SessionMessagesResponse, ci as SpaceFsUploadEntry, cn as BillingProductPricing, cr as ReferenceAggregateResponse, di as SpaceFsUploadPlanEntryInput, dn as BillingSubscriptionHistoryStatus, dr as ReferenceQueryResponse, ea as ChannelConfig, ei as SpaceFsFileResponse, en as BillingCreditUnit, er as PatchResourceLabelsResponse, fi as SpaceFsUploadProgress, fn as BillingSubscriptionSummary, fr as ReferenceQueryableType, gi as SpaceListItem, gn as CanvasNodeInput, gr as SendMessageCronJobPayload, hi as SpaceInvitation, hn as CanvasDocumentRecord, hr as ResourceLabelsResponse, ii as SpaceFsReadFilesInput, in as BillingProductBillingInterval, ir as PromptTemplateCatalogResponse, ji as SpaceUsageSummary, jn as CronJobUpdatePatch, jr as SpaceChannelBindingInput, ki as SpaceUsageHourlyStat, kn as CronJobPayload, kr as SpaceAccessPolicy, li as SpaceFsUploadError, ln as BillingRedemptionResult, lr as ReferenceDirection, mi as SpaceFsWriteFileInput, mn as CanvasCreateInput, mr as ReferenceResourceType, n as createHttpClient, ni as SpaceFsPreparingFile, nn as BillingPaymentStatus, nr as PromptAccessMode, oi as SpaceFsTreeResponse, on as BillingProductDisplay, or as ReferenceAggregateGroup, pi as SpaceFsUploadResponse, pn as CanvasBootstrapResponse, pr as ReferenceRecord, qn as LabelRecord, qr as SpaceFsCompleteUploadInput, qt as BillingCatalogProduct, ri as SpaceFsReadFilesError, rn as BillingPluginStatus, rr as PromptTemplateCatalogEntry, si as SpaceFsUploadDestination, sn as BillingProductKind, sr as ReferenceAggregateGroupBy, t as CohubHttpClient, ta as DiscordChannelConfig, ti as SpaceFsMoveInput, tn as BillingHistoryPagination, tr as Permission, ui as SpaceFsUploadPlanEntry, un as BillingSubscriptionHistoryList, ur as ReferenceKind, vi as SpaceMeta, vn as CanvasSemanticOp, vr as SessionMessageResponse, wi as SpaceRole, wn as CreateSpaceInput, wr as SessionTurnSignedUrlsResponse, wt as HttpError, xi as SpacePresenceUser, xn as CheckpointRecord, xr as SessionRecord, yi as SpaceModListItem, yn as CanvasTransactionInput, yr as SessionMessagesPaginatedResponse, zi as ListGenerationModelsResponse, zn as InvitationDetail, zr as SpaceCommerceProductBenefitBinding, zt as ApiError } from "./chunks/http.js";
-export { AcceptInvitationResponse, ApiError, BatchUserProfilesResponse, BillingAccessWarning, BillingBalanceActivity, BillingBalanceActivityKind, BillingBalanceActivityList, BillingBalanceActivityStatus, BillingCatalog, BillingCatalogProduct, BillingCheckoutActionState, BillingCheckoutResult, BillingConversionIntent, BillingCreditExpiryGroup, BillingCreditGrantStatus, BillingCreditStatus, BillingCreditUnit, BillingHistoryPagination, BillingPaymentStatus, BillingPluginStatus, BillingProductBillingInterval, BillingProductCreditBenefit, BillingProductDisplay, BillingProductKind, BillingProductPricing, BillingRedemptionResult, BillingSubscriptionHistoryList, BillingSubscriptionHistoryStatus, BillingSubscriptionSummary, CanvasBootstrapResponse, CanvasCreateInput, CanvasDocumentRecord, CanvasNodeInput, CanvasNodeRecord, CanvasSemanticOp, CanvasTransactionInput, Channel, type ChannelConfig, CheckpointRecord, type CohubClientOptions, CohubHttpClient, type ContentBlock, type CreateGenerationTaskRequest, type CreateGenerationTaskResponse, CreateInvitationInput, CreateInvitationResponse, CreateSpaceInput, CreateSpaceModInput, CreateSpacePromptInput, CreateSpacePromptResponse, CreateSpaceSessionInput, CronJobPayload, CronJobRecord, CronJobUpdatePatch, CursorPageInfo, type DiscordChannelConfig, ExploreSection, ExploreSpaceItem, ExploreSpacesResponse, type Fetch, type GenerationContentBlock, type GenerationPolicy, type GenerationTaskResult, GlobalSearchResponse, GlobalSearchResult, GlobalSearchType, HttpError, HttpTransport, InvitationDetail, JsonObject, JsonPrimitive, JsonValue, LabelAssignmentListItem, LabelAssignmentPageInfo, LabelAssignmentRecord, LabelListItem, LabelRecord, LabelResourceType, LabelScopeType, LabelSource, type ListGenerationModelsResponse, MeResponse, type MessageRecord, ModelCatalogEntry, PatchResourceLabelsInput, PatchResourceLabelsResponse, Permission, PromptAccessMode, PromptTemplateCatalogEntry, PromptTemplateCatalogResponse, type PublicGenerationDeclaration, PublicUserProfile, ReferenceAggregateGroup, ReferenceAggregateGroupBy, ReferenceAggregateResponse, ReferenceDirection, ReferenceKind, ReferenceQueryResponse, ReferenceQueryableType, ReferenceRecord, ReferenceResourceType, ResourceLabelsResponse, SendMessageCronJobPayload, SessionBindingRecord, type SessionForkRecord, SessionMessageResponse, SessionMessagesPaginatedResponse, SessionMessagesResponse, SessionRecord, type SessionTurnIndexItem, SessionTurnIndexResponse, type SessionTurnRecord, SessionTurnResponse, type SessionTurnSegmentRecord, SessionTurnSignedUrlsResponse, SessionTurnStreamSnapshotResponse, SessionTurnWindowResponse, SessionTurnsPaginatedResponse, SpaceAccess, SpaceAccessPolicy, SpaceBootstrapSource, SpaceChannelBindingInput, SpaceCheckpointDetailResponse, SpaceCommerceBenefit, SpaceCommerceBuyerProfile, SpaceCommerceCreditsBenefit, SpaceCommerceFeatureBenefit, SpaceCommerceOrder, SpaceCommerceProduct, SpaceCommerceProductBenefitBinding, SpaceCommerceProductCreditBenefit, SpaceConfig, SpaceConfigInput, SpaceConfigResponse, SpaceCreateResponse, SpaceDefaultResponse, SpaceEnvInput, SpaceFsCompleteUploadInput, SpaceFsCompleteUploadResponse, SpaceFsCreateUploadInput, SpaceFsCreateUploadResponse, SpaceFsEncoding, SpaceFsEntry, SpaceFsFileKind, SpaceFsFileResponse, SpaceFsMoveInput, SpaceFsPreparingFile, SpaceFsReadFilesError, SpaceFsReadFilesInput, SpaceFsReadFilesResponse, SpaceFsTreeResponse, SpaceFsUploadDestination, SpaceFsUploadEntry, SpaceFsUploadError, SpaceFsUploadPlanEntry, SpaceFsUploadPlanEntryInput, SpaceFsUploadProgress, SpaceFsUploadResponse, SpaceFsWriteFileInput, SpaceInvitation, SpaceListItem, SpaceMember, SpaceMeta, SpaceModListItem, SpacePresenceSnapshot, SpacePresenceUser, SpacePublicProfile, SpaceRecord, SpaceRole, SpaceSandboxAutoDestroyPolicy, SpaceSandboxConfig, SpaceSandboxProvider, SpaceSessionsResponse, SpaceUsageHourlyStat, SpaceUsageResponse, SpaceUsageSummary, TaskRunDetailResponse, TaskRunRecord, UserProfile, UserRulesResponse, createHttpClient };
+import { $n as PatchResourceLabelsInput, $r as SpaceFsEncoding, $t as BillingCreditStatus, Ai as SpaceSessionsResponse, An as CronJobRecord, Ar as SpaceAccessPolicy, Bi as GenerationTaskResult, Bn as JsonObject, Br as SpaceCommerceProductBenefitBinding, Bt as BatchUserProfilesResponse, Ci as SpacePresenceUser, Cn as CreateInvitationResponse, Cr as SessionTurnIndexResponse, Ct as Fetch, Di as SpaceSandboxAutoDestroyPolicy, Dn as CreateSpacePromptResponse, Dr as SessionTurnWindowResponse, Ei as SpaceRole, En as CreateSpacePromptInput, Er as SessionTurnStreamSnapshotResponse, Fi as TaskRunRecord, Fn as ExploreSpacesResponse, Fr as SpaceCommerceBuyerProfile, Gi as GenerationPolicy, Gn as LabelAssignmentRecord, Gr as SpaceConfigUpdateResponse, Gt as BillingBalanceActivityStatus, Hi as PublicGenerationDeclaration, Hn as JsonValue, Hr as SpaceConfig, Ht as BillingBalanceActivity, Ii as UserProfile, In as GlobalSearchResponse, Ir as SpaceCommerceCreditsBenefit, Jn as LabelResourceType, Jr as SpaceEnvInput, Jt as BillingCheckoutActionState, Kn as LabelListItem, Kr as SpaceCreateResponse, Kt as BillingCatalog, Li as UserRulesResponse, Ln as GlobalSearchResult, Lr as SpaceCommerceFeatureBenefit, Mi as SpaceUsageResponse, Mn as CursorPageInfo, Mr as SpaceChannelBindingInput, Ni as SpaceUsageSummary, Nn as ExploreSection, Nr as SpaceCheckpointDetailResponse, Oi as SpaceSandboxConfig, On as CreateSpaceSessionInput, Or as SessionTurnsPaginatedResponse, Pi as TaskRunDetailResponse, Pn as ExploreSpaceItem, Pr as SpaceCommerceBenefit, Qn as ModelCatalogEntry, Qr as SpaceFsCreateUploadResponse, Qt as BillingCreditGrantStatus, Ri as CreateGenerationTaskRequest, Rn as GlobalSearchType, Rr as SpaceCommerceOrder, Rt as AcceptInvitationResponse, Si as SpacePresenceSnapshot, Sn as CreateInvitationInput, Sr as SessionRecord, St as CohubClientOptions, Ti as SpaceRecord, Tn as CreateSpaceModInput, Tr as SessionTurnSignedUrlsResponse, Tt as HttpTransport, Un as LabelAssignmentListItem, Ur as SpaceConfigInput, Ut as BillingBalanceActivityKind, Vi as ListGenerationModelsResponse, Vn as JsonPrimitive, Vr as SpaceCommerceProductCreditBenefit, Vt as BillingAccessWarning, Wn as LabelAssignmentPageInfo, Wr as SpaceConfigResponse, Wt as BillingBalanceActivityList, Xn as LabelSource, Xr as SpaceFsCompleteUploadResponse, Xt as BillingConversionIntent, Yn as LabelScopeType, Yr as SpaceFsCompleteUploadInput, Yt as BillingCheckoutResult, Zn as MeResponse, Zr as SpaceFsCreateUploadInput, Zt as BillingCreditExpiryGroup, _i as SpaceInvitation, _n as CanvasNodeRecord, _r as SendMessageCronJobPayload, ai as SpaceFsReadFilesError, an as BillingProductCreditBenefit, ar as PublicUserProfile, bi as SpaceMeta, bn as Channel, br as SessionMessagesPaginatedResponse, ci as SpaceFsTreeResponse, cn as BillingProductPricing, cr as ReferenceAggregateResponse, di as SpaceFsUploadError, dn as BillingSubscriptionHistoryStatus, dr as ReferenceQueryResponse, ei as SpaceFsEntry, en as BillingCreditUnit, er as PatchResourceLabelsResponse, fi as SpaceFsUploadPlanEntry, fn as BillingSubscriptionSummary, fr as ReferenceQueryableType, gi as SpaceFsWriteFileInput, gn as CanvasNodeInput, gr as SandboxSpecId, hi as SpaceFsUploadResponse, hn as CanvasDocumentRecord, hr as ResourceLabelsResponse, ii as SpaceFsPreparingFile, in as BillingProductBillingInterval, ir as PromptTemplateCatalogResponse, ji as SpaceUsageHourlyStat, jn as CronJobUpdatePatch, jr as SpaceBootstrapSource, ki as SpaceSandboxProvider, kn as CronJobPayload, kr as SpaceAccess, li as SpaceFsUploadDestination, ln as BillingRedemptionResult, lr as ReferenceDirection, mi as SpaceFsUploadProgress, mn as CanvasCreateInput, mr as ReferenceResourceType, n as createHttpClient, na as ChannelConfig, ni as SpaceFsFileResponse, nn as BillingPaymentStatus, nr as PromptAccessMode, oi as SpaceFsReadFilesInput, on as BillingProductDisplay, or as ReferenceAggregateGroup, pi as SpaceFsUploadPlanEntryInput, pn as CanvasBootstrapResponse, pr as ReferenceRecord, qn as LabelRecord, qr as SpaceDefaultResponse, qt as BillingCatalogProduct, ra as DiscordChannelConfig, ri as SpaceFsMoveInput, rn as BillingPluginStatus, rr as PromptTemplateCatalogEntry, si as SpaceFsReadFilesResponse, sn as BillingProductKind, sr as ReferenceAggregateGroupBy, t as CohubHttpClient, ta as GenerationContentBlock, ti as SpaceFsFileKind, tn as BillingHistoryPagination, tr as Permission, ui as SpaceFsUploadEntry, un as BillingSubscriptionHistoryList, ur as ReferenceKind, vi as SpaceListItem, vn as CanvasSemanticOp, vr as SessionBindingRecord, wi as SpacePublicProfile, wn as CreateSpaceInput, wr as SessionTurnResponse, wt as HttpError, xi as SpaceModListItem, xn as CheckpointRecord, xr as SessionMessagesResponse, yi as SpaceMember, yn as CanvasTransactionInput, yr as SessionMessageResponse, zi as CreateGenerationTaskResponse, zn as InvitationDetail, zr as SpaceCommerceProduct, zt as ApiError } from "./chunks/http.js";
