fix: base64url safe

* feat(issues): add apply changes workflow for parameter updater

* chore(issues): remove my wip comments

* chore: conflicts on generated

* chore: resolving conflicts

* chore: new queries

* chore: reverting

* feat: refactor to dedicated IParametersBinding

* feat(dui): disable apply changes button for resolved issues

* fix(dui): assert workspaceId is non-null in issue query

.gitignore

@@ -15,4 +15,6 @@ dist
 !.yarn/plugins
 !.yarn/releases
 !.yarn/sdks
-!.yarn/versions
+!.yarn/versions
+
+.claude

components/accounts/ExchangeTokenSignInFlow.vue

@@ -0,0 +1,175 @@
+<template>
+  <div v-if="!hidden" class="flex flex-col space-y-2">
+    <!-- idle: server URL + sign in button -->
+    <template v-if="state === 'idle'">
+      <div class="flex space-x-2">
+        <FormButton
+          v-if="canAddAccount"
+          full-width
+          color="outline"
+          @click="openBrowserAuth()"
+        >
+          Log in with OAuth token
+        </FormButton>
+      </div>
+    </template>
+
+    <!-- waiting: instructions + code input -->
+    <template v-if="state === 'waiting' || state === 'submitting'">
+      <div class="text-foreground-2 space-y-2 border rounded-lg p-2">
+        <div class="text-sm text-center">
+          Check your browser: authorize the app, then copy the exchange code and paste
+          it below.
+        </div>
+        <div class="py-2"><CommonLoadingBar :loading="state === 'waiting'" /></div>
+        <FormTextInput
+          v-model="exchangeCode"
+          name="exchangeCode"
+          :show-label="false"
+          placeholder="Paste exchange code here"
+          color="foundation"
+          autocomplete="off"
+          :disabled="state === 'submitting'"
+        />
+        <FormButton
+          full-width
+          :disabled="!exchangeCode?.trim() || state === 'submitting'"
+          @click="submitCode()"
+        >
+          {{ state === 'submitting' ? 'Signing in...' : 'Submit' }}
+        </FormButton>
+
+        <div v-if="showHelp" class="p-2 rounded-md space-y-1">
+          <div class="text-sm text-center">Having trouble?</div>
+          <div class="flex justify-center">
+            <span>
+              <FormButton size="sm" text @click="retryFlow()">Retry</FormButton>
+              or
+              <FormButton text size="sm" @click="$openUrl('https://speckle.community')">
+                Get in touch with us
+              </FormButton>
+            </span>
+          </div>
+        </div>
+      </div>
+    </template>
+
+    <!-- error -->
+    <template v-if="state === 'error'">
+      <div class="text-foreground-2 space-y-2">
+        <div class="text-sm text-center text-red-500">
+          {{ errorMessage }}
+        </div>
+        <FormButton full-width @click="retryFlow()">Try again</FormButton>
+        <FormButton text size="sm" full-width @click="emit('backToSignIn')">
+          Back
+        </FormButton>
+      </div>
+    </template>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref } from 'vue'
+import { useAuthManager } from '~/lib/authn/useAuthManager'
+import { useTokenExchange, supportsOAuthToken } from '~/lib/authn/useTokenExchange'
+import { useMixpanel } from '~/lib/core/composables/mixpanel'
+import { useAccountStore } from '~/store/accounts'
+import type { BaseBridge } from '~/lib/bridge/base'
+
+const props = defineProps<{
+  serverUrl: string
+}>()
+
+const emit = defineEmits<{
+  (e: 'backToSignIn'): void
+}>()
+
+const app = useNuxtApp()
+const { generateLocalChallenge } = useAuthManager()
+const { exchangeAccessCode } = useTokenExchange()
+const { trackEvent } = useMixpanel()
+const accountStore = useAccountStore()
+
+const { $accountBinding } = useNuxtApp()
+const canAddAccount = ['AddAccount', 'addAccount'].some((name) =>
+  ($accountBinding as unknown as BaseBridge).availableMethodNames.includes(name)
+)
+
+const state = ref<'idle' | 'waiting' | 'submitting' | 'error'>('idle')
+const exchangeCode = ref<string | undefined>()
+const errorMessage = ref('')
+const showHelp = ref(false)
+const hidden = ref(false)
+
+const checkServerSupport = async (url: string) => {
+  const serverUrl = url ? new URL(url).origin : 'https://app.speckle.systems'
+  hidden.value = !(await supportsOAuthToken(serverUrl))
+}
+
+let debounceTimer: ReturnType<typeof setTimeout> | null = null
+
+onMounted(() => checkServerSupport(props.serverUrl))
+watch(
+  () => props.serverUrl,
+  (url) => {
+    if (debounceTimer) clearTimeout(debounceTimer)
+    debounceTimer = setTimeout(() => checkServerSupport(url), 500)
+  }
+)
+
+let currentCodeVerifier = ''
+let currentCodeChallenge = ''
+let currentServerUrl = ''
+
+const openBrowserAuth = async () => {
+  currentServerUrl = props.serverUrl
+    ? new URL(props.serverUrl).origin
+    : 'https://app.speckle.systems'
+
+  const { codeVerifier, codeChallenge } = await generateLocalChallenge()
+  currentCodeVerifier = codeVerifier
+  currentCodeChallenge = codeChallenge
+  const authUrl = `${currentServerUrl}/authn/verify/sdui/${codeChallenge}?returnExchangeToken=true&code_challenge_method=S256`
+  app.$openUrl(authUrl)
+
+  state.value = 'waiting'
+  exchangeCode.value = undefined
+  showHelp.value = false
+
+  setTimeout(() => {
+    if (state.value === 'waiting') {
+      showHelp.value = true
+    }
+  }, 10_000)
+}
+
+const submitCode = async () => {
+  const code = exchangeCode.value?.trim()
+  if (!code || !currentCodeChallenge || !currentServerUrl) return
+
+  state.value = 'submitting'
+  try {
+    await exchangeAccessCode(
+      currentServerUrl,
+      code,
+      currentCodeChallenge,
+      currentCodeVerifier
+    )
+    void trackEvent('DUI Account Added')
+    // Refresh accounts so the watcher in Menu.vue detects the new account and closes the dialog
+    await accountStore.refreshAccounts()
+  } catch (error) {
+    errorMessage.value =
+      error instanceof Error ? error.message : 'Failed to sign in. Please try again.'
+    state.value = 'error'
+  }
+}
+
+const retryFlow = () => {
+  state.value = 'idle'
+  exchangeCode.value = undefined
+  errorMessage.value = ''
+  showHelp.value = false
+}
+</script>

components/accounts/LegacySignInFlow.vue

@@ -2,56 +2,30 @@
   <div class="flex flex-col space-y-2">
     <div v-if="isDesktopServiceAvailable">
       <div v-show="!isAddingAccount" class="text-foreground-2 space-y-2">
-        <FormButton
-          text
-          size="sm"
-          full-width
-          @click="showCustomServerInput = !showCustomServerInput"
-        >
-          {{ showCustomServerInput ? 'Use default server' : 'Set custom server url' }}
-        </FormButton>
-        <div v-if="showCustomServerInput">
-          <FormTextInput
-            v-model="customServerUrl"
-            name="name"
-            :show-label="false"
-            color="foundation"
-            autocomplete="off"
-            show-clear
-            @clear="showCustomServerInput = false"
-          />
-        </div>
         <div class="flex space-x-2">
-          <FormButton
-            color="outline"
-            class="px-1"
-            :icon-left="ArrowLeftIcon"
-            hide-text
-            @click="emit('backToSignIn')"
-          />
-
-          <FormButton full-width @click="startAccountAddFlow()">
-            Sign in (Legacy)
+          <FormButton full-width color="outline" @click="startAccountAddFlow()">
+            Log in (Legacy)
           </FormButton>
         </div>
       </div>
 
-      <div v-show="isAddingAccount" class="text-foreground-2 mt-2 mb-4 space-y-2">
+      <div
+        v-show="isAddingAccount"
+        class="text-foreground-2 mt-2 mb-4 space-y-2 border rounded-lg p-2"
+      >
         <div class="text-sm text-center">
           Please check your browser: waiting for authorization to complete.
         </div>
         <div class="py-2"><CommonLoadingBar :loading="isAddingAccount" /></div>
-        <div v-if="showHelp" class="bg-blue-500/10 p-2 rounded-md space-y-2">
+        <div v-if="showHelp" class="p-2 rounded-md space-y-1">
           <div class="text-sm text-center">Having trouble?</div>
-          <FormButton size="sm" full-width @click="restartFlow()">Retry</FormButton>
-          <FormButton
-            text
-            size="sm"
-            full-width
-            @click="$openUrl('https://speckle.community')"
-          >
-            Get in touch with us
-          </FormButton>
+          <div class="flex justify-center">
+            <span>
+              <FormButton text size="sm" @click="$openUrl('https://speckle.community')">
+                Get in touch with us
+              </FormButton>
+            </span>
+          </div>
         </div>
       </div>
     </div>
@@ -91,6 +65,10 @@ const hostApp = useHostAppStore()
 const app = useNuxtApp()
 const { trackEvent } = useMixpanel()
 
