@neta-art/cohub 8.17.0 → 8.19.0

package/dist/index.js

@@ -1,10 +1,55 @@
-import { $ as BoardConnectionSchema, A as DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, B as BoardItemPatchSchema, C as SessionPatchReducer, D as DESKTOP_COMMAND_MAX_TIMEOUT_MS, E as DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, F as parseDesktopCommand, G as parseBoardEffectInput, H as BoardSemanticMutationSchema, I as parseDesktopCommandId, J as BoardCompositionInputSchema, K as BOARD_ANIMATION_CHANNELS, L as resolveOpenSurface, M as DESKTOP_COMMAND_VERSION, N as isDesktopCallMethod, O as DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, P as isTerminalDesktopCommandStatus, Q as parseBoardCompositionInput, R as NAVIGATION_ERROR_MESSAGE_MAX_LENGTH, S as parseAssistantMessageCommit, T as ensureRealtimeConnected, U as BoardEffectInputSchema, V as BoardSemanticCommandSchema, W as BoardEffectSchema, X as BoardProceduralClipSchema, Y as BoardCompositionSchema, Z as BoardTrackSchema, _ as PublicInviteApi, a as DesktopCommandsApi, at as SessionAccessApi, b as SessionGenerationStreamClient, c as ReferralsApi, ct as PublicAssetsApi, d as TasksApi, dt as ModelsApi, et as BOARD_ARROW_STROKE_SIZE, f as BoardClient, ft as GenerationsApi, g as SpacesApi, h as SpaceWebhooksApi, i as WorkCommerceApi, it as DEFAULT_BOARD_RENDER_LIMITS, j as DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, k as DESKTOP_COMMAND_PENDING_TTL_SECONDS, l as UsersApi, lt as SkillsApi, m as SpacePublicFilesApi, mt as ChannelsApi, n as createHttpClient, nt as BOARD_BUILTIN_CLIP_KINDS, o as UiCommandsApi, ot as ReferencesApi, p as SpaceClient, pt as CronJobsApi, q as BOARD_ANIMATION_CHANNEL_CAPABILITIES, r as AppCommerceApi, rt as BOARD_BUILTIN_EFFECT_KINDS, s as AppsApi, st as SearchApi, t as CohubHttpClient, tt as BOARD_BUILTIN_CAPABILITIES, u as UserApi, ut as PromptsApi, v as buildSpaceInvitePath, w as createSessionPatchReducer, x as createSessionGenerationStreamClient, y as buildSpacePath, z as BoardAuthoringItemSchema } from "./chunks/http.js";
+import { $ as BoardEffectInputSchema, A as SkillsApi, B as DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, C as SessionPatchReducer, D as ReferencesApi, E as SessionAccessApi, F as ChannelsApi, G as parseDesktopCommand, H as DESKTOP_COMMAND_VERSION, I as DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, J as NAVIGATION_ERROR_MESSAGE_MAX_LENGTH, K as parseDesktopCommandId, L as DESKTOP_COMMAND_MAX_TIMEOUT_MS, M as ModelsApi, N as GenerationsApi, O as SearchApi, P as CronJobsApi, Q as BoardSemanticMutationSchema, R as DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, S as parseAssistantMessageCommit, T as ensureRealtimeConnected, U as isDesktopCallMethod, V as DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, W as isTerminalDesktopCommandStatus, X as BoardItemPatchSchema, Y as BoardAuthoringItemSchema, Z as BoardSemanticCommandSchema, _ as PublicInviteApi, a as DesktopCommandsApi, at as BoardCompositionSchema, b as SessionGenerationStreamClient, c as ReferralsApi, ct as parseBoardCompositionInput, d as TasksApi, dt as BOARD_BUILTIN_CAPABILITIES, et as BoardEffectSchema, f as BoardClient, ft as BOARD_BUILTIN_CLIP_KINDS, g as SpacesApi, h as SpaceWebhooksApi, i as WorkCommerceApi, it as BoardCompositionInputSchema, j as PromptsApi, k as PublicAssetsApi, l as UsersApi, lt as BoardConnectionSchema, m as SpacePublicFilesApi, mt as DEFAULT_BOARD_RENDER_LIMITS, n as createHttpClient, nt as BOARD_ANIMATION_CHANNELS, o as UiCommandsApi, ot as BoardProceduralClipSchema, p as SpaceClient, pt as BOARD_BUILTIN_EFFECT_KINDS, q as resolveOpenSurface, r as AppCommerceApi, rt as BOARD_ANIMATION_CHANNEL_CAPABILITIES, s as AppsApi, st as BoardTrackSchema, t as CohubHttpClient, tt as parseBoardEffectInput, u as UserApi, ut as BOARD_ARROW_STROKE_SIZE, v as buildSpaceInvitePath, w as createSessionPatchReducer, x as createSessionGenerationStreamClient, y as buildSpacePath, z as DESKTOP_COMMAND_PENDING_TTL_SECONDS } from "./chunks/http.js";
 import { _ as requestSourceToHeaders, a as sanitizeAccessToken, b as REALTIME_ROOM_EVENT_NAME_PATTERN, c as REQUEST_SOURCE_VIA_MAX_LENGTH, d as isRequestSourceEmpty, f as isRequestSourceUuid, g as readRequestSourceFromEnv, h as parseRequestSourceFromHeaders, i as matchesUnauthorizedErrorToken, l as hasRequestSourceIdentity, m as normalizeRequestSource, n as HttpTransport, o as COHUB_SOURCE_HEADER, p as mergeRequestSourceIntoMeta, r as joinApiUrl, s as COHUB_SOURCE_HEADER_NAMES, t as HttpError, u as isRequestSourceClientId, v as resolveRequestSourceChannel, y as isUuid } from "./chunks/transport.js";
 import { a as normalizeWebsocketUrl, c as resolveExecutionAppId, d as resolveWebsocketUrl, f as PERMISSIONS, h as scopeListHasPermission, i as normalizeVoiceInputWebsocketUrl, l as resolveExecutionToken, m as isUserLevelPermission, n as getCohubContext, o as resolveApiBaseUrl, p as USER_LEVEL_PERMISSIONS, r as normalizeBaseUrl, s as resolveCohubEnvironment, t as COHUB_ENVIRONMENTS, u as resolveVoiceInputWebsocketUrl } from "./chunks/environment.js";
 import { a as extractBillingPayload, c as isFeatureNotEntitledError, i as FEATURE_NOT_ENTITLED_ERROR_CODE, l as isHttpErrorCode, n as createWebsocketClient, o as isBillingAccessBlockedCode, r as BILLING_ACCESS_BLOCKED_ERROR_CODE, s as isBillingAccessBlockedError, t as WebsocketClient } from "./chunks/websocket.js";
 import { VoiceApi, VoiceInputClient, createVoiceInputClient } from "./voice-input.js";
 import { filterSpacePickerItems, normalizeSpacePickerQuery, orderSpacePickerItems, selectSpacePickerItems } from "./space-picker.js";
 import { z } from "zod";
+//#region ../protocol/dist/app-authorization.js
+const appAuthorizationTargetSchema = z.discriminatedUnion("kind", [
+	z.object({ kind: z.literal("account") }),
+	z.object({
+		kind: z.literal("space"),
+		spaceId: z.string().min(1)
+	}),
+	z.object({ kind: z.literal("pick-space") })
+]);
+const appAuthorizationRequestSchema = z.object({
+	target: appAuthorizationTargetSchema,
+	scopes: z.array(z.string().min(1)).min(1).max(128),
+	reason: z.string().max(280).optional(),
+	alwaysAsk: z.boolean().optional(),
+	fallback: z.enum(["allow", "none"]).default("allow")
+});
+const appAuthorizationGrantSchema = z.object({
+	id: z.string().min(1),
+	spaceId: z.string().min(1),
+	scopes: z.array(z.string()),
+	expiresAt: z.string().nullable()
+});
+const appAuthorizationResultSchema = z.discriminatedUnion("status", [
+	z.object({
