@neta-art/cohub 8.0.1 → 8.2.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as BOARD_BUILTIN_EFFECT_KINDS, A as DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, B as BoardEffectSchema, C as createSessionPatchReducer, D as DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, E as DESKTOP_COMMAND_MAX_TIMEOUT_MS, F as parseDesktopCommandId, G as BoardCompositionSchema, H as BOARD_ANIMATION_CHANNELS, I as BoardAuthoringItemSchema, J as parseBoardCompositionInput, K as BoardProceduralClipSchema, L as BoardItemPatchSchema, M as isDesktopCallMethod, N as isTerminalDesktopCommandStatus, O as DESKTOP_COMMAND_PENDING_TTL_SECONDS, P as parseDesktopCommand, Q as BOARD_BUILTIN_CLIP_KINDS, R as BoardSemanticMutationSchema, S as SessionPatchReducer, T as DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, U as BOARD_ANIMATION_CHANNEL_CAPABILITIES, V as parseBoardEffectInput, W as BoardCompositionInputSchema, X as BOARD_ARROW_STROKE_SIZE, Y as BoardConnectionSchema, Z as BOARD_BUILTIN_CAPABILITIES, _ as buildSpaceInvitePath, a as DesktopCommandsApi, at as SkillsApi, b as createSessionGenerationStreamClient, c as ReferralsApi, ct as GenerationsApi, d as TasksApi, et as DEFAULT_BOARD_RENDER_LIMITS, f as BoardClient, g as PublicInviteApi, h as SpacesApi, i as WorkCommerceApi, it as PublicAssetsApi, j as DESKTOP_COMMAND_VERSION, k as DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, l as UsersApi, lt as CronJobsApi, m as SpacePublicFilesApi, n as createHttpClient, nt as ReferencesApi, o as UiCommandsApi, ot as PromptsApi, p as SpaceClient, q as BoardTrackSchema, r as AppCommerceApi, rt as SearchApi, s as AppsApi, st as ModelsApi, t as CohubHttpClient, tt as SessionAccessApi, u as UserApi, ut as ChannelsApi, v as buildSpacePath, w as ensureRealtimeConnected, x as parseAssistantMessageCommit, y as SessionGenerationStreamClient, z as BoardEffectInputSchema } from "./chunks/http.js";
+import { $ as BOARD_BUILTIN_CAPABILITIES, A as DESKTOP_COMMAND_PENDING_TTL_SECONDS, B as BoardSemanticMutationSchema, C as parseAssistantMessageCommit, D as DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, E as ensureRealtimeConnected, F as isTerminalDesktopCommandStatus, G as BOARD_ANIMATION_CHANNEL_CAPABILITIES, H as BoardEffectSchema, I as parseDesktopCommand, J as BoardProceduralClipSchema, K as BoardCompositionInputSchema, L as parseDesktopCommandId, M as DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, N as DESKTOP_COMMAND_VERSION, O as DESKTOP_COMMAND_MAX_TIMEOUT_MS, P as isDesktopCallMethod, Q as BOARD_ARROW_STROKE_SIZE, R as BoardAuthoringItemSchema, S as createSessionGenerationStreamClient, T as createSessionPatchReducer, U as parseBoardEffectInput, V as BoardEffectInputSchema, W as BOARD_ANIMATION_CHANNELS, X as parseBoardCompositionInput, Y as BoardTrackSchema, Z as BoardConnectionSchema, _ as SpacesApi, a as AppCommerceApi, at as SearchApi, b as buildSpacePath, c as UiCommandsApi, ct as PromptsApi, d as UsersApi, dt as CronJobsApi, et as BOARD_BUILTIN_CLIP_KINDS, f as UserApi, ft as ChannelsApi, g as SpacePublicFilesApi, h as SpaceClient, i as scopeListHasPermission, it as ReferencesApi, j as DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, k as DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, l as AppsApi, lt as ModelsApi, m as BoardClient, n as createHttpClient, nt as DEFAULT_BOARD_RENDER_LIMITS, o as WorkCommerceApi, ot as PublicAssetsApi, p as TasksApi, q as BoardCompositionSchema, r as PERMISSIONS, rt as SessionAccessApi, s as DesktopCommandsApi, st as SkillsApi, t as CohubHttpClient, tt as BOARD_BUILTIN_EFFECT_KINDS, u as ReferralsApi, ut as GenerationsApi, v as PublicInviteApi, w as SessionPatchReducer, x as SessionGenerationStreamClient, y as buildSpaceInvitePath, z as BoardItemPatchSchema } from "./chunks/http.js";
 import { _ as requestSourceToHeaders, a as sanitizeAccessToken, b as REALTIME_ROOM_EVENT_NAME_PATTERN, c as REQUEST_SOURCE_VIA_MAX_LENGTH, d as isRequestSourceEmpty, f as isRequestSourceUuid, g as readRequestSourceFromEnv, h as parseRequestSourceFromHeaders, i as matchesUnauthorizedErrorToken, l as hasRequestSourceIdentity, m as normalizeRequestSource, n as HttpTransport, o as COHUB_SOURCE_HEADER, p as mergeRequestSourceIntoMeta, r as joinApiUrl, s as COHUB_SOURCE_HEADER_NAMES, t as HttpError, u as isRequestSourceClientId, v as resolveRequestSourceChannel, y as isUuid } from "./chunks/transport.js";
 import { a as resolveApiBaseUrl, c as resolveWebsocketUrl, i as normalizeWebsocketUrl, n as normalizeBaseUrl, o as resolveCohubEnvironment, r as normalizeVoiceInputWebsocketUrl, s as resolveVoiceInputWebsocketUrl, t as COHUB_ENVIRONMENTS } from "./chunks/environment.js";
 import { a as extractBillingPayload, c as isFeatureNotEntitledError, i as FEATURE_NOT_ENTITLED_ERROR_CODE, l as isHttpErrorCode, n as createWebsocketClient, o as isBillingAccessBlockedCode, r as BILLING_ACCESS_BLOCKED_ERROR_CODE, s as isBillingAccessBlockedError, t as WebsocketClient } from "./chunks/websocket.js";
@@ -1150,7 +1150,8 @@ const RESERVED_PLATFORM_PATH_SEGMENTS = Object.freeze([
 	"user",
 	"users",
 	"work-auth",
-	"app-auth"
+	"app-auth",
+	"zh"
 ]);
 new Set(RESERVED_PLATFORM_PATH_SEGMENTS);
 [...RESERVED_PLATFORM_PATH_SEGMENTS];
@@ -2144,35 +2145,54 @@ var PopupBrokerTransport = class {
 	}
 };
 const TOKEN_STORAGE_PREFIX = "cohub:app-token";
-const AUTHORIZED_SCOPES_STORAGE_PREFIX = "cohub:app-auth-scopes";
+const AUTHORIZED_GRANTS_STORAGE_PREFIX = "cohub:app-auth-grants";
+/** The space a server response actually granted, when it says so. */
+const responseSpaceId = (value) => typeof value === "string" && value ? value : void 0;
+/**
+* Records one consent, keyed by its space. Newer entries replace older ones
+* for the same space, so implicit home-space requests (no `spaceId`) and
+* explicit ones converge onto a single entry once the server echoes its
+* canonical space id back.