+const props = defineProps<{
+  serverUrl: string
+}>()
+
 const emit = defineEmits<{
   (e: 'backToSignIn'): void
 }>()
@@ -98,7 +76,6 @@ const emit = defineEmits<{
 const showCustomServerInput = ref(false)
 const isAddingAccount = ref(false)
 const isDesktopServiceAvailable = ref(false) // this should be false default because there is a delay if /ping is not successful.
-const customServerUrl = ref<string | undefined>('https://app.speckle.systems')
 const showHelp = ref(false)
 
 const accountCheckerIntervalFn = useIntervalFn(
@@ -123,9 +100,9 @@ const startAccountAddFlow = () => {
   setTimeout(() => {
     showHelp.value = true
   }, 10_000)
-  const url = customServerUrl.value
+  const url = props.serverUrl
     ? `http://localhost:29364/auth/add-account?serverUrl=${
-        new URL(customServerUrl.value).origin
+        new URL(props.serverUrl).origin
       }`
     : `http://localhost:29364/auth/add-account`
 
@@ -149,11 +126,6 @@ const startAccountAddFlow = () => {
   }, 30_000)
 }
 
-const restartFlow = () => {
-  isAddingAccount.value = false
-  showHelp.value = false
-}
-
 onMounted(async () => {
   isDesktopServiceAvailable.value = await pingDesktopService()
 })

components/accounts/Menu.vue

@@ -39,20 +39,24 @@
             title="Add a new account"
             fullscreen="none"
           >
-            <div class="flex flex-col space-y-2">
-              <AccountsSignInFlow v-if="!showLegacy" />
-              <AccountsLegacySignInFlow v-else @back-to-sign-in="showLegacy = false" />
-
-              <FormButton
-                v-if="!showLegacy"
-                text
-                full-width
-                size="sm"
-                class="text-xs"
-                @click="showLegacy = true"
-              >
-                Legacy Sign in
-              </FormButton>
+            <div class="flex flex-col space-y-4 p-2">
+              <FormTextInput
+                v-model="customServerUrl"
+                name="Server to sign in"
+                show-label
+                placeholder="https://app.speckle.systems"
+                color="foundation"
+                autocomplete="off"
+                show-clear
+              />
+              <div class="space-y-2">
+                <AccountsSignInFlow :server-url="customServerUrl" />
+                <AccountsExchangeTokenSignInFlow :server-url="customServerUrl" />
+                <AccountsLegacySignInFlow
+                  v-if="!canStartAuthAccount"
+                  :server-url="customServerUrl"
+                />
+              </div>
             </div>
           </CommonDialog>
         </div>
@@ -68,10 +72,18 @@ import type { DUIAccount } from '~/store/accounts'
 import { useAccountStore } from '~/store/accounts'
 import { useMixpanel } from '~/lib/core/composables/mixpanel'
 import { useDesktopService } from '~/lib/core/composables/desktopService'
+import type { BaseBridge } from '~/lib/bridge/base'
 
 const { trackEvent } = useMixpanel()
 const app = useNuxtApp()
 const { pingDesktopService } = useDesktopService()
+const { $accountBinding } = useNuxtApp()
+const canStartAuthAccount = ['AuthenticateAccount', 'authenticateAccount'].some(
+  (name) =>
+    ($accountBinding as unknown as BaseBridge).availableMethodNames.includes(name)
+)
+
+const customServerUrl = ref<string>('https://app.speckle.systems')
 
 const props = withDefaults(
   defineProps<{
@@ -88,7 +100,7 @@ defineEmits<{
 }>()
 
 const showAddNewAccount = ref(false)
-const showLegacy = ref(false)
+const signInMode = ref<'default' | 'exchange' | 'legacy'>('default')
 
 const showAccountsDialog = defineModel<boolean>('open', {
   required: false,
@@ -110,8 +122,8 @@ watch(showAccountsDialog, (newVal) => {
 
 watch(showAddNewAccount, (newVal) => {
   if (newVal) {
-    // reset the current/legacy state on every add account sub-dialog
-    showLegacy.value = false
+    // reset the sign-in mode on every add account sub-dialog
+    signInMode.value = 'default'
   }
 })
 

components/accounts/SignInFlow.vue

@@ -1,51 +1,53 @@
 <template>
   <div class="flex flex-col space-y-2">
-    <FormButton
-      text
-      size="sm"
-      full-width
-      @click="showCustomServerInput = !showCustomServerInput"
-    >
-      {{ showCustomServerInput ? 'Use default server' : 'Set custom server url' }}
-    </FormButton>
-    <div v-if="showCustomServerInput">
-      <FormTextInput
-        v-model="customServerUrl"
-        name="name"
-        :show-label="false"
-        placeholder="https://app.speckle.systems"
-        color="foundation"
-        autocomplete="off"
-        show-clear
-        @clear="showCustomServerInput = false"
-      />
-    </div>
-
-    <FormButton v-if="canAddAccount" full-width @click="logIn()">Sign in</FormButton>
+    <FormButton v-if="canAddAccount" full-width @click="logIn()">Log in</FormButton>
   </div>
 </template>
 
 <script setup lang="ts">
-import { ref } from 'vue'
 import { useAuthManager } from '~/lib/authn/useAuthManager'
 import type { BaseBridge } from '~/lib/bridge/base'
+import { useAccountStore } from '~/store/accounts'
+import { useHostAppStore } from '~/store/hostApp'
+import { ToastNotificationType } from '@speckle/ui-components'
 
-const customServerUrl = ref<string | undefined>('https://app.speckle.systems')
-const showCustomServerInput = ref(false)
+const props = defineProps<{
+  serverUrl: string
+}>()
 
+const accountStore = useAccountStore()
+const hostAppStore = useHostAppStore()
 const { $accountBinding } = useNuxtApp()
 const canAddAccount = ['AddAccount', 'addAccount'].some((name) =>
   ($accountBinding as unknown as BaseBridge).availableMethodNames.includes(name)
 )
+const canStartAuthAccount = ['AuthenticateAccount', 'authenticateAccount'].some(
+  (name) =>
+    ($accountBinding as unknown as BaseBridge).availableMethodNames.includes(name)
+)
 
 const { generateChallenge } = useAuthManager()
 
-const logIn = () => {
-  const serverUrl = customServerUrl.value
-    ? new URL(customServerUrl.value).origin
+const logIn = async () => {
+  const serverUrl = props.serverUrl
+    ? new URL(props.serverUrl).origin
     : 'https://app.speckle.systems'
-  const challenge = generateChallenge(serverUrl)
-  const authUrl = `${serverUrl}/authn/verify/sdui/${challenge}`
-  window.location.href = authUrl
+  if (canStartAuthAccount) {
+    const acc = await $accountBinding.authenticateAccount(serverUrl)
+    if (acc.token) {
+      await accountStore.refreshAccounts()
+    } else {
+      hostAppStore.setNotification({
+        title: 'Log In',
+        type: ToastNotificationType.Info,
+        description:
+          "Log in could not completed. Make sure you have logged in successfully, otherwise try 'Log in with OAuth token'"
+      })
+    }
+  } else {
+    const { codeChallenge } = await generateChallenge(serverUrl)
+    const authUrl = `${serverUrl}/authn/verify/sdui/${codeChallenge}?code_challenge_method=S256`
+    window.location.href = authUrl
+  }
 }
 </script>

components/home/NoAccountsPanel.vue

@@ -6,18 +6,22 @@
       Welcome to Speckle
     </h1>
     <div v-if="isDesktopServiceAvailable || canAddAccount">
-      <AccountsSignInFlow v-if="!showLegacy" />
-      <AccountsLegacySignInFlow v-else @back-to-sign-in="showLegacy = false" />
-      <FormButton
-        v-if="!showLegacy"
-        text
-        full-width
-        size="sm"
-        class="text-xs"
-        @click="showLegacy = true"
-      >
-        Legacy Sign in
-      </FormButton>
+      <div class="flex flex-col space-y-4 p-2">
+        <FormTextInput
+          v-model="customServerUrl"
+          name="Server to sign in"
+          :show-label="false"
+          placeholder="https://app.speckle.systems"
+          color="foundation"
+          autocomplete="off"
+          show-clear
+        />
+        <div class="space-y-2">
+          <AccountsSignInFlow :server-url="customServerUrl" />
+          <AccountsExchangeTokenSignInFlow :server-url="customServerUrl" />
+          <AccountsLegacySignInFlow :server-url="customServerUrl" />
+        </div>
+      </div>
     </div>
     <div v-else>
       <div class="text-foreground-2 mt-2 mb-4">
@@ -53,13 +57,13 @@ import type { BaseBridge } from '~/lib/bridge/base'
 const accountStore = useAccountStore()
 const { pingDesktopService } = useDesktopService()
 