+export { AcceptInvitationResponse, ApiError, BatchUserProfilesResponse, BillingAccessWarning, BillingBalanceActivity, BillingBalanceActivityKind, BillingBalanceActivityList, BillingBalanceActivityStatus, BillingCatalog, BillingCatalogProduct, BillingCheckoutActionState, BillingCheckoutResult, BillingConversionIntent, BillingCreditExpiryGroup, BillingCreditGrantStatus, BillingCreditStatus, BillingCreditUnit, BillingHistoryPagination, BillingPaymentStatus, BillingPluginStatus, BillingProductBillingInterval, BillingProductCreditBenefit, BillingProductDisplay, BillingProductKind, BillingProductPricing, BillingRedemptionResult, BillingSubscriptionHistoryList, BillingSubscriptionHistoryStatus, BillingSubscriptionSummary, CanvasBootstrapResponse, CanvasCreateInput, CanvasDocumentRecord, CanvasNodeInput, CanvasNodeRecord, CanvasSemanticOp, CanvasTransactionInput, Channel, type ChannelConfig, CheckpointRecord, type CohubClientOptions, CohubHttpClient, type ContentBlock, type CreateGenerationTaskRequest, type CreateGenerationTaskResponse, CreateInvitationInput, CreateInvitationResponse, CreateSpaceInput, CreateSpaceModInput, CreateSpacePromptInput, CreateSpacePromptResponse, CreateSpaceSessionInput, CronJobPayload, CronJobRecord, CronJobUpdatePatch, CursorPageInfo, type DiscordChannelConfig, ExploreSection, ExploreSpaceItem, ExploreSpacesResponse, type Fetch, type GenerationContentBlock, type GenerationPolicy, type GenerationTaskResult, GlobalSearchResponse, GlobalSearchResult, GlobalSearchType, HttpError, HttpTransport, InvitationDetail, JsonObject, JsonPrimitive, JsonValue, LabelAssignmentListItem, LabelAssignmentPageInfo, LabelAssignmentRecord, LabelListItem, LabelRecord, LabelResourceType, LabelScopeType, LabelSource, type ListGenerationModelsResponse, MeResponse, type MessageRecord, ModelCatalogEntry, PatchResourceLabelsInput, PatchResourceLabelsResponse, Permission, PromptAccessMode, PromptTemplateCatalogEntry, PromptTemplateCatalogResponse, type PublicGenerationDeclaration, PublicUserProfile, ReferenceAggregateGroup, ReferenceAggregateGroupBy, ReferenceAggregateResponse, ReferenceDirection, ReferenceKind, ReferenceQueryResponse, ReferenceQueryableType, ReferenceRecord, ReferenceResourceType, ResourceLabelsResponse, SandboxSpecId, SendMessageCronJobPayload, SessionBindingRecord, type SessionForkRecord, SessionMessageResponse, SessionMessagesPaginatedResponse, SessionMessagesResponse, SessionRecord, type SessionTurnIndexItem, SessionTurnIndexResponse, type SessionTurnRecord, SessionTurnResponse, type SessionTurnSegmentRecord, SessionTurnSignedUrlsResponse, SessionTurnStreamSnapshotResponse, SessionTurnWindowResponse, SessionTurnsPaginatedResponse, SpaceAccess, SpaceAccessPolicy, SpaceBootstrapSource, SpaceChannelBindingInput, SpaceCheckpointDetailResponse, SpaceCommerceBenefit, SpaceCommerceBuyerProfile, SpaceCommerceCreditsBenefit, SpaceCommerceFeatureBenefit, SpaceCommerceOrder, SpaceCommerceProduct, SpaceCommerceProductBenefitBinding, SpaceCommerceProductCreditBenefit, SpaceConfig, SpaceConfigInput, SpaceConfigResponse, SpaceConfigUpdateResponse, SpaceCreateResponse, SpaceDefaultResponse, SpaceEnvInput, SpaceFsCompleteUploadInput, SpaceFsCompleteUploadResponse, SpaceFsCreateUploadInput, SpaceFsCreateUploadResponse, SpaceFsEncoding, SpaceFsEntry, SpaceFsFileKind, SpaceFsFileResponse, SpaceFsMoveInput, SpaceFsPreparingFile, SpaceFsReadFilesError, SpaceFsReadFilesInput, SpaceFsReadFilesResponse, SpaceFsTreeResponse, SpaceFsUploadDestination, SpaceFsUploadEntry, SpaceFsUploadError, SpaceFsUploadPlanEntry, SpaceFsUploadPlanEntryInput, SpaceFsUploadProgress, SpaceFsUploadResponse, SpaceFsWriteFileInput, SpaceInvitation, SpaceListItem, SpaceMember, SpaceMeta, SpaceModListItem, SpacePresenceSnapshot, SpacePresenceUser, SpacePublicProfile, SpaceRecord, SpaceRole, SpaceSandboxAutoDestroyPolicy, SpaceSandboxConfig, SpaceSandboxProvider, SpaceSessionsResponse, SpaceUsageHourlyStat, SpaceUsageResponse, SpaceUsageSummary, TaskRunDetailResponse, TaskRunRecord, UserProfile, UserRulesResponse, createHttpClient };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { a as normalizeWebsocketUrl, c as resolveVoiceInputWebsocketUrl, i as normalizeVoiceInputWebsocketUrl, l as resolveWebsocketUrl, n as CohubEnvironment, o as resolveApiBaseUrl, r as normalizeBaseUrl, s as resolveCohubEnvironment, t as COHUB_ENVIRONMENTS } from "./chunks/environment.js";
-import { C as ContentBlock, _ as SessionForkRecord, b as SessionTurnIndexItem, c as createWebsocketClient, f as RealtimeServerEvent, h as MessageRecord, l as ChannelEnvelope, r as WebsocketClient, u as LabelAssignmentsUpdatedEvent, x as SessionTurnRecord, y as SessionTurnSegmentRecord } from "./chunks/websocket.js";
+import { C as ContentBlock, _ as SessionForkRecord, b as SessionTurnIndexItem, c as createWebsocketClient, f as RealtimeServerEvent, h as MessageRecord, l as ChannelEnvelope, r as WebsocketClient, s as WebsocketEventPayload, u as LabelAssignmentsUpdatedEvent, x as SessionTurnRecord, y as SessionTurnSegmentRecord } from "./chunks/websocket.js";
 import { a as VoiceInputCreateOptions, i as VoiceInputClientOptions, l as createVoiceInputClient, n as VoiceInputCallbacks, o as VoiceInputEvent, r as VoiceInputClient, t as VoiceApi } from "./chunks/voice-input.js";
-import { $ as parseAssistantMessageCommit, $i as GenerationContentBlock, $n as PatchResourceLabelsInput, $r as SpaceFsFileKind, $t as BillingCreditStatus, A as TasksApi, Ai as SpaceUsageResponse, An as CronJobRecord, Ar as SpaceBootstrapSource, At as WorkRuntimeCheckoutState, B as GenerationStreamCommitEvent, Bi as PublicGenerationDeclaration, Bn as JsonObject, Br as SpaceCommerceProductCreditBenefit, Bt as BatchUserProfilesResponse, C as WorkStatus, Ci as SpaceRecord, Cn as CreateInvitationResponse, Cr as SessionTurnResponse, Ct as Fetch, D as WorkVisibility, Di as SpaceSandboxProvider, Dn as CreateSpacePromptResponse, Dr as SessionTurnsPaginatedResponse, Dt as ParentBridgeTransport, E as WorkVersionRecord, Ei as SpaceSandboxConfig, En as CreateSpacePromptInput, Er as SessionTurnWindowResponse, Et as RawHttpResponse, F as SpaceEventName, Fi as UserRulesResponse, Fn as ExploreSpacesResponse, Fr as SpaceCommerceCreditsBenefit, Ft as WorkRuntimeTransport, G as GenerationStreamLifecycleEvent, Gi as assertGenerationRequestAllowedByPolicy, Gn as LabelAssignmentRecord, Gr as SpaceDefaultResponse, Gt as BillingBalanceActivityStatus, H as GenerationStreamEvent, Hi as GenerationParameterConstraint, Hn as JsonValue, Hr as SpaceConfigInput, Ht as BillingBalanceActivity, I as SpacesApi, Ii as CreateGenerationTaskRequest, In as GlobalSearchResponse, Ir as SpaceCommerceFeatureBenefit, It as createWorkRuntime, J as GenerationStreamSubscribeOptions, Ji as filterGenerationDeclarationsByPolicy, Jn as LabelResourceType, Jr as SpaceFsCompleteUploadResponse, Jt as BillingCheckoutActionState, K as GenerationStreamOutOfSyncEvent, Ki as decodeGenerationPolicy, Kn as LabelListItem, Kr as SpaceEnvInput, Kt as BillingCatalog, L as WebSocketConnectionState, Li as CreateGenerationTaskResponse, Ln as GlobalSearchResult, Lr as SpaceCommerceOrder, Lt as resolveWorkTransport, M as SessionSubscriptionHandlers, Mi as TaskRunDetailResponse, Mn as CursorPageInfo, Mr as SpaceCheckpointDetailResponse, Mt as WorkRuntimeContext, N as SpaceChannelBindingRecord, Ni as TaskRunRecord, Nn as ExploreSection, Nr as SpaceCommerceBenefit, Nt as WorkRuntimeModeConfig, O as WorksApi, Oi as SpaceSessionsResponse, On as CreateSpaceSessionInput, Or as SpaceAccess, Ot as PopupBrokerTransport, P as SpaceClient, Pi as UserProfile, Pn as ExploreSpaceItem, Pr as SpaceCommerceBuyerProfile, Pt as WorkRuntimeRequestOptions, Q as createSessionGenerationStreamClient, Qi as parseGenerationPolicyFromEnv, Qn as ModelCatalogEntry, Qr as SpaceFsEntry, Qt as BillingCreditGrantStatus, R as PublicInviteApi, Ri as GenerationTaskResult, Rn as GlobalSearchType, Rr as SpaceCommerceProduct, Rt as AcceptInvitationResponse, S as WorkSessionResponse, Si as SpacePublicProfile, Sn as CreateInvitationInput, Sr as SessionTurnIndexResponse, St as CohubClientOptions, T as WorkUpdateInput, Ti as SpaceSandboxAutoDestroyPolicy, Tn as CreateSpaceModInput, Tr as SessionTurnStreamSnapshotResponse, Tt as HttpTransport, U as GenerationStreamFinalizedEvent, Ui as GenerationPolicy, Un as LabelAssignmentListItem, Ur as SpaceConfigResponse, Ut as BillingBalanceActivityKind, V as GenerationStreamErrorEvent, Vi as GenerationModelPolicy, Vn as JsonPrimitive, Vr as SpaceConfig, Vt as BillingAccessWarning, W as