@neta-art/cohub 8.13.0 → 8.15.0

package/dist/index.js

@@ -1,8 +1,9 @@
 import { $ as BoardConnectionSchema, A as DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, B as BoardItemPatchSchema, C as SessionPatchReducer, D as DESKTOP_COMMAND_MAX_TIMEOUT_MS, E as DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, F as parseDesktopCommand, G as parseBoardEffectInput, H as BoardSemanticMutationSchema, I as parseDesktopCommandId, J as BoardCompositionInputSchema, K as BOARD_ANIMATION_CHANNELS, L as resolveOpenSurface, M as DESKTOP_COMMAND_VERSION, N as isDesktopCallMethod, O as DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, P as isTerminalDesktopCommandStatus, Q as parseBoardCompositionInput, R as NAVIGATION_ERROR_MESSAGE_MAX_LENGTH, S as parseAssistantMessageCommit, T as ensureRealtimeConnected, U as BoardEffectInputSchema, V as BoardSemanticCommandSchema, W as BoardEffectSchema, X as BoardProceduralClipSchema, Y as BoardCompositionSchema, Z as BoardTrackSchema, _ as PublicInviteApi, a as DesktopCommandsApi, at as SessionAccessApi, b as SessionGenerationStreamClient, c as ReferralsApi, ct as PublicAssetsApi, d as TasksApi, dt as ModelsApi, et as BOARD_ARROW_STROKE_SIZE, f as BoardClient, ft as GenerationsApi, g as SpacesApi, h as SpaceWebhooksApi, i as WorkCommerceApi, it as DEFAULT_BOARD_RENDER_LIMITS, j as DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, k as DESKTOP_COMMAND_PENDING_TTL_SECONDS, l as UsersApi, lt as SkillsApi, m as SpacePublicFilesApi, mt as ChannelsApi, n as createHttpClient, nt as BOARD_BUILTIN_CLIP_KINDS, o as UiCommandsApi, ot as ReferencesApi, p as SpaceClient, pt as CronJobsApi, q as BOARD_ANIMATION_CHANNEL_CAPABILITIES, r as AppCommerceApi, rt as BOARD_BUILTIN_EFFECT_KINDS, s as AppsApi, st as SearchApi, t as CohubHttpClient, tt as BOARD_BUILTIN_CAPABILITIES, u as UserApi, ut as PromptsApi, v as buildSpaceInvitePath, w as createSessionPatchReducer, x as createSessionGenerationStreamClient, y as buildSpacePath, z as BoardAuthoringItemSchema } from "./chunks/http.js";
 import { _ as requestSourceToHeaders, a as sanitizeAccessToken, b as REALTIME_ROOM_EVENT_NAME_PATTERN, c as REQUEST_SOURCE_VIA_MAX_LENGTH, d as isRequestSourceEmpty, f as isRequestSourceUuid, g as readRequestSourceFromEnv, h as parseRequestSourceFromHeaders, i as matchesUnauthorizedErrorToken, l as hasRequestSourceIdentity, m as normalizeRequestSource, n as HttpTransport, o as COHUB_SOURCE_HEADER, p as mergeRequestSourceIntoMeta, r as joinApiUrl, s as COHUB_SOURCE_HEADER_NAMES, t as HttpError, u as isRequestSourceClientId, v as resolveRequestSourceChannel, y as isUuid } from "./chunks/transport.js";
-import { a as normalizeWebsocketUrl, c as resolveExecutionAppId, d as resolveWebsocketUrl, f as PERMISSIONS, i as normalizeVoiceInputWebsocketUrl, l as resolveExecutionToken, n as getCohubContext, o as resolveApiBaseUrl, p as scopeListHasPermission, r as normalizeBaseUrl, s as resolveCohubEnvironment, t as COHUB_ENVIRONMENTS, u as resolveVoiceInputWebsocketUrl } from "./chunks/environment.js";
+import { a as normalizeWebsocketUrl, c as resolveExecutionAppId, d as resolveWebsocketUrl, f as PERMISSIONS, h as scopeListHasPermission, i as normalizeVoiceInputWebsocketUrl, l as resolveExecutionToken, m as isUserLevelPermission, n as getCohubContext, o as resolveApiBaseUrl, p as USER_LEVEL_PERMISSIONS, r as normalizeBaseUrl, s as resolveCohubEnvironment, t as COHUB_ENVIRONMENTS, u as resolveVoiceInputWebsocketUrl } from "./chunks/environment.js";
 import { a as extractBillingPayload, c as isFeatureNotEntitledError, i as FEATURE_NOT_ENTITLED_ERROR_CODE, l as isHttpErrorCode, n as createWebsocketClient, o as isBillingAccessBlockedCode, r as BILLING_ACCESS_BLOCKED_ERROR_CODE, s as isBillingAccessBlockedError, t as WebsocketClient } from "./chunks/websocket.js";
 import { VoiceApi, VoiceInputClient, createVoiceInputClient } from "./voice-input.js";
+import { filterSpacePickerItems, normalizeSpacePickerQuery, orderSpacePickerItems, selectSpacePickerItems } from "./space-picker.js";
 import { z } from "zod";
 //#region ../protocol/dist/board.js
 const BOARD_DOCUMENT_KIND = "cohub.board";
@@ -1390,6 +1391,14 @@ const buildAppRuntimeConfigureRequest = (input) => ({
 	type: "configure.request",
 	...input
 });
+const buildAppRuntimePointer = (input) => ({
+	protocol: APP_RUNTIME_PROTOCOL,
+	version: 1,
+	type: "pointer",
+	x: input.x,
+	y: input.y,
+	down: input.down
+});
 //#endregion
 //#region ../protocol/dist/app-navigation.js
 const APP_NAVIGATION_PROTOCOL = "cohub.app.navigation";
@@ -2199,8 +2208,55 @@ const generateRequestId = () => globalThis.crypto?.randomUUID?.() ?? `${Date.now
 var ParentBridgeTransport = class {
 	supportsNavigation = true;
 	trustedParentOrigin = null;
+	readyAnnounced = false;
 	contextListeners = /* @__PURE__ */ new Set();
 	contextListener = null;
+	diagnosticListeners = /* @__PURE__ */ new Set();
+	diagnosticListener = null;
+	/**
+	* Tells the host the runtime is ready once, before any subscription. Hosts
+	* gate unsolicited messages (context pushes, diagnostics) on this handshake,
+	* so the diagnostic subscription must trigger it too — an app that never
+	* subscribes to context still needs diagnostics to arrive.