+*/
+function recordConsent(grants, spaceId, scopes) {
+	return [...(grants ?? []).filter((grant) => grant.spaceId !== spaceId), spaceId ? {
+		spaceId,
+		scopes
+	} : { scopes }];
+}
+const isAuthorizedGrant = (value) => {
+	if (!value || typeof value !== "object") return false;
+	const record = value;
+	return (record.spaceId === void 0 || typeof record.spaceId === "string") && Array.isArray(record.scopes) && record.scopes.every((scope) => typeof scope === "string");
+};
 var AppRuntimeApi = class {
 	token = null;
 	transport;
 	tokenStorageKey;
-	scopesStorageKey;
+	grantsStorageKey;
 	appIdResolver;
 	/** Ensures storage keys are resolved (via slug lookup) at most once. */
 	storageKeysReady;
-	/** Scopes previously granted via requestAuthorization, retained so token
-	* refreshes can re-authorize (preserving viewerScopes) instead of falling
-	* back to a base session token that only carries appScopes. */
-	authorizedScopes = null;
+	/** Consents previously granted via requestAuthorization, retained so token
+	* refreshes can re-authorize (preserving viewer grants) instead of falling
+	* back to a base session token that only carries app-side scopes. */
+	authorizedGrants = null;
 	constructor(transport = new ParentBridgeTransport(), appId, appIdResolver) {
 		this.transport = transport;
 		this.appIdResolver = appIdResolver;
 		if (appId) {
 			this.tokenStorageKey = `${TOKEN_STORAGE_PREFIX}:${appId}`;
-			this.scopesStorageKey = `${AUTHORIZED_SCOPES_STORAGE_PREFIX}:${appId}`;
+			this.grantsStorageKey = `${AUTHORIZED_GRANTS_STORAGE_PREFIX}:${appId}`;
 			this.storageKeysReady = Promise.resolve();
 			this.token = this.readStoredToken();
-			this.authorizedScopes = this.readStoredScopes();
+			this.authorizedGrants = this.readStoredGrants();
 		} else if (appIdResolver) {
 			this.tokenStorageKey = null;
-			this.scopesStorageKey = null;
+			this.grantsStorageKey = null;
 			this.storageKeysReady = null;
 		} else {
 			this.tokenStorageKey = null;
-			this.scopesStorageKey = null;
+			this.grantsStorageKey = null;
 			this.storageKeysReady = Promise.resolve();
 		}
 	}
@@ -2187,11 +2207,11 @@ var AppRuntimeApi = class {
 			const appId = this.appIdResolver ? await this.appIdResolver() : null;
 			if (appId) {
 				this.tokenStorageKey = `${TOKEN_STORAGE_PREFIX}:${appId}`;
-				this.scopesStorageKey = `${AUTHORIZED_SCOPES_STORAGE_PREFIX}:${appId}`;
+				this.grantsStorageKey = `${AUTHORIZED_GRANTS_STORAGE_PREFIX}:${appId}`;
 				const stored = this.readStoredToken();
 				if (stored && !this.token) this.token = stored;
-				const storedScopes = this.readStoredScopes();
-				if (storedScopes && !this.authorizedScopes) this.authorizedScopes = storedScopes;
+				const storedGrants = this.readStoredGrants();
+				if (storedGrants && !this.authorizedGrants) this.authorizedGrants = storedGrants;
 			}
 		})();
 		return this.storageKeysReady;
@@ -2211,22 +2231,23 @@ var AppRuntimeApi = class {
 			else localStorage.removeItem(this.tokenStorageKey);
 		} catch {}
 	}
-	readStoredScopes() {
-		if (!this.scopesStorageKey || typeof localStorage === "undefined") return null;
+	readStoredGrants() {
+		if (!this.grantsStorageKey || typeof localStorage === "undefined") return null;
 		try {
-			const raw = localStorage.getItem(this.scopesStorageKey);
+			const raw = localStorage.getItem(this.grantsStorageKey);
 			if (!raw) return null;
 			const parsed = JSON.parse(raw);
-			return Array.isArray(parsed) && parsed.every((s) => typeof s === "string") ? parsed : null;
+			if (!Array.isArray(parsed) || !parsed.every(isAuthorizedGrant)) return null;
+			return parsed;
 		} catch {
 			return null;
 		}
 	}
-	writeStoredScopes(scopes) {
-		if (!this.scopesStorageKey || typeof localStorage === "undefined") return;
+	writeStoredGrants(grants) {
+		if (!this.grantsStorageKey || typeof localStorage === "undefined") return;
 		try {
-			if (scopes && scopes.length > 0) localStorage.setItem(this.scopesStorageKey, JSON.stringify(scopes));
-			else localStorage.removeItem(this.scopesStorageKey);
+			if (grants && grants.length > 0) localStorage.setItem(this.grantsStorageKey, JSON.stringify(grants));
+			else localStorage.removeItem(this.grantsStorageKey);
 		} catch {}
 	}
 	async context() {
@@ -2245,14 +2266,29 @@ var AppRuntimeApi = class {
 			this.token = null;
 			this.writeStoredToken(null);
 		}
-		if (options?.forceRefresh && this.authorizedScopes && this.authorizedScopes.length > 0) {
-			const response = await this.transport.request({
-				type: "cohub.app.authorize",
-				scopes: this.authorizedScopes
-			}, { timeoutMs: 12e4 });
-			this.token = response?.token ?? null;
-			this.writeStoredToken(this.token);
-			return this.token;
+		if (options?.forceRefresh && this.authorizedGrants && this.authorizedGrants.length > 0) {
+			let refreshed = false;
+			let next = [];
+			for (const grant of this.authorizedGrants) try {
+				const response = await this.transport.request({
+					type: "cohub.app.authorize",
+					scopes: grant.scopes,
+					spaceId: grant.spaceId
+				}, { timeoutMs: 12e4 });
+				const token = response?.token ?? null;
+				if (!token) continue;
+				this.token = token;
+				next = recordConsent(next, responseSpaceId(response?.space?.id) ?? grant.spaceId, grant.scopes);
+				refreshed = true;
+			} catch {
+				next = recordConsent(next, grant.spaceId, grant.scopes);
+			}
