@neta-art/cohub 8.9.0 → 8.10.0

package/dist/chunks/environment.js

@@ -1,3 +1,56 @@
+//#region src/types.ts
+/**
+* The full permission vocabulary, mirrored from `@cohub/core` permissions.
+* Kept as a runtime constant so hosts can validate untrusted scopes from
+* app iframes — TypeScript unions cannot constrain cross-window messages.
+*/
+const PERMISSIONS = [
+	"space.view",
+	"space.edit",
+	"space.label.view",
+	"space.label.manage",
+	"space.label.assign",
+	"session.view",
+	"session.edit",
+	"session.prompt.readonly",
+	"session.prompt.fullaccess",
+	"generation.create",
+	"file.view",
+	"file.view.filtered",
+	"file.edit",
+	"checkpoint.view",
+	"checkpoint.edit",
+	"member.view",
+	"member.manage",
+	"references.view",
+	"channel.view",
+	"channel.manage",
+	"cronjob.view",
+	"cronjob.manage",
+	"taskrun.view",
+	"command.execute",
+	"sandbox.view",
+	"sandbox.manage",
+	"mod.view",
+	"mod.manage",
+	"space.commerce.view",
+	"space.commerce.manage",
+	"user.space.list",
+	"user.session.list",
+	"user.taskrun.list",
+	"user.usage.read"
+];
+/** A held permission that already covers the checked one. */
+const IMPLIED_PERMISSIONS = {
+	"session.prompt.readonly": ["session.prompt.fullaccess"],
+	"file.view.filtered": ["file.view"]
+};
+/** Implication-aware membership check, mirroring `@cohub/core`. */
+function scopeListHasPermission(scopes, permission) {
+	if (scopes.includes(permission)) return true;
+	return (IMPLIED_PERMISSIONS[permission] ?? []).some((implies) => scopes.includes(implies));
+}
+//#endregion
 //#region src/environment.ts
 const COHUB_ENVIRONMENTS = {
 	prod: {
@@ -17,17 +70,55 @@ const readProcessEnv = () => {
 const readRuntimeEnv = () => readProcessEnv()?.ENV;
 /** Existing scoped identity injected into Sandbox command processes. */
 const resolveExecutionToken = () => readProcessEnv()?.COHUB_EXECUTION_TOKEN?.trim() || null;
-function resolveExecutionAppId() {
-	const payload = resolveExecutionToken()?.split(".")[1];
-	if (!payload) return null;
+function decodeExecutionPayload() {
+	const encoded = resolveExecutionToken()?.split(".")[1];
+	if (!encoded) return null;
 	try {
-		const base64 = payload.replaceAll("-", "+").replaceAll("_", "/").padEnd(Math.ceil(payload.length / 4) * 4, "=");
-		const appId = JSON.parse(globalThis.atob(base64)).appId;
-		return typeof appId === "string" && appId ? appId : null;
+		const base64 = encoded.replaceAll("-", "+").replaceAll("_", "/").padEnd(Math.ceil(encoded.length / 4) * 4, "=");
+		const decoded = JSON.parse(globalThis.atob(base64));
+		return decoded && typeof decoded === "object" ? decoded : null;
 	} catch {
 		return null;
 	}
 }
+const readString = (env, key) => env?.[key]?.trim() || null;
+const readPayloadString = (payload, key) => typeof payload?.[key] === "string" && payload[key] ? payload[key] : null;
+const KNOWN_PERMISSIONS = new Set(PERMISSIONS);
+const readScopes = (payload) => Array.isArray(payload?.scopes) ? payload.scopes.filter((scope) => typeof scope === "string" && KNOWN_PERMISSIONS.has(scope)) : [];
+function getCohubContext() {
+	const env = readProcessEnv();
+	const token = resolveExecutionToken();
+	const isBrowser = typeof window !== "undefined" && typeof document !== "undefined";
+	const runtime = token || readString(env, "COHUB_SPACE_ID") ? "sandbox" : isBrowser ? "browser" : "local";
+	const payload = decodeExecutionPayload();
+	if (!token && runtime !== "sandbox") return {
+		runtime: { kind: runtime },
+		execution: null
+	};
+	return {
+		runtime: { kind: runtime },
+		execution: {
+			source: readPayloadString(payload, "source"),
+			actorUserId: readString(env, "COHUB_USER_UUID") ?? readPayloadString(payload, "actorUserId"),
+			viewerUserId: readPayloadString(payload, "viewerUserId"),
+			spaceId: readString(env, "COHUB_SPACE_ID") ?? readPayloadString(payload, "spaceId"),
+			sessionId: readString(env, "COHUB_SESSION_ID") ?? readPayloadString(payload, "sessionId"),
+			turnId: readString(env, "COHUB_TURN_ID") ?? readPayloadString(payload, "turnId"),
+			toolCallId: readString(env, "COHUB_TOOL_CALL_ID"),
+			sourceClientId: readString(env, "COHUB_SOURCE_CLIENT_ID"),
+			taskRunId: readPayloadString(payload, "taskRunId"),
+			appId: readPayloadString(payload, "appId"),
+			appVersionId: readPayloadString(payload, "appVersionId"),
+			action: readPayloadString(payload, "action"),
+			scopes: readScopes(payload),
+			modelProvider: readString(env, "COHUB_MODEL_PROVIDER"),
+			modelId: readString(env, "COHUB_MODEL_ID")
+		}
+	};
+}
+function resolveExecutionAppId() {
+	return readPayloadString(decodeExecutionPayload(), "appId");
+}
 const resolveCohubEnvironment = (env) => {
 	if (env) return env;
 	return readRuntimeEnv() === "dev" ? "dev" : "prod";
@@ -56,4 +147,4 @@ const resolveVoiceInputWebsocketUrl = (options = {}) => {
 	return COHUB_ENVIRONMENTS[resolveCohubEnvironment(options.env)].voiceInputWebsocketUrl;
 };