+	*/
+	announceReady() {
+		if (this.readyAnnounced || !hasParent()) return;
+		const parentOrigin = this.trustedParentOrigin ?? getParentOrigin();
+		if (!parentOrigin) return;
+		try {
+			window.parent.postMessage(buildAppRuntimeReady(), parentOrigin);
+			this.readyAnnounced = true;
+		} catch {}
+	}
+	subscribeDiagnostics(listener) {
+		if (!hasParent() || typeof window.addEventListener !== "function") return () => {};
+		this.diagnosticListeners.add(listener);
+		this.announceReady();
+		if (!this.diagnosticListener) {
+			this.diagnosticListener = (event) => {
+				if (event.source !== window.parent) return;
+				const parentOrigin = this.trustedParentOrigin ?? getParentOrigin();
+				if (parentOrigin && event.origin !== parentOrigin) return;
+				const data = event.data;
+				if (data?.type !== "cohub.app.diagnostic") return;
+				if (typeof data.code !== "string" || typeof data.message !== "string") return;
+				const diagnostic = {
+					code: data.code,
+					message: data.message,
+					...data.detail && typeof data.detail === "object" ? { detail: data.detail } : {}
+				};
+				for (const current of this.diagnosticListeners) current(diagnostic);
+			};
+			window.addEventListener("message", this.diagnosticListener);
+		}
+		return () => {
+			this.diagnosticListeners.delete(listener);
+			if (this.diagnosticListeners.size === 0 && this.diagnosticListener) {
+				window.removeEventListener("message", this.diagnosticListener);
+				this.diagnosticListener = null;
+			}
+		};
+	}
 	subscribeContextChanged(listener) {
 		if (!hasParent()) return () => {};
 		this.contextListeners.add(listener);
@@ -2214,10 +2270,7 @@ var ParentBridgeTransport = class {
 				for (const current of this.contextListeners) current(data.context);
 			};
 			window.addEventListener("message", this.contextListener);
-			const parentOrigin = this.trustedParentOrigin ?? getParentOrigin();
-			if (parentOrigin) try {
-				window.parent.postMessage(buildAppRuntimeReady(), parentOrigin);
-			} catch {}
+			this.announceReady();
 		}
 		return () => {
 			this.contextListeners.delete(listener);
@@ -2433,9 +2486,88 @@ var AppRuntimeApi = class {
 	* refreshes can re-authorize (preserving viewer grants) instead of falling
 	* back to a base session token that only carries app-side scopes. */
 	authorizedGrants = null;
+	/**
+	* Rect input regions are hover-gated by the host, which needs to know when
+	* the pointer leaves them. A cross-origin frame swallows those moves once
+	* the host makes it interactive, so while a rect region is active we report
+	* the pointer ourselves. `all`/`none` need no reporting: their state is
+	* known without it.
+	*/
+	pointerListening = false;
+	pointerForwarding = false;
+	pointerDown = false;
+	pointerFrame = null;
+	pointerPending = null;
+	/** Cleanup for the constructor's diagnostic subscription; cleared on dispose. */
+	diagnosticUnsubscribe;
+	onPointerMove = (event) => {
+		if (!this.pointerForwarding) return;
+		this.pointerDown = event.buttons !== 0;
+		this.queuePointer(event.clientX, event.clientY);
+	};
+	onPointerDown = (event) => {
+		if (!this.pointerForwarding) return;
+		this.pointerDown = true;
+		this.flushPointer(event.clientX, event.clientY);
+	};
+	onPointerUp = (event) => {
+		if (!this.pointerForwarding && !this.pointerDown) return;
+		this.pointerDown = false;
+		this.flushPointer(event.clientX, event.clientY);
+	};
+	onPointerCancel = (event) => {
+		if (!this.pointerForwarding && !this.pointerDown) return;
+		this.pointerDown = false;
+		this.flushPointer(event.clientX, event.clientY);
+	};
+	/** Coalesce moves to one message per frame; presses flush immediately. */
+	queuePointer(x, y) {
+		this.pointerPending = {
+			x,
+			y
+		};
+		if (this.pointerFrame !== null) return;
+		this.pointerFrame = requestAnimationFrame(() => {
+			this.pointerFrame = null;
+			const pending = this.pointerPending;
+			this.pointerPending = null;
+			if (pending && this.pointerForwarding) this.reportPointer(pending.x, pending.y, this.pointerDown);
+		});
+	}
+	flushPointer(x, y) {
+		if (this.pointerFrame !== null) {
+			cancelAnimationFrame(this.pointerFrame);
+			this.pointerFrame = null;
+		}
+		this.pointerPending = null;
+		this.reportPointer(x, y, this.pointerDown);
+	}
+	reportPointer(x, y, down) {
+		this.transport.notify?.(buildAppRuntimePointer({
+			x,
+			y,
+			down
+		}));
+	}
+	setPointerForwarding(on) {
+		if (typeof window === "undefined" || !this.transport.notify) return;
+		this.pointerForwarding = on;
+		if (!on || this.pointerListening) return;
+		this.pointerListening = true;
+		window.addEventListener("pointermove", this.onPointerMove, {
+			passive: true,
+			capture: true
+		});
+		window.addEventListener("pointerdown", this.onPointerDown, true);
+		window.addEventListener("pointerup", this.onPointerUp, true);
+		window.addEventListener("pointercancel", this.onPointerCancel, true);
+	}
 	constructor(transport = new ParentBridgeTransport(), appId, appIdResolver) {
 		this.transport = transport;
 		this.appIdResolver = appIdResolver;
+		this.diagnosticUnsubscribe = transport.subscribeDiagnostics?.((diagnostic) => {
+			console.warn(`[cohub] ${diagnostic.message} (${diagnostic.code})`, diagnostic.detail ?? {});
+		}) ?? null;
 		if (appId) {
 			this.tokenStorageKey = `${TOKEN_STORAGE_PREFIX}:${appId}`;
 			this.grantsStorageKey = `${AUTHORIZED_GRANTS_STORAGE_PREFIX}:${appId}`;
@@ -2515,6 +2647,32 @@ var AppRuntimeApi = class {
 	onContextChanged(listener) {
 		return this.transport.subscribeContextChanged?.(listener) ?? (() => {});
 	}
+	/** Subscribes to developer-facing host diagnostics. */
+	onDiagnostic(listener) {
+		return this.transport.subscribeDiagnostics?.(listener) ?? (() => {});
+	}
+	/**
+	* Releases listeners and any pending pointer frame this runtime registered.
+	* Safe to call more than once.