+			this.authorizedGrants = next;
+			this.writeStoredGrants(next);
+			if (refreshed) {
+				this.writeStoredToken(this.token);
+				return this.token;
+			}
 		}
 		const response = await this.transport.request({
 			type: "cohub.app.token",
@@ -2262,20 +2298,63 @@ var AppRuntimeApi = class {
 		this.writeStoredToken(this.token);
 		return this.token;
 	}
+	/**
+	* Requests viewer consent. Without a `spaceId` the grant targets the app's
+	* home space; with one it targets that space — the app may only grant what
+	* the viewer can already do there themselves. Reuses a previous grant
+	* silently unless `alwaysAsk` forces the consent dialog.
+	*/
 	async requestAuthorization(input) {
 		await this.ensureStorageKeys();
 		const response = await this.transport.request({
 			type: "cohub.app.authorize",
 			scopes: input.scopes,
-			reason: input.reason
+			reason: input.reason,
+			spaceId: input.spaceId,
+			alwaysAsk: input.alwaysAsk
 		}, { timeoutMs: 12e4 });
-		this.token = response?.token ?? null;
-		this.writeStoredToken(this.token);
-		if (this.token) {
-			this.authorizedScopes = input.scopes;
-			this.writeStoredScopes(input.scopes);
+		const token = response?.token ?? null;
+		if (token) {
+			this.token = token;
+			this.writeStoredToken(token);
+			const spaceId = responseSpaceId(response?.space?.id) ?? input.spaceId;
+			this.authorizedGrants = recordConsent(this.authorizedGrants, spaceId, input.scopes);
+			this.writeStoredGrants(this.authorizedGrants);
 		}
-		return Boolean(this.token);
+		return Boolean(token);
+	}
+	/**
+	* Asks the viewer to pick a Space and grant the scopes on it — one consent
+	* dialog covers both. Resolves with the picked space so the app knows where
+	* it may act; `space` is null when the viewer denied.
+	*/
+	async requestSpaceAuthorization(input) {
+		await this.ensureStorageKeys();
+		const response = await this.transport.request({
+			type: "cohub.app.authorize",
+			scopes: input.scopes,
+			reason: input.reason,
+			selectSpace: true,
+			alwaysAsk: input.alwaysAsk
+		}, { timeoutMs: 12e4 });
+		const token = response?.token ?? null;
+		const spaceId = typeof response?.space?.id === "string" ? response.space.id : null;
+		const spaceName = typeof response?.space?.name === "string" ? response.space.name : null;
+		if (token) {
+			this.token = token;
+			this.writeStoredToken(token);
+		}
+		if (token && spaceId) {
+			this.authorizedGrants = recordConsent(this.authorizedGrants, spaceId, input.scopes);
+			this.writeStoredGrants(this.authorizedGrants);
+		}
+		return {
+			granted: Boolean(token),
+			space: spaceId ? {
+				id: spaceId,
+				name: spaceName
+			} : null
+		};
 	}
 	async purchase(input) {
 		const purchaseAttemptId = input.purchaseAttemptId?.trim() || generateRequestId();
@@ -2438,7 +2517,12 @@ var CohubClient = class {
 	context() {
 		return this.appRuntime.context();
 	}
-	auth = { request: (input) => this.appRuntime.requestAuthorization(input) };
+	auth = {
+		/** Ensure the app holds these scopes. Silent when a grant already covers them; `alwaysAsk` forces the dialog. */
+		request: (input) => this.appRuntime.requestAuthorization(input),
+		/** One consent: the viewer picks a Space and grants the scopes on it. `alwaysAsk` re-opens the picker. */
+		requestSpace: (input) => this.appRuntime.requestSpaceAuthorization(input)
+	};
 	app = {
 		realtime: null,
 		/** Expose callable methods from inside a published app. */
@@ -2634,8 +2718,9 @@ const MAX_AGE_MS = 336 * 60 * 60 * 1e3;
 function isBrowser() {
 	return typeof localStorage !== "undefined";
 }
-function storageKey(userUuid, appId) {
-	return `${STORAGE_PREFIX}:${encodeURIComponent(userUuid)}:${encodeURIComponent(appId)}:v${CACHE_VERSION}`;
+function storageKey(userUuid, appId, spaceId) {
+	const base = `${STORAGE_PREFIX}:${encodeURIComponent(userUuid)}:${encodeURIComponent(appId)}`;
+	return spaceId ? `${base}:${encodeURIComponent(spaceId)}:v${CACHE_VERSION}` : `${base}:v${CACHE_VERSION}`;
 }
 function userPrefix(userUuid) {
 	return `${STORAGE_PREFIX}:${encodeURIComponent(userUuid)}:`;
@@ -2643,19 +2728,19 @@ function userPrefix(userUuid) {
 function isPermissionArray(value) {
 	return Array.isArray(value) && value.every((v) => typeof v === "string");
 }
-function isCachedWorkGrant(value) {
+function isCachedAppGrant(value) {
 	if (!value || typeof value !== "object") return false;
 	const record = value;
 	return record.version === CACHE_VERSION && typeof record.userUuid === "string" && typeof record.appId === "string" && isPermissionArray(record.scopes) && typeof record.updatedAt === "number";
 }
-function readEntry(userUuid, appId) {
+function readEntry(userUuid, appId, spaceId) {
 	if (!isBrowser()) return null;
-	const key = storageKey(userUuid, appId);
+	const key = storageKey(userUuid, appId, spaceId);
 	try {
 		const raw = localStorage.getItem(key);
 		if (!raw) return null;
 		const parsed = JSON.parse(raw);
-		if (!isCachedWorkGrant(parsed) || parsed.userUuid !== userUuid || parsed.appId !== appId) {
+		if (!isCachedAppGrant(parsed) || parsed.userUuid !== userUuid || parsed.appId !== appId) {
 			localStorage.removeItem(key);
 			return null;
 		}
@@ -2673,44 +2758,86 @@ function readEntry(userUuid, appId) {
 }
 /**
 * Returns true when the viewer has previously granted every requested scope
-* for this work, allowing a silent re-authorization.