 //#endregion
-export { resolveApiBaseUrl as a, resolveExecutionToken as c, normalizeWebsocketUrl as i, resolveVoiceInputWebsocketUrl as l, normalizeBaseUrl as n, resolveCohubEnvironment as o, normalizeVoiceInputWebsocketUrl as r, resolveExecutionAppId as s, COHUB_ENVIRONMENTS as t, resolveWebsocketUrl as u };
+export { normalizeWebsocketUrl as a, resolveExecutionAppId as c, resolveWebsocketUrl as d, PERMISSIONS as f, normalizeVoiceInputWebsocketUrl as i, resolveExecutionToken as l, getCohubContext as n, resolveApiBaseUrl as o, scopeListHasPermission as p, normalizeBaseUrl as r, resolveCohubEnvironment as s, COHUB_ENVIRONMENTS as t, resolveVoiceInputWebsocketUrl as u };

package/dist/chunks/http.d.ts

@@ -1,5 +1,5 @@
-import { $ as CheckpointRecord, $n as SpaceEnvInput, $r as UserActivityResponse, $t as ReferenceAggregateGroupBy, Ar as SpaceModListItem, At as LabelResourceType, Bn as SpaceCommerceBuyerProfile, Bt as PatchResourceLabelsInput, Ca as NavigationLaunch, Cn as SessionTurnWindowResponse, Co as SessionTurnRecord, Cr as SpaceFsWriteFileInput, Da as BoardCapabilities, Do as TurnIntermediateMessagesFile, En as SkillCatalogResponse, Et as LabelItemsResponse, Fa as BoardPlaybackSnapshot, Fo as SpaceCompletionResult, Fr as SpacePublicProfile, Gn as SpaceCommerceProductBenefitBinding, Gt as PromptTemplateCatalogResponse, Ha as BoardAuthoringReadInput, Hr as SpaceTurnAuthorFilter, Ht as Permission, Io as SpaceCompletionStreamEvent, Ir as SpaceRecord, It as PaletteOverviewResponse, Ja as BoardSemanticMutation, Ji as BoardAwarenessUpdate, Jn as SpaceConfigInput, Jr as TaskRunDetailResponse, Jt as PublicUserPageResponse, Kr as SpaceUsageResponse, Kt as PublicReferral, La as BoardSummary, Lo as Usage, Lr as SpaceRole, Ma as BoardPlaybackCommand, Mi as BoardAwarenessUpdatedEvent$1, Mn as SpaceActivityResponse, Mr as SpacePendingDiffSummary, Ni as BoardChangedEvent$1, No as CreateSpaceCompletionInput, Nr as SpacePresenceSnapshot, Nt as MeResponse, Oa as BoardCreateInput, Or as SpaceMember, Ot as LabelListItem, Pi as BoardPlaybackChangedEvent$1, Pt as ModelCatalogEntry, Q as CheckpointDiffSummary, Qn as SpaceDefaultResponse, Rn as SpaceCheckpointDetailResponse, Ro as BillingPayload, Sa as NavigationCall, Sn as SessionTurnStreamSnapshotResponse, Sr as SpaceFsUploadResponse, Ti as GenerationModelDeclaration, To as StoredIntermediateMessage, Tr as SpaceInvitationListResponse, Tt as LabelAssignmentRecord, Ua as BoardAuthoringSnapshot, Un as SpaceCommerceOrder, Uo as RequestSource, Vr as SpaceSessionsResponse, Vt as PatchResourceLabelsResponse, W as Channel, Wi as SessionTurnPatchEvent, Wn as SpaceCommerceProduct, Xn as SpaceConfigUpdateResponse, Xr as UserActivityQuery, Yi as AppArtifactDescriptor, Yn as SpaceConfigResponse, Yr as TaskRunRecord, Zn as SpaceCreateResponse, _n as SessionMessagesResponse, _o as SpacePublicEndpoints, _t as GlobalSearchType, a as WebsocketClientOptions, at as CreateSpacePromptInput, bn as SessionTurnResponse, d as BatchUserProfilesResponse, da as DesktopCommand, dr as SpaceFsPreparingFile, dt as CursorPageInfo, ei as UserProfile, en as ReferenceAggregateResponse, er as SpaceFsCompleteUploadInput, et as ClaimReferralResponse, gn as SessionMessagesPaginatedResponse, ha as DesktopCommandStatus, hn as SessionMessageResponse, hr as SpaceFsTreeResponse, ht as GlobalSearchResponse, ii as UserSessionsResponse, in as ReferenceQueryableType, ir as SpaceFsCreateUploadResponse, ja as BoardMutationReceipt, jr as SpacePendingDiffFileResponse, kn as SpaceAccessPolicy, l as AcceptInvitationResponse, lr as SpaceFsFileResponse, lt as CronJobRecord, ma as DesktopCommandRecord, mr as SpaceFsReadFilesResponse, nn as ReferenceKind, nt as CreateInvitationResponse, oi as ChannelConfig, ot as CreateSpacePromptResponse, pa as DesktopCommandError, q as CheckpointDiffFileResponse, r as WebsocketClient, rn as ReferenceQueryResponse, rr as SpaceFsCreateUploadInput, rt as CreateSpaceInput, s as WebsocketEventPayload, si as ChannelHealth, sn as ReferralDashboard, st as CreateSpaceSessionInput, ta as AppContentKind, ti as UserRulesResponse, tn as ReferenceDirection, tr as SpaceFsCompleteUploadResponse, tt as CreateInvitationInput, ur as SpaceFsMoveInput, ut as CronJobUpdatePatch, vn as SessionRecord, vo as MessageRecord, wi as GenerationContentBlock, wn as SessionTurnsPaginatedResponse, wo as SpaceTurnsResponse, xn as SessionTurnSignedUrlsResponse, xo as MessageToolCallsFile, yn as SessionTurnIndexResponse, yo as SessionForkRecord, yt as InvitationDetail, zi as RealtimePatchOperation, zn as SpaceCommerceBenefit, zo as ContentBlock } from "./websocket.js";
-import { n as CohubEnvironment } from "./environment.js";