+		status: z.literal("granted"),
+		requestedTarget: appAuthorizationTargetSchema,
+		target: z.discriminatedUnion("kind", [z.object({ kind: z.literal("account") }), z.object({
+			kind: z.literal("space"),
+			spaceId: z.string().min(1),
+			name: z.string().nullable()
+		})]),
+		resolution: z.enum([
+			"requested",
+			"selected",
+			"fallback"
+		]),
+		grant: appAuthorizationGrantSchema
+	}),
+	z.object({ status: z.literal("cancelled") }),
+	z.object({
+		status: z.literal("denied"),
+		code: z.string()
+	})
+]);
+//#endregion
 //#region ../protocol/dist/board.js
 const BOARD_DOCUMENT_KIND = "cohub.board";
 const BOARD_MANIFEST_KIND = "cohub.board.manifest";
@@ -1205,6 +1250,451 @@ function filterGenerationDeclarationsByPolicy(declarations, policy) {
 	});
 }
 //#endregion
+//#region ../protocol/dist/core/content-schema.js
+const meta = z.record(z.string(), z.unknown());
+const contentBlockSchema = z.lazy(() => z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("text"),
+		text: z.string(),
+		_meta: meta.optional()
+	}),
+	z.object({
+		type: z.literal("thinking"),
+		thinking: z.string(),
+		signature: z.string().optional(),
+		_meta: meta.optional()
+	}),
+	z.object({
+		type: z.literal("image"),
+		source: z.union([z.object({
+			type: z.literal("url"),
+			url: z.string().url()
+		}), z.object({
+			type: z.literal("base64"),
+			media_type: z.string(),
+			data: z.string()
+		})]),
+		_meta: meta.optional()
+	}),
+	z.object({
+		type: z.literal("shell_command"),
+		command: z.string(),
+		rawText: z.string(),
+		_meta: meta.optional()
+	}),
+	z.object({
+		type: z.literal("tool_use"),
+		id: z.string().min(1),
+		name: z.string().min(1),
+		input: z.record(z.string(), z.unknown()),
+		_meta: meta.optional()
+	}),
+	z.object({
+		type: z.literal("tool_result"),
+		tool_use_id: z.string().min(1),
+		content: z.union([z.string(), z.array(contentBlockSchema)]),
+		is_error: z.boolean().optional(),
+		_meta: meta.optional()
+	}),
+	z.object({
+		type: z.literal("system_note"),
+		note_type: z.enum([
+			"session_created",
+			"forked",
+			"compacted",
+			"info"
+		]),
+		text: z.string(),
+		_meta: meta.optional()
+	})
+]));
+//#endregion
+//#region ../protocol/dist/runtime/archive.js
+const RUNTIME_ARCHIVE_SEGMENT_BYTES = 4194304;
+const digest = z.string().regex(/^[a-f0-9]{64}$/);
+const runtimeArchiveSegmentSchema = z.object({
+	offset: z.number().int().safe().nonnegative(),
+	sizeBytes: z.number().int().min(1).max(RUNTIME_ARCHIVE_SEGMENT_BYTES),
+	sha256: digest,
+	md5: z.string().regex(/^[a-f0-9]{32}$/)
+}).strict();
+const harnessArchiveSchema = z.object({
+	sessionId: z.string().uuid(),
+	turnId: z.string().uuid(),
+	harness: z.enum(["pi", "codex"])
+}).strict();
+const harnessArchiveIndexSchema = harnessArchiveSchema.extend({
+	version: z.literal(1),
+	nativeFormat: z.enum(["pi.jsonl", "codex.rollout"]),
+	nativeSessionId: z.string().min(1).max(255),
+	parentTurnId: z.string().uuid().nullable(),
+	sizeBytes: z.number().int().safe().positive(),
+	sha256: digest,
+	segments: z.array(runtimeArchiveSegmentSchema).max(256)
+}).strict().refine((value) => value.nativeFormat === (value.harness === "pi" ? "pi.jsonl" : "codex.rollout"), "Native format mismatch");
+function validateArchiveBoundary(index, parent) {
+	if (index.parentTurnId !== (parent?.turnId ?? null)) throw new Error("Archive parent mismatch");
+	if (parent && (parent.sessionId !== index.sessionId || parent.harness !== index.harness || parent.nativeSessionId !== index.nativeSessionId)) throw new Error("Archive identity mismatch");
+	let offset = parent?.sizeBytes ?? 0;
+	for (const segment of index.segments) {
+		if (segment.offset !== offset) throw new Error("Archive segments are not contiguous");
+		offset += segment.sizeBytes;
+	}
+	if (offset !== index.sizeBytes || !parent && !index.segments.length) throw new Error("Archive is incomplete");
+	if (!index.segments.length && parent?.sha256 !== index.sha256) throw new Error("Unchanged archive checksum mismatch");
+}
+//#endregion
+//#region ../protocol/dist/runtime/context.js
+const createEmptyUsage = () => ({
+	input: 0,
+	output: 0,
+	cacheRead: 0,
+	cacheWrite: 0,
+	totalTokens: 0,
+	cost: {
+		input: 0,
+		output: 0,
+		cacheRead: 0,
+		cacheWrite: 0,
+		total: 0
+	}
+});
+/**
+* Project one block as itself, or drop it. Nothing is ever rewritten into prompt text.
+* URL images, system notes and unknown blocks have no native representation here; the
+* durable copy stays in the database and is not faked into the model's input.
+*/
+function projectBlock(block) {
+	if (block.type === "text") return {
+		type: "text",
+		text: block.text
+	};
+	if (block.type === "image") return block.source.type === "base64" ? {
+		type: "image",
+		data: block.source.data,
+		mimeType: block.source.media_type
+	} : null;
+	if (block.type === "thinking") return {
+		type: "thinking",
+		thinking: block.thinking,
+		...block.signature ? { thinkingSignature: block.signature } : {}
+	};
+	return null;
+}
+const projectContent = (content) => content.map(projectBlock).filter((block) => block !== null);
+const isCompaction = (message) => message.role === "system" && message.content.some((block) => block.type === "system_note" && block.note_type === "compacted");
+/** A generation placeholder must never be projected as if it were a finished result. */
+const isPendingGenerationResult = (message) => message.role === "assistant" && message.meta?.messageKind === "generation_result" && message.meta?.generationStatus !== "completed" && message.meta?.generationStatus !== "failed";
+function selectRuntimeContextMessages(messages) {
+	let boundary = -1;
+	let latest = -1;
+	messages.forEach((message, index) => {
+		if (!isCompaction(message)) return;
+		const compaction = message.meta?.compaction;
+		const timestamp = Date.parse(compaction?.compactedAt ?? String(message.meta?.createdAt ?? ""));
+		const order = Number.isFinite(timestamp) ? timestamp : index;
+		if (order >= latest) {
+			latest = order;
+			boundary = index;
+		}
+	});
+	const compaction = messages[boundary];
+	if (!compaction) return messages;
+	return [compaction, ...messages.slice(boundary + 1).filter((message) => !isCompaction(message))];
+}
+/**
+* Compile durable, normalized messages into Pi-compatible context without replaying tools.
+* Representable blocks and tool pairing are preserved verbatim; anything without a native
+* representation is dropped rather than described in prompt text.