+* for this app on the target space, allowing a silent re-authorization.
 */
-function hasGrantedAppScopes(userUuid, appId, scopes) {
+function hasGrantedAppScopes(userUuid, appId, scopes, spaceId) {
 	if (!userUuid || !appId || scopes.length === 0) return false;
-	const entry = readEntry(userUuid, appId);
+	const entry = readEntry(userUuid, appId, spaceId);
 	if (!entry) return false;
-	const granted = new Set(entry.scopes);
-	return scopes.every((scope) => granted.has(scope));
+	return scopes.every((scope) => scopeListHasPermission(entry.scopes, scope));
 }
 /**
-* Records the granted scopes for a work, merged with any previously granted
-* scopes so a growing permission set stays covered.
+* Lists every cached grant for an app — one entry per space — so hosts can
+* report what the viewer previously consented to without a server round trip.
+* Entries past their re-consent window are dropped on read.
 */
-function setGrantedAppScopes(userUuid, appId, scopes) {
+function listGrantedAppScopes(userUuid, appId, homeSpaceId) {
+	if (!userUuid || !appId || !isBrowser()) return [];
+	const prefix = `${STORAGE_PREFIX}:${encodeURIComponent(userUuid)}:${encodeURIComponent(appId)}:`;
+	const grants = [];
+	try {
+		for (let i = 0; i < localStorage.length; i += 1) {
+			const key = localStorage.key(i);
+			if (!key?.startsWith(prefix)) continue;
+			const spaceId = key.slice(prefix.length).match(/^(?:(.*):)?v\d+$/)?.[1] || homeSpaceId;
+			if (!spaceId) continue;
+			const raw = localStorage.getItem(key);
+			if (!raw) continue;
+			const parsed = JSON.parse(raw);
+			if (!isCachedAppGrant(parsed) || parsed.userUuid !== userUuid || parsed.appId !== appId || Date.now() - parsed.updatedAt > MAX_AGE_MS) continue;
+			grants.push({
+				spaceId: decodeURIComponent(spaceId),
+				scopes: parsed.scopes
+			});
+		}
+	} catch {}
+	return grants;
+}
+/**
+* Records the granted scopes for an app on a space. Replaces any previously
+* cached scopes so the cache mirrors the server row exactly — an explicit
+* consent with fewer scopes must narrow the cache too, or silent reuse could
+* hand back permissions the viewer just removed.
+*/
+function setGrantedAppScopes(userUuid, appId, scopes, spaceId) {
 	if (!userUuid || !appId || scopes.length === 0) return;
-	const existing = readEntry(userUuid, appId);
-	const merged = Array.from(/* @__PURE__ */ new Set([...existing?.scopes ?? [], ...scopes]));
 	const entry = {
 		version: CACHE_VERSION,
 		userUuid,
 		appId,
-		scopes: merged,
+		scopes: Array.from(new Set(scopes)),
 		updatedAt: Date.now()
 	};
 	if (!isBrowser()) return;
 	try {
-		localStorage.setItem(storageKey(userUuid, appId), JSON.stringify(entry));
+		localStorage.setItem(storageKey(userUuid, appId, spaceId), JSON.stringify(entry));
+	} catch {}
+}
+/**
+* Synchronizes a cached grant with the server while preserving the last
+* explicit-consent timestamp. Also migrates legacy keys to the canonical Space.
+*/
+function syncGrantedAppScopes(userUuid, appId, fromSpaceId, toSpaceId, scopes) {
+	if (!userUuid || !appId || !toSpaceId || scopes.length === 0 || !isBrowser()) return;
+	const entry = readEntry(userUuid, appId, toSpaceId) ?? readEntry(userUuid, appId, fromSpaceId);
+	if (!entry) return;
+	try {
+		localStorage.setItem(storageKey(userUuid, appId, toSpaceId), JSON.stringify({
+			...entry,
+			scopes: Array.from(new Set(scopes))
+		}));
+		if (fromSpaceId !== toSpaceId) localStorage.removeItem(storageKey(userUuid, appId, fromSpaceId));
 	} catch {}
 }
 /**
-* Clears cached grants. Pass a appId to clear a single work, or omit it to
-* clear every cached grant for the user (used on sign-out).
+* Clears cached grants. Pass an appId to clear one app (optionally one
+* space), or omit it to clear every cached grant for the user (sign-out).