+import { $r as SpaceUsageResponse, $t as PublicReferral, Aa as BoardAuthoringReadInput, An as SessionTurnWindowResponse, Ao as MessageToolCallsFile, Ar as SpaceFsWriteFileInput, Br as SpacePresenceSnapshot, Bt as MeResponse, Ca as BoardPlaybackSnapshot, Cn as SessionMessagesPaginatedResponse, Di as SessionTurnPatchEvent, Dn as SessionTurnResponse, Do as MessageRecord, En as SessionTurnIndexResponse, Et as InvitationDetail, Fr as SpaceMember, Ft as LabelListItem, Gn as SpaceCheckpointDetailResponse, Go as SpaceCompletionStreamEvent, Ho as CreateSpaceCompletionInput, Hr as SpacePublicProfile, Ia as BoardSemanticMutation, In as SpaceAccessPolicy, Io as TurnIntermediateMessagesFile, Ji as DesktopCommandStatus, Jr as SpaceSessionsResponse, Jt as PatchResourceLabelsResponse, Ki as DesktopCommandError, Kn as SpaceCommerceBenefit, Ko as Usage, Lr as SpaceModListItem, Lt as LabelResourceType, Mo as SessionTurnRecord, Mr as SpaceInvitationListResponse, Mt as LabelAssignmentRecord, Nn as SkillCatalogResponse, No as SpaceTurnsResponse, Nt as LabelItemsResponse, Oi as AppArtifactDescriptor, On as SessionTurnSignedUrlsResponse, Oo as SessionForkRecord, Pi as AppContentKind, Po as StoredIntermediateMessage, Qn as SpaceCommerceProductBenefitBinding, Qt as PromptTemplateCatalogResponse, Rr as SpacePendingDiffFileResponse, Sn as SessionMessageResponse, So as ChannelHealth, Sr as SpaceFsTreeResponse, St as GlobalSearchResponse, Ta as BoardSummary, Tn as SessionRecord, Ur as SpaceRecord, Ut as PaletteOverviewResponse, Vt as ModelCatalogEntry, Wi as DesktopCommand, Wo as SpaceCompletionResult, Wr as SpaceRole, Xn as SpaceCommerceOrder, Yr as SpaceTurnAuthorFilter, Yt as Permission, Z as Channel, Zn as SpaceCommerceProduct, Zo as RequestSource, _o as BillingPayload, _r as SpaceFsMoveInput, _t as CronJobUpdatePatch, ar as SpaceDefaultResponse, at as CheckpointDiffSummary, ba as BoardPlaybackCommand, ci as UserRulesResponse, cn as ReferenceDirection, cr as SpaceFsCompleteUploadResponse, ct as CreateInvitationInput, di as UserSessionsResponse, dn as ReferenceQueryableType, dr as SpaceFsCreateUploadResponse, et as CheckpointDiffFileResponse, ft as CreateSpacePromptInput, g as AcceptInvitationResponse, ga as BoardCreateInput, gi as BoardPlaybackChangedEvent$1, gr as SpaceFsFileResponse, gt as CronJobRecord, ha as BoardCapabilities, hi as BoardChangedEvent$1, ir as SpaceCreateResponse, ja as BoardAuthoringSnapshot, jn as SessionTurnsPaginatedResponse, kn as SessionTurnStreamSnapshotResponse, kr as SpaceFsUploadResponse, ln as ReferenceKind, lt as CreateInvitationResponse, mi as BoardAwarenessUpdatedEvent$1, mn as ReferralDashboard, mt as CreateSpaceSessionInput, na as NavigationLaunch, ni as TaskRunRecord, nr as SpaceConfigResponse, oi as UserActivityResponse, on as ReferenceAggregateGroupBy, or as SpaceEnvInput, ot as CheckpointRecord, pt as CreateSpacePromptResponse, qi as DesktopCommandRecord, qn as SpaceCommerceBuyerProfile, qo as ContentBlock, qt as PatchResourceLabelsInput, r as CohubEnvironment, ra as SpacePublicEndpoints, ri as UserActivityQuery, rr as SpaceConfigUpdateResponse, sa as BoardAwarenessUpdate, si as UserProfile, sn as ReferenceAggregateResponse, sr as SpaceFsCompleteUploadInput, st as ClaimReferralResponse, ta as NavigationCall, ti as TaskRunDetailResponse, tn as PublicUserPageResponse, tr as SpaceConfigInput, un as ReferenceQueryResponse, ur as SpaceFsCreateUploadInput, ut as CreateSpaceInput, v as BatchUserProfilesResponse, vo as GenerationContentBlock, vr as SpaceFsPreparingFile, vt as CursorPageInfo, wn as SessionMessagesResponse, wt as GlobalSearchType, xi as RealtimePatchOperation, xo as ChannelConfig, xr as SpaceFsReadFilesResponse, ya as BoardMutationReceipt, yo as GenerationModelDeclaration, zn as SpaceActivityResponse, zr as SpacePendingDiffSummary } from "./environment.js";
+import { a as WebsocketClientOptions, r as WebsocketClient, s as WebsocketEventPayload } from "./websocket.js";
 import { a as VoiceInputCreateOptions } from "./voice-input.js";
 //#region ../protocol/dist/model/status.d.ts
 /** Per-model availability status, derived from observed traffic with probe fallback. */
@@ -720,7 +720,7 @@ declare class SkillsApi {
 }
 //#endregion
 //#region src/apis/public-assets.d.ts
-type PublicAssetPurpose = "user_avatar" | "space_avatar" | "chat_attachment";
+type PublicAssetPurpose = "user_avatar" | "space_avatar" | "chat_attachment" | "app_source";
 type PublicAssetUploadProtocol = "presigned_put_v1";
 /** Preprocessed chat images. General chat files and avatars may use any mime string. */
 type PublicAssetMimeType = "image/webp" | "image/jpeg";
@@ -762,6 +762,7 @@ type PublicAssetUploadProgress = {
   totalBytes: number;
   ratio: number;
 };
+type UploadAppSourceInput = UploadChatAttachmentInput;
 type UploadChatAttachmentInput = {
   /** Optional association only; upload is user-scoped. */
   spaceId?: string;
@@ -785,6 +786,7 @@ declare class PublicAssetsApi {
   }): Promise<CreatePublicAssetUploadResponse>;
   upload(input: UploadPublicAssetInput): Promise<PublicAssetUploadBase>;