+const customServerUrl = ref<string>('https://app.speckle.systems')
+
 const { $accountBinding } = useNuxtApp()
 const canAddAccount = ['AddAccount', 'addAccount'].some((name) =>
   ($accountBinding as unknown as BaseBridge).availableMethodNames.includes(name)
 )
 
-const showLegacy = ref(false)
-
 const isDesktopServiceAvailable = ref(false) // this should be false default because there is a delay if /ping is not successful.
 
 onMounted(async () => {

components/issues/Dialog.vue

@@ -28,7 +28,7 @@
             </div>
           </div>
           <hr />
-          <IssuesSelectedItem :issue="selectedIssue" />
+          <IssuesSelectedItem :issue="selectedIssue" :model-card="modelCard" />
         </div>
 
         <div v-if="!selectedIssue" class="flex flex-col space-y-2">

components/issues/SelectedItem.vue

@@ -6,9 +6,21 @@
       </div>
       <IssuesBasicTiptap
         v-if="issue.description?.doc"
-        class="border rounded-xl border-outline-3"
+        class="border rounded-xl border-outline-3 w-full"
         :doc="issue.description?.doc"
       ></IssuesBasicTiptap>
+
+      <div v-if="app.$parametersBinding && hasObjectDeltas" class="w-full pt-1 pb-1">
+        <FormButton
+          class="w-full justify-center"
+          :disabled="isApplying || isResolved"
+          @click="applyChanges"
+        >
+          {{
+            isApplying ? 'Applying...' : isResolved ? 'Issue resolved' : 'Apply changes'
+          }}
+        </FormButton>
+      </div>
       <div class="flex flex-wrap items-center gap-x-3 gap-y-1">
         <IssuesStatusIcon :status="issue.status" show-label />
         <IssuesPriorityIcon :priority="issue.priority" show-label />
@@ -84,14 +96,85 @@
 </template>
 
 <script setup lang="ts">
+import { computed, ref } from 'vue'
+import { useQuery } from '@vue/apollo-composable'
+import { ResourceMetaType, IssueStatus } from '~/lib/common/generated/gql/graphql'
+import { issueResourceMetaSearchQuery } from '~/lib/issues/graphql/queries'
 import type { IssuesItemFragment } from '~/lib/common/generated/gql/graphql'
+import type { IModelCard } from '~/lib/models/card'
 import dayjs from 'dayjs'
 import { Calendar } from 'lucide-vue-next'
 
 const props = defineProps<{
   issue: IssuesItemFragment
+  modelCard: IModelCard
 }>()
 
+const app = useNuxtApp()
+const isApplying = ref(false)
+
+const isResolved = computed(() => {
+  return props.issue.status === IssueStatus.Resolved
+})
+
+const queryVariables = computed(() => ({
+  workspaceId: props.modelCard.workspaceId!,
+  projectId: props.modelCard.projectId,
+  resourceType: ResourceMetaType.Issue,
+  resourceId: props.issue.id,
+  metaType: 'objectDeltas'
+}))
+
+const queryOptions = computed(() => ({
+  fetchPolicy: 'cache-and-network' as const,
+  enabled: !!props.modelCard.workspaceId,
+  clientId: props.modelCard.accountId
+}))
+
+const { result: resourceMetaResult } = useQuery(
+  issueResourceMetaSearchQuery,
+  queryVariables,
+  queryOptions
+)
+
+const hasObjectDeltas = computed<boolean>(() => {
+  const metadata = resourceMetaResult.value?.resourceMetaSearch
+  return Array.isArray(metadata) && metadata.length > 0
+})
+
+const objectDeltasPayload = computed<unknown>(() => {
+  if (!hasObjectDeltas.value) return null
+  const metadata = resourceMetaResult.value?.resourceMetaSearch
+
+  if (Array.isArray(metadata) && metadata.length > 0) {
+    return metadata[0]?.data as unknown
+  }
+
+  return null
+})
+
+const applyChanges = async () => {
+  if (!objectDeltasPayload.value) return
+
+  isApplying.value = true
+  try {
+    const payload =
+      typeof objectDeltasPayload.value === 'string'
+        ? objectDeltasPayload.value
+        : JSON.stringify(objectDeltasPayload.value)
+
+    if (app.$parametersBinding) {
+      await app.$parametersBinding.update(payload)
+    } else {
+      console.warn('IParametersBinding not available in this host app')
+    }
+  } catch (error) {
+    console.error('Failed to apply changes:', error)
+  } finally {
+    isApplying.value = false
+  }
+}
+
 const formattedDate = computed((): string | null => {
   try {
     const date = props.issue.dueDate ? dayjs(props.issue.dueDate).toDate() : null

components/model/Sender.vue

@@ -32,13 +32,18 @@
       <FilterListSelect :filter="modelCard.sendFilter" @update:filter="updateFilter" />
 
       <div class="mt-4 flex justify-end items-center space-x-2">
-        <FormButton size="sm" color="outline" @click.stop="saveFilter()">
+        <FormButton
+          size="sm"
+          color="outline"
+          :disabled="isSaveDisabled"
+          @click.stop="saveFilter()"
+        >
           Save
         </FormButton>
         <div v-tippy="!canCreateVersionPerm ? canCreateVersionMessage : ''">
           <FormButton
             size="sm"
-            :disabled="!canCreateVersionPerm"
+            :disabled="!canCreateVersionPerm || isSaveDisabled"
             @click.stop="saveFilterAndSend()"
           >
             Save & Publish
@@ -114,7 +119,7 @@
   </ModelCardBase>
 </template>
 <script setup lang="ts">
-import { ref, onMounted } from 'vue'
+import { ref, onMounted, computed } from 'vue'
 import ModelCardBase from '~/components/model/CardBase.vue'
 import { Square3Stack3DIcon } from '@heroicons/vue/20/solid'
 import type { ModelCardNotification } from '~/lib/models/card/notification'
@@ -206,22 +211,28 @@ const sendOrCancel = () => {
   hasSetVersionMessage.value = false
 }
 
-let newFilter: ISendFilter
+const newFilter = ref<ISendFilter>()
 const updateFilter = (filter: ISendFilter) => {
-  newFilter = filter
+  newFilter.value = filter
 }
 
+const isSaveDisabled = computed(() => {
+  const filterToCheck = newFilter.value || props.modelCard.sendFilter
+  return !store.validateSendFilter(filterToCheck).valid
+})
+
 const saveFilter = async () => {
+  if (!newFilter.value) return // Safety check
   void trackEvent('DUI3 Action', {
     name: 'Publish Card Filter Change',
-    filter: newFilter.typeDiscriminator
+    filter: newFilter.value.typeDiscriminator
   })
 
   // do not reset idmap while creating a new one because it is managed by host app
-  newFilter.idMap = props.modelCard.sendFilter?.idMap
+  newFilter.value.idMap = props.modelCard.sendFilter?.idMap
 
   await store.patchModel(props.modelCard.modelCardId, {
-    sendFilter: newFilter,
+    sendFilter: newFilter.value,
     expired: true
   })
   openFilterDialog.value = false

components/send/Wizard.vue

@@ -42,13 +42,10 @@
           }
         "
       />
-      <div
-        v-tippy="!canPublish && !isLoadingPermissions ? publishLimitMessage : ''"
-        class="mt-2"
-      >
+      <div v-tippy="publishTooltipMessage" class="mt-2">
         <FormButton
           full-width
-          :disabled="!canPublish || isLoadingPermissions"
+          :disabled="isPublishDisabled"
           :loading="isLoadingPermissions"
           @click="addModel"
         >
@@ -72,6 +69,7 @@ import type { ISendFilter } from '~/lib/models/card/send'
 import { SenderModelCard } from '~/lib/models/card/send'
 import { useHostAppStore } from '~/store/hostApp'
 import { useAccountStore } from '~/store/accounts'
+import { useSelectionStore } from '~/store/selection'
 import { useMixpanel } from '~/lib/core/composables/mixpanel'
 import { useSettingsTracking } from '~/lib/core/composables/trackSettings'
 import type { CardSetting } from '~/lib/models/card/setting'
@@ -103,6 +101,23 @@ const { canCreateModelIngestion, canCreateVersion } = useCheckGraphql()
 const canPublish = ref(false)
 const publishLimitMessage = ref<string | undefined>(undefined)
 const isLoadingPermissions = ref(false)
+const hostAppStore = useHostAppStore()
+const selectionStore = useSelectionStore()
+
+const publishValidation = computed(() => hostAppStore.validateSendFilter(filter.value))
+
+const isPublishDisabled = computed(() => {
+  return (
+    !canPublish.value || isLoadingPermissions.value || !publishValidation.value.valid
+  )
+})
+
+const publishTooltipMessage = computed(() => {
+  if (!publishValidation.value.valid) return publishValidation.value.reason
+  if (!canPublish.value && !isLoadingPermissions.value)
+    return publishLimitMessage.value || ''
+  return ''
+})
 
 const updateSearchText = (text: string | undefined) => {
   urlParseError.value = undefined
@@ -119,6 +134,7 @@ watch(urlParsedData, (newVal) => {
 watch(showSendDialog, (newVal) => {
   if (newVal) {
     urlParseError.value = undefined
+    void selectionStore.refreshSelectionFromHostApp()
   }
 })
 