+	*/
+	dispose() {
+		const unsubscribe = this.diagnosticUnsubscribe;
+		this.diagnosticUnsubscribe = null;
+		unsubscribe?.();
+		this.pointerForwarding = false;
+		this.pointerPending = null;
+		if (this.pointerFrame !== null) {
+			if (typeof cancelAnimationFrame === "function") cancelAnimationFrame(this.pointerFrame);
+			this.pointerFrame = null;
+		}
+		if (this.pointerListening && typeof window !== "undefined") {
+			window.removeEventListener("pointermove", this.onPointerMove, { capture: true });
+			window.removeEventListener("pointerdown", this.onPointerDown, true);
+			window.removeEventListener("pointerup", this.onPointerUp, true);
+			window.removeEventListener("pointercancel", this.onPointerCancel, true);
+			this.pointerListening = false;
+		}
+	}
 	async navigationOpen(target, call) {
 		if (this.transport.supportsNavigation === false) return {
 			protocol: "cohub.app.navigation",
@@ -2552,9 +2710,13 @@ var AppRuntimeApi = class {
 	* Requests the host to update the overlay's geometry or pointer hit regions.
 	* Only meaningful when the App was opened as an `overlay` surface; the host
 	* is free to clamp or ignore values that violate its layout policy.
+	*
+	* A non-empty rect `inputRegion` also starts reporting the pointer to the
+	* host, which is how the host learns when it leaves the region.
 	*/
 	requestConfigure(input) {
 		this.transport.notify?.(buildAppRuntimeConfigureRequest(input));
+		if (input.inputRegion !== void 0) this.setPointerForwarding(Array.isArray(input.inputRegion) && input.inputRegion.length > 0);
 	}
 	async getAccessToken(options) {
 		await this.ensureStorageKeys();
@@ -2596,10 +2758,15 @@ var AppRuntimeApi = class {
 		return this.token;
 	}
 	/**
-	* Requests viewer consent. Without a `spaceId` the grant targets the app's
-	* home space; with one it targets that space — the app may only grant what
-	* the viewer can already do there themselves. Reuses a previous grant
-	* silently unless `alwaysAsk` forces the consent dialog.
+	* Requests viewer consent. With an accessible `spaceId` the grant targets
+	* that Space; otherwise the host resolves a viewer-controlled Space (the
+	* invocation or embedding Space, then the viewer's last picked Space, then
+	* their first accessible one) — never the app author's home Space. The app
+	* may only grant what the viewer can already do there themselves. Reuses a
+	* previous grant silently unless `alwaysAsk` forces the consent dialog.
+	*
+	* Returns whether a token was granted; use
+	* {@link requestSpaceAuthorization} when the app needs to know which Space.
 	*/
 	async requestAuthorization(input) {
 		await this.ensureStorageKeys();
@@ -2855,8 +3022,17 @@ var CohubClient = class {
 	context() {
 		return this.appRuntime.context();
 	}
+	/** Releases listeners this client registered. Safe to call more than once. */
+	dispose() {
+		this.appRuntime.dispose();
+	}
 	auth = {
-		/** Ensure the app holds these scopes. Silent when a grant already covers them; `alwaysAsk` forces the dialog. */
+		/**
+		* Ensure the app holds these scopes. Without an accessible `spaceId` the
+		* host targets a viewer-controlled Space (never the app author's home
+		* Space) — use `requestSpace` when the app needs to know which Space.
+		* Silent when a grant already covers them; `alwaysAsk` forces the dialog.
+		*/
 		request: (input) => this.appRuntime.requestAuthorization(input),
 		/** One consent: the viewer picks a Space and grants the scopes on it. `alwaysAsk` re-opens the picker. */
 		requestSpace: (input) => this.appRuntime.requestSpaceAuthorization(input),
@@ -3122,6 +3298,19 @@ function hasGrantedAppScopes(userUuid, appId, scopes, spaceId) {
 	return scopes.every((scope) => scopeListHasPermission(entry.scopes, scope));
 }
 /**
+* The Space ids of cached grants that cover every requested scope, scanning all
+* Spaces. Used for account-level scopes, which are not bound to one Space but
+* must be renewed against a Space whose grant actually exists. The coverage is
+* already validated here, so callers must not re-check with a per-Space key
+* (a legacy, Space-less entry would otherwise never match).
+*/
+function listGrantedAppSpacesForScopes(userUuid, appId, scopes, homeSpaceId) {
+	if (!userUuid || !appId || scopes.length === 0) return [];
+	const spaces = /* @__PURE__ */ new Set();
+	for (const grant of listGrantedAppScopes(userUuid, appId, homeSpaceId)) if (scopes.every((scope) => scopeListHasPermission(grant.scopes, scope))) spaces.add(grant.spaceId);
+	return [...spaces];
+}
+/**
 * Lists every cached grant for an app — one entry per space — so hosts can
 * report what the viewer previously consented to without a server round trip.
 * Entries past their re-consent window are dropped on read.
@@ -3226,11 +3415,24 @@ function sanitizeRequestedScopes(value) {
 }
 /** Consent dialogs render the reason; keep hostile input bounded. */
 const MAX_REASON_LENGTH = 280;
+/**
+* Bound the viewer's Space lookup so a stalled network can't leave the consent
+* dialog reserved but invisible until the SDK request times out.
+*/
+const SPACE_LIST_TIMEOUT_MS = 1e4;
+/** Bound a single authorize call so a stalled network can't wedge the flow. */
+const AUTHORIZE_TIMEOUT_MS = 3e4;
+/** Cap serial silent-renewal attempts per request (account grants may span Spaces). */
+const MAX_SILENT_SPACE_ATTEMPTS = 4;
+const timeoutSignal = (ms) => typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(ms) : void 0;
+const spaceListSignal = () => timeoutSignal(SPACE_LIST_TIMEOUT_MS);
 var AppAuthorizationError = class extends Error {
 	status;
-	constructor(message, status) {
+	code;
+	constructor(message, status, code) {
 		super(message);
 		this.status = status;
+		this.code = code;
 		this.name = "AppAuthorizationError";
 	}
 };
@@ -3239,6 +3441,17 @@ const isDefinitiveAuthorizationFailure = (error) => error instanceof AppAuthoriz
 	403,
 	404
 ].includes(error.status);
+/** A grant the server rejected (revoked / not found) — safe to drop from cache. */
+const isGrantRejection = (error) => error instanceof AppAuthorizationError && [403, 404].includes(error.status);
+/** A stale access token — never a revoked grant, so never clear the cache. */
+const isAuthFailure = (error) => error instanceof AppAuthorizationError && error.status === 401;
+/** Viewer-facing copy for grant failures the viewer cannot act on technically. */
+const VIEWER_OPAQUE_AUTH_MESSAGES = {
+	space_inaccessible: "Couldn't connect this app to your Space. Try another Space.",
+	app_not_accessible: "This app isn't available in this Space right now.",
+	scope_not_held: "This app needs permissions you don't have yet."