GenerationStreamIntermediateMessage, Wi as GenerationPolicyError, Wn as LabelAssignmentPageInfo, Wr as SpaceCreateResponse, Wt as BillingBalanceActivityList, X as GenerationStreamTurnUpdatedEvent, Xi as getAllowedGenerationModelIds, Xn as LabelSource, Xr as SpaceFsCreateUploadResponse, Xt as BillingConversionIntent, Y as GenerationStreamSubscriptionHandlers, Yi as findGenerationModelPolicy, Yn as LabelScopeType, Yr as SpaceFsCreateUploadInput, Yt as BillingCheckoutResult, Z as SessionGenerationStreamClient, Zi as normalizeGenerationPolicy, Zn as MeResponse, Zr as SpaceFsEncoding, Zt as BillingCreditExpiryGroup, _ as WorkPresentationMeta, _i as SpaceMember, _n as CanvasNodeRecord, _r as SessionBindingRecord, _t as PromptsApi, a as WorkCommerceCreditConsumeResponse, ai as SpaceFsReadFilesResponse, an as BillingProductCreditBenefit, ar as PublicUserProfile, at as createSessionPatchReducer, b as WorkRecord, bi as SpacePresenceSnapshot, bn as Channel, br as SessionMessagesResponse, bt as CronJobsApi, c as WorkCommerceEntitlementsResponse, ci as SpaceFsUploadEntry, cn as BillingProductPricing, cr as ReferenceAggregateResponse, ct as ReferencesApi, d as WorkCommercePurchaseResponse, di as SpaceFsUploadPlanEntryInput, dn as BillingSubscriptionHistoryStatus, dr as ReferenceQueryResponse, dt as CreatePublicAssetUploadResponse, ea as ChannelConfig, ei as SpaceFsFileResponse, en as BillingCreditUnit, er as PatchResourceLabelsResponse, et as SessionPatchApplyInput, f as WorkAuthorizeResponse, fi as SpaceFsUploadProgress, fn as BillingSubscriptionSummary, fr as ReferenceQueryableType, ft as PublicAssetMimeType, g as WorkMeta, gi as SpaceListItem, gn as CanvasNodeInput, gr as SendMessageCronJobPayload, gt as UploadPublicAssetInput, h as WorkGetResponse, hi as SpaceInvitation, hn as CanvasDocumentRecord, hr as ResourceLabelsResponse, ht as UploadChatImageAttachmentInput, i as WorkCommerceCheckoutStatus, ii as SpaceFsReadFilesInput, in as BillingProductBillingInterval, ir as PromptTemplateCatalogResponse, it as SessionPatchStatus, j as SessionEventName, ji as SpaceUsageSummary, jn as CronJobUpdatePatch, jr as SpaceChannelBindingInput, jt as WorkRuntimeCheckoutStatus, k as UserApi, ki as SpaceUsageHourlyStat, kn as CronJobPayload, kr as SpaceAccessPolicy, kt as WorkRuntimeApi, l as WorkCommerceOrder, li as SpaceFsUploadError, ln as BillingRedemptionResult, lr as ReferenceDirection, lt as SearchApi, m as WorkDetailResponse, mi as SpaceFsWriteFileInput, mn as CanvasCreateInput, mr as ReferenceResourceType, mt as PublicAssetsApi, n as createHttpClient, ni as SpaceFsPreparingFile, nn as BillingPaymentStatus, nr as PromptAccessMode, nt as SessionPatchReducer, o as WorkCommerceCreditConsumeStatus, oi as SpaceFsTreeResponse, on as BillingProductDisplay, or as ReferenceAggregateGroup, ot as SessionAccessApi, p as WorkCreateInput, pi as SpaceFsUploadResponse, pn as CanvasBootstrapResponse, pr as ReferenceRecord, pt as PublicAssetPurpose, q as GenerationStreamStateEvent, qi as encodeGenerationPolicy, qn as LabelRecord, qr as SpaceFsCompleteUploadInput, qt as BillingCatalogProduct, r as WorkCommerceApi, ri as SpaceFsReadFilesError, rn as BillingPluginStatus, rr as PromptTemplateCatalogEntry, rt as SessionPatchState, s as WorkCommerceEntitlement, si as SpaceFsUploadDestination, sn as BillingProductKind, sr as ReferenceAggregateGroupBy, st as ReferenceResourceSelector, t as CohubHttpClient, ta as DiscordChannelConfig, ti as SpaceFsMoveInput, tn as BillingHistoryPagination, tr as Permission, tt as SessionPatchApplyResult, u as WorkCommerceProductResolveResponse, ui as SpaceFsUploadPlanEntry, un as BillingSubscriptionHistoryList, ur as ReferenceKind, ut as CreatePublicAssetUploadInput, v as WorkPublicOwnerRecord, vi as SpaceMeta, vn as CanvasSemanticOp, vr as SessionMessageResponse, vt as ModelsApi, w as WorkTargetType, wi as SpaceRole, wn as CreateSpaceInput, wr as SessionTurnSignedUrlsResponse, wt as HttpError, x as WorkResolveResponse, xi as SpacePresenceUser, xn as CheckpointRecord, xr as SessionRecord, xt as ChannelsApi, y as WorkPublicSpaceRecord, yi as SpaceModListItem, yn as CanvasTransactionInput, yr as SessionMessagesPaginatedResponse, yt as GenerationsApi, z as AssistantMessageCommit, zi as ListGenerationModelsResponse, zn as InvitationDetail, zr as SpaceCommerceProductBenefitBinding, zt as ApiError } from "./chunks/http.js";
+import { $ as parseAssistantMessageCommit, $i as normalizeGenerationPolicy, $n as PatchResourceLabelsInput, $r as SpaceFsEncoding, $t as BillingCreditStatus, A as TasksApi, Ai as SpaceSessionsResponse, An as CronJobRecord, Ar as SpaceAccessPolicy, At as WorkRuntimeCheckoutState, B as GenerationStreamCommitEvent, Bi as GenerationTaskResult, Bn as JsonObject, Br as SpaceCommerceProductBenefitBinding, Bt as BatchUserProfilesResponse, C as WorkStatus, Ci as SpacePresenceUser, Cn as CreateInvitationResponse, Cr as SessionTurnIndexResponse, Ct as Fetch, D as WorkVisibility, Di as SpaceSandboxAutoDestroyPolicy, Dn as CreateSpacePromptResponse, Dr as SessionTurnWindowResponse, Dt as ParentBridgeTransport, E as WorkVersionRecord, Ei as SpaceRole, En as CreateSpacePromptInput, Er as SessionTurnStreamSnapshotResponse, Et as RawHttpResponse, F as SpaceEventName, Fi as TaskRunRecord, Fn as ExploreSpacesResponse, Fr as SpaceCommerceBuyerProfile, Ft as WorkRuntimeTransport, G as GenerationStreamLifecycleEvent, Gi as GenerationPolicy, Gn as LabelAssignmentRecord, Gr as SpaceConfigUpdateResponse, Gt as BillingBalanceActivityStatus, H as GenerationStreamEvent, Hi as PublicGenerationDeclaration, Hn as JsonValue, Hr as SpaceConfig, Ht as BillingBalanceActivity, I as SpacesApi, Ii as UserProfile, In as GlobalSearchResponse, Ir as SpaceCommerceCreditsBenefit, It as createWorkRuntime, J as GenerationStreamSubscribeOptions, Ji as decodeGenerationPolicy, Jn as LabelResourceType, Jr as SpaceEnvInput, Jt as BillingCheckoutActionState, K as GenerationStreamOutOfSyncEvent, Ki as GenerationPolicyError, Kn as LabelListItem, Kr as SpaceCreateResponse, Kt as BillingCatalog, L as WebSocketConnectionState, Li as UserRulesResponse, Ln as GlobalSearchResult, Lr as SpaceCommerceFeatureBenefit, Lt as resolveWorkTransport, M as SessionSubscriptionHandlers, Mi as SpaceUsageResponse, Mn as CursorPageInfo, Mr as SpaceChannelBindingInput, Mt as WorkRuntimeContext, N as SpaceChannelBindingRecord, Ni as SpaceUsageSummary, Nn as ExploreSection, Nr as SpaceCheckpointDetailResponse, Nt as WorkRuntimeModeConfig, O as WorksApi, Oi as SpaceSandboxConfig, On as CreateSpaceSessionInput, Or as SessionTurnsPaginatedResponse, Ot as PopupBrokerTransport, P as SpaceClient, Pi as TaskRunDetailResponse, Pn as ExploreSpaceItem, Pr as SpaceCommerceBenefit, Pt as WorkRuntimeRequestOptions, Q as createSessionGenerationStreamClient, Qi as getAllowedGenerationModelIds, Qn as ModelCatalogEntry, Qr as SpaceFsCreateUploadResponse, Qt as BillingCreditGrantStatus, R as PublicInviteApi, Ri as CreateGenerationTaskRequest, Rn as GlobalSearchType, Rr as SpaceCommerceOrder, Rt as AcceptInvitationResponse, S as WorkSessionResponse, Si as SpacePresenceSnapshot, Sn as CreateInvitationInput, Sr as SessionRecord, St as CohubClientOptions, T as WorkUpdateInput, Ti as SpaceRecord, Tn as CreateSpaceModInput, Tr as SessionTurnSignedUrlsResponse, Tt as HttpTransport, U as GenerationStreamFinalizedEvent, Ui as GenerationModelPolicy, Un as LabelAssignmentListItem, Ur as SpaceConfigInput, Ut as BillingBalanceActivityKind, V as GenerationStreamErrorEvent, Vi as ListGenerationModelsResponse, Vn as JsonPrimitive, Vr as SpaceCommerceProductCreditBenefit, Vt as BillingAccessWarning, W as GenerationStreamIntermediateMessage, Wi as GenerationParameterConstraint, Wn as LabelAssignmentPageInfo, Wr as SpaceConfigResponse, Wt as BillingBalanceActivityList, X as GenerationStreamTurnUpdatedEvent, Xi as filterGenerationDeclarationsByPolicy, Xn as LabelSource, Xr as SpaceFsCompleteUploadResponse, Xt as BillingConversionIntent, Y as GenerationStreamSubscriptionHandlers, Yi as encodeGenerationPolicy, Yn as LabelScopeType, Yr as SpaceFsCompleteUploadInput, Yt as BillingCheckoutResult, Z as SessionGenerationStreamClient, Zi as findGenerationModelPolicy, Zn as MeResponse, Zr as SpaceFsCreateUploadInput, Zt as BillingCreditExpiryGroup, _ as WorkPresentationMeta, _i as SpaceInvitation, _n as CanvasNodeRecord, _r as SendMessageCronJobPayload, _t as PromptsApi, a as WorkCommerceCreditConsumeResponse, ai as SpaceFsReadFilesError, an as BillingProductCreditBenefit, ar as PublicUserProfile, at as createSessionPatchReducer, b as WorkRecord, bi as SpaceMeta, bn as Channel, br as SessionMessagesPaginatedResponse, bt as CronJobsApi, c as WorkCommerceEntitlementsResponse, ci as SpaceFsTreeResponse, cn as BillingProductPricing, cr as ReferenceAggregateResponse, ct as ReferencesApi, d as WorkCommercePurchaseResponse, di as SpaceFsUploadError, dn as BillingSubscriptionHistoryStatus, dr as ReferenceQueryResponse, dt as CreatePublicAssetUploadResponse, ea as parseGenerationPolicyFromEnv, ei as SpaceFsEntry, en as BillingCreditUnit, er as PatchResourceLabelsResponse, et as SessionPatchApplyInput, f as WorkAuthorizeResponse, fi as SpaceFsUploadPlanEntry, fn as BillingSubscriptionSummary, fr as ReferenceQueryableType, ft as PublicAssetMimeType, g as WorkMeta, gi as SpaceFsWriteFileInput, gn as CanvasNodeInput, gr as SandboxSpecId, gt as UploadPublicAssetInput, h as WorkGetResponse, hi as SpaceFsUploadResponse, hn as CanvasDocumentRecord, hr as ResourceLabelsResponse, ht as UploadChatImageAttachmentInput, i as WorkCommerceCheckoutStatus, ii as SpaceFsPreparingFile, in as BillingProductBillingInterval, ir as PromptTemplateCatalogResponse, it as SessionPatchStatus, j as SessionEventName, ji as SpaceUsageHourlyStat, jn as CronJobUpdatePatch, jr as SpaceBootstrapSource, jt as WorkRuntimeCheckoutStatus, k as UserApi, ki as