@@ -204,8 +220,6 @@ const selectModel = (model: ModelListModelItemFragment) => {
   void trackEvent('DUI3 Action', { name: 'Publish Wizard', step: 'model selected' })
 }
 
-const hostAppStore = useHostAppStore()
-
 // accountId, serverUrl, projectId, modelId, sendFilter, settings
 const addModel = async () => {
   void trackEvent('DUI3 Action', {

components/wizard/ModelSelector.vue

@@ -32,33 +32,6 @@
           </FormButton>
         </div>
       </div>
-      <div
-        v-if="
-          canCreateModelResult &&
-          !canCreateModelResult.project.permissions.canCreateModel.authorized
-        "
-      >
-        <CommonAlert title="Cannot create new models" color="info" hide-icon>
-          <template #description>
-            {{ canCreateModelResult.project.permissions.canCreateModel.message }}
-
-            <FormButton
-              v-if="workspaceSlug"
-              full-width
-              color="primary"
-              size="sm"
-              class="mt-2"
-              @click="
-                $openUrl(
-                  `${account.accountInfo.serverInfo.url}/settings/workspaces/${workspaceSlug}/billing`
-                )
-              "
-            >
-              Explore Plans
-            </FormButton>
-          </template>
-        </CommonAlert>
-      </div>
       <div class="relative grid grid-cols-1 gap-2">
         <CommonLoadingBar v-if="loading" loading />
 

components/wizard/ProjectSelector.vue

@@ -3,12 +3,18 @@
     <div class="space-y-2 relative">
       <div v-if="workspacesEnabled && workspaces" class="flex items-center space-x-2">
         <div class="flex-grow min-w-0">
-          <!-- NO WORKSPACE YET -->
           <div v-if="workspaces.length === 0">
             <FormButton
               full-width
               class="flex items-center"
-              @click="$openUrl('https://app.speckle.systems/workspaces/actions/create')"
+              @click="
+                $openUrl(
+                  `${activeAccount.accountInfo.serverInfo.url.replace(
+                    /\/$/,
+                    ''
+                  )}/workspaces/actions/create`
+                )
+              "
             >
               <div class="min-w-0 truncate flex-grow">
                 <span>{{ 'Create a workspace' }}</span>
@@ -72,13 +78,7 @@
             color="foundation"
           />
           <div class="flex justify-between items-center space-x-2">
-            <div
-              v-tippy="
-                canCreateProject
-                  ? 'Create new project'
-                  : canCreateProjectPermissionCheck?.message
-              "
-            >
+            <div v-if="canCreateProject" v-tippy="'Create new project'">
               <FormButton
                 color="outline"
                 :disabled="!canCreateProject"
@@ -88,6 +88,22 @@
                 <PlusIcon class="w-4 -mx-2" />
               </FormButton>
             </div>
+            <div
+              v-else
+              v-tippy="
+                canCreateProject
+                  ? 'Create new project'
+                  : canCreateProjectPermissionCheck?.message
+              "
+            >
+              <FormButton
+                color="primary"
+                :class="`p-1.5 bg-foundation rounded text-foreground border`"
+                @click="upgradePlanButtonAction"
+              >
+                <ArrowUpCircleIcon class="w-4 -mx-2" />
+              </FormButton>
+            </div>
             <CommonDialog
               v-model:open="showProjectCreateDialog"
               :title="`Create new project`"
@@ -132,28 +148,6 @@
             </div>
           </div>
         </div>
-        <div
-          v-if="
-            canCreateProjectPermissionCheck &&
-            !canCreateProjectPermissionCheck.authorized &&
-            showUpgradePlanButton
-          "
-        >
-          <CommonAlert color="info" hide-icon>
-            <template #description>
-              {{ canCreateProjectPermissionCheck.message }}
-              <FormButton
-                full-width
-                class="mt-2"
-                color="primary"
-                size="sm"
-                @click="upgradePlanButtonAction()"
-              >
-                Upgrade now
-              </FormButton>
-            </template>
-          </CommonAlert>
-        </div>
 
         <WizardPersonalProjectsWarning v-if="isPersonalProjectsAsWorkspace" />
 
@@ -202,7 +196,7 @@
 <script setup lang="ts">
 import { ChevronDownIcon, ArrowTopRightOnSquareIcon } from '@heroicons/vue/24/outline'
 import { storeToRefs } from 'pinia'
-import { PlusIcon } from '@heroicons/vue/20/solid'
+import { PlusIcon, ArrowUpCircleIcon } from '@heroicons/vue/20/solid'
 import type { DUIAccount } from '~/store/accounts'
 import { useAccountStore } from '~/store/accounts'
 import {
@@ -493,35 +487,6 @@ const canCreateProjectPermissionCheck = computed(() => {
   return null
 })
 
-const upgradePlanButtonAction = () => {
-  if (!canCreateProjectPermissionCheck.value) return
-  if (canCreateProjectPermissionCheck.value.code === 'WorkspaceNoEditorSeat') {
-    // open url to workspace/settings/users
-    $openUrl(
-      `${account.value.accountInfo.serverInfo.url}/settings/workspaces/${selectedWorkspace.value?.slug}/members`
-    )
-    return
-  }
-  if (canCreateProjectPermissionCheck.value.code === 'WorkspaceLimitsReached') {
-    // open url to workspace/billing
-    $openUrl(
-      `${account.value.accountInfo.serverInfo.url}/settings/workspaces/${selectedWorkspace.value?.slug}/billing`
-    )
-    return
-  }
-}
-
-const showUpgradePlanButton = computed(() => {
-  if (!canCreateProjectPermissionCheck.value) return false
-  if (
-    canCreateProjectPermissionCheck.value.code === 'WorkspaceNoEditorSeat' ||
-    canCreateProjectPermissionCheck.value.code === 'WorkspaceLimitsReached'
-  ) {
-    return true
-  }
-  return false
-})
-
 const isCreatingProject = ref(false)
 const showProjectCreateDialog = ref(false)
 
@@ -610,6 +575,24 @@ const createNewPersonalProject = async (name: string) => {
   isCreatingProject.value = false
 }
 
+const upgradePlanButtonAction = () => {
+  if (!canCreateProjectPermissionCheck.value) return
+  if (canCreateProjectPermissionCheck.value.code === 'WorkspaceNoEditorSeat') {
+    // open url to workspace/settings/users
+    $openUrl(
+      `${account.value.accountInfo.serverInfo.url}/settings/workspaces/${selectedWorkspace.value?.slug}/members`
+    )
+    return
+  }
+  if (canCreateProjectPermissionCheck.value.code === 'WorkspaceLimitsReached') {
+    // open url to workspace/billing
+    $openUrl(
+      `${account.value.accountInfo.serverInfo.url}/settings/workspaces/${selectedWorkspace.value?.slug}/billing`
+    )
+    return
+  }
+}
+
 const loadMore = () => {
   fetchMore({
     variables: { cursor: projectsResult.value?.activeUser?.projects.cursor },

lib/authn/useAuthManager.ts

@@ -1,29 +1,81 @@
-const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
 const CHALLENGE_KEY = 'speckle_challenge'
 const CHALLENGE_URL_KEY = 'speckle_url_challenge'
+const CODE_VERIFIER_KEY = 'speckle_code_verifier'
+
+function toBase64Url(buffer: Uint8Array): string {
+  const base64 = btoa(String.fromCharCode(...buffer))
+  return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+
+/**
+ * Generates a cryptographically random base64url-encoded string.
+ * 32 bytes → 43 characters after base64url encoding (within the RFC 7636 range of 43-128).
+ */
+function createCodeVerifier(): string {
+  const bytes = crypto.getRandomValues(new Uint8Array(32))
+  return toBase64Url(bytes)
+}
+
+/**
+ * Computes SHA-256 hash of a string and returns it as base64url.
+ * This is the PKCE code_challenge derivation from a code_verifier.
+ */
+async function computeS256Challenge(codeVerifier: string): Promise<string> {
+  const data = new TextEncoder().encode(codeVerifier)
+  const digest = await crypto.subtle.digest('SHA-256', data)
+  return toBase64Url(new Uint8Array(digest))
+}
+
+export interface ChallengeData {
+  /** The raw random string (code_verifier in PKCE terms) */
+  codeVerifier: string
+  /** SHA-256 base64url hash of codeVerifier (code_challenge for S256 method) */
+  codeChallenge: string
+}
 