 */
-function clearGrantedAppScopes(userUuid, appId) {
+function clearGrantedAppScopes(userUuid, appId, spaceId) {
 	if (!isBrowser() || !userUuid) return;
 	try {
 		if (appId) {
-			localStorage.removeItem(storageKey(userUuid, appId));
+			localStorage.removeItem(storageKey(userUuid, appId, spaceId));
 			return;
 		}
 		const prefix = userPrefix(userUuid);
@@ -2731,6 +2858,42 @@ function clonePermissionScopes(scopes) {
 	return Array.from(scopes ?? []).filter((scope) => typeof scope === "string");
 }
 /**
+* Scopes arriving over postMessage are untrusted: keep only known permission
+* names (in first-seen order, deduplicated) so a malicious app cannot push
+* arbitrary strings, duplicates, or oversized arrays into the consent dialog.
+*/
+function sanitizeRequestedScopes(value) {
+	if (!Array.isArray(value)) return [];
+	const known = new Set(PERMISSIONS);
+	const seen = /* @__PURE__ */ new Set();
+	for (const scope of value) if (typeof scope === "string" && known.has(scope)) seen.add(scope);
+	return Array.from(seen);
+}
+/** Consent dialogs render the reason; keep hostile input bounded. */
+const MAX_REASON_LENGTH = 280;
+var AppAuthorizationError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+		this.name = "AppAuthorizationError";
+	}
+};
+const isDefinitiveAuthorizationFailure = (error) => error instanceof AppAuthorizationError && [
+	401,
+	403,
+	404
+].includes(error.status);
+function sanitizeReason(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	if (!trimmed) return void 0;
+	return trimmed.length > MAX_REASON_LENGTH ? trimmed.slice(0, MAX_REASON_LENGTH) : trimmed;
+}
+function normalizePermissionScopes(scopes) {
+	return Array.from(new Set(clonePermissionScopes(scopes)));
+}
+/**
 * Framework-agnostic app bridge host core — message handling, app session
 * token minting, authorization (with silent re-grant cache), and
 * purchase/checkout flow — without any rendering or reactive primitives.
@@ -2745,6 +2908,8 @@ function createAppBridgeCore(config) {
 	const authorizationContext = config.authorizationContext ?? (config.isBackground ? { surface: "background" } : { surface: "page" });
 	const onStateChange = config.onStateChange;
 	let appToken = null;
+	/** Consents made through this host, keyed by target space. */
+	const sessionViewerGrants = /* @__PURE__ */ new Map();
 	let activeInvocation;
 	let contextChangeVersion = 0;
 	const legacyRequestIds = /* @__PURE__ */ new Set();
@@ -2752,6 +2917,7 @@ function createAppBridgeCore(config) {
 		const invocation = activeInvocation !== void 0 ? activeInvocation : config.getInvocation?.() ?? config.invocation;
 		const appScopes = clonePermissionScopes(app.appScopes);
 		const viewerUuid = await getViewerUuid();
+		const viewerGrants = mergeViewerGrants(viewerUuid, Array.from(sessionViewerGrants.values()));
 		return {
 			app: {
 				id: app.id,
@@ -2762,9 +2928,24 @@ function createAppBridgeCore(config) {
 			viewer: viewerUuid ? { userUuid: viewerUuid } : null,
 			...invocation ? { invocation: { ...invocation } } : {},
 			permissions: {
-				scopes: appScopes,
+				scopes: normalizePermissionScopes([...appScopes, ...viewerGrants.flatMap((grant) => grant.scopes)]),
 				appScopes,
-				viewerScopes: []
+				viewerScopes: normalizePermissionScopes(viewerGrants.flatMap((grant) => grant.scopes)),
+				viewerGrants
+			}
+		};
+	}
+	/** Builds an authorize reply; the target space rides along for the app. */
+	function authorizeResult(token, spaceId, spaceName) {
+		return {
+			type: "cohub.app.authorize.result",
+			token,
+			space: spaceId ? {
+				id: spaceId,
+				name: spaceName
+			} : {
+				id: app.spaceId,
+				name: app.spaceName ?? null
 			}
 		};
 	}
@@ -2821,6 +3002,12 @@ function createAppBridgeCore(config) {
 		const viewerUuid = await getViewerUuid();
 		return Boolean(viewerUuid && viewerUuid === app.userUuid);
 	}
+	function mergeViewerGrants(viewerUuid, sessionGrants) {
+		const bySpace = /* @__PURE__ */ new Map();
+		for (const grant of listGrantedAppScopes(viewerUuid, app.id, app.spaceId)) bySpace.set(grant.spaceId, grant);
+		for (const grant of sessionGrants) bySpace.set(grant.spaceId, grant);
+		return Array.from(bySpace.values());
+	}
 	function allowsOwnerAutoAuthorization() {
 		return authorizationContext.surface === "background" || authorizationContext.surface === "app";
 	}
@@ -2841,11 +3028,17 @@ function createAppBridgeCore(config) {
 		appToken = token;
 		return appToken;
 	}
-	async function authorize(scopes) {
+	/**
+	* Calls the authorize endpoint. `silent` marks a background refresh of a
+	* previous consent: the server then only renews a live grant and never
+	* creates or revives one, so a revoked grant cannot come back without a
+	* fresh dialog.