+*/
+function contextToPiMessages(messages, options = {}) {
+	const result = [];
+	for (const message of selectRuntimeContextMessages(messages)) {
+		if (isPendingGenerationResult(message)) continue;
+		const meta = {
+			...message.meta,
+			messageId: message.id,
+			turnId: message.turnId
+		};
+		const recordedAt = Date.parse(String(message.meta?.createdAt ?? ""));
+		const timestamp = Number.isFinite(recordedAt) ? recordedAt : 0;
+		if (message.role === "system") continue;
+		if (message.role !== "assistant") {
+			const projected = projectContent(message.content);
+			if (projected.length) result.push({
+				role: "user",
+				content: projected,
+				timestamp,
+				meta
+			});
+			continue;
+		}
+		const calls = new Map(message.content.flatMap((block) => block.type === "tool_use" ? [[block.id, block.name]] : []));
+		const content = message.content.flatMap((block) => {
+			if (block.type === "tool_result") return [];
+			if (block.type === "tool_use") return [{
+				type: "toolCall",
+				id: block.id,
+				name: block.name,
+				arguments: block.input
+			}];
+			const projected = projectBlock(block);
+			return projected ? [projected] : [];
+		});
+		if (content.length) result.push({
+			role: "assistant",
+			content,
+			api: typeof message.meta?.nativeApi === "string" ? message.meta.nativeApi : options.resolveApi?.({
+				provider: message.provider ?? null,
+				model: message.model ?? null
+			}) ?? "history",
+			provider: message.provider ?? options.fallbackProvider ?? "history",
+			model: message.model ?? "history",
+			usage: {
+				...createEmptyUsage(),
+				...message.usage
+			},
+			stopReason: message.stopReason === "tool_use" ? "toolUse" : message.stopReason ?? (calls.size ? "toolUse" : "stop"),
+			...message.errorMessage ? { errorMessage: message.errorMessage } : {},
+			timestamp,
+			meta
+		});
+		for (const block of message.content) {
+			if (block.type !== "tool_result") continue;
+			if (!calls.has(block.tool_use_id)) continue;
+			result.push({
+				role: "toolResult",
+				toolCallId: block.tool_use_id,
+				toolName: calls.get(block.tool_use_id) ?? "tool",
+				content: typeof block.content === "string" ? [{
+					type: "text",
+					text: block.content
+				}] : projectContent(block.content),
+				isError: block.is_error ?? false,
+				timestamp,
+				meta
+			});
+			calls.delete(block.tool_use_id);
+		}
+	}
+	return result;
+}
+//#endregion
+//#region ../protocol/dist/runtime/index.js
+const RUNTIME_PROTOCOL_VERSION = 1;
+const RUNTIME_MAX_FRAME_BYTES = 33554432;
+const RUNTIME_RECOVERY_BATCH_SIZE = 64;
+z.enum([
+	"cohub",
+	"pi",
+	"codex"
+]);
+const isLocalHarness = (value) => value === "pi" || value === "codex";
+const resolveHarness = (meta) => {
+	const value = meta && typeof meta === "object" ? meta.harness : null;
+	return isLocalHarness(value) ? value : "cohub";
+};
+const runtimeCapabilitiesSchema = z.object({
+	harnesses: z.array(z.enum(["pi", "codex"])).min(1).max(2),
+	models: z.array(z.object({
+		harness: z.enum(["pi", "codex"]),
+		provider: z.string().max(100),
+		id: z.string().min(1).max(255),
+		name: z.string().max(255)
+	})).max(2e3)
+});
+const runtimePendingExecutionSchema = z.object({
+	sessionId: z.string().uuid(),
+	turnId: z.string().uuid(),
+	harness: z.enum(["pi", "codex"])
+}).strict();
+z.object({
+	connectionId: z.string().uuid(),
+	endpoint: z.url({ protocol: /^wss?$/ }),
+	ownerUserId: z.string().min(1),
+	capabilities: runtimeCapabilitiesSchema
+});
+const runtimeReadySchema = z.object({
+	type: z.literal("runtime.ready"),
+	connectionId: z.string().uuid()
+});
+z.object({
+	expectedTurnId: z.string().uuid(),
+	revision: z.string().min(1),
+	confirmed: z.literal(true)
+}).strict();
+const id = z.string().uuid();
+const ordinal = z.number().int().min(0).max(1e5);
+const content = z.array(contentBlockSchema).max(1e5);
+const count = z.number().finite().nonnegative().optional();
+const usageSchema = z.object({
+	input: count,
+	output: count,
+	cacheRead: count,
+	cacheWrite: count,
+	totalTokens: count,
+	cost: z.object({
+		input: count,
+		output: count,
+		cacheRead: count,
+		cacheWrite: count,
+		total: count
+	}).nullable().optional()
+});
+const runtimeMessageSchema = z.object({
+	ordinal,
+	content,
+	provider: z.string().nullable().optional(),
+	model: z.string().nullable().optional(),
+	usage: usageSchema.nullable().optional(),
+	stopReason: z.string().max(64).nullable().optional(),
+	errorMessage: z.string().max(16384).nullable().optional()
+});
+const runtimeEventSchema = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("message.start"),
+		ordinal
+	}),
+	z.object({
+		type: z.literal("text.delta"),
+		ordinal,
+		index: ordinal,
+		kind: z.enum(["text", "thinking"]),
+		delta: z.string()
+	}),
+	z.object({
+		type: z.literal("content.replace"),
+		ordinal,
+		content
+	}),
+	z.object({
+		type: z.literal("message.commit"),
+		message: runtimeMessageSchema
+	}),
+	z.object({
+		type: z.literal("turn.end"),
+		message: runtimeMessageSchema,
+		archive: harnessArchiveSchema.nullable().optional(),
+		resume: z.enum([
+			"native",
+			"restored",
+			"handoff",
+			"new"
+		])
+	}),
+	z.object({
+		type: z.literal("context.required"),
+		pendingTurnIds: z.array(id).max(2).optional(),
+		historyOnly: z.boolean().optional()
+	}),
+	z.object({ type: z.literal("turn.acknowledged") }),
+	z.object({
+		type: z.literal("turn.error"),
+		message: z.string().max(16384),
+		uncertain: z.boolean().optional()
+	})
+]);
+z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("runtime.hello"),
+		version: z.literal(1),
+		spaceId: id,
+		token: z.string().min(1).max(16384),
+		capabilities: runtimeCapabilitiesSchema
+	}).strict(),
+	z.object({
+		type: z.literal("runtime.recovery"),
+		executions: z.array(runtimePendingExecutionSchema).min(1).max(64)
+	}).strict(),
+	z.object({ type: z.literal("runtime.heartbeat") }),
+	z.object({
+		type: z.literal("runtime.auth"),
+		token: z.string().min(1).max(16384)
+	}),
+	z.object({
+		type: z.literal("runtime.event"),
+		requestId: id,
+		event: runtimeEventSchema
+	})
+]);
+const runtimeContextSchema = z.object({
+	complete: z.boolean().optional(),
+	revision: z.string(),
+	throughTurnId: id.nullable(),
+	messages: z.array(z.object({
+		id: z.string(),
+		turnId: id,
+		role: z.enum([
+			"user",
+			"assistant",
+			"system"
+		]),
+		content,
+		provider: z.string().nullable().optional(),
+		model: z.string().nullable().optional(),
+		usage: usageSchema.nullable().optional(),
+		stopReason: z.string().nullable().optional(),
+		errorMessage: z.string().nullable().optional(),
+		meta: z.record(z.string(), z.unknown()).nullable().optional()
+	})),
+	archive: harnessArchiveSchema.nullable().optional(),
+	resolvedTurnIds: z.array(id).max(2).optional(),
+	settledTurnIds: z.array(id).max(2).optional()
+});
+const runtimeCommandSchema = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("turn.recover"),
+		requestId: id,
+		execution: z.object({
+			spaceId: id,
+			sessionId: id,
+			turnId: id,
+			harness: z.enum(["pi", "codex"])
+		})
+	}),
+	z.object({
+		type: z.literal("turn.start"),
+		requestId: id,
+		resumeOnly: z.boolean().optional(),
+		input: z.object({
+			spaceId: id,
+			sessionId: id,
+			turnId: id,
+			userMessageId: id,
+			harness: z.enum(["pi", "codex"]),
+			messages: z.array(z.object({
+				turnId: id,
+				userMessageId: id,
+				userId: z.string().nullable(),
+				content
+			})).min(1).max(64),
+			context: runtimeContextSchema,
+			provider: z.string().nullable().optional(),
+			model: z.string().nullable().optional(),
+			thinkingLevel: z.string().nullable().optional(),
+			accessMode: z.enum(["read_only", "full_access"])
+		}).refine((input) => {
+			const owner = input.messages.at(-1);
+			return owner?.turnId === input.turnId && owner.userMessageId === input.userMessageId && new Set(input.messages.map((message) => message.turnId)).size === input.messages.length && new Set(input.messages.map((message) => message.userMessageId)).size === input.messages.length;
+		}, "Runtime batch owner or message identity mismatch")
+	}),
+	z.object({
+		type: z.literal("session.context"),
+		requestId: id,
+		context: runtimeContextSchema
+	}),
+	z.object({
+		type: z.literal("turn.abort"),
+		requestId: id
+	}),
+	z.object({
+		type: z.literal("turn.ack"),
+		requestId: id,
+		revision: z.string(),
+		turnId: id
+	})
+]);
+//#endregion
 //#region ../protocol/dist/public-identifiers.js
 const USERNAME_PATTERN = /^(?!-)(?!.*--)[a-z0-9-]{1,39}(?<!-)$/;
 const SPACE_SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9_-]{0,78}[a-z0-9])?$/;
@@ -2187,6 +2677,18 @@ function attachAppEmbed(frame, options) {
 }
 //#endregion
 //#region src/app-runtime.ts
+var AppRuntimeError = class extends Error {
+	code;
+	requestId;
+	retryable;
+	constructor(code, message, requestId) {
+		super(message);
+		this.code = code;
+		this.requestId = requestId;
+		this.name = "AppRuntimeError";
+		this.retryable = code === "host_timeout" || code === "login_timeout" || code === "request_failed";