SpaceSandboxProvider, kn as CronJobPayload, kr as SpaceAccess, kt as WorkRuntimeApi, l as WorkCommerceOrder, li as SpaceFsUploadDestination, ln as BillingRedemptionResult, lr as ReferenceDirection, lt as SearchApi, m as WorkDetailResponse, mi as SpaceFsUploadProgress, mn as CanvasCreateInput, mr as ReferenceResourceType, mt as PublicAssetsApi, n as createHttpClient, na as ChannelConfig, ni as SpaceFsFileResponse, nn as BillingPaymentStatus, nr as PromptAccessMode, nt as SessionPatchReducer, o as WorkCommerceCreditConsumeStatus, oi as SpaceFsReadFilesInput, on as BillingProductDisplay, or as ReferenceAggregateGroup, ot as SessionAccessApi, p as WorkCreateInput, pi as SpaceFsUploadPlanEntryInput, pn as CanvasBootstrapResponse, pr as ReferenceRecord, pt as PublicAssetPurpose, q as GenerationStreamStateEvent, qi as assertGenerationRequestAllowedByPolicy, qn as LabelRecord, qr as SpaceDefaultResponse, qt as BillingCatalogProduct, r as WorkCommerceApi, ra as DiscordChannelConfig, ri as SpaceFsMoveInput, rn as BillingPluginStatus, rr as PromptTemplateCatalogEntry, rt as SessionPatchState, s as WorkCommerceEntitlement, si as SpaceFsReadFilesResponse, sn as BillingProductKind, sr as ReferenceAggregateGroupBy, st as ReferenceResourceSelector, t as CohubHttpClient, ta as GenerationContentBlock, ti as SpaceFsFileKind, tn as BillingHistoryPagination, tr as Permission, tt as SessionPatchApplyResult, u as WorkCommerceProductResolveResponse, ui as SpaceFsUploadEntry, un as BillingSubscriptionHistoryList, ur as ReferenceKind, ut as CreatePublicAssetUploadInput, v as WorkPublicOwnerRecord, vi as SpaceListItem, vn as CanvasSemanticOp, vr as SessionBindingRecord, vt as ModelsApi, w as WorkTargetType, wi as SpacePublicProfile, wn as CreateSpaceInput, wr as SessionTurnResponse, wt as HttpError, x as WorkResolveResponse, xi as SpaceModListItem, xn as CheckpointRecord, xr as SessionMessagesResponse, xt as ChannelsApi, y as WorkPublicSpaceRecord, yi as SpaceMember, yn as CanvasTransactionInput, yr as SessionMessageResponse, yt as GenerationsApi, z as AssistantMessageCommit, zi as CreateGenerationTaskResponse, zn as InvitationDetail, zr as SpaceCommerceProduct, zt as ApiError } from "./chunks/http.js";
 
 //#region src/apis/billing.d.ts
 declare class BillingApi {
@@ -132,6 +132,7 @@ declare class CohubClient {
     };
   };
   space(spaceId: string): SpaceClient;
+  onUserEvent(handler: (event: WebsocketEventPayload) => void): () => void;
   onConnection(handler: (state: WebSocketConnectionState) => void): () => void;
 }
 declare const createCohubClient: (options?: CohubClientOptions) => CohubClient;
@@ -251,4 +252,4 @@ declare function isHttpErrorCode(error: unknown, code: string): error is HttpErr
   code: string;
 };
 //#endregion
-export { AcceptInvitationResponse, ApiError, type AssistantMessageCommit, BatchUserProfilesResponse, BillingAccessWarning, BillingApi, BillingBalanceActivity, BillingBalanceActivityKind, BillingBalanceActivityList, BillingBalanceActivityStatus, BillingCatalog, BillingCatalogProduct, BillingCheckoutActionState, BillingCheckoutResult, BillingConversionIntent, BillingCreditExpiryGroup, BillingCreditGrantStatus, BillingCreditStatus, BillingCreditUnit, BillingHistoryPagination, BillingPaymentStatus, BillingPluginStatus, BillingProductBillingInterval, BillingProductCreditBenefit, BillingProductDisplay, BillingProductKind, BillingProductPricing, BillingRedemptionResult, BillingSubscriptionHistoryList, BillingSubscriptionHistoryStatus, BillingSubscriptionSummary, COHUB_ENVIRONMENTS, CanvasBootstrapResponse, CanvasCreateInput, CanvasDocumentRecord, CanvasNodeInput, CanvasNodeRecord, CanvasSemanticOp, CanvasTransactionInput, Channel, type ChannelConfig, type ChannelEnvelope, CheckpointRecord, CohubClient, type CohubClientOptions, type CohubEnvironment, CohubHttpClient, type ContentBlock, type CreateGenerationTaskRequest, type CreateGenerationTaskResponse, CreateInvitationInput, CreateInvitationResponse, type CreatePublicAssetUploadInput, type CreatePublicAssetUploadResponse, CreateSpaceInput, CreateSpaceModInput, CreateSpacePromptInput, CreateSpacePromptResponse, CreateSpaceSessionInput, CronJobPayload, CronJobRecord, CronJobUpdatePatch, CursorPageInfo, type DiscordChannelConfig, ExploreSection, ExploreSpaceItem, ExploreSpacesResponse, type Fetch, type GenerationContentBlock, type GenerationModelPolicy, type GenerationParameterConstraint, type GenerationPolicy, GenerationPolicyError, type GenerationStreamCommitEvent, type GenerationStreamErrorEvent, type GenerationStreamEvent, type GenerationStreamFinalizedEvent, type GenerationStreamIntermediateMessage, type GenerationStreamLifecycleEvent, type GenerationStreamOutOfSyncEvent, type GenerationStreamStateEvent, type GenerationStreamSubscribeOptions, type GenerationStreamSubscriptionHandlers, type GenerationStreamTurnUpdatedEvent, type GenerationTaskResult, GlobalSearchResponse, GlobalSearchResult, GlobalSearchType, HttpError, InvitationDetail, JsonObject, JsonPrimitive, JsonValue, LabelAssignmentListItem, LabelAssignmentPageInfo, LabelAssignmentRecord, type LabelAssignmentsUpdatedEvent, LabelListItem, LabelRecord, LabelResourceType, LabelScopeType, LabelSource, type ListGenerationModelsResponse, MeResponse, type MessageRecord, ModelCatalogEntry, ParentBridgeTransport, PatchResourceLabelsInput, PatchResourceLabelsResponse, Permission, PopupBrokerTransport, PromptAccessMode, PromptTemplateCatalogEntry, PromptTemplateCatalogResponse, type PublicAssetMimeType, type PublicAssetPurpose, type PublicGenerationDeclaration, PublicUserProfile, type RawHttpResponse, type RealtimeServerEvent, ReferenceAggregateGroup, ReferenceAggregateGroupBy, ReferenceAggregateResponse, ReferenceDirection, ReferenceKind, ReferenceQueryResponse, ReferenceQueryableType, ReferenceRecord, type ReferenceResourceSelector, ReferenceResourceType, ReferencesApi, ResourceLabelsResponse, SendMessageCronJobPayload, SessionBindingRecord, type SessionEventName, type SessionForkRecord, SessionGenerationStreamClient, SessionMessageResponse, SessionMessagesPaginatedResponse, SessionMessagesResponse, type SessionPatchApplyInput, type SessionPatchApplyResult, SessionPatchReducer, type SessionPatchState, type SessionPatchStatus, SessionRecord, type SessionSubscriptionHandlers, type SessionTurnIndexItem, SessionTurnIndexResponse, type SessionTurnRecord, SessionTurnResponse, type SessionTurnSegmentRecord, SessionTurnSignedUrlsResponse, SessionTurnStreamSnapshotResponse, SessionTurnWindowResponse, SessionTurnsPaginatedResponse, SpaceAccess, SpaceAccessPolicy, SpaceBootstrapSource, SpaceChannelBindingInput, type SpaceChannelBindingRecord, SpaceCheckpointDetailResponse, SpaceCommerceBenefit, SpaceCommerceBuyerProfile, SpaceCommerceCreditsBenefit, SpaceCommerceFeatureBenefit, SpaceCommerceOrder, SpaceCommerceProduct, SpaceCommerceProductBenefitBinding, SpaceCommerceProductCreditBenefit, SpaceConfig, SpaceConfigInput, SpaceConfigResponse, SpaceCreateResponse, SpaceDefaultResponse, SpaceEnvInput, type SpaceEventName, SpaceFsCompleteUploadInput, SpaceFsCompleteUploadResponse, SpaceFsCreateUploadInput, SpaceFsCreateUploadResponse, SpaceFsEncoding, SpaceFsEntry, SpaceFsFileKind, SpaceFsFileResponse, SpaceFsMoveInput, SpaceFsPreparingFile, SpaceFsReadFilesError, SpaceFsReadFilesInput, SpaceFsReadFilesResponse, SpaceFsTreeResponse, SpaceFsUploadDestination, SpaceFsUploadEntry, SpaceFsUploadError, SpaceFsUploadPlanEntry, SpaceFsUploadPlanEntryInput, SpaceFsUploadProgress, SpaceFsUploadResponse, SpaceFsWriteFileInput, SpaceInvitation, SpaceListItem, SpaceMember, SpaceMeta, SpaceModListItem, SpacePresenceSnapshot, SpacePresenceUser, SpacePublicProfile, SpaceRecord, SpaceRole, SpaceSandboxAutoDestroyPolicy, SpaceSandboxConfig, SpaceSandboxProvider, SpaceSessionsResponse, SpaceUsageHourlyStat, SpaceUsageResponse, SpaceUsageSummary, TaskRunDetailResponse, TaskRunRecord, type UploadChatImageAttachmentInput, type UploadPublicAssetInput, UserProfile, UserRulesResponse, UsersApi, VoiceApi, type VoiceInputCallbacks, VoiceInputClient, type VoiceInputClientOptions, type VoiceInputCreateOptions, type VoiceInputEvent, type WebSocketConnectionState, WebsocketClient, type WorkAuthorizeRequest, type WorkAuthorizeResponse, type WorkBridgeCore, type WorkBridgeCoreConfig, type WorkBridgeCoreWork, type WorkBridgeDialogState, type WorkBridgeGetAccessToken, type WorkBridgeGetViewerUuid, type WorkBridgeRequestSignIn, WorkCommerceApi, type WorkCommerceCheckoutStatus, type WorkCommerceCreditConsumeResponse, type WorkCommerceCreditConsumeStatus, type WorkCommerceEntitlement, type WorkCommerceEntitlementsResponse, type WorkCommerceOrder, type WorkCommerceProductResolveResponse, type WorkCommercePurchaseResponse, type WorkCreateInput, type WorkDetailResponse, type WorkGetResponse, type WorkMeta, type WorkPresentationMeta, type WorkPublicOwnerRecord, type WorkPublicSpaceRecord, type WorkPurchaseRequest, type WorkRecord, type WorkResolveResponse, WorkRuntimeApi, type WorkRuntimeCheckoutState, type WorkRuntimeCheckoutStatus, type WorkRuntimeContext, type WorkRuntimeModeConfig, type WorkRuntimeRequestOptions, type WorkRuntimeTransport, type WorkSessionResponse, type WorkStatus, type WorkTargetType, type WorkUpdateInput, type WorkVersionRecord, type WorkVisibility, WorksApi, assertGenerationRequestAllowedByPolicy, clearGrantedWorkScopes, createCohubClient, createHttpClient, createSessionGenerationStreamClient, createSessionPatchReducer, createVoiceInputClient, createWebsocketClient, createWorkBridgeCore, createWorkRuntime, decodeGenerationPolicy, encodeGenerationPolicy, filterGenerationDeclarationsByPolicy, findGenerationModelPolicy, getAllowedGenerationModelIds, hasGrantedWorkScopes, isHttpErrorCode, normalizeBaseUrl, normalizeGenerationPolicy, normalizeVoiceInputWebsocketUrl, normalizeWebsocketUrl, parseAssistantMessageCommit, parseGenerationPolicyFromEnv, resolveApiBaseUrl, resolveCohubEnvironment, resolveVoiceInputWebsocketUrl, resolveWebsocketUrl, resolveWorkTransport, setGrantedWorkScopes };