+};
+const viewerOpaqueAuthMessage = (error) => error instanceof AppAuthorizationError && error.code ? VIEWER_OPAQUE_AUTH_MESSAGES[error.code] ?? null : null;
 /**
 * Whether a new authorize request asks for exactly the consent a pending
 * dialog already shows: same scopes, same target and same mode. Such a request
@@ -3454,11 +3667,30 @@ function createAppBridgeCore(config) {
 		authOpen: false,
 		pendingAuth: null,
 		authError: null,
-		authSaving: false
+		authSaving: false,
+		selectedSpaceId: null,
+		canChangeSpace: false
 	};
 	function notify() {
 		onStateChange?.({ ...state });
 	}
+	/** notify() that never lets a broken host callback escape. */
+	function safeNotify() {
+		try {
+			notify();
+		} catch {}
+	}
+	/** Sends a developer-facing diagnostic to the app; never surfaced to viewers. */
+	function emitDiagnostic(diagnostic) {
+		try {
+			config.notify?.({
+				type: "cohub.app.diagnostic",
+				code: diagnostic.code,
+				message: diagnostic.message,
+				...diagnostic.detail ? { detail: diagnostic.detail } : {}
+			});
+		} catch {}
+	}
 	const pendingPurchaseStorageKey = `cohub-app-purchase:${app.id}`;
 	const purchaseInFlight = /* @__PURE__ */ new Map();
 	let activePurchase = null;
@@ -3501,13 +3733,14 @@ function createAppBridgeCore(config) {
 	* fresh dialog.
 	*/
 	async function authorize(scopes, spaceId, options) {
-		const userToken = await getAccessToken();
+		const userToken = await getAccessToken(options?.forceRefreshToken ? { forceRefresh: true } : void 0);
 		if (!userToken) {
 			await config.requestSignIn(typeof location !== "undefined" ? location.pathname : "/");
 			throw new Error("Sign in is required to authorize this app.");
 		}
 		const response = await fetch(`${apiOrigin}/api/apps/${app.id}/authorize`, {
 			method: "POST",
+			signal: timeoutSignal(AUTHORIZE_TIMEOUT_MS),
 			headers: {
 				Authorization: `Bearer ${userToken}`,
 				"Content-Type": "application/json"
@@ -3519,7 +3752,7 @@ function createAppBridgeCore(config) {
 			})
 		});
 		const payload = await response.json().catch(() => null);
-		if (!response.ok) throw new AppAuthorizationError(typeof payload?.message === "string" ? payload.message : "Authorization failed.", response.status);
+		if (!response.ok) throw new AppAuthorizationError(typeof payload?.message === "string" ? payload.message : "Authorization failed.", response.status, typeof payload?.code === "string" ? payload.code : void 0);
 		const token = readTokenResponse(payload);
 		if (!token) throw new Error("Invalid app authorization response.");
 		const canonicalSpaceId = typeof payload?.grant?.spaceId === "string" && payload.grant.spaceId ? payload.grant.spaceId : spaceId ?? app.spaceId;
@@ -3538,6 +3771,64 @@ function createAppBridgeCore(config) {
 		};
 	}
 	/**
+	* Silent renewal with a single stale-token retry: a 401 means the access
+	* token expired, not that the grant was revoked, so refresh once before
+	* letting the caller classify the failure.
+	*/
+	async function authorizeSilent(scopes, spaceId) {
+		try {
+			return await authorize(scopes, spaceId, { silent: true });
+		} catch (error) {
+			if (!isAuthFailure(error)) throw error;
+			return authorize(scopes, spaceId, {
+				silent: true,
+				forceRefreshToken: true
+			});
+		}
+	}
+	/**
+	* Attempts silent renewal against each target in order. Returns true when the
+	* request was answered (success or terminal error); false when every target
+	* was a rejected grant, so the caller should fall back to consent.
+	*/
+	async function attemptSilentRenewal(reserved, viewerUuid, scopes, targets) {
+		if (!viewerUuid || targets.length === 0) return false;
+		for (const target of targets) try {
+			const result = await authorizeSilent(scopes, target);
+			if (state.pendingAuth !== reserved) return true;
+			replyPendingAuth(reserved, authorizeResult(result.token, result.spaceId, null));
+			resetDialogState();
+			safeNotify();
+			return true;
+		} catch (error) {
+			if (state.pendingAuth !== reserved) return true;
+			if (isGrantRejection(error)) {
+				clearGrantedAppScopes(viewerUuid, app.id, target);
+				if (target === app.spaceId) clearGrantedAppScopes(viewerUuid, app.id);
+				continue;
+			}
+			replyPendingAuth(reserved, {
+				type: "cohub.app.error",
+				message: error instanceof Error ? error.message : "Authorization failed."
+			});
+			resetDialogState();
+			safeNotify();
+			return true;
+		}
+		return false;
+	}
+	/** Normalizes a raw Space payload into a picker candidate. */
+	function toSpaceOption(value) {
+		if (typeof value.id !== "string" || !value.id) return null;
+		const owner = value.ownerUserUuid ?? value.userUuid;
+		return {
+			id: value.id,
+			name: typeof value.name === "string" && value.name ? value.name : null,
+			...typeof owner === "string" ? { ownerUserUuid: owner } : {},
+			...typeof value.isPinned === "boolean" ? { isPinned: value.isPinned } : {}
+		};
+	}
+	/**
 	* Lists the viewer's spaces for the consent dialog picker. Fetched by the
 	* host with the viewer's own token — the app only ever learns the space
 	* the viewer picks, never the list.
@@ -3546,7 +3837,10 @@ function createAppBridgeCore(config) {
 		const request = async (forceRefresh = false) => {
 			const userToken = await getAccessToken({ forceRefresh });
 			if (!userToken) return null;
-			return fetch(`${apiOrigin}/api/spaces`, { headers: { Authorization: `Bearer ${userToken}` } });
+			return fetch(`${apiOrigin}/api/spaces`, {
+				headers: { Authorization: `Bearer ${userToken}` },
+				signal: spaceListSignal()
+			});
 		};
 		try {
 			let response = await request();
@@ -3555,14 +3849,33 @@ function createAppBridgeCore(config) {
 			const spaces = await response.json();
 			if (!Array.isArray(spaces)) return null;
 			return spaces.flatMap((space) => {
-				if (typeof space.id !== "string" || !space.id) return [];
-				return [{
-					id: space.id,
-					name: typeof space.name === "string" && space.name ? space.name : null,
-					...typeof (space.ownerUserUuid ?? space.userUuid) === "string" ? { ownerUserUuid: space.ownerUserUuid ?? space.userUuid } : {},
-					...typeof space.isPinned === "boolean" ? { isPinned: space.isPinned } : {}
-				}];
+				const option = toSpaceOption(space);
+				return option ? [option] : [];
+			});
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Ensures the viewer has a Space to target when their accessible list is
+	* empty. `GET /api/spaces/default` returns their home Space, creating it on
+	* first use — the same path taken when they first enter Cohub.