+	}
+};
 const isBrowser$1 = () => typeof window !== "undefined" && typeof window.parent !== "undefined";
 const hasParent = () => isBrowser$1() && window.parent !== window;
 const getParentOrigin = () => {
@@ -2258,7 +2760,7 @@ var ParentBridgeTransport = class {
 		};
 	}
 	subscribeContextChanged(listener) {
-		if (!hasParent()) return () => {};
+		if (!hasParent() || typeof window.addEventListener !== "function") return () => {};
 		this.contextListeners.add(listener);
 		if (!this.contextListener) {
 			this.contextListener = (event) => {
@@ -2321,7 +2823,7 @@ var ParentBridgeTransport = class {
 				cleanup();
 				this.trustedParentOrigin = event.origin;
 				if (data.type === "cohub.app.error") {
-					reject(new Error(data.message));
+					reject(new AppRuntimeError(data.code ?? "request_failed", data.message, requestId));
 					return;
 				}
 				resolve(data);
@@ -2362,6 +2864,7 @@ var PopupBrokerTransport = class {
 		if (message.type === "cohub.app.context") return {
 			type: "cohub.app.context.result",
 			context: {
+				mode: "broker",
 				app: {
 					id: await this.resolveAppId() ?? "",
 					slug: "",
@@ -2397,6 +2900,7 @@ var PopupBrokerTransport = class {
 				return;
 			}
 			let ready = false;
+			let loginPending = false;
 			let settled = false;
 			let timer = null;
 			let closeChecker = null;
@@ -2422,8 +2926,20 @@ var PopupBrokerTransport = class {
 				if (event.origin !== this.brokerOrigin) return;
 				const data = event.data;
 				if (!data) return;
+				if (data.type === "cohub.app.broker.progress" && !loginPending && !ready) {
+					loginPending = true;
+					if (timer) clearTimeout(timer);
+					timer = setTimeout(() => finish(() => reject(new AppRuntimeError("login_timeout", "Login did not complete in time."))), 6e5);
+					return;
+				}
 				if (data.type === "cohub.app.broker.ready" && !ready) {
+					if (message.type === "cohub.app.authorize.v2" && data.authorizationVersion !== 2) {
+						finish(() => reject(new AppRuntimeError("unsupported", "This host does not support structured authorization.")));
+						return;
+					}
 					ready = true;
+					if (timer) clearTimeout(timer);
+					timer = setTimeout(() => finish(() => reject(new AppRuntimeError("host_timeout", "Authorization timed out."))), timeoutMs);
 					try {
 						popup.postMessage({
 							...message,
@@ -2437,7 +2953,7 @@ var PopupBrokerTransport = class {
 				if (data.requestId !== requestId) return;
 				finish(() => {
 					if (data.type === "cohub.app.error") {
-						reject(new Error(data.message));
+						reject(new AppRuntimeError(data.code ?? "request_failed", data.message, requestId));
 						return;
 					}
 					resolve(data);
@@ -2446,7 +2962,8 @@ var PopupBrokerTransport = class {
 			window.addEventListener("message", onMessage);
 			closeChecker = setInterval(() => {
 				if (popup.closed) finish(() => {
-					if (!ready) reject(/* @__PURE__ */ new Error("Authorization window was closed."));
+					if (message.type === "cohub.app.authorize.v2") resolve({ result: { status: "cancelled" } });
+					else if (!ready) reject(/* @__PURE__ */ new Error("Authorization window was closed."));
 					else resolve(null);
 				});
 			}, 500);
@@ -2564,6 +3081,7 @@ var AppRuntimeApi = class {
 	}
 	constructor(transport = new ParentBridgeTransport(), appId, appIdResolver) {
 		this.transport = transport;
+		this.contextUnsubscribe = transport.subscribeContextChanged?.((context) => this.observeContext(context)) ?? null;
 		this.appIdResolver = appIdResolver;
 		this.diagnosticUnsubscribe = transport.subscribeDiagnostics?.((diagnostic) => {
 			console.warn(`[cohub] ${diagnostic.message} (${diagnostic.code})`, diagnostic.detail ?? {});
@@ -2605,6 +3123,10 @@ var AppRuntimeApi = class {
 		return this.storageKeysReady;
 	}
 	readStoredToken() {
+		if (this.transport instanceof PopupBrokerTransport) {
+			this.writeStoredToken(null);
+			return null;
+		}
 		if (!this.tokenStorageKey || typeof localStorage === "undefined") return null;
 		try {
 			return localStorage.getItem(this.tokenStorageKey);
@@ -2613,6 +3135,7 @@ var AppRuntimeApi = class {
 		}
 	}
 	writeStoredToken(token) {
+		if (this.transport instanceof PopupBrokerTransport) token = null;
 		if (!this.tokenStorageKey || typeof localStorage === "undefined") return;
 		try {
 			if (token) localStorage.setItem(this.tokenStorageKey, token);
@@ -2638,11 +3161,30 @@ var AppRuntimeApi = class {
 			else localStorage.removeItem(this.grantsStorageKey);
 		} catch {}
 	}
+	serverGrants = false;
+	viewerIdentity;
+	identityVersion = 0;
+	contextUnsubscribe = null;
+	observeContext(context) {
+		if (context.capabilities?.serverGrants) this.serverGrants = true;
+		if (context.viewer === void 0) return;
+		const viewer = context.viewer?.userUuid ?? null;
+		if (this.viewerIdentity !== void 0 && viewer !== this.viewerIdentity) {
+			this.identityVersion++;
+			this.token = null;
+			this.authorizedGrants = null;
+			this.writeStoredToken(null);
+			this.writeStoredGrants(null);
+		}
+		this.viewerIdentity = viewer;
+	}
 	async context() {
-		return (await this.transport.request({ type: "cohub.app.context" }, {
+		const response = await this.transport.request({ type: "cohub.app.context" }, {
 			timeoutMs: 8e3,
 			retryIntervalMs: 250
-		}))?.context ?? null;
+		});
+		if (response?.context) this.observeContext(response.context);
+		return response?.context ?? null;
 	}
 	onContextChanged(listener) {
 		return this.transport.subscribeContextChanged?.(listener) ?? (() => {});
@@ -2659,6 +3201,8 @@ var AppRuntimeApi = class {
 		const unsubscribe = this.diagnosticUnsubscribe;
 		this.diagnosticUnsubscribe = null;
 		unsubscribe?.();
+		this.contextUnsubscribe?.();
+		this.contextUnsubscribe = null;
 		this.pointerForwarding = false;
 		this.pointerPending = null;
 		if (this.pointerFrame !== null) {
@@ -2720,12 +3264,13 @@ var AppRuntimeApi = class {
 	}
 	async getAccessToken(options) {
 		await this.ensureStorageKeys();
+		const identityVersion = this.identityVersion;
 		if (this.token && !options?.forceRefresh) return this.token;
 		if (options?.forceRefresh) {
 			this.token = null;
 			this.writeStoredToken(null);
 		}
-		if (options?.forceRefresh && this.authorizedGrants && this.authorizedGrants.length > 0) {
+		if (!this.serverGrants && options?.forceRefresh && this.authorizedGrants && this.authorizedGrants.length > 0) {
 			let refreshed = false;
 			let next = [];
 			for (const grant of this.authorizedGrants) try {
@@ -2734,12 +3279,14 @@ var AppRuntimeApi = class {
 					scopes: grant.scopes,
 					spaceId: grant.spaceId
 				}, { timeoutMs: 12e4 });
+				if (identityVersion !== this.identityVersion) return null;
 				const token = response?.token ?? null;
 				if (!token) continue;
 				this.token = token;
 				next = recordConsent(next, responseSpaceId(response?.space?.id) ?? grant.spaceId, grant.scopes);
 				refreshed = true;
 			} catch {
+				if (identityVersion !== this.identityVersion) return null;
 				next = recordConsent(next, grant.spaceId, grant.scopes);
 			}
 			this.authorizedGrants = next;
@@ -2753,11 +3300,37 @@ var AppRuntimeApi = class {
 			type: "cohub.app.token",
 			forceRefresh: Boolean(options?.forceRefresh)
 		}, { timeoutMs: 2e4 });
+		if (identityVersion !== this.identityVersion) return null;
 		this.token = response?.token ?? null;
 		this.writeStoredToken(this.token);
 		return this.token;
 	}
+	/** Structured authorization. Legacy hosts cannot execute this message. */
+	async authorize(input) {
+		const parsed = appAuthorizationRequestSchema.safeParse(input);
+		if (!parsed.success) throw new AppRuntimeError("invalid_request", "Invalid authorization request.");
+		await this.ensureStorageKeys();
+		const context = await this.context();
+		if (context?.mode !== "broker" && context?.capabilities?.authorization !== 2) throw new AppRuntimeError("unsupported", "This host does not support structured authorization.");
+		const identityVersion = this.identityVersion;
+		const response = await this.transport.request({
+			type: "cohub.app.authorize.v2",
+			...parsed.data
+		}, { timeoutMs: 12e4 });
+		if (identityVersion !== this.identityVersion) throw new AppRuntimeError("session_changed", "The signed-in account changed. Please try again.");
+		if (!response) throw new AppRuntimeError("host_timeout", "Authorization host did not respond. It may not support structured authorization.");
+		const result = appAuthorizationResultSchema.safeParse(response.result);
+		if (!result.success) throw new AppRuntimeError("invalid_response", "Invalid authorization result.");
+		this.serverGrants = true;
+		if (result.data.status === "granted") {
+			if (typeof response.token !== "string" || !response.token) throw new AppRuntimeError("invalid_response", "Authorization token is missing.");
+			this.token = response.token;
+			this.writeStoredToken(this.token);
+		}
+		return result.data;
+	}
 	/**
+	* @deprecated Use authorize() to receive the actual target and grant.