+export { AcceptInvitationResponse, ApiError, type AssistantMessageCommit, BatchUserProfilesResponse, BillingAccessWarning, BillingApi, BillingBalanceActivity, BillingBalanceActivityKind, BillingBalanceActivityList, BillingBalanceActivityStatus, BillingCatalog, BillingCatalogProduct, BillingCheckoutActionState, BillingCheckoutResult, BillingConversionIntent, BillingCreditExpiryGroup, BillingCreditGrantStatus, BillingCreditStatus, BillingCreditUnit, BillingHistoryPagination, BillingPaymentStatus, BillingPluginStatus, BillingProductBillingInterval, BillingProductCreditBenefit, BillingProductDisplay, BillingProductKind, BillingProductPricing, BillingRedemptionResult, BillingSubscriptionHistoryList, BillingSubscriptionHistoryStatus, BillingSubscriptionSummary, COHUB_ENVIRONMENTS, CanvasBootstrapResponse, CanvasCreateInput, CanvasDocumentRecord, CanvasNodeInput, CanvasNodeRecord, CanvasSemanticOp, CanvasTransactionInput, Channel, type ChannelConfig, type ChannelEnvelope, CheckpointRecord, CohubClient, type CohubClientOptions, type CohubEnvironment, CohubHttpClient, type ContentBlock, type CreateGenerationTaskRequest, type CreateGenerationTaskResponse, CreateInvitationInput, CreateInvitationResponse, type CreatePublicAssetUploadInput, type CreatePublicAssetUploadResponse, CreateSpaceInput, CreateSpaceModInput, CreateSpacePromptInput, CreateSpacePromptResponse, CreateSpaceSessionInput, CronJobPayload, CronJobRecord, CronJobUpdatePatch, CursorPageInfo, type DiscordChannelConfig, ExploreSection, ExploreSpaceItem, ExploreSpacesResponse, type Fetch, type GenerationContentBlock, type GenerationModelPolicy, type GenerationParameterConstraint, type GenerationPolicy, GenerationPolicyError, type GenerationStreamCommitEvent, type GenerationStreamErrorEvent, type GenerationStreamEvent, type GenerationStreamFinalizedEvent, type GenerationStreamIntermediateMessage, type GenerationStreamLifecycleEvent, type GenerationStreamOutOfSyncEvent, type GenerationStreamStateEvent, type GenerationStreamSubscribeOptions, type GenerationStreamSubscriptionHandlers, type GenerationStreamTurnUpdatedEvent, type GenerationTaskResult, GlobalSearchResponse, GlobalSearchResult, GlobalSearchType, HttpError, InvitationDetail, JsonObject, JsonPrimitive, JsonValue, LabelAssignmentListItem, LabelAssignmentPageInfo, LabelAssignmentRecord, type LabelAssignmentsUpdatedEvent, LabelListItem, LabelRecord, LabelResourceType, LabelScopeType, LabelSource, type ListGenerationModelsResponse, MeResponse, type MessageRecord, ModelCatalogEntry, ParentBridgeTransport, PatchResourceLabelsInput, PatchResourceLabelsResponse, Permission, PopupBrokerTransport, PromptAccessMode, PromptTemplateCatalogEntry, PromptTemplateCatalogResponse, type PublicAssetMimeType, type PublicAssetPurpose, type PublicGenerationDeclaration, PublicUserProfile, type RawHttpResponse, type RealtimeServerEvent, ReferenceAggregateGroup, ReferenceAggregateGroupBy, ReferenceAggregateResponse, ReferenceDirection, ReferenceKind, ReferenceQueryResponse, ReferenceQueryableType, ReferenceRecord, type ReferenceResourceSelector, ReferenceResourceType, ReferencesApi, ResourceLabelsResponse, SandboxSpecId, SendMessageCronJobPayload, SessionBindingRecord, type SessionEventName, type SessionForkRecord, SessionGenerationStreamClient, SessionMessageResponse, SessionMessagesPaginatedResponse, SessionMessagesResponse, type SessionPatchApplyInput, type SessionPatchApplyResult, SessionPatchReducer, type SessionPatchState, type SessionPatchStatus, SessionRecord, type SessionSubscriptionHandlers, type SessionTurnIndexItem, SessionTurnIndexResponse, type SessionTurnRecord, SessionTurnResponse, type SessionTurnSegmentRecord, SessionTurnSignedUrlsResponse, SessionTurnStreamSnapshotResponse, SessionTurnWindowResponse, SessionTurnsPaginatedResponse, SpaceAccess, SpaceAccessPolicy, SpaceBootstrapSource, SpaceChannelBindingInput, type SpaceChannelBindingRecord, SpaceCheckpointDetailResponse, SpaceCommerceBenefit, SpaceCommerceBuyerProfile, SpaceCommerceCreditsBenefit, SpaceCommerceFeatureBenefit, SpaceCommerceOrder, SpaceCommerceProduct, SpaceCommerceProductBenefitBinding, SpaceCommerceProductCreditBenefit, SpaceConfig, SpaceConfigInput, SpaceConfigResponse, SpaceConfigUpdateResponse, SpaceCreateResponse, SpaceDefaultResponse, SpaceEnvInput, type SpaceEventName, SpaceFsCompleteUploadInput, SpaceFsCompleteUploadResponse, SpaceFsCreateUploadInput, SpaceFsCreateUploadResponse, SpaceFsEncoding, SpaceFsEntry, SpaceFsFileKind, SpaceFsFileResponse, SpaceFsMoveInput, SpaceFsPreparingFile, SpaceFsReadFilesError, SpaceFsReadFilesInput, SpaceFsReadFilesResponse, SpaceFsTreeResponse, SpaceFsUploadDestination, SpaceFsUploadEntry, SpaceFsUploadError, SpaceFsUploadPlanEntry, SpaceFsUploadPlanEntryInput, SpaceFsUploadProgress, SpaceFsUploadResponse, SpaceFsWriteFileInput, SpaceInvitation, SpaceListItem, SpaceMember, SpaceMeta, SpaceModListItem, SpacePresenceSnapshot, SpacePresenceUser, SpacePublicProfile, SpaceRecord, SpaceRole, SpaceSandboxAutoDestroyPolicy, SpaceSandboxConfig, SpaceSandboxProvider, SpaceSessionsResponse, SpaceUsageHourlyStat, SpaceUsageResponse, SpaceUsageSummary, TaskRunDetailResponse, TaskRunRecord, type UploadChatImageAttachmentInput, type UploadPublicAssetInput, UserProfile, UserRulesResponse, UsersApi, VoiceApi, type VoiceInputCallbacks, VoiceInputClient, type VoiceInputClientOptions, type VoiceInputCreateOptions, type VoiceInputEvent, type WebSocketConnectionState, WebsocketClient, type WorkAuthorizeRequest, type WorkAuthorizeResponse, type WorkBridgeCore, type WorkBridgeCoreConfig, type WorkBridgeCoreWork, type WorkBridgeDialogState, type WorkBridgeGetAccessToken, type WorkBridgeGetViewerUuid, type WorkBridgeRequestSignIn, WorkCommerceApi, type WorkCommerceCheckoutStatus, type WorkCommerceCreditConsumeResponse, type WorkCommerceCreditConsumeStatus, type WorkCommerceEntitlement, type WorkCommerceEntitlementsResponse, type WorkCommerceOrder, type WorkCommerceProductResolveResponse, type WorkCommercePurchaseResponse, type WorkCreateInput, type WorkDetailResponse, type WorkGetResponse, type WorkMeta, type WorkPresentationMeta, type WorkPublicOwnerRecord, type WorkPublicSpaceRecord, type WorkPurchaseRequest, type WorkRecord, type WorkResolveResponse, WorkRuntimeApi, type WorkRuntimeCheckoutState, type WorkRuntimeCheckoutStatus, type WorkRuntimeContext, type WorkRuntimeModeConfig, type WorkRuntimeRequestOptions, type WorkRuntimeTransport, type WorkSessionResponse, type WorkStatus, type WorkTargetType, type WorkUpdateInput, type WorkVersionRecord, type WorkVisibility, WorksApi, assertGenerationRequestAllowedByPolicy, clearGrantedWorkScopes, createCohubClient, createHttpClient, createSessionGenerationStreamClient, createSessionPatchReducer, createVoiceInputClient, createWebsocketClient, createWorkBridgeCore, createWorkRuntime, decodeGenerationPolicy, encodeGenerationPolicy, filterGenerationDeclarationsByPolicy, findGenerationModelPolicy, getAllowedGenerationModelIds, hasGrantedWorkScopes, isHttpErrorCode, normalizeBaseUrl, normalizeGenerationPolicy, normalizeVoiceInputWebsocketUrl, normalizeWebsocketUrl, parseAssistantMessageCommit, parseGenerationPolicyFromEnv, resolveApiBaseUrl, resolveCohubEnvironment, resolveVoiceInputWebsocketUrl, resolveWebsocketUrl, resolveWorkTransport, setGrantedWorkScopes };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { C as GenerationsApi, S as ModelsApi, T as ChannelsApi, _ as SessionAccessApi, a as UserApi, b as PublicAssetsApi, c as SpacesApi, d as createSessionGenerationStreamClient, f as parseAssistantMessageCommit, g as HttpTransport, h as HttpError, i as WorksApi, l as PublicInviteApi, m as createSessionPatchReducer, n as createHttpClient, o as TasksApi, p as SessionPatchReducer, r as WorkCommerceApi, s as SpaceClient, t as CohubHttpClient, u as SessionGenerationStreamClient, v as ReferencesApi, w as CronJobsApi, x as PromptsApi, y as SearchApi } from "./chunks/http.js";
+import { C as ModelsApi, E as ChannelsApi, S as PromptsApi, T as CronJobsApi, _ as ensureRealtimeConnected, a as UserApi, b as SearchApi, c as SpacesApi, d as createSessionGenerationStreamClient, f as parseAssistantMessageCommit, g as HttpTransport, h as HttpError, i as WorksApi, l as PublicInviteApi, m as createSessionPatchReducer, n as createHttpClient, o as TasksApi, p as SessionPatchReducer, r as WorkCommerceApi, s as SpaceClient, t as CohubHttpClient, u as SessionGenerationStreamClient, v as SessionAccessApi, w as GenerationsApi, x as PublicAssetsApi, y as ReferencesApi } from "./chunks/http.js";
 import { a as resolveApiBaseUrl, c as resolveWebsocketUrl, i as normalizeWebsocketUrl, n as normalizeBaseUrl, o as resolveCohubEnvironment, r as normalizeVoiceInputWebsocketUrl, s as resolveVoiceInputWebsocketUrl, t as COHUB_ENVIRONMENTS } from "./chunks/environment.js";
 import { WebsocketClient, createWebsocketClient } from "./websocket.js";
 import { VoiceApi, VoiceInputClient, createVoiceInputClient } from "./voice-input.js";
@@ -507,6 +507,10 @@ var CohubClient = class {
 	space(spaceId) {
 		return new SpaceClient(spaceId, this.transport, this.websocketClient);
 	}
+	onUserEvent(handler) {
+		ensureRealtimeConnected(this.websocketClient);
+		return this.websocketClient.on("event", handler);
+	}
 	onConnection(handler) {
 		const connectingCleanup = this.websocketClient.on("connecting", (payload) => {
 			handler({

package/docs/work-runtime-guide.md

@@ -0,0 +1,938 @@
+# Cohub Work Runtime Guide
+
+This guide explains how to use the Cohub SDK **inside a published Work** — the
+only environment where runtime APIs (`context()`, `auth.request`,
+`work.commerce.*`) function. Read this before writing any Work that calls Cohub
+capabilities from browser-side JavaScript.