   /** Durable public upload for any chat attachment (image or file). No space required. */
+  uploadAppSource(input: UploadAppSourceInput): Promise<PublicAssetUploadBase>;
   uploadChatAttachment(input: UploadChatAttachmentInput): Promise<PublicAssetUploadBase>;
   /** Preprocessed chat image (webp/jpeg). Same durable path as uploadChatAttachment. */
   uploadChatImageAttachment(input: UploadChatImageAttachmentInput): Promise<PublicAssetUploadBase>;
@@ -1811,10 +1813,19 @@ declare class SpaceClient {
 }
 //#endregion
 //#region src/apis/tasks.d.ts
+type TaskWaitOptions = {
+  timeoutMs?: number;
+  pollIntervalMs?: number;
+  signal?: AbortSignal;
+};
 declare class TasksApi {
   private readonly transport;
-  constructor(transport: HttpTransport);
-  get(taskRunId: string): Promise<TaskRunDetailResponse>;
+  private readonly websocketClient;
+  constructor(transport: HttpTransport, websocketClient?: WebsocketClient | null);
+  get(taskRunId: string, options?: {
+    signal?: AbortSignal;
+  }): Promise<TaskRunDetailResponse>;
+  wait(taskRunId: string, options?: TaskWaitOptions): Promise<TaskRunRecord>;
   getMany(taskRunIds: string[], options?: {
     spaceId?: string;
   }): Promise<{
@@ -2451,4 +2462,4 @@ declare class CohubHttpClient {
 }
 declare const createHttpClient: (options?: CohubClientOptions) => CohubHttpClient;
 //#endregion
-export { AppTargetType as $, matchesUnauthorizedErrorToken as $n, BuildSpaceInvitePathInput as $t, WaitForUiCommandOptions as A, CreatePublicAssetUploadResponse as An, SpaceStartupResponse as Ar, WorkVersionRecord as At, AppPresentationMeta as B, PromptsApi as Bn, BoardClient as Bt, DesktopCommandsApi as C, SessionPatchStatus as Cn, PublicFileCreateUploadInput as Cr, WorkPublicSpaceRecord as Ct, UiCommandStatus as D, ReferencesApi as Dn, PublicFileUploadEntryInput as Dr, WorkStatus as Dt, UiCommandRecord as E, ReferenceResourceSelector as En, PublicFileListResponse as Er, WorkSessionResponse as Et, AppCreateInput as F, PublicAssetsApi as Fn, ListGenerationModelsResponse as Fr, UsersApi as Ft, AppPromotionRecord as G, CohubClientOptions as Gn, SessionSubscriptionHandlers as Gt, AppPromotionEventResponse as H, GenerationsApi as Hn, BoardPlaybackChangedEvent as Ht, AppDetailResponse as I, UploadChatAttachmentInput as In, PublicGenerationDeclaration as Ir, UserApi as It, AppPublicSpaceRecord as J, HttpTraceContext as Jn, SpaceEventName as Jt, AppPromotionStatsResponse as K, Fetch as Kn, SpaceChannelBindingRecord as Kt, AppExtractedPageMeta as L, UploadChatImageAttachmentInput as Ln, ModelStatusEntry as Lr, TasksApi as Lt, AppAuthorizeResponse as M, PublicAssetPurpose as Mn, CreateGenerationTaskResponse as Mr, WorkViewStatsResponse as Mt, AppContent as N, PublicAssetUploadProgress as Nn, GenerationTaskResult as Nr, WorkVisibility as Nt, UiCommandsApi as O, SearchApi as On, PublicFileUploadPlanEntry as Or, WorkTargetType as Ot, AppContentDownload as P, PublicAssetUploadProtocol as Pn, GenerationUsageBilling as Pr, ReferralsApi as Pt, AppStatus as Q, joinApiUrl as Qn, WebSocketConnectionState as Qt, AppGetResponse as R, UploadPublicAssetInput as Rn, ModelStatusResponse as Rr, BoardAwarenessUpdatedEvent as Rt, CreateUiCommandInput as S, SessionPatchState as Sn, AppNavigationTarget as Sr, WorkPublicOwnerRecord as St, UiCommandError as T, SessionAccessApi as Tn, PublicFileListEntry as Tr, WorkResolveResponse as Tt, AppPromotionProvider as U, CronJobsApi as Un, BoardSubscriptionHandlers as Ut, AppPromotionCreateInput as V, ModelsApi as Vn, BoardEventName as Vt, AppPromotionProviderStatus as W, ChannelsApi as Wn, SessionEventName as Wt, AppResolveResponse as X, RawHttpResponse as Xn, SpaceTurnListOptions as Xt, AppRecord as Y, HttpTransport as Yn, SpacePublicFilesApi as Yt, AppSessionResponse as Z, UnauthorizedContext as Zn, SpacesApi as Zt, WorkCommerceEntitlementsResponse as _, createSessionGenerationStreamClient as _n, resolveAppTransport as _r, WorkPromotionEventResponse as _t, AppCommerceCreditConsumeResponse as a, GenerationStreamCommitEvent as an, AppRuntimeCheckoutState as ar, AppVisibility as at, WorkCommercePurchaseResponse as b, SessionPatchApplyResult as bn, AppNavigationOpenMessage as br, WorkPromotionRecord as bt, AppCommerceEntitlementsResponse as c, GenerationStreamFinalizedEvent as cn, AppRuntimeInvocationContext as cr, WorkContent as ct, AppCommercePurchaseResponse as d, GenerationStreamOutOfSyncEvent as dn, AppRuntimeShellContext as dr, WorkDetailResponse as dt, BuildSpacePathInput as en, sanitizeAccessToken as er, AppUpdateInput as et, WorkCommerceApi as f, GenerationStreamStateEvent as fn, AppRuntimeTransport as fr, WorkExtractedPageMeta as ft, WorkCommerceEntitlement as g, SessionGenerationStreamClient as gn, createSlugAppIdResolver as gr, WorkPromotionCreateInput as gt, WorkCommerceCreditConsumeStatus as h, GenerationStreamTurnUpdatedEvent as hn, createAppRuntime as hr, WorkPresentationMeta as ht, AppCommerceCheckoutStatus