 	* Requests viewer consent. With an accessible `spaceId` the grant targets
 	* that Space; otherwise the host resolves a viewer-controlled Space (the
 	* invocation or embedding Space, then the viewer's last picked Space, then
@@ -2788,6 +3361,7 @@ var AppRuntimeApi = class {
 		return Boolean(token);
 	}
 	/**
+	* @deprecated Use authorize() with a pick-space target.
 	* Asks the viewer to pick a Space and grant the scopes on it — one consent
 	* dialog covers both. Resolves with the picked space so the app knows where
 	* it may act; `space` is null when the viewer denied.
@@ -2887,7 +3461,8 @@ function createSlugAppIdResolver(deps) {
 			if (typeof doFetch !== "function") return null;
 			const response = await doFetch(`${deps.apiBaseUrl}/api/apps/by-slug/${encodeURIComponent(deps.ownerUsername)}/${encodeURIComponent(deps.spaceSlug)}/${encodeURIComponent(deps.appSlug)}`);
 			if (!response.ok) throw new Error(`getBySlug failed: ${response.status}`);
-			return (await response.json())?.work?.id ?? null;
+			const data = await response.json();
+			return data?.app?.id ?? data?.work?.id ?? null;
 		})().catch(() => {
 			cached = null;
 			return null;
@@ -3027,14 +3602,16 @@ var CohubClient = class {
 		this.appRuntime.dispose();
 	}
 	auth = {
+		authorize: (input) => this.appRuntime.authorize(input),
 		/**
+		* @deprecated Use authorize() for the actual target and structured result.
 		* Ensure the app holds these scopes. Without an accessible `spaceId` the
 		* host targets a viewer-controlled Space (never the app author's home
 		* Space) — use `requestSpace` when the app needs to know which Space.
 		* Silent when a grant already covers them; `alwaysAsk` forces the dialog.
 		*/
 		request: (input) => this.appRuntime.requestAuthorization(input),
-		/** One consent: the viewer picks a Space and grants the scopes on it. `alwaysAsk` re-opens the picker. */
+		/** @deprecated Use authorize({ target: { kind: "pick-space" }, scopes }). */
 		requestSpace: (input) => this.appRuntime.requestSpaceAuthorization(input),
 		/** One consent: create a viewer-owned Space and grant the scopes on it. `space` is `CreateSpaceInput`. */
 		requestCreateSpace: (input) => this.appRuntime.requestCreateSpaceAuthorization(input)
@@ -3393,6 +3970,7 @@ function clearGrantedAppScopes(userUuid, appId, spaceId) {
 }
 //#endregion
 //#region src/app-bridge-core.ts
+var AppLoginRedirect = class extends Error {};
 function readTokenResponse(value) {
 	if (!value || typeof value !== "object") return null;
 	const token = value.token;
@@ -3572,18 +4150,95 @@ function createAppBridgeCore(config) {
 	const authorizationContext = config.authorizationContext ?? (config.isBackground ? { surface: "background" } : { surface: "page" });
 	const onStateChange = config.onStateChange;
 	let appToken = null;
+	let tokenViewer;
+	function synchronizeViewer(viewer) {
+		if (tokenViewer !== void 0 && tokenViewer !== viewer) {
+			appToken = null;
+			sessionViewerGrants.clear();
+			authoritativeGrants.clear();
+		}
+		tokenViewer = viewer;
+	}
 	/** Consents made through this host, keyed by target space. */
 	const sessionViewerGrants = /* @__PURE__ */ new Map();
 	let activeInvocation;
 	let contextChangeVersion = 0;
 	const legacyRequestIds = /* @__PURE__ */ new Set();
+	const authorizationRequests = /* @__PURE__ */ new Map();
+	const authoritativeGrants = /* @__PURE__ */ new Map();
+	function canJoin(pending, next, requestId) {
+		const previous = authorizationRequests.get(pending.requestId);
+		const current = authorizationRequests.get(requestId);
+		return Boolean(previous) === Boolean(current) && previous?.fallback === current?.fallback && isSameConsent(pending, next);
+	}
+	let signInFlight = null;
+	const pendingLoginKey = `cohub:app-login:${app.id}`;
+	function rememberAuthorization(data) {
+		if (data.createSpace) return;
+		try {
+			const structured = typeof data.requestId === "string" ? authorizationRequests.get(data.requestId) : void 0;
+			sessionStorage.setItem(pendingLoginKey, JSON.stringify({
+				at: Date.now(),
+				data: {
+					...structured ? {
+						...structured,
+						type: "cohub.app.authorize.v2"
+					} : { type: data.type },
+					requestId: data.requestId,
+					scopes: data.scopes,
+					reason: sanitizeReason(data.reason),
+					spaceId: data.spaceId,
+					selectSpace: data.selectSpace,
+					alwaysAsk: data.alwaysAsk
+				}
+			}));
+		} catch {}
+	}
+	function clearAuthorizationIntent(requestId) {
+		try {
+			const raw = sessionStorage.getItem(pendingLoginKey);
+			if (!raw) return;
+			const saved = JSON.parse(raw);
+			if (isRecord(saved) && isRecord(saved.data) && saved.data.requestId === requestId) sessionStorage.removeItem(pendingLoginKey);
+		} catch {}
+	}
+	async function resumeAuthorization() {
+		if (state.pendingAuth || !await getViewerUuid()) return;
+		try {
+			const raw = sessionStorage.getItem(pendingLoginKey);
+			if (!raw) return;
+			const saved = JSON.parse(raw);
+			if (!isRecord(saved) || typeof saved.at !== "number" || Date.now() - saved.at > 6e5 || !isRecord(saved.data)) {
+				sessionStorage.removeItem(pendingLoginKey);
+				return;
+			}
+			await handleMessage({ data: saved.data });
+		} catch {}
+	}
+	async function startSignIn() {
+		if (state.pendingAuth) rememberAuthorization({
+			...state.pendingAuth,
+			type: "cohub.app.authorize"
+		});
+		signInFlight ??= config.requestSignIn(typeof location !== "undefined" ? location.pathname + location.search + location.hash : "/").catch((error) => {
+			signInFlight = null;
+			throw error;
+		});
+		await signInFlight;
+	}
 	async function getContext() {
 		const invocation = activeInvocation !== void 0 ? activeInvocation : config.getInvocation?.() ?? config.invocation;
 		const shell = config.getShell?.() ?? config.shell;
 		const appScopes = clonePermissionScopes(app.appScopes);
 		const viewerUuid = await getViewerUuid();
+		synchronizeViewer(viewerUuid);
 		const viewerGrants = mergeViewerGrants(viewerUuid, Array.from(sessionViewerGrants.values()));
 		return {
+			capabilities: {
+				authorization: 2,
+				serverGrants: true
+			},
+			mode: authorizationContext.surface === "broker" ? "broker" : "bridge",
 			app: {
 				id: app.id,
 				slug: app.slug,
@@ -3625,13 +4280,63 @@ function createAppBridgeCore(config) {
 		};
 	}
 	function replyForRequest(requestId, payload, complete = false) {
+		const request = authorizationRequests.get(requestId);
+		if (request && payload.type === "cohub.app.error" && [
+			"space_inaccessible",
+			"scope_not_held",
+			"app_not_accessible",
+			"consent_required"
+		].includes(String(payload.code))) payload = {
+			...payload,
+			type: "cohub.app.authorize.result",
+			token: null,
+			result: {
+				status: "denied",
+				code: payload.code
+			}
+		};
+		if (request && payload.type === "cohub.app.authorize.result" && !payload.result) {
+			const space = payload.space;
+			const grant = space ? authoritativeGrants.get(space.id) : void 0;
+			let result = { status: "cancelled" };
+			if (payload.token && space && grant) result = {
+				status: "granted",
+				requestedTarget: request.target,
+				target: request.target.kind === "account" ? { kind: "account" } : {
+					kind: "space",
+					spaceId: space.id,
+					name: space.name
+				},
+				resolution: request.target.kind === "pick-space" ? "selected" : request.target.kind === "space" && request.target.spaceId !== space.id ? "fallback" : "requested",
+				grant
+			};
+			else if (payload.token) payload = {
+				type: "cohub.app.error",
+				code: "invalid_response",
+				message: "Missing authoritative grant."