+
+It is written to be self-contained: an agent or developer who reads only this
+file plus the SDK type definitions should be able to build a working Work
+without reverse-engineering source code.
+
+---
+
+## Table of contents
+
+1. [Mental model](#1-mental-model)
+2. [Two deployment modes: bridge vs broker](#2-two-deployment-modes-bridge-vs-broker)
+3. [The scope model — read this twice](#3-the-scope-model--read-this-twice)
+4. [Initialization recipe](#4-initialization-recipe)
+5. [Capability reference](#5-capability-reference)
+   - [LLM chat](#llm-chat-spaceprompt--subscribegeneration)
+   - [Image / media generation](#image--media-generation-generationscreateandwait)
+   - [Model listing](#model-listing-modelslist--modelslistmultimodal)
+   - [File reads](#file-reads-spacefiles)
+   - [Account-level data](#account-level-data-spaceslist--userlistsessions--usergetusage)
+   - [Commerce](#commerce-workcommerce)
+6. [Complete working example](#6-complete-working-example)
+7. [Common pitfalls checklist](#7-common-pitfalls-checklist)
+8. [Publishing a Work (API/SDK)](#8-publishing-a-work-apisdk)
+
+---
+
+## 1. Mental model
+
+A **Work** is a published, shareable web page hosted by Cohub. When a viewer
+opens a Work, Cohub serves its HTML/JS inside a **runtime** that bridges the
+Work's code to Cohub's backend.
+
+From the Work's JavaScript, you create a Cohub client and call APIs the same
+way you would from any other client — **but** the client is pre-wired to obtain
+short-lived access tokens from the Cohub shell (the runtime host) instead of
+requiring the viewer to paste an API key.
+
+```
+┌─────────────────────────────────────────┐
+│  Cohub shell (host page / iframe parent) │
+│                                         │
+│  ┌───────────────────────────────────┐  │
+│  │  Your Work (iframe or standalone) │  │
+│  │                                   │  │
+│  │  createCohubClient() ──► token ──►│──┼──► Cohub API
+│  │  client.context()    ◄── identity │  │
+│  │  client.auth.request() ──► consent│  │
+│  └───────────────────────────────────┘  │
+└─────────────────────────────────────────┘
+```
+
+Three runtime-only APIs form the foundation; everything else is standard SDK:
+
+| API | What it does | Returns |
+|---|---|---|
+| `client.context()` | Asks the host for the Work's identity | `{ work, space, viewer?, permissions }` or `null` |
+| `client.auth.request({ scopes, reason })` | Shows the viewer a consent dialog; on approval, caches a token carrying those scopes | `true` / `false` |
+| `client.work.commerce.*` | Entitlement checks, credit consumption, purchases | (see Commerce section) |
+
+> **Runtime-only constraint.** These three APIs only work inside a **published**
+> Work. Outside that context (a static asset URL, a local `file://` preview,
+> a plain Node script) `context()` returns `null` and `auth.request` / commerce
+> calls fail. Always develop against a published Work.
+
+---
+
+## 2. Two deployment modes: bridge vs broker
+
+The SDK auto-detects which mode you are in based on whether the page is inside
+an iframe. You normally do **not** need to set the mode explicitly.
+
+### Bridge mode (default, primary)
+
+The Work runs inside a Cohub-hosted iframe (`window.parent !== window`). The
+SDK communicates with the parent window via `postMessage` to request tokens
+and context. This is the normal case when a viewer opens a Work through Cohub.
+
+- `client.context()` returns the **real** `space.id`, `work.id`, and current
+  permission scopes from the host.
+- `client.auth.request()` triggers an in-shell consent flow (no popup window).
+
+### Broker mode (standalone deployment)
+
+The Work is accessed as a standalone page (`window.parent === window`), e.g.
+a direct static-asset URL not wrapped in the Cohub iframe. The SDK opens a
+**popup window** to a Cohub auth-broker page to obtain tokens.
+
+- `client.context()` is **answered locally** by the SDK: `space.id` is an
+  **empty string `""`**, and `viewerScopes` is **always empty**.
+- `client.auth.request()` opens a popup to
+  `${brokerOrigin}/work-auth?work=${workId}`.
+
+> **Broker mode requires configuration.** You must pass `work: { brokerOrigin,
+> workId }` to `createCohubClient` for broker mode to activate. Without it, a
+> standalone page gets `ParentBridgeTransport` which has no parent to talk to,
+> so `context()` returns `null`. See [Initialization recipe](#4-initialization-recipe).
+
+### Detecting the mode at runtime
+
+```js
+const ctx = await client.context();
+const isBroker = !ctx?.space?.id; // bridge has a real id; broker is ""
+```
+
+In broker mode you cannot get `spaceId` from `context()`. Resolve it via the
+public Work API (no token needed):
+
+```js
+const isBroker = !ctx?.space?.id;
+let spaceId;
+if (isBroker) {
+  const detail = await client.works.get(workId); // public, no auth
+  spaceId = detail.work.spaceId;
+} else {
+  spaceId = ctx.space.id;
+}
+```
+
+### Broker mode: user-activation ordering gotcha
+
+`HttpTransport` calls `getAccessToken()` on **every** request — including
+public ones like `works.get()`. In broker mode, an uncached token request
+opens a popup, which **consumes the browser's user-activation budget**. If a
+second popup (`auth.request`) follows in the same click, the browser blocks it.
+
+**Fix:** call `auth.request()` **before** any other API call that triggers
+`getAccessToken()`. After `auth.request` succeeds, the token is cached in
+`localStorage` and subsequent `getAccessToken()` calls hit the cache — no
+popup.
+
+```js
+// WRONG: works.get() opens a popup, consumes activation, auth.request popup blocked
+const detail = await client.works.get(workId);
+await client.auth.request({ scopes, reason });
+
+// RIGHT: auth.request opens the only popup, then works.get() hits token cache
+await client.auth.request({ scopes, reason });
+const detail = await client.works.get(workId);
+```
+
+Bridge mode is unaffected — `getAccessToken()` uses `postMessage` (no popup),
+so ordering does not matter there.
+
+---
+
+## 3. The scope model — read this twice
+
+> This is the **single most common source of bugs**. Every 403 you encounter
+> in a Work will almost certainly trace back to a missing scope of the wrong
+> type. Read this section carefully.
+
+Cohub Work permissions come in **two disjoint sets**. They do not overlap and
+do not imply each other.
+
+### Work scopes (direct, no user consent)
+
+Granted by the publisher **at publish time**. The Work always has them — no
+viewer action needed. These are **read** permissions.
+
+```
+space.view       — read space config, list models
+session.view     — read sessions, turns, stream generation updates
+file.view        — read files / file tree
+taskrun.view     — read task run details (used by generation polling!)
+```
+
+Set via `workScopes` when creating/updating a Work.
+
+### Viewer scopes (consent-required, action permissions)
+
+Declared by the publisher at publish time as **allowed** (`allowedViewerScopes`),
+but **not active** until the viewer approves them through a consent dialog
+triggered by `client.auth.request()`. These are **action** permissions.
+
+```
+session.prompt.readonly   — send read-only prompts (no side effects)
+session.prompt.fullaccess — send prompts with full access (write, create sessions)
+generation.create         — create generation tasks (image/video/audio)
+user.space.list           — list the viewer's spaces (account-level)
+user.session.list         — list the viewer's sessions across all spaces
+user.usage.read           — read the viewer's aggregated usage
+```
+
+### The golden rule
+
+> **Read operations need work scopes. Action operations need viewer scopes.
+> They never substitute for each other.**
+
+`session.prompt.fullaccess` lets you **send** a prompt, but does **not** let
+you **read** the result — that needs `session.view` (a work scope).
+`generation.create` lets you **create** a generation task, but reading its
+result needs `taskrun.view` (a work scope).
+
+### Complete API → scope mapping
+
+| Operation | SDK call | Scope needed | Type |
+|---|---|---|---|
+| Read space config | `space.get()` / `space.getConfig()` | `space.view` | work |
+| List models | `client.models.list()` / `listMultimodal()` | *(none — just authenticated)* | — |
+| Send a prompt | `space.prompt({ content, ... })` | `session.prompt.fullaccess` (or `.readonly`) | viewer |
+| Read turn result | `session.turns.get(turnId)` | `session.view` | work |
+| Stream generation | `session.subscribeGeneration({ state, finalized })` | `session.view` | work |
+| Read file tree | `space.files.tree()` | `file.view` | work |
+| Read file content | `space.files.read(path)` | `file.view` | work |
+| Create generation task | `client.generations.create(request)` | `generation.create` | viewer |
+| **Poll generation result** | `client.generations.wait(taskRunId)` / `createAndWait()` | **`taskrun.view`** | **work** |
+| Read task run detail | `client.tasks.get(taskRunId)` | `taskrun.view` | work |
+| List viewer's spaces | `client.spaces.list()` | `user.space.list` | viewer |
+| List viewer's sessions | `client.user.listSessions()` | `user.session.list` | viewer |
+| Read viewer's usage | `client.user.getUsage()` | `user.usage.read` | viewer |
+| Commerce: entitlements | `client.work.commerce.getEntitlements()` | *(runtime only, no scope)* | — |
+| Commerce: consume credits | `client.work.commerce.consumeCredits()` | *(runtime only, no scope)* | — |
+| Commerce: purchase | `client.work.commerce.purchase()` | *(runtime only, no scope)* | — |
+
+### Minimal scope sets for common Work types
+
+**LLM chat Work** (send prompt + read reply):
+- workScopes: `["space.view", "session.view"]`
+- allowedViewerScopes: `["session.prompt.fullaccess"]`
+
+**Image generation Work** (create + poll):
+- workScopes: `["space.view", "taskrun.view"]`
+- allowedViewerScopes: `["generation.create"]`
+
+**LLM + image generation Work** (the demo):
+- workScopes: `["space.view", "session.view", "taskrun.view"]`
+- allowedViewerScopes: `["session.prompt.fullaccess", "generation.create"]`
+
+**File-reader Work** (static, no viewer action):
+- workScopes: `["space.view", "file.view"]`
+- allowedViewerScopes: `[]`
+
+### Checking granted scopes at runtime
+
+`client.context()` returns a `permissions` object with three arrays:
+
+```js
+const ctx = await client.context();
+ctx.permissions.scopes       // all effective scopes (work + viewer)
+ctx.permissions.workScopes   // work scopes granted at publish time
+ctx.permissions.viewerScopes // viewer scopes the current viewer has approved
+```
+
+To check whether a **viewer** scope is already granted (to skip re-requesting):
+
+```js
+function hasViewerScope(ctx, scope) {
+  return (ctx?.permissions?.viewerScopes ?? []).includes(scope);
+}
+```
+
+---
+
+## 4. Initialization recipe
+
+### No-build HTML (CDN import)
+
+Works are typically single HTML files with no bundler. Import the SDK from an
+ESM CDN:
+
+```js
+import { createCohubClient } from "https://esm.sh/@neta-art/cohub@2";
+```
+
+> Pin to a major version (`@2`) or an exact version (`@2.6.0`) to avoid
+> breaking changes. Check `npm view @neta-art/cohub version` for the latest.