 export function useAuthManager() {
-  const generateChallenge = (url: string): string => {
-    let result = ''
-    for (let i = 0; i < 12; i++) {
-      result += chars.charAt(Math.floor(Math.random() * chars.length))
-    }
-    localStorage.setItem(CHALLENGE_KEY, result) // <-- persist it
+  /**
+   * Generates a PKCE code_verifier + code_challenge pair and persists to localStorage.
+   * Used by redirect-based sign-in flows (SignInFlow) that need to
+   * recover the values after the browser navigates away and back.
+   */
+  const generateChallenge = async (url: string): Promise<ChallengeData> => {
+    const codeVerifier = createCodeVerifier()
+    const codeChallenge = await computeS256Challenge(codeVerifier)
+    localStorage.setItem(CHALLENGE_KEY, codeChallenge)
+    localStorage.setItem(CODE_VERIFIER_KEY, codeVerifier)
     localStorage.setItem(CHALLENGE_URL_KEY, url)
-    return result
+    return { codeVerifier, codeChallenge }
+  }
+
+  /**
+   * Generates a PKCE code_verifier + code_challenge pair without persisting to localStorage.
+   * Used by flows that keep values in memory (ExchangeTokenSignInFlow)
+   * so they don't overwrite the redirect flow's stored data.
+   */
+  const generateLocalChallenge = async (): Promise<ChallengeData> => {
+    const codeVerifier = createCodeVerifier()
+    const codeChallenge = await computeS256Challenge(codeVerifier)
+    return { codeVerifier, codeChallenge }
   }
 
   const getChallenge = (): string | null => {
     return localStorage.getItem(CHALLENGE_KEY)
   }
 
+  const getCodeVerifier = (): string | null => {
+    return localStorage.getItem(CODE_VERIFIER_KEY)
+  }
+
   const getChallengeUrl = (): string | null => {
     return localStorage.getItem(CHALLENGE_URL_KEY)
   }
 
   return {
     getChallenge,
+    getCodeVerifier,
     getChallengeUrl,
-    generateChallenge
+    generateChallenge,
+    generateLocalChallenge
   }
 }

lib/authn/useTokenExchange.ts

@@ -0,0 +1,114 @@
+import { md5 } from '@speckle/shared'
+import type { Account } from '~/lib/bindings/definitions/IAccountBinding'
+
+/**
+ * Checks if the server supports the new /oauth/token endpoint.
+ * The server exposes GET /oauth/token returning 'supported' when available.
+ */
+export async function supportsOAuthToken(serverUrl: string): Promise<boolean> {
+  try {
+    const res = await fetch(new URL('/oauth/token', serverUrl), { method: 'GET' })
+    return res.ok
+  } catch {
+    return false
+  }
+}
+
+export function useTokenExchange() {
+  const { $accountBinding } = useNuxtApp()
+
+  const exchangeAccessCode = async (
+    rawServerUrl: string,
+    accessCode: string,
+    challenge: string,
+    codeVerifier?: string
+  ): Promise<void> => {
+    // Normalize to origin (strips trailing slash, path, etc.)
+    // so account IDs stay consistent with connectors
+    const serverUrl = new URL(rawServerUrl).origin
+    const tokenHeaders = { 'Content-Type': 'application/json' }
+    let tokenResponse: Response
+
+    // If we have a codeVerifier, try the new PKCE-based /oauth/token endpoint first
+    if (codeVerifier && (await supportsOAuthToken(serverUrl))) {
+      tokenResponse = await fetch(new URL('/oauth/token', serverUrl), {
+        method: 'POST',
+        headers: tokenHeaders,
+        body: JSON.stringify({
+          appId: 'sdui',
+          appSecret: 'sdui',
+          accessCode,
+          codeVerifier
+        })
+      })
+    } else {
+      // Fall back to legacy /auth/token with plain challenge
+      tokenResponse = await fetch(new URL('/auth/token', serverUrl), {
+        method: 'POST',
+        headers: tokenHeaders,
+        body: JSON.stringify({
+          appId: 'sdui',
+          appSecret: 'sdui',
+          accessCode,
+          challenge
+        })
+      })
+    }
+
+    if (!tokenResponse.ok) {
+      const errorText = await tokenResponse.text()
+      throw new Error(
+        `Token exchange failed with status ${tokenResponse.status}: ${errorText}`
+      )
+    }
+
+    const { token, refreshToken } = (await tokenResponse.json()) as {
+      token: string
+      refreshToken: string
+    }
+
+    // Query user and server info
+    const graphqlQuery = {
+      query:
+        'query { activeUser { id name email company avatar } serverInfo { name company adminContact description version } }'
+    }
+
+    const userAndServerInfoResponse = await fetch(new URL('/graphql', serverUrl), {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify(graphqlQuery)
+    })
+
+    if (!userAndServerInfoResponse.ok) {
+      throw new Error(
+        `Failed to fetch user info with status ${userAndServerInfoResponse.status}`
+      )
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+    const userAndServerInfo = await userAndServerInfoResponse.json()
+
+    const accountId = md5(
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      userAndServerInfo.data.activeUser.email + serverUrl
+    ).toUpperCase()
+
+    const account: Account = {
+      id: accountId,
+      token,
+      refreshToken,
+      isDefault: true,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access
+      serverInfo: { url: serverUrl, ...userAndServerInfo.data.serverInfo },
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access
+      userInfo: userAndServerInfo.data.activeUser
+    }
+
+    await $accountBinding.addAccount(accountId, account)
+  }
+
+  return { exchangeAccessCode }
+}

lib/bindings/definitions/IAccountBinding.ts

@@ -9,6 +9,7 @@ export interface IAccountBinding extends IBinding<IAccountBindingEvents> {
   getAccounts: () => Promise<Account[]>
   addAccount: (accountId: string, account: Account) => Promise<void>
   removeAccount: (accountId: string) => Promise<void>
+  authenticateAccount: (serverUrl: string) => Promise<Account>
 }
 
 // An almost 1-1 mapping of what we need from the Core accounts class.
@@ -60,6 +61,25 @@ export class MockedAccountBinding implements IAccountBinding {
     return await console.log('no way dude', accountId, account)
   }
 
+  public async authenticateAccount(serverUrl: string) {
+    const config = useRuntimeConfig()
+    return (await {
+      id: 'whatever',
+      isDefault: true,
+      token: config.public.speckleToken,
+      serverInfo: {
+        name: 'test',
+        url: serverUrl,
+        frontend2: true
+      },
+      userInfo: {
+        id: 'whatever',
+        avatar: 'whatever',
+        email: ''
+      }
+    }) as Account
+  }
+
   public async removeAccount(accountId: string) {
     return await console.log('no way dude', accountId)
   }

lib/bindings/definitions/IBasicConnectorBinding.ts

@@ -26,6 +26,7 @@ export interface IBasicConnectorBinding
   highlightObjects: (objectIds: string[]) => Promise<void>
   removeModel: (model: IModelCard) => Promise<void>
   removeModels: (models: IModelCard[]) => Promise<void>
+  updateParameters: (payload: string) => Promise<void>
 }
 
 export interface IBasicConnectorBindingHostEvents
@@ -107,6 +108,10 @@ export class MockedBaseBinding implements IBasicConnectorBinding {
     await console.log('no way dude')
   }
 
+  public async updateParameters(payload: string) {
+    await console.log('Mock: updateParameters called with payload:', payload)
+  }
+
   public async showDevTools() {
     await console.log('No way dude')
   }

lib/bindings/definitions/IParametersBinding.ts

@@ -0,0 +1,3 @@
+export interface IParametersBinding {
+  update: (payload: string) => Promise<void>
+}

lib/bindings/definitions/ISendBinding.ts

@@ -26,6 +26,7 @@ export interface ISendBindingEvents
     modelCardId: string
     versionId: string
     sendConversionResults: ConversionResult[]
+    ingestionId?: string
   }) => void
   setIdMap: (args: {
     modelCardId: string