+			};
+			if (payload.type !== "cohub.app.error") payload = {
+				...payload,
+				result
+			};
+		}
+		if (complete && (payload.type === "cohub.app.authorize.result" || payload.type === "cohub.app.error" && [
+			"invalid_request",
+			"space_inaccessible",
+			"scope_not_held",
+			"app_not_accessible",
+			"consent_required"
+		].includes(String(payload.code)))) clearAuthorizationIntent(requestId);
 		const namespace = legacyRequestIds.has(requestId) ? "work" : "app";
 		const type = payload.type;
 		reply(requestId, {
 			...payload,
 			...typeof type === "string" && type.startsWith("cohub.app.") ? { type: type.replace("cohub.app.", `cohub.${namespace}.`) } : {}
 		});
-		if (complete) legacyRequestIds.delete(requestId);
+		if (complete) {
+			legacyRequestIds.delete(requestId);
+			authorizationRequests.delete(requestId);
+		}
 	}
 	function toLegacyWorkContext(context) {
 		const permissions = context.permissions ? {
@@ -3710,12 +4415,11 @@ function createAppBridgeCore(config) {
 		return authorizationContext.surface === "background" || authorizationContext.surface === "app" || authorizationContext.surface === "overlay";
 	}
 	async function ensureBaseToken(forceRefresh = false) {
+		const viewer = await getViewerUuid();
+		synchronizeViewer(viewer);
 		if (appToken && !forceRefresh) return appToken;
 		const userToken = await getAccessToken({ forceRefresh });
-		if (!userToken) {
-			await config.requestSignIn(typeof location !== "undefined" ? location.pathname : "/");
-			return null;
-		}
+		if (!userToken) return null;
 		const response = await fetch(`${apiOrigin}/api/apps/${app.id}/session`, {
 			method: "POST",
 			headers: { Authorization: `Bearer ${userToken}` }
@@ -3723,6 +4427,7 @@ function createAppBridgeCore(config) {
 		if (!response.ok) throw new Error("Failed to create app session.");
 		const token = readTokenResponse(await response.json());
 		if (!token) throw new Error("Invalid app session response.");
+		if (viewer !== await getViewerUuid()) return null;
 		appToken = token;
 		return appToken;
 	}
@@ -3733,11 +4438,14 @@ function createAppBridgeCore(config) {
 	* fresh dialog.
 	*/
 	async function authorize(scopes, spaceId, options) {
+		const incremental = Boolean(state.pendingAuth && authorizationRequests.has(state.pendingAuth.requestId));
 		const userToken = await getAccessToken(options?.forceRefreshToken ? { forceRefresh: true } : void 0);
 		if (!userToken) {
-			await config.requestSignIn(typeof location !== "undefined" ? location.pathname : "/");
-			throw new Error("Sign in is required to authorize this app.");
+			if (mintedSpace) throw new AppAuthorizationError("Sign in to finish authorization.", 401, "login_required");
+			await startSignIn();
+			throw new AppLoginRedirect();
 		}
+		const authorizingViewer = await getViewerUuid();
 		const response = await fetch(`${apiOrigin}/api/apps/${app.id}/authorize`, {
 			method: "POST",
 			signal: timeoutSignal(AUTHORIZE_TIMEOUT_MS),
@@ -3748,13 +4456,18 @@ function createAppBridgeCore(config) {
 			body: JSON.stringify({
 				scopes,
 				...spaceId ? { spaceId } : {},
-				...options?.silent ? { silent: true } : {}
+				...options?.silent ? { silent: true } : {},
+				...incremental ? { scopeMode: "extend" } : {}
 			})
 		});
 		const payload = await response.json().catch(() => null);
 		if (!response.ok) throw new AppAuthorizationError(typeof payload?.message === "string" ? payload.message : "Authorization failed.", response.status, typeof payload?.code === "string" ? payload.code : void 0);
+		if (authorizingViewer !== await getViewerUuid()) throw new AppAuthorizationError("The signed-in account changed. Please try again.", 409, "session_changed");
+		synchronizeViewer(authorizingViewer);
 		const token = readTokenResponse(payload);
 		if (!token) throw new Error("Invalid app authorization response.");
+		const parsedGrant = appAuthorizationGrantSchema.safeParse(payload?.grant);
+		if (parsedGrant.success) authoritativeGrants.set(parsedGrant.data.spaceId, parsedGrant.data);
 		const canonicalSpaceId = typeof payload?.grant?.spaceId === "string" && payload.grant.spaceId ? payload.grant.spaceId : spaceId ?? app.spaceId;
 		const grantedScopes = sanitizeRequestedScopes(payload?.grant?.scopes);
 		const canonicalScopes = grantedScopes.length > 0 ? grantedScopes : clonePermissionScopes(scopes);
@@ -3836,7 +4549,10 @@ function createAppBridgeCore(config) {
 	async function listViewerSpaces() {
 		const request = async (forceRefresh = false) => {
 			const userToken = await getAccessToken({ forceRefresh });
-			if (!userToken) return null;
+			if (!userToken) {
+				await startSignIn();
+				throw new AppLoginRedirect();
+			}
 			return fetch(`${apiOrigin}/api/spaces`, {
 				headers: { Authorization: `Bearer ${userToken}` },
 				signal: spaceListSignal()
@@ -3852,7 +4568,8 @@ function createAppBridgeCore(config) {
 				const option = toSpaceOption(space);
 				return option ? [option] : [];
 			});
-		} catch {
+		} catch (error) {
+			if (error instanceof AppLoginRedirect) throw error;
 			return null;
 		}
 	}
@@ -4006,8 +4723,38 @@ function createAppBridgeCore(config) {
 		return (await response.json()).checkout ?? null;
 	}
 	async function handleMessage(event) {
-		const data = event.data;
+		let data = event.data;
 		if (!data?.requestId) return;
+		if (data.type === "cohub.app.authorize.v2") {
+			const parsed = appAuthorizationRequestSchema.safeParse(event.data);
+			if (!parsed.success || parsed.data.scopes.some((scope) => !PERMISSIONS.includes(scope))) {
+				replyForRequest(data.requestId, {
+					type: "cohub.app.error",
+					code: "invalid_request",
+					message: "Invalid authorization request."
+				}, true);
+				return;
+			}
+			const input = parsed.data;
+			if (input.target.kind === "account" && input.scopes.some((scope) => !isUserLevelPermission(scope))) {
+				replyForRequest(data.requestId, {
+					type: "cohub.app.error",
+					code: "invalid_request",
+					message: "Space permissions require a Space target."