as i, AssistantMessageCommit as in, AppRuntimeAuthorizationResult as ir, AppViewerGrantRecord as it, AppActionRunResponse as j, PublicAssetMimeType as jn, CreateGenerationTaskRequest as jr, WorkViewSource as jt, WaitForDesktopCommandOptions as k, CreatePublicAssetUploadInput as kn, PublicFileUrlResponse as kr, WorkUpdateInput as kt, AppCommerceOrder as l, GenerationStreamIntermediateMessage as ln, AppRuntimeModeConfig as lr, WorkContentDownload as lt, WorkCommerceCreditConsumeResponse as m, GenerationStreamSubscriptionHandlers as mn, PopupBrokerTransport as mr, WorkMeta as mt, createHttpClient as n, buildSpaceInvitePath as nn, AppIdResolver as nr, AppViewSource as nt, AppCommerceCreditConsumeStatus as o, GenerationStreamErrorEvent as on, AppRuntimeCheckoutStatus as or, AppsApi as ot, WorkCommerceCheckoutStatus as p, GenerationStreamSubscribeOptions as pn, ParentBridgeTransport as pr, WorkGetResponse as pt, AppPublicOwnerRecord as q, HttpError as qn, SpaceClient as qt, AppCommerceApi as r, buildSpacePath as rn, AppRuntimeApi as rr, AppViewStatsResponse as rt, AppCommerceEntitlement as s, GenerationStreamEvent as sn, AppRuntimeContext as sr, WorkAuthorizeResponse as st, CohubHttpClient as t, PublicInviteApi as tn, AppContextChangedListener as tr, AppVersionRecord as tt, AppCommerceProductResolveResponse as u, GenerationStreamLifecycleEvent as un, AppRuntimeRequestOptions as ur, WorkCreateInput as ut, WorkCommerceOrder as v, parseAssistantMessageCommit as vn, AppNavigationCall as vr, WorkPromotionProvider as vt, UiCommand as w, createSessionPatchReducer as wn, PublicFileCreateUploadResponse as wr, WorkRecord as wt, CreateDesktopCommandInput as x, SessionPatchReducer as xn, AppNavigationOpenResponse as xr, WorkPromotionStatsResponse as xt, WorkCommerceProductResolveResponse as y, SessionPatchApplyInput as yn, AppNavigationLaunch as yr, WorkPromotionProviderStatus as yt, AppMeta as z, SkillsApi as zn, BoardChangedEvent as zt };
+export { AppTargetType as $, UnauthorizedContext as $n, WebSocketConnectionState as $t, WaitForUiCommandOptions as A, CreatePublicAssetUploadInput as An, PublicFileUploadPlanEntry as Ar, WorkVersionRecord as At, AppPresentationMeta as B, UploadPublicAssetInput as Bn, ModelStatusResponse as Br, BoardChangedEvent as Bt, DesktopCommandsApi as C, SessionPatchState as Cn, AppNavigationOpenResponse as Cr, WorkPublicSpaceRecord as Ct, UiCommandStatus as D, ReferenceResourceSelector as Dn, PublicFileListEntry as Dr, WorkStatus as Dt, UiCommandRecord as E, SessionAccessApi as En, PublicFileCreateUploadResponse as Er, WorkSessionResponse as Et, AppCreateInput as F, PublicAssetUploadProtocol as Fn, GenerationTaskResult as Fr, UsersApi as Ft, AppPromotionRecord as G, CronJobsApi as Gn, SessionEventName as Gt, AppPromotionEventResponse as H, PromptsApi as Hn, BoardEventName as Ht, AppDetailResponse as I, PublicAssetsApi as In, GenerationUsageBilling as Ir, UserApi as It, AppPublicSpaceRecord as J, Fetch as Jn, SpaceClient as Jt, AppPromotionStatsResponse as K, ChannelsApi as Kn, SessionSubscriptionHandlers as Kt, AppExtractedPageMeta as L, UploadAppSourceInput as Ln, ListGenerationModelsResponse as Lr, TaskWaitOptions as Lt, AppAuthorizeResponse as M, PublicAssetMimeType as Mn, SpaceStartupResponse as Mr, WorkViewStatsResponse as Mt, AppContent as N, PublicAssetPurpose as Nn, CreateGenerationTaskRequest as Nr, WorkVisibility as Nt, UiCommandsApi as O, ReferencesApi as On, PublicFileListResponse as Or, WorkTargetType as Ot, AppContentDownload as P, PublicAssetUploadProgress as Pn, CreateGenerationTaskResponse as Pr, ReferralsApi as Pt, AppStatus as Q, RawHttpResponse as Qn, SpacesApi as Qt, AppGetResponse as R, UploadChatAttachmentInput as Rn, PublicGenerationDeclaration as Rr, TasksApi as Rt, CreateUiCommandInput as S, SessionPatchReducer as Sn, AppNavigationOpenMessage as Sr, WorkPublicOwnerRecord as St, UiCommandError as T, createSessionPatchReducer as Tn, PublicFileCreateUploadInput as Tr, WorkResolveResponse as Tt, AppPromotionProvider as U, ModelsApi as Un, BoardPlaybackChangedEvent as Ut, AppPromotionCreateInput as V, SkillsApi as Vn, BoardClient as Vt, AppPromotionProviderStatus as W, GenerationsApi as Wn, BoardSubscriptionHandlers as Wt, AppResolveResponse as X, HttpTraceContext as Xn, SpacePublicFilesApi as Xt, AppRecord as Y, HttpError as Yn, SpaceEventName as Yt, AppSessionResponse as Z, HttpTransport as Zn, SpaceTurnListOptions as Zt, WorkCommerceEntitlementsResponse as _, SessionGenerationStreamClient as _n, createAppRuntime as _r, WorkPromotionEventResponse as _t, AppCommerceCreditConsumeResponse as a, AssistantMessageCommit as an, AppRuntimeApi as ar, AppVisibility as at, WorkCommercePurchaseResponse as b, SessionPatchApplyInput as bn, AppNavigationCall as br, WorkPromotionRecord as bt, AppCommerceEntitlementsResponse as c, GenerationStreamEvent as cn, AppRuntimeCheckoutStatus as