lib/common/generated/gql/gql.ts

@@ -61,8 +61,10 @@ type Documents = {
     "\n  mutation FailModelIngestionWithError($input: ModelIngestionFailedInput!) {\n    projectMutations {\n      modelIngestionMutations {\n        failWithError(input: $input) {\n          id\n        }\n      }\n    }\n  }\n": typeof types.FailModelIngestionWithErrorDocument,
     "\n  mutation FailModelIngestionWithCancel($input: ModelIngestionCancelledInput!) {\n    projectMutations {\n      modelIngestionMutations {\n        failWithCancel(input: $input) {\n          id\n        }\n      }\n    }\n  }\n": typeof types.FailModelIngestionWithCancelDocument,
     "\n  query CanCreateIngestion($modelId: String!, $projectId: String!) {\n    project(id: $projectId) {\n      model(id: $modelId) {\n        permissions {\n          canCreateIngestion {\n            authorized\n            code\n            message\n          }\n        }\n      }\n    }\n  }\n": typeof types.CanCreateIngestionDocument,
+    "\n  subscription ProjectModelIngestionUpdated(\n    $input: ProjectModelIngestionSubscriptionInput!\n  ) {\n    projectModelIngestionUpdated(input: $input) {\n      type\n      modelIngestion {\n        id\n        statusData {\n          __typename\n          ... on ModelIngestionSuccessStatus {\n            status\n            versionId\n          }\n          ... on ModelIngestionProcessingStatus {\n            status\n            progressMessage\n            progress\n          }\n          ... on ModelIngestionFailedStatus {\n            status\n            errorReason\n          }\n          ... on ModelIngestionCancelledStatus {\n            status\n            cancellationMessage\n          }\n          ... on ModelIngestionQueuedStatus {\n            status\n            progressMessage\n          }\n        }\n      }\n    }\n  }\n": typeof types.ProjectModelIngestionUpdatedDocument,
     "\n  fragment IssuesItem on Issue {\n    id\n    status\n    title\n    priority\n    viewerState\n    identifier\n    resourceIdString\n    activities(input: { limit: 1, sortDirection: asc }) {\n      totalCount\n      items {\n        actor {\n          id\n          user {\n            name\n            id\n            avatar\n          }\n        }\n        eventType\n        createdAt\n      }\n    }\n    replies {\n      totalCount\n      items {\n        id\n        author {\n          id\n          user {\n            name\n            id\n            avatar\n          }\n        }\n        createdAt\n        description {\n          doc\n        }\n      }\n    }\n    description {\n      doc\n    }\n    labels {\n      hexColor\n      id\n      name\n    }\n    author {\n      id\n      user {\n        id\n        name\n        avatar\n      }\n    }\n    dueDate\n    assignee {\n      id\n      user {\n        id\n        avatar\n        name\n      }\n    }\n  }\n": typeof types.IssuesItemFragmentDoc,
     "\n  query IssuesList($projectId: String!) {\n    project(id: $projectId) {\n      id\n      issues {\n        totalCount\n        items {\n          ...IssuesItem\n        }\n      }\n    }\n  }\n": typeof types.IssuesListDocument,
+    "\n  query IssueResourceMetaSearch(\n    $workspaceId: String!\n    $resourceType: ResourceMetaType!\n    $resourceId: String!\n    $projectId: String\n    $metaType: String\n  ) {\n    resourceMetaSearch(\n      workspaceId: $workspaceId\n      resourceType: $resourceType\n      resourceId: $resourceId\n      projectId: $projectId\n      metaType: $metaType\n    ) {\n      data\n    }\n  }\n": typeof types.IssueResourceMetaSearchDocument,
     "\n  subscription WorkspacePlanUsageUpdated($input: WorkspacePlanUsageSubscriptionInput!) {\n    workspacePlanUsageUpdated(input: $input)\n  }\n": typeof types.WorkspacePlanUsageUpdatedDocument,
 };
 const documents: Documents = {
@@ -113,8 +115,10 @@ const documents: Documents = {
     "\n  mutation FailModelIngestionWithError($input: ModelIngestionFailedInput!) {\n    projectMutations {\n      modelIngestionMutations {\n        failWithError(input: $input) {\n          id\n        }\n      }\n    }\n  }\n": types.FailModelIngestionWithErrorDocument,
     "\n  mutation FailModelIngestionWithCancel($input: ModelIngestionCancelledInput!) {\n    projectMutations {\n      modelIngestionMutations {\n        failWithCancel(input: $input) {\n          id\n        }\n      }\n    }\n  }\n": types.FailModelIngestionWithCancelDocument,
     "\n  query CanCreateIngestion($modelId: String!, $projectId: String!) {\n    project(id: $projectId) {\n      model(id: $modelId) {\n        permissions {\n          canCreateIngestion {\n            authorized\n            code\n            message\n          }\n        }\n      }\n    }\n  }\n": types.CanCreateIngestionDocument,
+    "\n  subscription ProjectModelIngestionUpdated(\n    $input: ProjectModelIngestionSubscriptionInput!\n  ) {\n    projectModelIngestionUpdated(input: $input) {\n      type\n      modelIngestion {\n        id\n        statusData {\n          __typename\n          ... on ModelIngestionSuccessStatus {\n            status\n            versionId\n          }\n          ... on ModelIngestionProcessingStatus {\n            status\n            progressMessage\n            progress\n          }\n          ... on ModelIngestionFailedStatus {\n            status\n            errorReason\n          }\n          ... on ModelIngestionCancelledStatus {\n            status\n            cancellationMessage\n          }\n          ... on ModelIngestionQueuedStatus {\n            status\n            progressMessage\n          }\n        }\n      }\n    }\n  }\n": types.ProjectModelIngestionUpdatedDocument,
     "\n  fragment IssuesItem on Issue {\n    id\n    status\n    title\n    priority\n    viewerState\n    identifier\n    resourceIdString\n    activities(input: { limit: 1, sortDirection: asc }) {\n      totalCount\n      items {\n        actor {\n          id\n          user {\n            name\n            id\n            avatar\n          }\n        }\n        eventType\n        createdAt\n      }\n    }\n    replies {\n      totalCount\n      items {\n        id\n        author {\n          id\n          user {\n            name\n            id\n            avatar\n          }\n        }\n        createdAt\n        description {\n          doc\n        }\n      }\n    }\n    description {\n      doc\n    }\n    labels {\n      hexColor\n      id\n      name\n    }\n    author {\n      id\n      user {\n        id\n        name\n        avatar\n      }\n    }\n    dueDate\n    assignee {\n      id\n      user {\n        id\n        avatar\n        name\n      }\n    }\n  }\n": types.IssuesItemFragmentDoc,
     "\n  query IssuesList($projectId: String!) {\n    project(id: $projectId) {\n      id\n      issues {\n        totalCount\n        items {\n          ...IssuesItem\n        }\n      }\n    }\n  }\n": types.IssuesListDocument,
+    "\n  query IssueResourceMetaSearch(\n    $workspaceId: String!\n    $resourceType: ResourceMetaType!\n    $resourceId: String!\n    $projectId: String\n    $metaType: String\n  ) {\n    resourceMetaSearch(\n      workspaceId: $workspaceId\n      resourceType: $resourceType\n      resourceId: $resourceId\n      projectId: $projectId\n      metaType: $metaType\n    ) {\n      data\n    }\n  }\n": types.IssueResourceMetaSearchDocument,
     "\n  subscription WorkspacePlanUsageUpdated($input: WorkspacePlanUsageSubscriptionInput!) {\n    workspacePlanUsageUpdated(input: $input)\n  }\n": types.WorkspacePlanUsageUpdatedDocument,
 };
 
@@ -320,6 +324,10 @@ export function graphql(source: "\n  mutation FailModelIngestionWithCancel($inpu
  * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
  */
 export function graphql(source: "\n  query CanCreateIngestion($modelId: String!, $projectId: String!) {\n    project(id: $projectId) {\n      model(id: $modelId) {\n        permissions {\n          canCreateIngestion {\n            authorized\n            code\n            message\n          }\n        }\n      }\n    }\n  }\n"): (typeof documents)["\n  query CanCreateIngestion($modelId: String!, $projectId: String!) {\n    project(id: $projectId) {\n      model(id: $modelId) {\n        permissions {\n          canCreateIngestion {\n            authorized\n            code\n            message\n          }\n        }\n      }\n    }\n  }\n"];
+/**
+ * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
+ */
+export function graphql(source: "\n  subscription ProjectModelIngestionUpdated(\n    $input: ProjectModelIngestionSubscriptionInput!\n  ) {\n    projectModelIngestionUpdated(input: $input) {\n      type\n      modelIngestion {\n        id\n        statusData {\n          __typename\n          ... on ModelIngestionSuccessStatus {\n            status\n            versionId\n          }\n          ... on ModelIngestionProcessingStatus {\n            status\n            progressMessage\n            progress\n          }\n          ... on ModelIngestionFailedStatus {\n            status\n            errorReason\n          }\n          ... on ModelIngestionCancelledStatus {\n            status\n            cancellationMessage\n          }\n          ... on ModelIngestionQueuedStatus {\n            status\n            progressMessage\n          }\n        }\n      }\n    }\n  }\n"): (typeof documents)["\n  subscription ProjectModelIngestionUpdated(\n    $input: ProjectModelIngestionSubscriptionInput!\n  ) {\n    projectModelIngestionUpdated(input: $input) {\n      type\n      modelIngestion {\n        id\n        statusData {\n          __typename\n          ... on ModelIngestionSuccessStatus {\n            status\n            versionId\n          }\n          ... on ModelIngestionProcessingStatus {\n            status\n            progressMessage\n            progress\n          }\n          ... on ModelIngestionFailedStatus {\n            status\n            errorReason\n          }\n          ... on ModelIngestionCancelledStatus {\n            status\n            cancellationMessage\n          }\n          ... on ModelIngestionQueuedStatus {\n            status\n            progressMessage\n          }\n        }\n      }\n    }\n  }\n"];
 /**
  * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
  */
@@ -328,6 +336,10 @@ export function graphql(source: "\n  fragment IssuesItem on Issue {\n    id\n
  * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
  */
 export function graphql(source: "\n  query IssuesList($projectId: String!) {\n    project(id: $projectId) {\n      id\n      issues {\n        totalCount\n        items {\n          ...IssuesItem\n        }\n      }\n    }\n  }\n"): (typeof documents)["\n  query IssuesList($projectId: String!) {\n    project(id: $projectId) {\n      id\n      issues {\n        totalCount\n        items {\n          ...IssuesItem\n        }\n      }\n    }\n  }\n"];
+/**
+ * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
+ */
+export function graphql(source: "\n  query IssueResourceMetaSearch(\n    $workspaceId: String!\n    $resourceType: ResourceMetaType!\n    $resourceId: String!\n    $projectId: String\n    $metaType: String\n  ) {\n    resourceMetaSearch(\n      workspaceId: $workspaceId\n      resourceType: $resourceType\n      resourceId: $resourceId\n      projectId: $projectId\n      metaType: $metaType\n    ) {\n      data\n    }\n  }\n"): (typeof documents)["\n  query IssueResourceMetaSearch(\n    $workspaceId: String!\n    $resourceType: ResourceMetaType!\n    $resourceId: String!\n    $projectId: String\n    $metaType: String\n  ) {\n    resourceMetaSearch(\n      workspaceId: $workspaceId\n      resourceType: $resourceType\n      resourceId: $resourceId\n      projectId: $projectId\n      metaType: $metaType\n    ) {\n      data\n    }\n  }\n"];
 /**
  * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
  */