+
+### Environment detection — critical
+
+The SDK defaults to **production**. A Work running on a dev/staging host
+(e.g. `dev.cohub.run`, a `/dev/` path prefix) **must** pass `env: "dev"`
+explicitly — browsers do not inject `ENV` like Node does. If you omit this,
+your Work will call the production API while the runtime host expects dev,
+causing silent auth failures.
+
+```js
+const isDevWork =
+  location.pathname.startsWith("/dev/") ||
+  location.hostname.includes("dev");
+
+const client = createCohubClient({
+  env: isDevWork ? "dev" : "prod",
+});
+```
+
+### Broker mode configuration (standalone pages only)
+
+If the Work may be accessed as a standalone page (not inside the Cohub
+iframe), pass the `work` option so the SDK can fall back to broker mode:
+
+```js
+const client = createCohubClient({
+  env: isDevWork ? "dev" : "prod",
+  work: {
+    brokerOrigin: isDevWork ? "https://dev.cohub.run" : "https://cohub.run",
+    workId: "<your-published-work-id>",
+  },
+});
+```
+
+When inside the Cohub iframe, the SDK auto-detects bridge mode and ignores
+broker config. When standalone, it uses broker mode. **One codebase, both
+deployments.**
+
+### Standard initialization sequence
+
+```js
+// 1. Create client (env is mandatory in the browser)
+const client = createCohubClient({ env: isDevWork ? "dev" : "prod" });
+
+// 2. Get runtime context
+const ctx = await client.context();
+if (!ctx?.space?.id) {
+  // Not in a Work runtime (or broker mode — see §2)
+  throw new Error("Not running inside a published Work.");
+}
+
+// 3. Obtain the space client for API calls
+const spaceId = ctx.space.id;
+const space = client.space(spaceId);
+
+// 4. Request viewer scopes (from a user gesture, e.g. button click)
+const ok = await client.auth.request({
+  scopes: ["session.prompt.fullaccess", "generation.create"],
+  reason: "This Work needs to send prompts and generate images.",
+});
+if (!ok) {
+  // Viewer denied — handle gracefully
+}
+
+// 5. Call capabilities
+const result = await space.prompt({ content: [{ type: "text", text: "Hello" }] });
+```
+
+> **`auth.request` must be called from a user gesture** (click handler).
+Browsers block popups (broker mode) and some consent flows (bridge mode)
+when triggered programmatically without user activation. Do not call it on
+page load.
+
+---
+
+## 5. Capability reference
+
+Each recipe below shows the exact code pattern and scope requirements.
+Assume `client` and `space` are already initialized per [§4](#4-initialization-recipe).
+
+### LLM chat (`space.prompt` + `subscribeGeneration`)
+
+**Scopes:** viewer `session.prompt.fullaccess` (to send) + work `session.view` (to read/stream).
+
+`space.prompt()` is **asynchronous** — it returns immediately with a turn
+whose `assistantText` is `null`. You must either stream the reply via
+`subscribeGeneration` or poll `turns.get()`.
+
+```js
+// Send a prompt (creates or continues a session)
+const result = await space.prompt({
+  content: [{ type: "text", text: "Describe a shiba inu on Mars." }],
+  sessionId: null,        // null → creates a new session; pass an id to continue
+  model: "gpt-5.5",       // optional; omit for default
+  intent: "followup",     // "followup" | "steer" | "compact"
+});
+const sessionId = result.session.id;
+const turnId = result.turn.id;
+
+// --- Option A: stream the reply (preferred) ---
+// Requires work scope: session.view
+const stop = space.session(sessionId).subscribeGeneration({
+  state(event) {
+    // Partial text as it streams in
+    const text = (event.state?.contentBlocks ?? [])
+      .filter(b => b.type === "text")
+      .map(b => b.text)
+      .join("");
+    console.log("streaming:", text);
+  },
+  finalized(event) {
+    const turn = event.turn;
+    const reply = turn.assistantText
+      ?? (turn.assistantContent ?? []).filter(b => b.type === "text").map(b => b.text).join("");
+    console.log("final:", reply);
+  },
+  error(event) {
+    console.error("stream error:", event);
+  },
+});
+// Call stop() to unsubscribe when done.
+
+// --- Option B: poll for the reply (fallback) ---
+// Also requires work scope: session.view
+async function waitForTurn(sessionId, turnId) {
+  while (true) {
+    const { turn } = await space.session(sessionId).turns.get(turnId);
+    if (turn.status === "completed") return turn;
+    if (turn.status === "failed") throw new Error(turn.errorMessage || "failed");
+    await new Promise(r => setTimeout(r, 1500));
+  }
+}
+const turn = await waitForTurn(sessionId, turnId);
+const reply = turn.assistantText;
+```
+
+**Turn status values:** `"pending" | "running" | "completed" | "failed"`.
+
+**Turn reply fields:** `turn.assistantText` (string | null) and
+`turn.assistantContent` (ContentBlock[] | null). Always check both —
+`assistantText` is a convenience; `assistantContent` is the source of truth.
+
+> **Do not silently swallow `subscribeGeneration` errors.** If the work scope
+`session.view` is missing, the WebSocket subscription fails. If you catch and
+ignore it, your code silently degrades to polling — which will also 403.
+Surface the error so you can diagnose the missing scope.
+
+### Image / media generation (`generations.createAndWait`)
+
+**Scopes:** viewer `generation.create` (to create) + work `taskrun.view` (to poll).
+
+`createAndWait` is a convenience that calls `create` then `wait` (polls
+`GET /api/tasks/{id}`). **Both scopes are required** — `generation.create`
+for the create step, `taskrun.view` for the poll step. Missing `taskrun.view`
+is the #1 cause of "generation creates but never returns" bugs.
+
+```js
+const result = await client.generations.createAndWait(
+  {
+    spaceId,
+    model: "gpt-image-2",          // model id from models.listMultimodal()
+    content: [{ type: "text", text: "A cat on the moon, cartoon style" }],
+    parameters: {                   // optional, model-specific
+      size: "1024x1024",
+      // quality: "auto",           // gpt-image-2 supports quality
+    },
+  },
+  {
+    onPoll: (detail) => console.log("status:", detail.run.status),
+    // intervalMs: 1500,            // optional poll interval
+    // timeoutMs: 30 * 60 * 1000,   // optional timeout (default 30 min)
+  },
+);
+
+// Extract the image URL from the output blocks
+const image = (result.output ?? []).find(
+  b => b.type === "image" && b.source?.url
+);
+const imageUrl = image?.source?.url;
+```
+
+**Output block types:** `text`, `image`, `video`, `audio`. Each media block has
+a `source` of `{ type: "url", url }` or `{ type: "base64", mediaType, data }`.
+
+**Two-step alternative** (if you need the `taskRunId` immediately):
+
+```js
+const created = await client.generations.create(request);
+// created.taskRunId — generation task is queued
+const result = await client.generations.wait(created.taskRunId, { onPoll });
+```
+
+### Model listing (`models.list` / `models.listMultimodal`)
+
+**Scopes:** none — only requires a valid authenticated token (any token, no
+specific scope). Returns 401 without a token, but never 403.
+
+Call after initialization (after `context()` succeeds, so a token exists):
+
+```js
+// All models grouped by provider
+const catalog = await client.models.list();
+// catalog: { cohub: [...], openai: [...], ... }
+
+// Generation-capable models only (for image/video/audio generation)
+const { models } = await client.models.listMultimodal();
+// models: [{ model, title, description, ... }, ...]
+```
+
+Use `listMultimodal()` to populate a model picker for generation. Each entry's
+`model` field is the id you pass to `generations.createAndWait({ model })`.
+
+### File reads (`space.files`)
+
+**Scopes:** work `file.view` (read) + `space.view` (often needed for the space context).
+
+```js
+// List the file tree
+const tree = await space.files.tree();
+// tree: nested file/directory entries
+
+// Read a file (returns an HTTP Response — .text() / .blob() / .arrayBuffer())
+const response = await space.files.read("path/to/file.txt");
+const text = await response.text();
+
+// Read multiple files at once
+const files = await space.files.readMany(["a.txt", "b.json"]);
+```
+
+### Account-level data (`spaces.list` / `user.listSessions` / `user.getUsage`)
+
+**Scopes:** viewer `user.space.list` / `user.session.list` / `user.usage.read`.
+
+These access the **viewer's** account-level data across all their spaces — not
+the Work's own space. Each requires a separate viewer scope.
+
+```js
+// List the viewer's spaces — needs user.space.list
+await client.auth.request({
+  scopes: ["user.space.list"],
+  reason: "Show your space list.",
+});
+const spaces = await client.spaces.list();
+
+// List sessions across all the viewer's spaces — needs user.session.list
+await client.auth.request({
+  scopes: ["user.session.list"],
+  reason: "List your recent sessions.",
+});
+const { sessions } = await client.user.listSessions({ limit: 20 });
+
+// Read aggregated usage — needs user.usage.read
+await client.auth.request({
+  scopes: ["user.usage.read"],
+  reason: "Show your usage summary.",
+});
+const usage = await client.user.getUsage(30); // last 30 days
+```
+
+### Commerce (`work.commerce`)
+
+**Scopes:** none — runs inside the Work runtime, no scope needed. Only works
+in a published Work.
+
+```js
+// Check entitlements and credit balance in one call
+const { entitlements, credits } = await client.work.commerce.getEntitlements();
+
+// Feature unlock: purchase if not entitled
+const unlocked = entitlements.some(e => e.benefitKey === "space_pro" && e.enabled);
+if (!unlocked) {
+  await client.work.commerce.purchase({ productKey: "pro_unlock" });
+  // purchase() redirects to checkout; after return, re-check entitlements
+}
+
+// Credit consumption for a metered action
+const result = await client.work.commerce.consumeCredits({
+  amount: 10,
+  operationId: crypto.randomUUID(),  // idempotency key
+  reason: "Export high-res image",
+});
+if (result.status === "insufficient") {
+  await client.work.commerce.purchase({ productKey: "credit_pack" });
+}
+
+// After checkout return, query the order
+const checkoutState = await client.work.commerce.getCheckoutState();
+if (checkoutState.orderId) {
+  const { order } = await client.work.commerce.getOrder(checkoutState.orderId);
+}
+```
+
+---
+
+## 6. Complete working example
+
+A no-build HTML Work that tests LLM chat and image generation. This is the
+exact pattern that was verified end-to-end. Adapt it to your needs.
+
+> **Publish this Work with:**
+> - workScopes: `["space.view", "session.view", "taskrun.view"]`
+> - allowedViewerScopes: `["session.prompt.fullaccess", "generation.create"]`
+>
+> See [§8](#8-publishing-a-work-apisdk) for the publish API call.