cr, WorkContent as ct, AppCommercePurchaseResponse as d, GenerationStreamLifecycleEvent as dn, AppRuntimeModeConfig as dr, WorkDetailResponse as dt, BuildSpaceInvitePathInput as en, joinApiUrl as er, AppUpdateInput as et, WorkCommerceApi as f, GenerationStreamOutOfSyncEvent as fn, AppRuntimeRequestOptions as fr, WorkExtractedPageMeta as ft, WorkCommerceEntitlement as g, GenerationStreamTurnUpdatedEvent as gn, PopupBrokerTransport as gr, WorkPromotionCreateInput as gt, WorkCommerceCreditConsumeStatus as h, GenerationStreamSubscriptionHandlers as hn, ParentBridgeTransport as hr, WorkPresentationMeta as ht, AppCommerceCheckoutStatus as i, buildSpacePath as in, AppIdResolver as ir, AppViewerGrantRecord as it, AppActionRunResponse as j, CreatePublicAssetUploadResponse as jn, PublicFileUrlResponse as jr, WorkViewSource as jt, WaitForDesktopCommandOptions as k, SearchApi as kn, PublicFileUploadEntryInput as kr, WorkUpdateInput as kt, AppCommerceOrder as l, GenerationStreamFinalizedEvent as ln, AppRuntimeContext as lr, WorkContentDownload as lt, WorkCommerceCreditConsumeResponse as m, GenerationStreamSubscribeOptions as mn, AppRuntimeTransport as mr, WorkMeta as mt, createHttpClient as n, PublicInviteApi as nn, sanitizeAccessToken as nr, AppViewSource as nt, AppCommerceCreditConsumeStatus as o, GenerationStreamCommitEvent as on, AppRuntimeAuthorizationResult as or, AppsApi as ot, WorkCommerceCheckoutStatus as p, GenerationStreamStateEvent as pn, AppRuntimeShellContext as pr, WorkGetResponse as pt, AppPublicOwnerRecord as q, CohubClientOptions as qn, SpaceChannelBindingRecord as qt, AppCommerceApi as r, buildSpaceInvitePath as rn, AppContextChangedListener as rr, AppViewStatsResponse as rt, AppCommerceEntitlement as s, GenerationStreamErrorEvent as sn, AppRuntimeCheckoutState as sr, WorkAuthorizeResponse as st, CohubHttpClient as t, BuildSpacePathInput as tn, matchesUnauthorizedErrorToken as tr, AppVersionRecord as tt, AppCommerceProductResolveResponse as u, GenerationStreamIntermediateMessage as un, AppRuntimeInvocationContext as ur, WorkCreateInput as ut, WorkCommerceOrder as v, createSessionGenerationStreamClient as vn, createSlugAppIdResolver as vr, WorkPromotionProvider as vt, UiCommand as w, SessionPatchStatus as wn, AppNavigationTarget as wr, WorkRecord as wt, CreateDesktopCommandInput as x, SessionPatchApplyResult as xn, AppNavigationLaunch as xr, WorkPromotionStatsResponse as xt, WorkCommerceProductResolveResponse as y, parseAssistantMessageCommit as yn, resolveAppTransport as yr, WorkPromotionProviderStatus as yt, AppMeta as z, UploadChatImageAttachmentInput as zn, ModelStatusEntry as zr, BoardAwarenessUpdatedEvent as zt };

package/dist/chunks/http.js

@@ -1,5 +1,5 @@
 import { D as getRealtimeSpaceRoom, E as getRealtimeBoardRoom, n as HttpTransport, t as HttpError, y as isUuid } from "./transport.js";
-import { a as resolveApiBaseUrl, c as resolveExecutionToken } from "./environment.js";
+import { l as resolveExecutionToken, o as resolveApiBaseUrl } from "./environment.js";
 import { z } from "zod";
 //#region src/apis/channels.ts
 var ChannelsApi = class {
@@ -319,6 +319,18 @@ var PublicAssetsApi = class {
 		return plan.asset;
 	}
 	/** Durable public upload for any chat attachment (image or file). No space required. */
+	uploadAppSource(input) {
+		return this.upload({
+			purpose: "app_source",
+			spaceId: input.spaceId,
+			sessionId: input.sessionId,
+			file: input.file,
+			mimeType: input.mimeType,
+			filename: input.filename,
+			onProgress: input.onProgress,
+			signal: input.signal
+		});
+	}
 	uploadChatAttachment(input) {
 		return this.upload({
 			purpose: "chat_attachment",
@@ -3651,11 +3663,9 @@ var SpaceBoardsApi = class {
 		});
 	}
 	authoring(boardId, input = {}, customFetch) {
+		if (input.include?.length === 0) throw new Error("Board authoring include must not be empty.");
 		const params = new URLSearchParams();
-		if (input.include) {
-			for (const section of input.include) params.append("include", section);
-			if (input.include.length === 0) params.set("include", "");
-		}
+		for (const section of input.include ?? []) params.append("include", section);
 		if (input.itemIds?.length) params.set("itemIds", input.itemIds.join(","));
 		if (input.connectionIds?.length) params.set("connectionIds", input.connectionIds.join(","));
 		if (input.effectIds?.length) params.set("effectIds", input.effectIds.join(","));
@@ -4049,13 +4059,118 @@ var SpaceClient = class {
 };
 //#endregion
 //#region src/apis/tasks.ts
+const isTerminal = (status) => status === "completed" || status === "failed";
+const MAX_WAIT_TIMEOUT_MS = 864e5;
+const MIN_POLL_INTERVAL_MS = 100;
+function validateWaitNumber(name, value, max) {
+	if (!Number.isFinite(value) || value <= 0 || max !== void 0 && value > max) {
+		const suffix = max === void 0 ? "greater than 0" : `greater than 0 and at most ${max}ms`;