lib/ingestion/composables/useModelIngestion.ts

@@ -1,4 +1,8 @@
-import { provideApolloClient, useMutation } from '@vue/apollo-composable'
+import {
+  provideApolloClient,
+  useMutation,
+  useSubscription
+} from '@vue/apollo-composable'
 import { useAccountStore } from '~/store/accounts'
 import { useHostAppStore } from '~/store/hostApp'
 import {
@@ -8,7 +12,11 @@ import {
   failModelIngestionWithError,
   failModelIngestionWithCancel
 } from '../graphql/mutations'
-import type { SourceDataInput } from '~~/lib/common/generated/gql/graphql'
+import { projectModelIngestionUpdatedSubscription } from '../graphql/subscriptions'
+import type {
+  SourceDataInput,
+  ProjectModelIngestionUpdatedSubscription
+} from '~~/lib/common/generated/gql/graphql'
 import type { ISenderModelCard } from '~/lib/models/card/send'
 import { storeToRefs } from 'pinia'
 import { ToastNotificationType } from '@speckle/ui-components'
@@ -217,11 +225,95 @@ export const useModelIngestion = () => {
     return res?.data?.projectMutations.modelIngestionMutations.completeWithVersion
   }
 
+  // Tracks active ingestion subscriptions so they can be stopped on cancel or terminal state
+  const activeSubscriptions: Record<string, () => void> = {}
+
+  /**
+   * Subscribes to ingestion status updates for a given ingestionId.
+   * Used when the connector (.NET SDK) handles the ingestion and passes the ingestionId
+   * back to the DUI via setModelSendResult. The DUI then subscribes to track
+   * the server-side processing state until a terminal status is reached.
+   *
+   * Manages model card state directly: updates progress, sets versionId on success,
+   * sets error on failure, and clears progress on terminal states.
+   */
+  const subscribeToIngestion = (
+    senderModelCard: ISenderModelCard,
+    ingestionId: string
+  ) => {
+    const client = accountStore.getAccountClient(senderModelCard.accountId)
+
+    senderModelCard.progress = { status: 'Remote processing...' }
+
+    const { onResult, onError, stop } = provideApolloClient(client)(() =>
+      useSubscription(projectModelIngestionUpdatedSubscription, () => ({
+        input: {
+          projectId: senderModelCard.projectId,
+          ingestionReference: { ingestionId }
+        }
+      }))
+    )
+
+    activeSubscriptions[senderModelCard.modelCardId] = stop
+
+    onResult((result) => {
+      const data = result.data as ProjectModelIngestionUpdatedSubscription | undefined
+      const statusData = data?.projectModelIngestionUpdated?.modelIngestion?.statusData
+      if (!statusData) return
+
+      switch (statusData.__typename) {
+        case 'ModelIngestionSuccessStatus':
+          senderModelCard.latestCreatedVersionId = statusData.versionId
+          senderModelCard.progress = undefined
+          unsubscribeFromIngestion(senderModelCard.modelCardId)
+          break
+        case 'ModelIngestionProcessingStatus':
+          senderModelCard.progress = {
+            status: statusData.progressMessage,
+            progress: statusData.progress ?? undefined
+          }
+          break
+        case 'ModelIngestionFailedStatus':
+          senderModelCard.error = {
+            errorMessage: statusData.errorReason,
+            dismissible: true
+          }
+          senderModelCard.progress = undefined
+          unsubscribeFromIngestion(senderModelCard.modelCardId)
+          break
+        case 'ModelIngestionCancelledStatus':
+          senderModelCard.progress = undefined
+          unsubscribeFromIngestion(senderModelCard.modelCardId)
+          break
+        case 'ModelIngestionQueuedStatus':
+          senderModelCard.progress = {
+            status: statusData.progressMessage
+          }
+          break
+      }
+    })
+
+    onError((err) => {
+      console.error('Ingestion subscription error:', err)
+      unsubscribeFromIngestion(senderModelCard.modelCardId)
+    })
+  }
+
+  const unsubscribeFromIngestion = (modelCardId: string) => {
+    const stop = activeSubscriptions[modelCardId]
+    if (stop) {
+      stop()
+      delete activeSubscriptions[modelCardId]
+    }
+  }
+
   return {
     startIngestion,
     updateIngestion,
     failIngestion,
     cancelIngestion,
-    completeIngestionWithVersion
+    completeIngestionWithVersion,
+    subscribeToIngestion,
+    unsubscribeFromIngestion
   }
 }

lib/ingestion/graphql/subscriptions.ts

@@ -0,0 +1,38 @@
+import { graphql } from '~~/lib/common/generated/gql'
+
+export const projectModelIngestionUpdatedSubscription = graphql(`
+  subscription ProjectModelIngestionUpdated(
+    $input: ProjectModelIngestionSubscriptionInput!
+  ) {
+    projectModelIngestionUpdated(input: $input) {
+      type
+      modelIngestion {
+        id
+        statusData {
+          __typename
+          ... on ModelIngestionSuccessStatus {
+            status
+            versionId
+          }
+          ... on ModelIngestionProcessingStatus {
+            status
+            progressMessage
+            progress
+          }
+          ... on ModelIngestionFailedStatus {
+            status
+            errorReason
+          }
+          ... on ModelIngestionCancelledStatus {
+            status
+            cancellationMessage
+          }
+          ... on ModelIngestionQueuedStatus {
+            status
+            progressMessage
+          }
+        }
+      }
+    }
+  }
+`)

lib/issues/graphql/queries.ts

@@ -13,3 +13,23 @@ export const issuesListQuery = graphql(`
     }
   }
 `)
+
+export const issueResourceMetaSearchQuery = graphql(`
+  query IssueResourceMetaSearch(
+    $workspaceId: String!
+    $resourceType: ResourceMetaType!
+    $resourceId: String!
+    $projectId: String
+    $metaType: String
+  ) {
+    resourceMetaSearch(
+      workspaceId: $workspaceId
+      resourceType: $resourceType
+      resourceId: $resourceId
+      projectId: $projectId
+      metaType: $metaType
+    ) {
+      data
+    }
+  }
+`)

lib/validation.ts

@@ -1,6 +1,24 @@
+import { computed } from 'vue'
+import type {
+  ISendFilter,
+  SendFilterSelect,
+  RevitCategoriesSendFilter,
+  RevitViewsSendFilter
+} from '~/lib/models/card/send'
 import { ValidationHelpers } from '@speckle/ui-components'
 import type { GenericValidateFunction } from 'vee-validate'
 