+
+### `index.html`
+
+```html
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Cohub SDK Demo</title>
+  <link rel="stylesheet" href="style.css" />
+</head>
+<body>
+  <div class="container">
+    <h1>Cohub SDK Demo</h1>
+
+    <section class="card">
+      <h2>1. Context</h2>
+      <button id="btn-context" class="btn">Get context</button>
+      <pre id="output-context" class="output"></pre>
+    </section>
+
+    <section class="card">
+      <h2>2. Authorize</h2>
+      <button id="btn-auth" class="btn">Request viewer scopes</button>
+      <pre id="output-auth" class="output"></pre>
+    </section>
+
+    <section class="card">
+      <h2>3. LLM chat</h2>
+      <div id="chat-log" class="chat-log"></div>
+      <textarea id="chat-input" rows="2">Say hello in one sentence.</textarea>
+      <button id="btn-chat" class="btn">Send</button>
+      <pre id="output-chat" class="output"></pre>
+    </section>
+
+    <section class="card">
+      <h2>4. Image generation</h2>
+      <textarea id="img-prompt" rows="3">A cat on the moon, cartoon style</textarea>
+      <button id="btn-img" class="btn">Generate</button>
+      <div id="img-result"></div>
+      <pre id="output-img" class="output"></pre>
+    </section>
+  </div>
+  <script type="module" src="app.js"></script>
+</body>
+</html>
+```
+
+### `app.js`
+
+```js
+import { createCohubClient } from "https://esm.sh/@neta-art/cohub@2";
+
+// --- Environment detection (critical: browsers don't inject ENV) ---
+const isDevWork =
+  location.pathname.startsWith("/dev/") ||
+  location.hostname.includes("dev");
+
+const client = createCohubClient({
+  env: isDevWork ? "dev" : "prod",
+});
+
+const REQUIRED_SCOPES = ["generation.create", "session.prompt.fullaccess"];
+
+let space = null;
+let spaceId = null;
+let sessionId = null;
+
+const $ = (id) => document.getElementById(id);
+
+function setOutput(el, data) {
+  el.textContent = typeof data === "object" ? JSON.stringify(data, null, 2) : String(data);
+}
+
+function log(el, msg) {
+  el.textContent += `[${new Date().toLocaleTimeString()}] ${msg}\n`;
+}
+
+// --- Runtime initialization ---
+async function ensureRuntime(outEl) {
+  const ctx = await client.context();
+  if (!ctx?.space?.id) {
+    throw new Error("Not running inside a published Work runtime.");
+  }
+  spaceId = ctx.space.id;
+  space = client.space(spaceId);
+  return ctx;
+}
+
+// --- Viewer scope management ---
+function getViewerScopes(ctx) {
+  return ctx?.permissions?.viewerScopes ?? [];
+}
+
+function missingViewerScopes(ctx, scopes) {
+  const have = new Set(getViewerScopes(ctx));
+  return scopes.filter((s) => !have.has(s));
+}
+
+async function ensureViewerScopes(scopes, reason, outEl) {
+  const ctx = await ensureRuntime(outEl);
+  const missing = missingViewerScopes(ctx, scopes);
+  if (missing.length === 0) {
+    log(outEl, `Already have scopes: [${scopes.join(", ")}]`);
+    return true;
+  }
+  log(outEl, `Requesting scopes: [${missing.join(", ")}]...`);
+  const ok = await client.auth.request({ scopes, reason });
+  log(outEl, ok ? "Authorized." : "Authorization denied.");
+  return ok;
+}
+
+// --- LLM chat (space.prompt + subscribeGeneration) ---
+function extractText(blocks) {
+  return (blocks ?? [])
+    .filter((b) => b.type === "text" && typeof b.text === "string")
+    .map((b) => b.text)
+    .join("");
+}
+
+function waitForTurn(sid, turnId, onStream) {
+  return new Promise((resolve, reject) => {
+    let done = false;
+    let stop = null;
+
+    const finish = (fn) => {
+      if (done) return;
+      done = true;
+      if (stop) try { stop(); } catch {}
+      fn();
+    };
+
+    // Primary path: stream via WebSocket (needs work scope: session.view)
+    try {
+      stop = space.session(sid).subscribeGeneration({
+        state: (event) => {
+          const text = extractText(event.state?.contentBlocks);
+          if (text) onStream?.(text);
+        },
+        finalized: (event) => finish(() => resolve(event.turn)),
+        error: (event) => finish(() =>
+          reject(new Error(event?.rawEvent?.payload?.message || "stream error"))),
+      });
+    } catch (err) {
+      console.warn("subscribeGeneration failed:", err);
+    }
+
+    // Fallback: poll (also needs session.view — if missing, both paths 403)
+    const poll = async () => {
+      try {
+        const { turn } = await space.session(sid).turns.get(turnId);
+        if (turn.assistantText) onStream?.(turn.assistantText);
+        if (turn.status === "completed") finish(() => resolve(turn));
+        if (turn.status === "failed" || turn.status === "cancelled") {
+          finish(() => reject(new Error(turn.errorMessage || "failed")));
+        }
+      } catch (err) {
+        // Don't silently swallow — surface 403 (missing session.view)
+        console.error("poll error:", err);
+      }
+    };
+    const interval = setInterval(poll, 2000);
+    poll();
+    setTimeout(() => finish(() => reject(new Error("timeout"))), 120000);
+    // Note: in production, clear the interval in finish()
+  });
+}
+
+async function chat(text, outEl) {
+  const result = await space.prompt({
+    content: [{ type: "text", text }],
+    sessionId: sessionId || null,
+    intent: "followup",
+  });
+  sessionId = result.session.id;
+  const turn = await waitForTurn(sessionId, result.turn.id);
+  return turn.assistantText || extractText(turn.assistantContent) || "(empty)";
+}
+
+// --- Image generation (generations.createAndWait) ---
+async function generateImage(prompt, outEl) {
+  const result = await client.generations.createAndWait(
+    {
+      spaceId,
+      model: "gpt-image-2",
+      content: [{ type: "text", text: prompt }],
+      parameters: { size: "1024x1024" },
+    },
+    { onPoll: (d) => log(outEl, `poll: ${d.run.status}`) },
+  );
+  const image = (result.output ?? []).find(
+    (b) => b.type === "image" && b.source?.url,
+  );
+  return image?.source?.url ?? null;
+}
+
+// --- Event handlers (auth.request must be in a user gesture) ---
+$("btn-context").addEventListener("click", async () => {
+  const out = $("output-context");
+  out.textContent = "";
+  try {
+    const ctx = await client.context();
+    setOutput(out, {
+      "work.id": ctx?.work?.id,
+      "space.id": ctx?.space?.id,
+      permissions: ctx?.permissions,
+    });
+  } catch (err) { log(out, err.message); }
+});
+
+$("btn-auth").addEventListener("click", async () => {
+  const out = $("output-auth");
+  out.textContent = "";
+  const ok = await ensureViewerScopes(
+    REQUIRED_SCOPES,
+    "This demo needs to send prompts and generate images.",
+    out,
+  );
+  if (ok) log(out, "Ready to use capabilities.");
+});
+
+$("btn-chat").addEventListener("click", async () => {
+  const out = $("output-chat");
+  out.textContent = "";
+  const text = $("chat-input").value.trim();
+  if (!text) return;
+  try {
+    await ensureRuntime(out);
+    const ok = await ensureViewerScopes(
+      ["session.prompt.fullaccess"],
+      "LLM chat needs session.prompt.fullaccess.",
+      out,
+    );
+    if (!ok) return;
+    const reply = await chat(text, out);
+    log(out, `Reply: ${reply}`);
+  } catch (err) { log(out, err.message); }
+});
+
+$("btn-img").addEventListener("click", async () => {
+  const out = $("output-img");
+  out.textContent = "";
+  const prompt = $("img-prompt").value.trim();
+  if (!prompt) return;
+  try {
+    await ensureRuntime(out);
+    const ok = await ensureViewerScopes(
+      ["generation.create"],
+      "Image generation needs generation.create. taskrun.view comes from workScopes.",
+      out,
+    );
+    if (!ok) return;
+    const url = await generateImage(prompt, out);
+    if (url) {
+      $("img-result").innerHTML = `<img src="${url}" style="max-width:100%" />`;
+    }
+    log(out, "Done.");
+  } catch (err) { log(out, err.message); }
+});
+
+// Auto-fetch context on load (does not require auth)
+(async () => {
+  try {
+    const ctx = await client.context();
+    if (ctx) {
+      setOutput($("output-context"), {
+        "work.id": ctx.work?.id,
+        "space.id": ctx.space?.id,
+        permissions: ctx.permissions,
+      });
+    }
+  } catch {}
+})();
+```
+
+---
+
+## 7. Common pitfalls checklist
+
+Before publishing your Work, verify each item:
+
+- [ ] **Environment**: passed `env: "dev"` (or `"prod"`) explicitly — the SDK
+  defaults to prod and browsers don't inject `ENV`.
+- [ ] **Work scopes include all read operations**: `space.view`, `session.view`
+  (for LLM reply reads), `taskrun.view` (for generation polling), `file.view`
+  (for file reads). Missing any of these → 403 on reads.
+- [ ] **Viewer scopes include all action operations**: `session.prompt.fullaccess`
+  (or `.readonly`) for prompts, `generation.create` for generation.
+- [ ] **`session.prompt.fullaccess` does NOT include `session.view`** — they
+  are separate. Sending a prompt succeeds but reading the reply 403s without
+  `session.view`.
+- [ ] **`generation.create` does NOT include `taskrun.view`** — creating a
+  generation task succeeds but polling the result 403s without `taskrun.view`.
+- [ ] **`auth.request()` is called from a user gesture** (button click), not
+  on page load.
+- [ ] **`subscribeGeneration` errors are not silently swallowed** — if the
+  stream fails, surface it; a silent fallback to polling will also 403 if
+  `session.view` is missing.
+- [ ] **Broker mode**: if the Work may be accessed standalone, pass
+  `work: { brokerOrigin, workId }` and call `auth.request()` before any other
+  API call (to avoid user-activation exhaustion).
+- [ ] **Space has a slug and owner has a username** before publishing — the
+  API rejects Works when either is missing.
+- [ ] **Model ids are not hardcoded** — use `client.models.listMultimodal()`
+  to fetch available models dynamically (requires auth but no scope).
+
+---
+
+## 8. Publishing a Work (API/SDK)
+
+Before creating a Work through the API, ensure the owner has a username and
+the Space has a slug. The API rejects Works when either public identity part
+is missing.
+
+```js
+// Create a single-file Work (HTML file)
+await client.works.create({
+  spaceId,
+  slug: "my-html-demo",
+  status: "published",
+  targetType: "file",
+  targetRef: "demo/index.html",
+  workScopes: ["space.view", "session.view", "taskrun.view"],
+  allowedViewerScopes: ["session.prompt.fullaccess", "generation.create"],
+});
+
+// Create a directory Work (must contain index.html)
+await client.works.create({
+  spaceId,
+  slug: "my-site",
+  status: "published",
+  targetType: "directory",
+  targetRef: "site",
+  workScopes: ["space.view", "session.view", "taskrun.view", "file.view"],
+  allowedViewerScopes: ["session.prompt.fullaccess", "generation.create"],
+});
+
+// Create a port Work (sandbox dev server)
+await client.works.create({
+  spaceId,
+  slug: "live-preview",
+  status: "published",
+  targetType: "port",
+  targetRef: "5173",
+  workScopes: ["space.view"],
+  allowedViewerScopes: [],
+});
+```
+
+`targetRef` is a path **relative to the Space filesystem root** (not a local
+path). For file Works, the target must be an HTML file (`.html`/`.htm`).
+
+Update the published version from the current target:
+
+```js
+await client.works.publishVersion(workId);
+```
+
+Other SDK methods: `works.get(workId)`, `works.getBySlug(username, spaceSlug,
+workSlug)`, `works.listBySpace(spaceId)`, `works.update(workId, input)`,
+`works.delete(workId)`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neta-art/cohub",
-  "version": "2.6.0",
+  "version": "2.7.1",
   "description": "Cohub SDK for spaces, sessions, checkpoints, and realtime agent collaboration.",
   "license": "UNLICENSED",
   "private": false,
@@ -49,7 +49,8 @@
   "types": "./dist/index.d.ts",
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "docs"
   ],
   "devDependencies": {
     "tsdown": "^0.22.1",