+	*/
+	async function authorize(scopes, spaceId, options) {
 		const userToken = await getAccessToken();
 		if (!userToken) {
 			await config.requestSignIn(typeof location !== "undefined" ? location.pathname : "/");
-			return null;
+			throw new Error("Sign in is required to authorize this app.");
 		}
 		const response = await fetch(`${apiOrigin}/api/apps/${app.id}/authorize`, {
 			method: "POST",
@@ -2853,13 +3046,84 @@ function createAppBridgeCore(config) {
 				Authorization: `Bearer ${userToken}`,
 				"Content-Type": "application/json"
 			},
-			body: JSON.stringify({ scopes })
+			body: JSON.stringify({
+				scopes,
+				...spaceId ? { spaceId } : {},
+				...options?.silent ? { silent: true } : {}
+			})
 		});
-		if (!response.ok) throw new Error((await response.json().catch(() => null))?.message ?? "Authorization failed.");
-		const token = readTokenResponse(await response.json());
+		const payload = await response.json().catch(() => null);
+		if (!response.ok) throw new AppAuthorizationError(typeof payload?.message === "string" ? payload.message : "Authorization failed.", response.status);
+		const token = readTokenResponse(payload);
 		if (!token) throw new Error("Invalid app authorization response.");
+		const canonicalSpaceId = typeof payload?.grant?.spaceId === "string" && payload.grant.spaceId ? payload.grant.spaceId : spaceId ?? app.spaceId;
+		const grantedScopes = sanitizeRequestedScopes(payload?.grant?.scopes);
+		const canonicalScopes = grantedScopes.length > 0 ? grantedScopes : clonePermissionScopes(scopes);
 		appToken = token;
-		return appToken;
+		sessionViewerGrants.set(canonicalSpaceId, {
+			spaceId: canonicalSpaceId,
+			scopes: canonicalScopes
+		});
+		syncGrantedAppScopes(await getViewerUuid(), app.id, spaceId, canonicalSpaceId, canonicalScopes);
+		return {
+			token,
+			spaceId: canonicalSpaceId,
+			scopes: canonicalScopes
+		};
+	}
+	/**
+	* Lists the viewer's spaces for the consent dialog picker. Fetched by the
+	* host with the viewer's own token — the app only ever learns the space
+	* the viewer picks, never the list.
+	*/
+	async function listViewerSpaces() {
+		const userToken = await getAccessToken();
+		if (!userToken) return null;
+		try {
+			const response = await fetch(`${apiOrigin}/api/spaces`, { headers: { Authorization: `Bearer ${userToken}` } });
+			if (!response.ok) return null;
+			const spaces = await response.json();
+			if (!Array.isArray(spaces)) return null;
+			return spaces.flatMap((space) => {
+				if (typeof space.id !== "string" || !space.id) return [];
+				return [{
+					id: space.id,
+					name: typeof space.name === "string" && space.name ? space.name : null
+				}];
+			});
+		} catch {
+			return null;
+		}
+	}
+	const pickedSpaceStorageKey = `cohub:app-picked-space:${app.id}`;
+	function readLastPickedSpace() {
+		try {
+			return localStorage.getItem(pickedSpaceStorageKey);
+		} catch {
+			return null;
+		}
+	}
+	function writeLastPickedSpace(spaceId) {
+		try {
+			localStorage.setItem(pickedSpaceStorageKey, spaceId);
+		} catch {}
+	}
+	/**
+	* Resolves the target space's name for the consent dialog. The host — not
+	* the app — resolves it, so the dialog cannot be tricked into labeling a
+	* grant with the wrong space.
+	*/
+	async function resolveSpaceName(spaceId) {
+		const userToken = await getAccessToken();
+		if (!userToken) return null;
+		try {
+			const response = await fetch(`${apiOrigin}/api/spaces/${encodeURIComponent(spaceId)}`, { headers: { Authorization: `Bearer ${userToken}` } });
+			if (!response.ok) return null;
+			const space = await response.json();
+			return typeof space.name === "string" && space.name ? space.name : null;
+		} catch {
+			return null;
+		}
 	}
 	function writePendingPurchase(input) {
 		if (typeof sessionStorage === "undefined") return;
@@ -2972,38 +3236,60 @@ function createAppBridgeCore(config) {
 				config.onPurchaseRequested?.({ ...state.pendingPurchase });
 			}
 			if (data.type === "cohub.app.authorize" || data.type === "cohub.work.authorize") {
-				const allowedViewerScopes = clonePermissionScopes(app.allowedViewerScopes);
-				const scopes = clonePermissionScopes(data.scopes).filter((scope) => allowedViewerScopes.includes(scope));
+				const scopes = sanitizeRequestedScopes(data.scopes);
+				const spaceId = typeof data.spaceId === "string" && data.spaceId ? data.spaceId : void 0;
+				const selectSpace = data.selectSpace === true && !spaceId;
+				const alwaysAsk = data.alwaysAsk === true;
 				if (scopes.length === 0) {
 					replyForRequest(data.requestId, {
 						type: "cohub.app.error",
-						message: "No allowed scopes requested."
+						message: "No scopes requested."
 					}, true);
 					return;
 				}
-				if (allowsOwnerAutoAuthorization() && await isCurrentViewerAppOwner()) {
-					const token = await authorize(scopes);
-					replyForRequest(data.requestId, {
-						type: "cohub.app.authorize.result",
-						token
-					}, true);
+				if (!selectSpace && !alwaysAsk && allowsOwnerAutoAuthorization() && await isCurrentViewerAppOwner()) try {
+					const result = await authorize(scopes, spaceId, { silent: true });
+					replyForRequest(data.requestId, authorizeResult(result.token, result.spaceId, result.spaceId === app.spaceId ? app.spaceName ?? null : null), true);
 					return;
+				} catch (error) {
+					if (!isDefinitiveAuthorizationFailure(error)) {
+						replyForRequest(data.requestId, {
+							type: "cohub.app.error",
+							message: error instanceof Error ? error.message : "Authorization failed."
+						}, true);
+						return;
+					}
 				}
 				const viewerUuid = await getViewerUuid();
-				if (viewerUuid && hasGrantedAppScopes(viewerUuid, app.id, scopes)) try {
-					const token = await authorize(scopes);
-					replyForRequest(data.requestId, {
-						type: "cohub.app.authorize.result",
-						token
-					}, true);
+				const silentSpaceId = selectSpace ? readLastPickedSpace() : spaceId;
+				if (!alwaysAsk && viewerUuid && (selectSpace ? Boolean(silentSpaceId) : true) && silentSpaceId !== null && hasGrantedAppScopes(viewerUuid, app.id, scopes, silentSpaceId ?? void 0)) try {
+					const result = await authorize(scopes, silentSpaceId, { silent: true });
+					replyForRequest(data.requestId, authorizeResult(result.token, result.spaceId, null), true);
 					return;
-				} catch {
-					clearGrantedAppScopes(viewerUuid, app.id);
+				} catch (error) {
+					if (!isDefinitiveAuthorizationFailure(error)) {
+						replyForRequest(data.requestId, {
+							type: "cohub.app.error",
+							message: error instanceof Error ? error.message : "Authorization failed."