+	*/
+	async function ensureDefaultSpace() {
+		const request = async (forceRefresh = false) => {
+			const userToken = await getAccessToken({ forceRefresh });
+			if (!userToken) return null;
+			return fetch(`${apiOrigin}/api/spaces/default`, {
+				headers: { Authorization: `Bearer ${userToken}` },
+				signal: spaceListSignal()
 			});
+		};
+		try {
+			let response = await request();
+			if (response?.status === 401) response = await request(true);
+			if (!response?.ok) return null;
+			const payload = await response.json();
+			return payload?.space ? toSpaceOption(payload.space) : null;
 		} catch {
 			return null;
 		}
@@ -3581,6 +3894,27 @@ function createAppBridgeCore(config) {
 		} catch {}
 	}
 	/**
+	* Resolves the default target for a Space-bound request to a Space the
+	* viewer controls — preferring wherever the app was invoked, then the last
+	* Space the viewer picked. Returns undefined when nothing is accessible.
+	*/
+	function resolveDefaultSpaceId(candidates) {
+		if (!candidates?.length) return void 0;
+		const accessible = (id) => id && candidates.some((space) => space.id === id) ? id : void 0;
+		const invocation = activeInvocation !== void 0 ? activeInvocation : config.getInvocation?.() ?? config.invocation;
+		const shell = config.getShell?.() ?? config.shell;
+		return accessible(invocation?.spaceId) ?? accessible(shell?.space?.id) ?? accessible(readLastPickedSpace()) ?? candidates[0]?.id;
+	}
+	/**
+	* The Space the app is currently in, from trusted host context only (no
+	* network). Used to attempt silent renewal before loading the Space list.
+	*/
+	function resolveContextSpaceId() {
+		const invocation = activeInvocation !== void 0 ? activeInvocation : config.getInvocation?.() ?? config.invocation;
+		const shell = config.getShell?.() ?? config.shell;
+		return invocation?.spaceId ?? shell?.space?.id ?? void 0;
+	}
+	/**
 	* Creates the Space with the viewer's own token — the same `POST /api/spaces`
 	* path as the web New Space flow and the CLI. The app never holds this token.
 	*/
@@ -3619,23 +3953,6 @@ function createAppBridgeCore(config) {
 		};
 		throw new Error(message);
 	}
-	/**
-	* Resolves the target space's name for the consent dialog. The host — not
-	* the app — resolves it, so the dialog cannot be tricked into labeling a
-	* grant with the wrong space.
-	*/
-	async function resolveSpaceName(spaceId) {
-		const userToken = await getAccessToken();
-		if (!userToken) return null;
-		try {
-			const response = await fetch(`${apiOrigin}/api/spaces/${encodeURIComponent(spaceId)}`, { headers: { Authorization: `Bearer ${userToken}` } });
-			if (!response.ok) return null;
-			const space = await response.json();
-			return typeof space.name === "string" && space.name ? space.name : null;
-		} catch {
-			return null;
-		}
-	}
 	function writePendingPurchase(input) {
 		if (typeof sessionStorage === "undefined") return;
 		try {
@@ -3693,6 +4010,7 @@ function createAppBridgeCore(config) {
 		if (!data?.requestId) return;
 		const isLegacyWork = data.type?.startsWith("cohub.work.") === true;
 		if (isLegacyWork) legacyRequestIds.add(data.requestId);
+		let reservedAuth = null;
 		try {
 			if (data.type === "cohub.app.context" || data.type === "cohub.work.context") {
 				const context = await getContext();
@@ -3820,20 +4138,24 @@ function createAppBridgeCore(config) {
 				}
 				if (createSpace) {
 					mintedSpace = null;
-					state.pendingAuth = {
+					const pendingCreate = {
 						requestId: data.requestId,
 						scopes,
 						reason: sanitizeReason(data.reason),
 						homeSpaceName: app.spaceName ?? null,
 						createSpace
 					};
+					state.pendingAuth = pendingCreate;
+					reservedAuth = pendingCreate;
+					state.selectedSpaceId = null;
+					state.canChangeSpace = false;
 					state.authError = null;
 					state.authOpen = true;
 					notify();
 					return;
 				}
 				if (!selectSpace && !alwaysAsk && allowsOwnerAutoAuthorization() && await isCurrentViewerAppOwner()) try {
-					const result = await authorize(scopes, spaceId, { silent: true });
+					const result = await authorizeSilent(scopes, spaceId);
 					replyForRequest(data.requestId, authorizeResult(result.token, result.spaceId, result.spaceId === app.spaceId ? app.spaceName ?? null : null), true);
 					return;
 				} catch (error) {
@@ -3845,45 +4167,82 @@ function createAppBridgeCore(config) {
 						return;
 					}
 				}
-				const viewerUuid = await getViewerUuid();
-				const silentSpaceId = selectSpace ? readLastPickedSpace() : spaceId;
-				if (!alwaysAsk && viewerUuid && (selectSpace ? Boolean(silentSpaceId) : true) && silentSpaceId !== null && hasGrantedAppScopes(viewerUuid, app.id, scopes, silentSpaceId ?? void 0)) try {
-					const result = await authorize(scopes, silentSpaceId, { silent: true });
-					replyForRequest(data.requestId, authorizeResult(result.token, result.spaceId, null), true);
-					return;
-				} catch (error) {
-					if (!isDefinitiveAuthorizationFailure(error)) {
-						replyForRequest(data.requestId, {
-							type: "cohub.app.error",
-							message: error instanceof Error ? error.message : "Authorization failed."