+		throw new RangeError(`${name} must be ${suffix}.`);
+	}
+}
 var TasksApi = class {
 	transport;
-	constructor(transport) {
+	websocketClient;
+	constructor(transport, websocketClient = null) {
 		this.transport = transport;
+		this.websocketClient = websocketClient;
+	}
+	get(taskRunId, options) {
+		return this.transport.request(`/api/tasks/${taskRunId}`, { signal: options?.signal });
 	}
-	get(taskRunId) {
-		return this.transport.request(`/api/tasks/${taskRunId}`);
+	async wait(taskRunId, options = {}) {
+		if (options.signal?.aborted) throw new DOMException("The task wait was aborted.", "AbortError");
+		const timeoutMs = options.timeoutMs ?? 12e4;
+		const pollIntervalMs = options.pollIntervalMs ?? 2e3;
+		validateWaitNumber("timeoutMs", timeoutMs, MAX_WAIT_TIMEOUT_MS);
+		validateWaitNumber("pollIntervalMs", pollIntervalMs);
+		if (pollIntervalMs < MIN_POLL_INTERVAL_MS) throw new RangeError(`pollIntervalMs must be at least ${MIN_POLL_INTERVAL_MS}ms.`);
+		const deadline = Date.now() + timeoutMs;
+		const controller = new AbortController();
+		let timedOut = false;
+		let onTimeout = null;
+		const abortFromCaller = () => controller.abort();
+		const timeoutTimer = setTimeout(() => {
+			timedOut = true;
+			controller.abort();
+			onTimeout?.();
+		}, timeoutMs);
+		options.signal?.addEventListener("abort", abortFromCaller, { once: true });
+		let initial;
+		try {
+			initial = await this.get(taskRunId, { signal: controller.signal });
+		} catch (error) {
+			clearTimeout(timeoutTimer);
+			options.signal?.removeEventListener("abort", abortFromCaller);
+			if (timedOut) throw new Error(`Timed out waiting for task ${taskRunId}.`);
+			if (options.signal?.aborted) throw new DOMException("The task wait was aborted.", "AbortError");
+			throw error;
+		}
+		if (isTerminal(initial.run.status)) {
+			clearTimeout(timeoutTimer);
+			options.signal?.removeEventListener("abort", abortFromCaller);
+			return initial.run;
+		}
+		if (options.signal?.aborted) {
+			clearTimeout(timeoutTimer);
+			options.signal?.removeEventListener("abort", abortFromCaller);
+			throw new DOMException("The task wait was aborted.", "AbortError");
+		}
+		const spaceId = initial.run.spaceId;
+		return new Promise((resolve, reject) => {
+			let settled = false;
+			let pollTimer = null;
+			let releaseRoom = null;
+			let unsubscribe = null;
+			let inspectInFlight = false;
+			const cleanup = () => {
+				if (pollTimer) clearTimeout(pollTimer);
+				clearTimeout(timeoutTimer);
+				onTimeout = null;
+				options.signal?.removeEventListener("abort", abortFromCaller);
+				options.signal?.removeEventListener("abort", onAbort);
+				unsubscribe?.();
+				releaseRoom?.();
+			};
+			const finish = (callback) => {
+				if (settled) return;
+				settled = true;
+				cleanup();
+				callback();
+			};
+			const inspect = async () => {
+				if (settled || inspectInFlight) return;
+				inspectInFlight = true;
+				try {
+					const detail = await this.get(taskRunId, { signal: controller.signal });
+					if (isTerminal(detail.run.status)) {
+						finish(() => resolve(detail.run));
+						return;
+					}
+					if (!settled) pollTimer = setTimeout(inspect, Math.max(0, Math.min(pollIntervalMs, deadline - Date.now())));
+				} catch (error) {
+					if (timedOut) finish(() => reject(/* @__PURE__ */ new Error(`Timed out waiting for task ${taskRunId}.`)));
+					else if (options.signal?.aborted) finish(() => reject(new DOMException("The task wait was aborted.", "AbortError")));
+					else finish(() => reject(error));
+				} finally {
+					inspectInFlight = false;
+				}
+			};
+			const onEvent = (event) => {
+				if (event.type !== "task.updated") return;
+				if (event.payload.task?.id !== taskRunId) return;
+				inspect();
+			};
+			const onAbort = () => finish(() => reject(new DOMException("The task wait was aborted.", "AbortError")));
+			onTimeout = () => finish(() => reject(/* @__PURE__ */ new Error(`Timed out waiting for task ${taskRunId}.`)));
+			options.signal?.addEventListener("abort", onAbort, { once: true });
+			pollTimer = setTimeout(inspect, Math.max(0, Math.min(pollIntervalMs, deadline - Date.now())));
+			if (this.websocketClient && spaceId) {
+				ensureRealtimeConnected(this.websocketClient);
+				releaseRoom = this.websocketClient.retainRooms([getRealtimeSpaceRoom(spaceId)]);
+				unsubscribe = this.websocketClient.on("event", onEvent);
+			}
+		});
 	}
 	getMany(taskRunIds, options) {
 		const ids = [...new Set(taskRunIds.filter(Boolean))];
@@ -4433,59 +4548,6 @@ var AppCommerceApi = class {
 /** @deprecated Use `AppCommerceApi`. */
 var WorkCommerceApi = class extends AppCommerceApi {};
 //#endregion
-//#region src/types.ts
-/**
-* The full permission vocabulary, mirrored from `@cohub/core` permissions.
-* Kept as a runtime constant so hosts can validate untrusted scopes from
-* app iframes — TypeScript unions cannot constrain cross-window messages.