+						}, true);
+						return;
+					}
+					clearGrantedAppScopes(viewerUuid, app.id, silentSpaceId);
 				}
+				const [spaceName, spaces] = await Promise.all([spaceId ? resolveSpaceName(spaceId) : Promise.resolve(null), selectSpace ? listViewerSpaces() : Promise.resolve(void 0)]);
 				state.pendingAuth = {
 					requestId: data.requestId,
 					scopes,
-					reason: data.reason
+					reason: sanitizeReason(data.reason),
+					homeSpaceName: app.spaceName ?? null,
+					...spaceId ? {
+						spaceId,
+						spaceName
+					} : {},
+					...selectSpace ? {
+						selectSpace: true,
+						spaces: spaces ?? null
+					} : {}
 				};
 				state.authError = null;
 				state.authOpen = true;
@@ -3078,18 +3364,24 @@ function createAppBridgeCore(config) {
 			notify();
 		}
 	}
-	async function confirmAuth() {
+	async function confirmAuth(pickedSpaceId) {
 		if (!state.pendingAuth || state.authSaving) return;
+		const pending = state.pendingAuth;
+		if (pending.selectSpace && !pickedSpaceId) {
+			state.authError = "Pick a Space to continue.";
+			notify();
+			return;
+		}
 		state.authError = null;
 		state.authSaving = true;
 		notify();
 		try {
-			const token = await authorize(state.pendingAuth.scopes);
-			setGrantedAppScopes(await getViewerUuid(), app.id, state.pendingAuth.scopes);
-			replyForRequest(state.pendingAuth.requestId, {
-				type: "cohub.app.authorize.result",
-				token
-			}, true);
+			const requestedSpaceId = pending.selectSpace ? pickedSpaceId : pending.spaceId;
+			const result = await authorize(pending.scopes, requestedSpaceId);
+			setGrantedAppScopes(await getViewerUuid(), app.id, result.scopes, result.spaceId);
+			if (pending.selectSpace) writeLastPickedSpace(result.spaceId);
+			const spaceName = pending.selectSpace ? pending.spaces?.find((space) => space.id === result.spaceId)?.name ?? null : pending.spaceName ?? app.spaceName ?? null;
+			replyForRequest(pending.requestId, authorizeResult(result.token, result.spaceId, spaceName), true);
 			state.authOpen = false;
 			state.pendingAuth = null;
 		} catch (error) {
@@ -3343,4 +3635,4 @@ function createBoardExtensionRegistry() {
 }
 const BOARD_CHANNELS = BOARD_ANIMATION_CHANNELS;
 //#endregion
-export { APP_COMPOSER_CHIP_CONTENT_MAX_BYTES, APP_COMPOSER_CHIP_KEY_MAX_LENGTH, APP_COMPOSER_CHIP_LABEL_MAX_LENGTH, APP_SURFACE_READY_TIMEOUT_MS, APP_SURFACE_REQUEST_TIMEOUT_MS, AppCommerceApi, AppRealtimeApi, AppRefParseError, AppRoom, AppRuntimeApi, AppRuntimeApi as WorkRuntimeApi, AppSurfaceApi, AppsApi, BILLING_ACCESS_BLOCKED_ERROR_CODE, BOARD_ANIMATION_CHANNEL_CAPABILITIES, BOARD_CHANNELS, BOARD_COLOR_IDS, BOARD_GEO_KINDS, BillingApi, BoardAuthoringItemSchema, BoardClient, BoardCompositionInputSchema, BoardCompositionSchema, BoardEffectInputSchema, BoardEffectSchema, BoardExtensionRegistry, BoardItemPatchSchema, BoardPlaybackPolicySchema, COHUB_ENVIRONMENTS, COHUB_SOURCE_HEADER, COHUB_SOURCE_HEADER_NAMES, CohubClient, CohubHttpClient, DEFAULT_BOARD_LIMITS, DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, DESKTOP_COMMAND_MAX_TIMEOUT_MS, DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, DESKTOP_COMMAND_PENDING_TTL_SECONDS, DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, DESKTOP_COMMAND_VERSION, DesktopCommandsApi, FEATURE_NOT_ENTITLED_ERROR_CODE, GenerationPolicyError, HttpError, ParentBridgeTransport, PopupBrokerTransport, REQUEST_SOURCE_VIA_MAX_LENGTH, ReferencesApi, ReferralsApi, SessionGenerationStreamClient, SessionPatchReducer, SpacePublicFilesApi, UiCommandsApi, UsersApi, VoiceApi, VoiceInputClient, WebsocketClient, WorkCommerceApi, WorkRealtimeApi, WorkRefParseError, WorkRoom, WorkSurfaceApi, assertGenerationRequestAllowedByPolicy, buildAppSurfaceRequest, buildSpaceInvitePath, buildSpacePath, clearGrantedAppScopes, compileComposition, composition, createAppBridgeCore, createAppBridgeCore as createWorkBridgeCore, createAppRuntime, createAppRuntime as createWorkRuntime, createBoardExtensionRegistry, createCohubClient, createHttpClient, createSessionGenerationStreamClient, createSessionPatchReducer, createSlugAppIdResolver, createSlugAppIdResolver as