+				}, true);
+				return;
+			}
+			authorizationRequests.set(data.requestId, input);
+			data = {
+				requestId: data.requestId,
+				...input,
+				type: "cohub.app.authorize",
+				scopes: input.scopes,
+				spaceId: input.target.kind === "space" ? input.target.spaceId : void 0,
+				selectSpace: input.target.kind === "pick-space"
+			};
+		}
+		if (!data.requestId) return;
 		const isLegacyWork = data.type?.startsWith("cohub.work.") === true;
 		if (isLegacyWork) legacyRequestIds.add(data.requestId);
 		let reservedAuth = null;
@@ -4018,6 +4765,7 @@ function createAppBridgeCore(config) {
 					type: "cohub.app.context.result",
 					context: isLegacyWork ? toLegacyWorkContext(context) : context
 				}, true);
+				await resumeAuthorization();
 			}
 			if (data.type === "cohub.app.token" || data.type === "cohub.work.token") {
 				const token = await ensureBaseToken(Boolean(data.forceRefresh));
@@ -4125,18 +4873,22 @@ function createAppBridgeCore(config) {
 					return;
 				}
 				if (state.pendingAuth) {
-					if (isSameConsent(state.pendingAuth, {
+					if (canJoin(state.pendingAuth, {
 						scopes,
 						spaceId,
 						selectSpace,
 						createSpace
-					})) {
+					}, data.requestId)) {
 						state.pendingAuth.joinedRequestIds = [...state.pendingAuth.joinedRequestIds ?? [], data.requestId];
 						return;
 					}
 					dismissPendingAuth();
 				}
 				if (createSpace) {
+					if (!await getViewerUuid()) {
+						await startSignIn();
+						return;
+					}
 					mintedSpace = null;
 					const pendingCreate = {
 						requestId: data.requestId,
@@ -4154,7 +4906,7 @@ function createAppBridgeCore(config) {
 					notify();
 					return;
 				}
-				if (!selectSpace && !alwaysAsk && allowsOwnerAutoAuthorization() && await isCurrentViewerAppOwner()) try {
+				if (!selectSpace && !authorizationRequests.has(data.requestId) && !alwaysAsk && allowsOwnerAutoAuthorization() && await isCurrentViewerAppOwner()) try {
 					const result = await authorizeSilent(scopes, spaceId);
 					replyForRequest(data.requestId, authorizeResult(result.token, result.spaceId, result.spaceId === app.spaceId ? app.spaceName ?? null : null), true);
 					return;
@@ -4168,12 +4920,12 @@ function createAppBridgeCore(config) {
 					}
 				}
 				if (state.pendingAuth) {
-					if (isSameConsent(state.pendingAuth, {
+					if (canJoin(state.pendingAuth, {
 						scopes,
 						spaceId,
 						selectSpace,
 						createSpace
-					})) {
+					}, data.requestId)) {
 						state.pendingAuth.joinedRequestIds = [...state.pendingAuth.joinedRequestIds ?? [], data.requestId];
 						return;
 					}
@@ -4194,6 +4946,11 @@ function createAppBridgeCore(config) {
 				state.authError = null;
 				const viewerUuid = await getViewerUuid();
 				if (state.pendingAuth !== reserved) return;
+				if (!viewerUuid) {
+					rememberAuthorization(data);
+					await startSignIn();
+					return;
+				}
 				const spaceLevel = Boolean(spaceId) || selectSpace || scopes.some((scope) => !isUserLevelPermission(scope));
 				const lastPicked = readLastPickedSpace();
 				const contextSpaceId = resolveContextSpaceId();
@@ -4208,7 +4965,26 @@ function createAppBridgeCore(config) {
 					if (fallback) spaces = [fallback];
 				}
 				const candidates = spaces ?? null;
+				if (spaceLevel && spaces === null) {
+					reserved.spaces = null;
+					state.authError = "Couldn't load your Spaces. Please try again.";
+					state.authOpen = true;
+					state.canChangeSpace = false;
+					notify();
+					return;
+				}
 				const explicitAccessible = Boolean(spaceId) && candidates?.some((space) => space.id === spaceId) === true;
+				const structuredRequest = authorizationRequests.get(data.requestId);
+				if (spaceId && candidates && !explicitAccessible && structuredRequest?.fallback === "none") {
+					replyPendingAuth(reserved, {
+						type: "cohub.app.error",
+						code: "space_inaccessible",
+						message: "The requested Space is unavailable."
+					});
+					resetDialogState();
+					safeNotify();
+					return;
+				}
 				const defaultSpaceId = explicitAccessible ? spaceId : resolveDefaultSpaceId(candidates);
 				const silentTargets = (!spaceLevel ? [] : [selectSpace ? lastPicked && candidates?.some((space) => space.id === lastPicked) ? lastPicked : null : explicitAccessible ? spaceId : spaceId === void 0 ? defaultSpaceId : null].filter((target) => Boolean(target) && hasGrantedAppScopes(viewerUuid, app.id, scopes, target ?? void 0))).slice(0, MAX_SILENT_SPACE_ATTEMPTS);
 				if (!alwaysAsk && await attemptSilentRenewal(reserved, viewerUuid, scopes, silentTargets)) return;
@@ -4230,11 +5006,19 @@ function createAppBridgeCore(config) {
 				notify();
 			}
 		} catch (error) {
+			if (error instanceof AppLoginRedirect) {
+				rememberAuthorization(data);
+				resetDialogState();
+				safeNotify();
+				return;
+			}
 			const message = error instanceof Error ? error.message : "Request failed.";
+			const code = error instanceof AppAuthorizationError ? error.code : "request_failed";
 			if (reservedAuth && state.pendingAuth === reservedAuth) {
 				replyPendingAuth(reservedAuth, {
 					type: "cohub.app.error",
-					message
+					message,
+					code
 				});
 				resetDialogState();
 				safeNotify();
@@ -4242,7 +5026,8 @@ function createAppBridgeCore(config) {
 			}
 			replyForRequest(data.requestId, {
 				type: "cohub.app.error",
-				message
+				message,
+				code
 			}, true);
 		}
 	}
@@ -4262,7 +5047,14 @@ function createAppBridgeCore(config) {
 		if (!state.pendingAuth) return;
 		replyPendingAuth(state.pendingAuth, {
 			type: "cohub.app.authorize.result",
-			token: null
+			token: null,
+			...mintedSpace ? {
+				space: {
+					id: mintedSpace.id,
+					name: mintedSpace.name
+				},
+				stage: mintedSpace.provisioned ? "authorization" : "bootstrap"
+			} : {}
 		});
 		resetDialogState();
 		mintedSpace = null;
@@ -4323,6 +5115,11 @@ function createAppBridgeCore(config) {
 		if (!state.pendingAuth || state.authSaving) return;
 		const pending = state.pendingAuth;
 		let requestedSpaceId = (state.canChangeSpace ? pickedSpaceId : void 0) ?? state.selectedSpaceId ?? void 0;
+		if (pending.spaces === null) {
+			state.authError = "Couldn't load your Spaces. Please try again.";
+			notify();
+			return;
+		}
 		if (pending.spaces !== void 0) {
 			const candidates = pending.spaces;
 			if (!(requestedSpaceId !== void 0 && candidates?.some((space) => space.id === requestedSpaceId) === true)) {
@@ -4360,6 +5157,13 @@ function createAppBridgeCore(config) {
 			resetDialogState();
 			mintedSpace = null;
 		} catch (error) {
+			if (error instanceof AppLoginRedirect) return;
+			if (mintedSpace && error instanceof AppAuthorizationError && error.code === "login_required") {
+				replyPendingAuth(pending, authorizeResult(null, mintedSpace.id, mintedSpace.name));
+				resetDialogState();
+				mintedSpace = null;
+				return;
+			}
 			if (error instanceof AppAuthorizationError) emitDiagnostic({
 				code: error.code ?? "authorize_failed",
 				message: error.message,
@@ -4626,4 +5430,4 @@ function createBoardExtensionRegistry() {
 }
 const BOARD_CHANNELS = BOARD_ANIMATION_CHANNELS;
 //#endregion