-						}, true);
+				if (state.pendingAuth) {
+					if (isSameConsent(state.pendingAuth, {
+						scopes,
+						spaceId,
+						selectSpace,
+						createSpace
+					})) {
+						state.pendingAuth.joinedRequestIds = [...state.pendingAuth.joinedRequestIds ?? [], data.requestId];
 						return;
 					}
-					clearGrantedAppScopes(viewerUuid, app.id, silentSpaceId);
+					dismissPendingAuth();
 				}
-				const [spaceName, spaces] = await Promise.all([spaceId ? resolveSpaceName(spaceId) : Promise.resolve(null), selectSpace ? listViewerSpaces() : Promise.resolve(void 0)]);
-				state.pendingAuth = {
+				const reserved = {
 					requestId: data.requestId,
 					scopes,
 					reason: sanitizeReason(data.reason),
 					homeSpaceName: app.spaceName ?? null,
-					...spaceId ? {
-						spaceId,
-						spaceName
-					} : {},
-					...selectSpace ? {
-						selectSpace: true,
-						spaces: spaces ?? null
-					} : {}
+					...spaceId ? { spaceId } : {},
+					...selectSpace ? { selectSpace: true } : {}
 				};
+				state.pendingAuth = reserved;
+				reservedAuth = reserved;
+				state.selectedSpaceId = null;
+				state.canChangeSpace = false;
 				state.authError = null;
+				const viewerUuid = await getViewerUuid();
+				if (state.pendingAuth !== reserved) return;
+				const spaceLevel = Boolean(spaceId) || selectSpace || scopes.some((scope) => !isUserLevelPermission(scope));
+				const lastPicked = readLastPickedSpace();
+				const contextSpaceId = resolveContextSpaceId();
+				const preListTargets = !spaceLevel ? listGrantedAppSpacesForScopes(viewerUuid, app.id, scopes, app.spaceId) : spaceId === void 0 && !selectSpace && contextSpaceId && hasGrantedAppScopes(viewerUuid, app.id, scopes, contextSpaceId) ? [contextSpaceId] : [];
+				if (!alwaysAsk && await attemptSilentRenewal(reserved, viewerUuid, scopes, preListTargets)) return;
+				if (state.pendingAuth !== reserved) return;
+				let spaces = spaceLevel ? await listViewerSpaces() : void 0;
+				if (state.pendingAuth !== reserved) return;
+				if (spaces && spaces.length === 0) {
+					const fallback = await ensureDefaultSpace();
+					if (state.pendingAuth !== reserved) return;
+					if (fallback) spaces = [fallback];
+				}
+				const candidates = spaces ?? null;
+				const explicitAccessible = Boolean(spaceId) && candidates?.some((space) => space.id === spaceId) === true;
+				const defaultSpaceId = explicitAccessible ? spaceId : resolveDefaultSpaceId(candidates);
+				const silentTargets = (!spaceLevel ? [] : [selectSpace ? lastPicked && candidates?.some((space) => space.id === lastPicked) ? lastPicked : null : explicitAccessible ? spaceId : spaceId === void 0 ? defaultSpaceId : null].filter((target) => Boolean(target) && hasGrantedAppScopes(viewerUuid, app.id, scopes, target ?? void 0))).slice(0, MAX_SILENT_SPACE_ATTEMPTS);
+				if (!alwaysAsk && await attemptSilentRenewal(reserved, viewerUuid, scopes, silentTargets)) return;
+				if (state.pendingAuth !== reserved) return;
+				if (spaceId && candidates && !explicitAccessible) emitDiagnostic({
+					code: "space_inaccessible",
+					message: defaultSpaceId ? "The app requested a Space this viewer cannot access; using a Space the viewer controls instead." : "The app requested a Space this viewer cannot access, and no viewer-controlled Space was available.",
+					detail: { requestedSpaceId: spaceId }
+				});
+				const spaceName = defaultSpaceId ? candidates?.find((space) => space.id === defaultSpaceId)?.name ?? null : null;
+				Object.assign(reserved, {
+					...explicitAccessible && spaceName ? { spaceName } : {},
+					...spaces !== void 0 ? { spaces: spaces ?? null } : {},
+					...defaultSpaceId ? { defaultSpaceId } : {}
+				});
+				state.selectedSpaceId = defaultSpaceId ?? null;
+				state.canChangeSpace = !explicitAccessible && (candidates?.length ?? 0) > 1;
 				state.authOpen = true;
 				notify();
 			}
 		} catch (error) {
+			const message = error instanceof Error ? error.message : "Request failed.";
+			if (reservedAuth && state.pendingAuth === reservedAuth) {
+				replyPendingAuth(reservedAuth, {
+					type: "cohub.app.error",
+					message
+				});
+				resetDialogState();
+				safeNotify();
+				return;
+			}
 			replyForRequest(data.requestId, {
 				type: "cohub.app.error",
-				message: error instanceof Error ? error.message : "Request failed."
+				message
 			}, true);
 		}
 	}
@@ -3891,15 +4250,21 @@ function createAppBridgeCore(config) {
 	function replyPendingAuth(pending, payload) {
 		for (const requestId of [pending.requestId, ...pending.joinedRequestIds ?? []]) replyForRequest(requestId, payload, true);
 	}
+	/** Closes the consent dialog and drops its transient selection state. */
+	function resetDialogState() {
+		state.pendingAuth = null;
+		state.authOpen = false;
+		state.authError = null;
+		state.selectedSpaceId = null;
+		state.canChangeSpace = false;
+	}
 	function dismissPendingAuth() {
 		if (!state.pendingAuth) return;
 		replyPendingAuth(state.pendingAuth, {
 			type: "cohub.app.authorize.result",
 			token: null
 		});
-		state.pendingAuth = null;
-		state.authOpen = false;
-		state.authError = null;
+		resetDialogState();
 		mintedSpace = null;
 		notify();
 	}
@@ -3910,6 +4275,17 @@ function createAppBridgeCore(config) {
 		state.authSaving = false;
 		notify();
 	}
+	/**
+	* Only a Space the host actually loaded may become the target, so a UI bug
+	* cannot mint a grant against an arbitrary id.