-*/
-const PERMISSIONS = [
-	"space.view",
-	"space.edit",
-	"space.label.view",
-	"space.label.manage",
-	"space.label.assign",
-	"session.view",
-	"session.edit",
-	"session.prompt.readonly",
-	"session.prompt.fullaccess",
-	"generation.create",
-	"file.view",
-	"file.view.filtered",
-	"file.edit",
-	"checkpoint.view",
-	"checkpoint.edit",
-	"member.view",
-	"member.manage",
-	"references.view",
-	"channel.view",
-	"channel.manage",
-	"cronjob.view",
-	"cronjob.manage",
-	"taskrun.view",
-	"command.execute",
-	"sandbox.view",
-	"sandbox.manage",
-	"mod.view",
-	"mod.manage",
-	"space.commerce.view",
-	"space.commerce.manage",
-	"user.space.list",
-	"user.session.list",
-	"user.taskrun.list",
-	"user.usage.read"
-];
-/** A held permission that already covers the checked one. */
-const IMPLIED_PERMISSIONS = {
-	"session.prompt.readonly": ["session.prompt.fullaccess"],
-	"file.view.filtered": ["file.view"]
-};
-/** Implication-aware membership check, mirroring `@cohub/core`. */
-function scopeListHasPermission(scopes, permission) {
-	if (scopes.includes(permission)) return true;
-	return (IMPLIED_PERMISSIONS[permission] ?? []).some((implies) => scopes.includes(implies));
-}
-//#endregion
 //#region src/http.ts
 var CohubHttpClient = class {
 	spaces;
@@ -4554,4 +4616,4 @@ var CohubHttpClient = class {
 };
 const createHttpClient = (options) => new CohubHttpClient(options);
 //#endregion
-export { BoardConnectionSchema as $, DESKTOP_COMMAND_PENDING_TTL_SECONDS as A, BoardItemPatchSchema as B, parseAssistantMessageCommit as C, DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS as D, ensureRealtimeConnected as E, isTerminalDesktopCommandStatus as F, parseBoardEffectInput as G, BoardSemanticMutationSchema as H, parseDesktopCommand as I, BoardCompositionInputSchema as J, BOARD_ANIMATION_CHANNELS as K, parseDesktopCommandId as L, DESKTOP_COMMAND_TERMINAL_TTL_SECONDS as M, DESKTOP_COMMAND_VERSION as N, DESKTOP_COMMAND_MAX_TIMEOUT_MS as O, isDesktopCallMethod as P, parseBoardCompositionInput as Q, NAVIGATION_ERROR_MESSAGE_MAX_LENGTH as R, createSessionGenerationStreamClient as S, createSessionPatchReducer as T, BoardEffectInputSchema as U, BoardSemanticCommandSchema as V, BoardEffectSchema as W, BoardProceduralClipSchema as X, BoardCompositionSchema as Y, BoardTrackSchema as Z, SpacesApi as _, AppCommerceApi as a, SessionAccessApi as at, buildSpacePath as b, UiCommandsApi as c, PublicAssetsApi as ct, UsersApi as d, ModelsApi as dt, BOARD_ARROW_STROKE_SIZE as et, UserApi as f, GenerationsApi as ft, SpacePublicFilesApi as g, SpaceClient as h, scopeListHasPermission as i, DEFAULT_BOARD_RENDER_LIMITS as it, DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS as j, DESKTOP_COMMAND_PAYLOAD_MAX_BYTES as k, AppsApi as l, SkillsApi as lt, BoardClient as m, ChannelsApi as mt, createHttpClient as n, BOARD_BUILTIN_CLIP_KINDS as nt, WorkCommerceApi as o, ReferencesApi as ot, TasksApi as p, CronJobsApi as pt, BOARD_ANIMATION_CHANNEL_CAPABILITIES as q, PERMISSIONS as r, BOARD_BUILTIN_EFFECT_KINDS as rt, DesktopCommandsApi as s, SearchApi as st, CohubHttpClient as t, BOARD_BUILTIN_CAPABILITIES as tt, ReferralsApi as u, PromptsApi as ut, PublicInviteApi as v, SessionPatchReducer as w, SessionGenerationStreamClient as x, buildSpaceInvitePath as y, BoardAuthoringItemSchema as z };
+export { BOARD_BUILTIN_CAPABILITIES as $, DESKTOP_COMMAND_TERMINAL_TTL_SECONDS as A, BoardSemanticMutationSchema as B, createSessionPatchReducer as C, DESKTOP_COMMAND_PAYLOAD_MAX_BYTES as D, DESKTOP_COMMAND_MAX_TIMEOUT_MS as E, parseDesktopCommandId as F, BOARD_ANIMATION_CHANNEL_CAPABILITIES as G, BoardEffectSchema as H, NAVIGATION_ERROR_MESSAGE_MAX_LENGTH as I, BoardProceduralClipSchema as J, BoardCompositionInputSchema as K, BoardAuthoringItemSchema as L, isDesktopCallMethod as M, isTerminalDesktopCommandStatus as N, DESKTOP_COMMAND_PENDING_TTL_SECONDS as O, parseDesktopCommand as P, BOARD_ARROW_STROKE_SIZE as Q, BoardItemPatchSchema as R, SessionPatchReducer as S, DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS as T, parseBoardEffectInput as U, BoardEffectInputSchema as V, BOARD_ANIMATION_CHANNELS as W, parseBoardCompositionInput as X, BoardTrackSchema as Y, BoardConnectionSchema as Z, buildSpaceInvitePath as _, DesktopCommandsApi as a, SearchApi as at, createSessionGenerationStreamClient as b, ReferralsApi as c, PromptsApi as ct, TasksApi as d, CronJobsApi as dt, BOARD_BUILTIN_CLIP_KINDS as et, BoardClient as f, ChannelsApi as ft, PublicInviteApi as g, SpacesApi as h, WorkCommerceApi as i, ReferencesApi as it, DESKTOP_COMMAND_VERSION as j, DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS as k, UsersApi as l, ModelsApi as lt, SpacePublicFilesApi as m, createHttpClient as n, DEFAULT_BOARD_RENDER_LIMITS as nt, UiCommandsApi as o, PublicAssetsApi as ot, SpaceClient as p, BoardCompositionSchema as q, AppCommerceApi as r, SessionAccessApi as rt, AppsApi as s, SkillsApi as st, CohubHttpClient as t, BOARD_BUILTIN_EFFECT_KINDS as tt, UserApi as u, GenerationsApi as ut, buildSpacePath as v, ensureRealtimeConnected as w, parseAssistantMessageCommit as x, SessionGenerationStreamClient as y, BoardSemanticCommandSchema as z };

package/dist/chunks/transport.js

@@ -1,4 +1,4 @@
-import { a as resolveApiBaseUrl } from "./environment.js";
+import { o as resolveApiBaseUrl } from "./environment.js";
 //#region ../protocol/dist/realtime/types.js
 const WS_COMPACT_STREAM_CAPABILITY = "session.compact_stream.v1";
 const WS_ROOM_SUBSCRIPTION_CAPABILITY = "realtime.rooms.v1";

package/dist/chunks/voice-input.d.ts

@@ -1,4 +1,4 @@
-import { n as CohubEnvironment } from "./environment.js";
+import { r as CohubEnvironment } from "./environment.js";
 //#region src/voice-input.d.ts
 type VoiceInputEvent = {
   type: string;