createSlugWorkIdResolver, createVoiceInputClient, createWebsocketClient, decodeGenerationPolicy, encodeGenerationPolicy, extractBillingPayload, filterDiscoverableGenerationModels, filterGenerationDeclarationsByPolicy, findGenerationModelPolicy, formatAppRef, formatWorkRef, getAllowedGenerationModelIds, hasGrantedAppScopes, hasRequestSourceIdentity, isAppId, isBillingAccessBlockedCode, isBillingAccessBlockedError, isDesktopCallMethod, isFeatureNotEntitledError, isGenerationModelHidden, isHttpErrorCode, isRequestSourceClientId, isRequestSourceEmpty, isRequestSourceUuid, isTerminalDesktopCommandStatus, isUuid, isWorkId, joinApiUrl, matchesUnauthorizedErrorToken, mergeRequestSourceIntoMeta, normalizeBaseUrl, normalizeGenerationPolicy, normalizeRequestSource, normalizeVoiceInputWebsocketUrl, normalizeWebsocketUrl, parseAppRef, parseAppSurfaceReady, parseAppSurfaceResponse, parseAssistantMessageCommit, parseBoardCompositionInput, parseBoardEffectInput, parseBoardPlaybackPolicy, parseDesktopCommand, parseGenerationPolicyFromEnv, parseRequestSourceFromHeaders, parseWorkRef, proceduralClip, readRequestSourceFromEnv, requestSourceToHeaders, resolveApiBaseUrl, resolveAppTransport, resolveAppTransport as resolveWorkTransport, resolveCohubEnvironment, resolveRequestSourceChannel, resolveVoiceInputWebsocketUrl, resolveWebsocketUrl, sampleCompositionTracks, sampleEasing, sampleTrack, sanitizeAccessToken, setGrantedAppScopes, track };
+export { APP_COMPOSER_CHIP_CONTENT_MAX_BYTES, APP_COMPOSER_CHIP_KEY_MAX_LENGTH, APP_COMPOSER_CHIP_LABEL_MAX_LENGTH, APP_SURFACE_READY_TIMEOUT_MS, APP_SURFACE_REQUEST_TIMEOUT_MS, AppCommerceApi, AppRealtimeApi, AppRefParseError, AppRoom, AppRuntimeApi, AppRuntimeApi as WorkRuntimeApi, AppSurfaceApi, AppsApi, BILLING_ACCESS_BLOCKED_ERROR_CODE, BOARD_ANIMATION_CHANNEL_CAPABILITIES, BOARD_CHANNELS, BOARD_COLOR_IDS, BOARD_GEO_KINDS, BillingApi, BoardAuthoringItemSchema, BoardClient, BoardCompositionInputSchema, BoardCompositionSchema, BoardEffectInputSchema, BoardEffectSchema, BoardExtensionRegistry, BoardItemPatchSchema, BoardPlaybackPolicySchema, COHUB_ENVIRONMENTS, COHUB_SOURCE_HEADER, COHUB_SOURCE_HEADER_NAMES, CohubClient, CohubHttpClient, DEFAULT_BOARD_LIMITS, DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, DESKTOP_COMMAND_MAX_TIMEOUT_MS, DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, DESKTOP_COMMAND_PENDING_TTL_SECONDS, DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, DESKTOP_COMMAND_VERSION, DesktopCommandsApi, FEATURE_NOT_ENTITLED_ERROR_CODE, GenerationPolicyError, HttpError, PERMISSIONS, ParentBridgeTransport, PopupBrokerTransport, REQUEST_SOURCE_VIA_MAX_LENGTH, ReferencesApi, ReferralsApi, SessionGenerationStreamClient, SessionPatchReducer, SpacePublicFilesApi, UiCommandsApi, UsersApi, VoiceApi, VoiceInputClient, WebsocketClient, WorkCommerceApi, WorkRealtimeApi, WorkRefParseError, WorkRoom, WorkSurfaceApi, assertGenerationRequestAllowedByPolicy, buildAppSurfaceRequest, buildSpaceInvitePath, buildSpacePath, clearGrantedAppScopes, compileComposition, composition, createAppBridgeCore, createAppBridgeCore as createWorkBridgeCore, createAppRuntime, createAppRuntime as createWorkRuntime, createBoardExtensionRegistry, createCohubClient, createHttpClient, createSessionGenerationStreamClient, createSessionPatchReducer, createSlugAppIdResolver, createSlugAppIdResolver as createSlugWorkIdResolver, createVoiceInputClient, createWebsocketClient, decodeGenerationPolicy, encodeGenerationPolicy, extractBillingPayload, filterDiscoverableGenerationModels, filterGenerationDeclarationsByPolicy, findGenerationModelPolicy, formatAppRef, formatWorkRef, getAllowedGenerationModelIds, hasGrantedAppScopes, hasRequestSourceIdentity, isAppId, isBillingAccessBlockedCode, isBillingAccessBlockedError, isDesktopCallMethod, isFeatureNotEntitledError, isGenerationModelHidden, isHttpErrorCode, isRequestSourceClientId, isRequestSourceEmpty, isRequestSourceUuid, isTerminalDesktopCommandStatus, isUuid, isWorkId, joinApiUrl, matchesUnauthorizedErrorToken, mergeRequestSourceIntoMeta, normalizeBaseUrl, normalizeGenerationPolicy, normalizeRequestSource, normalizeVoiceInputWebsocketUrl, normalizeWebsocketUrl, parseAppRef, parseAppSurfaceReady, parseAppSurfaceResponse, parseAssistantMessageCommit, parseBoardCompositionInput, parseBoardEffectInput, parseBoardPlaybackPolicy, parseDesktopCommand, parseGenerationPolicyFromEnv, parseRequestSourceFromHeaders, parseWorkRef, proceduralClip, readRequestSourceFromEnv, requestSourceToHeaders, resolveApiBaseUrl, resolveAppTransport, resolveAppTransport as resolveWorkTransport, resolveCohubEnvironment, resolveRequestSourceChannel, resolveVoiceInputWebsocketUrl, resolveWebsocketUrl, sampleCompositionTracks, sampleEasing, sampleTrack, sanitizeAccessToken, scopeListHasPermission, setGrantedAppScopes, track };