-export { APP_COMPOSER_CHIP_CONTENT_MAX_BYTES, APP_COMPOSER_CHIP_KEY_MAX_LENGTH, APP_COMPOSER_CHIP_LABEL_MAX_LENGTH, APP_SURFACE_READY_TIMEOUT_MS, APP_SURFACE_REQUEST_TIMEOUT_MS, AppCommerceApi, AppRealtimeApi, AppRefParseError, AppRoom, AppRuntimeApi, AppRuntimeApi as WorkRuntimeApi, AppSurfaceApi, AppsApi, BILLING_ACCESS_BLOCKED_ERROR_CODE, BOARD_ANIMATION_CHANNEL_CAPABILITIES, BOARD_CHANNELS, BOARD_COLOR_IDS, BOARD_GEO_KINDS, BillingApi, BoardAnimationSpecSchema, BoardAuthoringItemSchema, BoardClient, BoardCompositionInputSchema, BoardCompositionSchema, BoardDealParamsSchema, BoardEffectInputSchema, BoardEffectSchema, BoardExtensionRegistry, BoardItemPatchSchema, BoardPlaybackPolicySchema, BoardSemanticCommandSchema, COHUB_ENVIRONMENTS, COHUB_SOURCE_HEADER, COHUB_SOURCE_HEADER_NAMES, CohubClient, CohubHttpClient, DEFAULT_BOARD_LIMITS, DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, DESKTOP_COMMAND_MAX_TIMEOUT_MS, DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, DESKTOP_COMMAND_PENDING_TTL_SECONDS, DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, DESKTOP_COMMAND_VERSION, DesktopCommandsApi, FEATURE_NOT_ENTITLED_ERROR_CODE, GenerationPolicyError, HttpError, PERMISSIONS, ParentBridgeTransport, PopupBrokerTransport, REQUEST_SOURCE_VIA_MAX_LENGTH, ReferencesApi, ReferralsApi, SessionGenerationStreamClient, SessionPatchReducer, SpacePublicFilesApi, SpaceWebhooksApi, USER_LEVEL_PERMISSIONS, UiCommandsApi, UsersApi, VoiceApi, VoiceInputClient, WebsocketClient, WorkCommerceApi, WorkRealtimeApi, WorkRefParseError, WorkRoom, WorkSurfaceApi, assertGenerationRequestAllowedByPolicy, attachAppEmbed, buildAppSurfaceRequest, buildSpaceInvitePath, buildSpacePath, clearGrantedAppScopes, compileComposition, composition, createAppBridgeCore, createAppBridgeCore as createWorkBridgeCore, createAppRuntime, createAppRuntime as createWorkRuntime, createBoardExtensionRegistry, createCohubClient, createHttpClient, createSessionGenerationStreamClient, createSessionPatchReducer, createSlugAppIdResolver, createSlugAppIdResolver as createSlugWorkIdResolver, createVoiceInputClient, createWebsocketClient, decodeGenerationPolicy, encodeGenerationPolicy, extractBillingPayload, filterDiscoverableGenerationModels, filterGenerationDeclarationsByPolicy, filterSpacePickerItems, findGenerationModelPolicy, formatAppRef, formatWorkRef, getAllowedGenerationModelIds, getCohubContext, hasGrantedAppScopes, hasRequestSourceIdentity, isAppId, isBillingAccessBlockedCode, isBillingAccessBlockedError, isDesktopCallMethod, isFeatureNotEntitledError, isGenerationModelHidden, isHttpErrorCode, isRequestSourceClientId, isRequestSourceEmpty, isRequestSourceUuid, isTerminalDesktopCommandStatus, isUserLevelPermission, isUuid, isWorkId, joinApiUrl, matchesUnauthorizedErrorToken, mergeRequestSourceIntoMeta, normalizeBaseUrl, normalizeGenerationPolicy, normalizeRequestSource, normalizeSpacePickerQuery, normalizeVoiceInputWebsocketUrl, normalizeWebsocketUrl, orderSpacePickerItems, parseAppRef, parseAppSurfaceReady, parseAppSurfaceResponse, parseAssistantMessageCommit, parseBoardCompositionInput, parseBoardEffectInput, parseBoardPlaybackPolicy, parseDesktopCommand, parseGenerationPolicyFromEnv, parseRequestSourceFromHeaders, parseWorkRef, proceduralClip, readRequestSourceFromEnv, requestSourceToHeaders, resolveApiBaseUrl, resolveAppTransport, resolveAppTransport as resolveWorkTransport, resolveCohubEnvironment, resolveExecutionAppId, resolveExecutionToken, resolveOpenSurface, resolveRequestSourceChannel, resolveVoiceInputWebsocketUrl, resolveWebsocketUrl, sampleCompositionTracks, sampleEasing, sampleTrack, sanitizeAccessToken, scopeListHasPermission, selectSpacePickerItems, setGrantedAppScopes, track };
+export { APP_COMPOSER_CHIP_CONTENT_MAX_BYTES, APP_COMPOSER_CHIP_KEY_MAX_LENGTH, APP_COMPOSER_CHIP_LABEL_MAX_LENGTH, APP_SURFACE_READY_TIMEOUT_MS, APP_SURFACE_REQUEST_TIMEOUT_MS, AppCommerceApi, AppRealtimeApi, AppRefParseError, AppRoom, AppRuntimeApi, AppRuntimeApi as WorkRuntimeApi, AppRuntimeError, AppSurfaceApi, AppsApi, BILLING_ACCESS_BLOCKED_ERROR_CODE, BOARD_ANIMATION_CHANNEL_CAPABILITIES, BOARD_CHANNELS, BOARD_COLOR_IDS, BOARD_GEO_KINDS, BillingApi, BoardAnimationSpecSchema, BoardAuthoringItemSchema, BoardClient, BoardCompositionInputSchema, BoardCompositionSchema, BoardDealParamsSchema, BoardEffectInputSchema, BoardEffectSchema, BoardExtensionRegistry, BoardItemPatchSchema, BoardPlaybackPolicySchema, BoardSemanticCommandSchema, COHUB_ENVIRONMENTS, COHUB_SOURCE_HEADER, COHUB_SOURCE_HEADER_NAMES, CohubClient, CohubHttpClient, DEFAULT_BOARD_LIMITS, DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, DESKTOP_COMMAND_MAX_TIMEOUT_MS, DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, DESKTOP_COMMAND_PENDING_TTL_SECONDS, DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, DESKTOP_COMMAND_VERSION, DesktopCommandsApi, FEATURE_NOT_ENTITLED_ERROR_CODE, GenerationPolicyError, HttpError, PERMISSIONS, ParentBridgeTransport, PopupBrokerTransport, REQUEST_SOURCE_VIA_MAX_LENGTH, RUNTIME_ARCHIVE_SEGMENT_BYTES, RUNTIME_MAX_FRAME_BYTES, RUNTIME_PROTOCOL_VERSION, RUNTIME_RECOVERY_BATCH_SIZE, ReferencesApi, ReferralsApi, SessionGenerationStreamClient, SessionPatchReducer, SpacePublicFilesApi, SpaceWebhooksApi, USER_LEVEL_PERMISSIONS, UiCommandsApi, UsersApi, VoiceApi, VoiceInputClient, WebsocketClient, WorkCommerceApi, WorkRealtimeApi, WorkRefParseError, WorkRoom, WorkSurfaceApi, assertGenerationRequestAllowedByPolicy, attachAppEmbed, buildAppSurfaceRequest, buildSpaceInvitePath, buildSpacePath, clearGrantedAppScopes, compileComposition, composition, contextToPiMessages, createAppBridgeCore, createAppBridgeCore as createWorkBridgeCore, createAppRuntime, createAppRuntime as createWorkRuntime, createBoardExtensionRegistry, createCohubClient, createHttpClient, createSessionGenerationStreamClient, createSessionPatchReducer, createSlugAppIdResolver, createSlugAppIdResolver as createSlugWorkIdResolver, createVoiceInputClient, createWebsocketClient, decodeGenerationPolicy, encodeGenerationPolicy, extractBillingPayload, filterDiscoverableGenerationModels, filterGenerationDeclarationsByPolicy, filterSpacePickerItems, findGenerationModelPolicy, formatAppRef, formatWorkRef, getAllowedGenerationModelIds, getCohubContext, harnessArchiveIndexSchema, hasGrantedAppScopes, hasRequestSourceIdentity, isAppId, isBillingAccessBlockedCode, isBillingAccessBlockedError, isDesktopCallMethod, isFeatureNotEntitledError, isGenerationModelHidden, isHttpErrorCode, isLocalHarness, isRequestSourceClientId, isRequestSourceEmpty, isRequestSourceUuid, isTerminalDesktopCommandStatus, isUserLevelPermission, isUuid, isWorkId, joinApiUrl, matchesUnauthorizedErrorToken, mergeRequestSourceIntoMeta, normalizeBaseUrl, normalizeGenerationPolicy, normalizeRequestSource, normalizeSpacePickerQuery, normalizeVoiceInputWebsocketUrl, normalizeWebsocketUrl, orderSpacePickerItems, parseAppRef, parseAppSurfaceReady, parseAppSurfaceResponse, parseAssistantMessageCommit, parseBoardCompositionInput, parseBoardEffectInput, parseBoardPlaybackPolicy, parseDesktopCommand, parseGenerationPolicyFromEnv, parseRequestSourceFromHeaders, parseWorkRef, proceduralClip, readRequestSourceFromEnv, requestSourceToHeaders, resolveApiBaseUrl, resolveAppTransport, resolveAppTransport as resolveWorkTransport, resolveCohubEnvironment, resolveExecutionAppId, resolveExecutionToken, resolveHarness, resolveOpenSurface, resolveRequestSourceChannel, resolveVoiceInputWebsocketUrl, resolveWebsocketUrl, runtimeCommandSchema, runtimeEventSchema, runtimeReadySchema, sampleCompositionTracks, sampleEasing, sampleTrack, sanitizeAccessToken, scopeListHasPermission, selectRuntimeContextMessages, selectSpacePickerItems, setGrantedAppScopes, track, validateArchiveBoundary };