+export const isSelectFilter = (f: ISendFilter): f is SendFilterSelect =>
+  f.type === 'Select' || 'selectedItems' in f
+
+export const isRevitCategoriesFilter = (
+  f: ISendFilter
+): f is RevitCategoriesSendFilter =>
+  f.id === 'revitCategories' || f.id === 'archicadLayers'
+
+export const isRevitViewsFilter = (f: ISendFilter): f is RevitViewsSendFilter =>
+  f.id === 'revitViews'
+
 export const isEmail = ValidationHelpers.isEmail
 
 export const isOneOrMultipleEmails = ValidationHelpers.isOneOrMultipleEmails
@@ -42,3 +60,42 @@ export function useModelNameValidationRules() {
     isValidModelName
   ])
 }
+
+export type FilterValidationResult = { valid: boolean; reason?: string }
+
+export function validateFilter(
+  filter: ISendFilter | undefined,
+  context: { selectionCount: number }
+): FilterValidationResult {
+  if (!filter) return { valid: false, reason: 'No filter selected' }
+
+  // Selection Filter check
+  if (filter.name === 'Selection' || filter.id === 'selection') {
+    return context.selectionCount > 0
+      ? { valid: true }
+      : { valid: false, reason: 'No objects selected to publish' }
+  }
+
+  // List-based filters (Rhino Layers, etc.)
+  if (isSelectFilter(filter)) {
+    return (filter.selectedItems?.length ?? 0) > 0
+      ? { valid: true }
+      : { valid: false, reason: 'No items selected to publish' }
+  }
+
+  // Category-based filters
+  if (isRevitCategoriesFilter(filter)) {
+    return (filter.selectedCategories?.length ?? 0) > 0
+      ? { valid: true }
+      : { valid: false, reason: 'No categories selected to publish' }
+  }
+
+  // View-based filters
+  if (isRevitViewsFilter(filter)) {
+    return filter.selectedView?.trim()
+      ? { valid: true }
+      : { valid: false, reason: 'No view selected to publish' }
+  }
+
+  return { valid: true }
+}

pages/authn/callback.vue

@@ -3,17 +3,16 @@
 </template>
 
 <script setup lang="ts">
-import { md5 } from '@speckle/shared'
 import { ToastNotificationType } from '@speckle/ui-components'
 import { useRoute, useRouter } from 'vue-router'
 import { useAuthManager } from '~/lib/authn/useAuthManager'
-import type { Account } from '~/lib/bindings/definitions/IAccountBinding'
+import { useTokenExchange } from '~/lib/authn/useTokenExchange'
 import { useHostAppStore } from '~/store/hostApp'
 
 const route = useRoute()
 const router = useRouter()
-const { getChallenge, getChallengeUrl } = useAuthManager()
-const { $accountBinding } = useNuxtApp()
+const { getChallenge, getCodeVerifier, getChallengeUrl } = useAuthManager()
+const { exchangeAccessCode } = useTokenExchange()
 const hostApp = useHostAppStore()
 
 onMounted(async () => {
@@ -22,69 +21,11 @@ onMounted(async () => {
     const accessCode = route.query.access_code as string | undefined
     if (accessCode && origin) {
       const challenge = getChallenge()
-      const body = {
-        appId: 'sdui',
-        appSecret: 'sdui',
-        accessCode,
-        challenge
+      if (!challenge) {
+        throw new Error('No challenge found in storage.')
       }
-
-      // Exchange the access code for a real token (optional)
-      const response = await fetch(new URL('/auth/token', origin), {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(body)
-      })
-      if (!response.ok) {
-        const errorText = await response.text()
-
-        hostApp.setNotification({
-          title: 'Log In',
-          type: ToastNotificationType.Danger,
-          description: `Token exchange failed with status ${response.status}: ${errorText}`
-        })
-        // Stop processing and redirect immediately on failure
-        return router.replace('/')
-      }
-
-      const { token, refreshToken } = (await response.json()) as {
-        token: string
-        refreshToken: string
-      }
-
-      const graphqlQuery = {
-        query:
-          'query { activeUser { id name email company avatar } serverInfo { name company adminContact description version } }'
-      }
-
-      const userAndServerInfoResponse = await fetch(new URL('/graphql', origin), {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          Authorization: `Bearer ${token}` // Add the token as a Bearer token
-        },
-        body: JSON.stringify(graphqlQuery)
-      })
-
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-      const userAndServerInfo = await userAndServerInfoResponse.json()
-      const accountId = md5(
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
-        userAndServerInfo.data.activeUser.email + origin
-      ).toUpperCase()
-
-      const account: Account = {
-        id: accountId,
-        token,
-        refreshToken,
-        isDefault: true,
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access
-        serverInfo: { url: origin, ...userAndServerInfo.data.serverInfo },
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access
-        userInfo: userAndServerInfo.data.activeUser
-      }
-
-      await $accountBinding.addAccount(accountId, account)
+      const codeVerifier = getCodeVerifier() ?? undefined
+      await exchangeAccessCode(origin, accessCode, challenge, codeVerifier)
     } else {
       throw new Error('No access code is found.')
     }
@@ -92,7 +33,7 @@ onMounted(async () => {
     hostApp.setNotification({
       type: ToastNotificationType.Danger,
       title: 'Failed to add your Speckle account.',
-      description: error as string
+      description: error instanceof Error ? error.message : (error as string)
     })
   } finally {
     router.replace('/')

plugins/00.bindings.ts

@@ -8,6 +8,7 @@ import {
   IAccountBindingKey,
   MockedAccountBinding
 } from '~/lib/bindings/definitions/IAccountBinding'
+import type { IParametersBinding } from '~/lib/bindings/definitions/IParametersBinding'
 
 import type { ITestBinding } from '~/lib/bindings/definitions/ITestBinding'
 import {
@@ -132,6 +133,10 @@ export default defineNuxtPlugin(async () => {
       ITopLevelExpectionHandlerBindingKey
     )
 
+  const parametersBinding = await tryHoistBinding<IParametersBinding>(
+    'parametersBinding'
+  )
+
   // Any binding implments these two methods below, we just choose one to
   // expose globally to the app.
   const showDevTools = () => {
@@ -157,7 +162,8 @@ export default defineNuxtPlugin(async () => {
       topLevelExceptionHandlerBinding,
       showDevTools,
       openUrl,
-      revitMapperBinding
+      revitMapperBinding,
+      parametersBinding
     }
   }
 })

store/hostApp.ts

@@ -13,6 +13,8 @@ import type {
   RevitViewsSendFilter,
   SendFilterSelect
 } from '~/lib/models/card/send'
+import { useSelectionStore } from '~/store/selection'
+import { validateFilter } from '~/lib/validation'
 import type { ToastNotification } from '@speckle/ui-components'
 import { ToastNotificationType } from '@speckle/ui-components'
 import type { Nullable } from '@speckle/shared'
@@ -51,7 +53,9 @@ export const useHostAppStore = defineStore('hostAppStore', () => {
     updateIngestion,
     failIngestion,
     cancelIngestion,
-    completeIngestionWithVersion
+    completeIngestionWithVersion,
+    subscribeToIngestion,
+    unsubscribeFromIngestion
   } = useModelIngestion()
   const isDistributedBySpeckle = ref<boolean>(true)
   const latestAvailableVersion = ref<Version | null>(null)
@@ -366,6 +370,14 @@ export const useHostAppStore = defineStore('hostAppStore', () => {
    */
   app.$sendBinding?.on('refreshSendFilters', () => void refreshSendFilters())
 
+  const validateSendFilter = (filter?: ISendFilter) => {
+    const selectionStore = useSelectionStore()
+
+    return validateFilter(filter, {
+      selectionCount: selectionStore.selectionInfo.selectedObjectIds?.length ?? 0
+    })
+  }
+
   /**
    * Send functionality
    */
@@ -477,6 +489,9 @@ export const useHostAppStore = defineStore('hostAppStore', () => {
     void trackEvent('DUI3 Action', { name: 'Send Cancel' }, model.accountId)
     model.latestCreatedVersionId = undefined
 
+    // Clean up any active ingestion subscription from SDK-based connectors
+    unsubscribeFromIngestion(modelCardId)
+
     // Cancel the ingestion if applicable
     if (shouldHandleIngestion.value) {
       const ingestionId = activeIngestions.value[modelCardId]
@@ -500,13 +515,22 @@ export const useHostAppStore = defineStore('hostAppStore', () => {
     modelCardId: string
     versionId: string
     sendConversionResults: ConversionResult[]
+    ingestionId?: string
   }) => {
     const model = documentModelStore.value.models.find(
       (m) => m.modelCardId === args.modelCardId
     ) as ISenderModelCard
-    model.latestCreatedVersionId = args.versionId
+    // Conversion results are always valid regardless of ingestion state
     model.report = args.sendConversionResults
-    model.progress = undefined
+
+    if (args.ingestionId) {
+      // Connector handled ingestion via SDK — composable subscribes and manages model card state to 'Version created' bla bla
+      subscribeToIngestion(model, args.ingestionId)
+    } else {
+      // Legacy path or no ingestion — behave as before
+      model.latestCreatedVersionId = args.versionId
+      model.progress = undefined
+    }
   }
 
   app.$sendBinding?.on('setModelSendResult', setModelSendResult)
@@ -924,6 +948,7 @@ export const useHostAppStore = defineStore('hostAppStore', () => {
     getSendSettings,
     setModelSendResult,
     setModelReceiveResult,
-    handleModelProgressEvents
+    handleModelProgressEvents,
+    validateSendFilter
   }
 })