+	*/
+	function setSelectedSpace(spaceId) {
+		if (!state.pendingAuth || state.authSaving || !state.canChangeSpace) return;
+		if (!state.pendingAuth.spaces?.some((space) => space.id === spaceId)) return;
+		if (state.selectedSpaceId === spaceId) return;
+		state.selectedSpaceId = spaceId;
+		notify();
+	}
 	async function executePurchase(purchase) {
 		const checkout = await createPurchase(purchase.productKey, purchase.purchaseAttemptId);
 		if (checkout && typeof checkout === "object") {
@@ -3946,38 +4322,50 @@ function createAppBridgeCore(config) {
 	async function confirmAuth(pickedSpaceId) {
 		if (!state.pendingAuth || state.authSaving) return;
 		const pending = state.pendingAuth;
-		if (pending.selectSpace && !pickedSpaceId) {
-			state.authError = "Pick a Space to continue.";
-			notify();
-			return;
+		let requestedSpaceId = (state.canChangeSpace ? pickedSpaceId : void 0) ?? state.selectedSpaceId ?? void 0;
+		if (pending.spaces !== void 0) {
+			const candidates = pending.spaces;
+			if (!(requestedSpaceId !== void 0 && candidates?.some((space) => space.id === requestedSpaceId) === true)) {
+				state.authError = !candidates || candidates.length === 0 ? "Couldn't load your Spaces. Please try again." : "Choose a Space to continue.";
+				notify();
+				return;
+			}
 		}
 		state.authError = null;
 		state.authSaving = true;
 		notify();
 		try {
-			let requestedSpaceId = pending.selectSpace ? pickedSpaceId : pending.spaceId;
-			let spaceName = pending.selectSpace ? pending.spaces?.find((space) => space.id === requestedSpaceId)?.name ?? null : pending.spaceName ?? app.spaceName ?? null;
 			if (pending.createSpace) {
 				mintedSpace ??= await createViewerSpace(pending.createSpace);
 				if (!mintedSpace.provisioned) {
 					replyPendingAuth(pending, authorizeResult(null, mintedSpace.id, mintedSpace.name ?? pending.createSpace.name));
-					state.authOpen = false;
-					state.pendingAuth = null;
+					resetDialogState();
 					mintedSpace = null;
 					return;
 				}
 				requestedSpaceId = mintedSpace.id;
-				spaceName = mintedSpace.name ?? pending.createSpace.name;
 			}
 			const result = await authorize(pending.scopes, requestedSpaceId);
 			setGrantedAppScopes(await getViewerUuid(), app.id, result.scopes, result.spaceId);
-			if (pending.selectSpace || pending.createSpace) writeLastPickedSpace(result.spaceId);
+			if (pending.selectSpace || pending.createSpace || pickedSpaceId && pickedSpaceId !== pending.spaceId) writeLastPickedSpace(result.spaceId);
+			let spaceName = null;
+			if (pending.createSpace) spaceName = mintedSpace?.name ?? pending.createSpace.name;
+			else {
+				const listed = pending.spaces?.find((space) => space.id === result.spaceId)?.name;
+				if (listed) spaceName = listed;
+				else if (result.spaceId === pending.spaceId) spaceName = pending.spaceName ?? null;
+				else if (result.spaceId === app.spaceId) spaceName = app.spaceName ?? null;
+			}
 			replyPendingAuth(pending, authorizeResult(result.token, result.spaceId, spaceName));
-			state.authOpen = false;
-			state.pendingAuth = null;
+			resetDialogState();
 			mintedSpace = null;
 		} catch (error) {
-			state.authError = error instanceof Error ? error.message : "Authorization failed.";
+			if (error instanceof AppAuthorizationError) emitDiagnostic({
+				code: error.code ?? "authorize_failed",
+				message: error.message,
+				detail: { scopes: pending.scopes }
+			});
+			state.authError = viewerOpaqueAuthMessage(error) ?? (error instanceof Error ? error.message : "Authorization failed.");
 		} finally {
 			state.authSaving = false;
 			notify();
@@ -3987,6 +4375,7 @@ function createAppBridgeCore(config) {
 		getState: () => ({ ...state }),
 		handleMessage,
 		notifyContextChanged,
+		setSelectedSpace,
 		confirmAuth,
 		cancelAuth
 	};
@@ -4237,4 +4626,4 @@ function createBoardExtensionRegistry() {
 }
 const BOARD_CHANNELS = BOARD_ANIMATION_CHANNELS;
 //#endregion
-export { APP_COMPOSER_CHIP_CONTENT_MAX_BYTES, APP_COMPOSER_CHIP_KEY_MAX_LENGTH, APP_COMPOSER_CHIP_LABEL_MAX_LENGTH, APP_SURFACE_READY_TIMEOUT_MS, APP_SURFACE_REQUEST_TIMEOUT_MS, AppCommerceApi, AppRealtimeApi, AppRefParseError, AppRoom, AppRuntimeApi, AppRuntimeApi as WorkRuntimeApi, AppSurfaceApi, AppsApi, BILLING_ACCESS_BLOCKED_ERROR_CODE, BOARD_ANIMATION_CHANNEL_CAPABILITIES, BOARD_CHANNELS, BOARD_COLOR_IDS, BOARD_GEO_KINDS, BillingApi, BoardAnimationSpecSchema, BoardAuthoringItemSchema, BoardClient, BoardCompositionInputSchema, BoardCompositionSchema, BoardDealParamsSchema, BoardEffectInputSchema, BoardEffectSchema, BoardExtensionRegistry, BoardItemPatchSchema, BoardPlaybackPolicySchema, BoardSemanticCommandSchema, COHUB_ENVIRONMENTS, COHUB_SOURCE_HEADER, COHUB_SOURCE_HEADER_NAMES, CohubClient, CohubHttpClient, DEFAULT_BOARD_LIMITS, DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, DESKTOP_COMMAND_MAX_TIMEOUT_MS, DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, DESKTOP_COMMAND_PENDING_TTL_SECONDS, DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, DESKTOP_COMMAND_VERSION, DesktopCommandsApi, FEATURE_NOT_ENTITLED_ERROR_CODE, GenerationPolicyError, HttpError, PERMISSIONS, ParentBridgeTransport, PopupBrokerTransport, REQUEST_SOURCE_VIA_MAX_LENGTH, ReferencesApi, ReferralsApi, SessionGenerationStreamClient, SessionPatchReducer, SpacePublicFilesApi, SpaceWebhooksApi, UiCommandsApi, UsersApi, VoiceApi, VoiceInputClient, WebsocketClient, WorkCommerceApi, WorkRealtimeApi, WorkRefParseError, WorkRoom, WorkSurfaceApi, assertGenerationRequestAllowedByPolicy, attachAppEmbed, buildAppSurfaceRequest, buildSpaceInvitePath, buildSpacePath, clearGrantedAppScopes, compileComposition, composition, createAppBridgeCore, createAppBridgeCore as createWorkBridgeCore, createAppRuntime, createAppRuntime as createWorkRuntime, createBoardExtensionRegistry, createCohubClient, createHttpClient, createSessionGenerationStreamClient, createSessionPatchReducer, createSlugAppIdResolver, createSlugAppIdResolver as createSlugWorkIdResolver, createVoiceInputClient, createWebsocketClient, decodeGenerationPolicy, encodeGenerationPolicy, extractBillingPayload, filterDiscoverableGenerationModels, filterGenerationDeclarationsByPolicy, findGenerationModelPolicy, formatAppRef, formatWorkRef, getAllowedGenerationModelIds, getCohubContext, hasGrantedAppScopes, hasRequestSourceIdentity, isAppId, isBillingAccessBlockedCode, isBillingAccessBlockedError, isDesktopCallMethod, isFeatureNotEntitledError, isGenerationModelHidden, isHttpErrorCode, isRequestSourceClientId, isRequestSourceEmpty, isRequestSourceUuid, isTerminalDesktopCommandStatus, isUuid, isWorkId, joinApiUrl, matchesUnauthorizedErrorToken, mergeRequestSourceIntoMeta, normalizeBaseUrl, normalizeGenerationPolicy, normalizeRequestSource, normalizeVoiceInputWebsocketUrl, normalizeWebsocketUrl, parseAppRef, parseAppSurfaceReady, parseAppSurfaceResponse, parseAssistantMessageCommit, parseBoardCompositionInput, parseBoardEffectInput, parseBoardPlaybackPolicy, parseDesktopCommand, parseGenerationPolicyFromEnv, parseRequestSourceFromHeaders, parseWorkRef, proceduralClip, readRequestSourceFromEnv, requestSourceToHeaders, resolveApiBaseUrl, resolveAppTransport, resolveAppTransport as resolveWorkTransport, resolveCohubEnvironment, resolveExecutionAppId, resolveExecutionToken, resolveOpenSurface, resolveRequestSourceChannel, resolveVoiceInputWebsocketUrl, resolveWebsocketUrl, sampleCompositionTracks, sampleEasing, sampleTrack, sanitizeAccessToken, scopeListHasPermission, setGrantedAppScopes, track };
+export { APP_COMPOSER_CHIP_CONTENT_MAX_BYTES, APP_COMPOSER_CHIP_KEY_MAX_LENGTH, APP_COMPOSER_CHIP_LABEL_MAX_LENGTH, APP_SURFACE_READY_TIMEOUT_MS, APP_SURFACE_REQUEST_TIMEOUT_MS, AppCommerceApi, AppRealtimeApi, AppRefParseError, AppRoom, AppRuntimeApi, AppRuntimeApi as WorkRuntimeApi, AppSurfaceApi, AppsApi, BILLING_ACCESS_BLOCKED_ERROR_CODE, BOARD_ANIMATION_CHANNEL_CAPABILITIES, BOARD_CHANNELS, BOARD_COLOR_IDS, BOARD_GEO_KINDS, BillingApi, BoardAnimationSpecSchema, BoardAuthoringItemSchema, BoardClient, BoardCompositionInputSchema, BoardCompositionSchema, BoardDealParamsSchema, BoardEffectInputSchema, BoardEffectSchema, BoardExtensionRegistry, BoardItemPatchSchema, BoardPlaybackPolicySchema, BoardSemanticCommandSchema, COHUB_ENVIRONMENTS, COHUB_SOURCE_HEADER, COHUB_SOURCE_HEADER_NAMES, CohubClient, CohubHttpClient, DEFAULT_BOARD_LIMITS, DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, DESKTOP_COMMAND_MAX_TIMEOUT_MS, DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, DESKTOP_COMMAND_PENDING_TTL_SECONDS, DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, DESKTOP_COMMAND_VERSION, DesktopCommandsApi, FEATURE_NOT_ENTITLED_ERROR_CODE, GenerationPolicyError, HttpError, PERMISSIONS, ParentBridgeTransport, PopupBrokerTransport, REQUEST_SOURCE_VIA_MAX_LENGTH, ReferencesApi, ReferralsApi, SessionGenerationStreamClient, SessionPatchReducer, SpacePublicFilesApi, SpaceWebhooksApi, USER_LEVEL_PERMISSIONS, UiCommandsApi, UsersApi, VoiceApi, VoiceInputClient, WebsocketClient, WorkCommerceApi, WorkRealtimeApi, WorkRefParseError, WorkRoom, WorkSurfaceApi, assertGenerationRequestAllowedByPolicy, attachAppEmbed, buildAppSurfaceRequest, buildSpaceInvitePath, buildSpacePath, clearGrantedAppScopes, compileComposition, composition, createAppBridgeCore, createAppBridgeCore as createWorkBridgeCore, createAppRuntime, createAppRuntime as createWorkRuntime, createBoardExtensionRegistry, createCohubClient, createHttpClient, createSessionGenerationStreamClient, createSessionPatchReducer, createSlugAppIdResolver, createSlugAppIdResolver as createSlugWorkIdResolver, createVoiceInputClient, createWebsocketClient, decodeGenerationPolicy, encodeGenerationPolicy, extractBillingPayload, filterDiscoverableGenerationModels, filterGenerationDeclarationsByPolicy, filterSpacePickerItems, findGenerationModelPolicy, formatAppRef, formatWorkRef, getAllowedGenerationModelIds, getCohubContext, hasGrantedAppScopes, hasRequestSourceIdentity, isAppId, isBillingAccessBlockedCode, isBillingAccessBlockedError, isDesktopCallMethod, isFeatureNotEntitledError, isGenerationModelHidden, isHttpErrorCode, isRequestSourceClientId, isRequestSourceEmpty, isRequestSourceUuid, isTerminalDesktopCommandStatus, isUserLevelPermission, isUuid, isWorkId, joinApiUrl, matchesUnauthorizedErrorToken, mergeRequestSourceIntoMeta, normalizeBaseUrl, normalizeGenerationPolicy, normalizeRequestSource, normalizeSpacePickerQuery, normalizeVoiceInputWebsocketUrl, normalizeWebsocketUrl, orderSpacePickerItems, parseAppRef, parseAppSurfaceReady, parseAppSurfaceResponse, parseAssistantMessageCommit, parseBoardCompositionInput, parseBoardEffectInput, parseBoardPlaybackPolicy, parseDesktopCommand, parseGenerationPolicyFromEnv, parseRequestSourceFromHeaders, parseWorkRef, proceduralClip, readRequestSourceFromEnv, requestSourceToHeaders, resolveApiBaseUrl, resolveAppTransport, resolveAppTransport as resolveWorkTransport, resolveCohubEnvironment, resolveExecutionAppId, resolveExecutionToken, resolveOpenSurface, resolveRequestSourceChannel, resolveVoiceInputWebsocketUrl, resolveWebsocketUrl, sampleCompositionTracks, sampleEasing, sampleTrack, sanitizeAccessToken, scopeListHasPermission, selectSpacePickerItems, setGrantedAppScopes, track };