@oddington/sdk 0.1.16 → 0.1.18

package/README.md

@@ -12,6 +12,16 @@ same key and content returns the original result; changed content conflicts.
 Existing Inbox-retained files remain separate from shared Files, with their
 original identities, bytes and audience. The SDK exposes no raw-credential API.
 
+Focused apps use `inbox.questions.list()` for `AnswerableQuestion[]`, with relevance
+bound by the trusted host to the canonical routines in the app declaration.
+The same list, answer and Record-search methods work in hosted and local apps.
+`InboxItem` remains the complete first-party Inbox value. Record refs are placement
+hints only: match them against independently authorized Data, and omit ambiguous
+detail placement. Keep drafts on failed or uncertain acceptance, prevent duplicate
+interaction while submitting, and dismiss a Question only after acknowledged
+acceptance. Refresh after a conflict; later effects remain Inbox work. These
+interaction duties belong to the consuming app's interface.
+
 ```sh
 npm install @oddington/sdk
 ```
@@ -95,7 +105,7 @@ try {
 
 os.init({ auth: browserAuth }); // Trusted workspace host startup only.
 // Later: await browserAuth.signOut(); // Ends only this browser's session.
-// On host teardown:
+// On document teardown (refresh, navigation or close):
 unsubscribe();
 browserAuth.dispose();
 ```
@@ -113,6 +123,12 @@ provider, configuration, membership list or access/refresh credential. Consumers
 never construct bearer headers. Multiple handles share provider coordination on
 the same origin; each owns its subscription/disposal independently.
 
+`dispose()` releases that handle's subscriptions, timers, installed SDK context
+and pending in-memory work. It does not sign out. A disposed handle cannot be
+reused; a refreshed or reopened document creates a fresh handle and calls
+`os.init({ auth: browserAuth })` again. Use `signOut()` to end the browser session
+and invalidate its installed capabilities intentionally.
+
 The hosted runtime routes that exact capability path directly to OS while the
 app keeps its independently deployed interface and other paths. Operators must
 activate and verify the OS route before releasing a consumer that depends on
@@ -162,7 +178,7 @@ approves a fresh request. Results are validated consent labels, safe status or a
 completed `returnUrl`; Auth owns navigation. Decisions require prior inspection
 and remain bound to the current request and account. The reserved auth origin
 cannot obtain workspace capabilities even if a caller invokes `os.init` there.
-Existing Inbox/customer apps and local browser sessions are separate migrations.
+Existing Inbox/customer apps and local app hosting are separate migrations.
 
 The same `os.init({ auth })` call also consumes authenticated bootstrap state on
 an OS-launched IPv4 loopback origin. It checks `/_os/app/context` on that exact
@@ -222,8 +238,15 @@ cancellation requests do not acknowledge cancellation. Handles expose no IDs,
 cursors, raw output or process controls. Local sign-out, expiry, context
 replacement, origin changes and unconfirmed credential changes invalidate pending work.
 
-The exact-origin browser credential survives reload and tab closure in local
-storage. Each active initialization proactively renews before expiry, normally
+The exact-origin browser credential survives document disposal, reload and tab
+closure in local storage. Disposal rejects the outgoing document's pending
+operations and disconnects its Run handles without cancelling the host-owned
+child. Fresh initialization at the same live Local Host origin can call the
+declared operation's `recover()` to continue that same owned Run without
+launching it again. Old handles remain invalid. Recovery is limited to the same
+authorized logical session, live Host and operation; it is not durable history.
+
+Each active initialization proactively renews before expiry, normally
 sixty seconds early with a shorter lead for shorter lifetimes. Only the exact
 Local Host silently refreshes the secure CLI login and confirms unchanged
 complete access. Successful renewal rotates only the bounded browser credential;
@@ -233,9 +256,10 @@ retry proactively without starting or delaying Data reads. They
 confirm the stored winner against the same Host and logical session before
 silently adopting it. Rotation preserves admitted Data/results and owned runs;
 old credentials cannot admit new requests and failed writes, launches and
-cancellations are never replayed. Sign-out, replacement and expiry cancel
-renewal, including pending response bodies. Host expiry and current membership
-remain authoritative; stored state cannot revive a stopped host. Recovery
+cancellations are never replayed. Disposal, sign-out, replacement and expiry
+cancel renewal, including pending response bodies. Unlike disposal, sign-out,
+expiry, confirmed revocation and host stop end local access. Host expiry and
+current membership remain authoritative; stored state cannot revive a stopped host. Recovery
 covers only the operation's current logical session and bounded terminal grace,
 without relaunching or durable history.
 Supplied File inputs currently reject `execution_unavailable` before launch;

package/dist/browser.js

@@ -1782,9 +1782,14 @@ var InboxOperationError = class extends Error {
   }
   status;
   reason;
-}, INBOX_RESULT_BYTES = 8 * 1024 * 1024, INBOX_INPUT_BYTES = 8192, INBOX_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i, operations = {
+}, INBOX_RESULT_BYTES = 8 * 1024 * 1024, INBOX_INPUT_BYTES = 8192, INBOX_LOCAL_INPUT_BYTES = 256 * 1024, INBOX_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function isAppQuestionOperation(operation2) {
+  return operation2 === "questions.list" || operation2 === "questions.answer" || operation2 === "questions.searchRecords";
+}
+var operations = {
   current: [],
   "items.list": [],
+  "questions.list": [],
   "items.read": ["itemId"],
   "items.see": ["itemId"],
   "items.markDigestRead": ["itemId"],
@@ -1937,7 +1942,7 @@ function parseInboxRequest(value) {
     let envelope = object3(value);
     assert(Object.keys(envelope).sort().join(",") === "input,operation"), assert(typeof envelope.operation == "string" && Object.hasOwn(operations, envelope.operation));
     let operation2 = envelope.operation, input = object3(envelope.input), required = operations[operation2];
-    assert(required.every((key) => Object.hasOwn(input, key)) && Object.keys(input).every((key) => required.includes(key) || operation2 === "questions.searchRecords" && key === "selected" || operation2 === "items.list" && key === "beforeNumber"));
+    assert(required.every((key) => Object.hasOwn(input, key)) && Object.keys(input).every((key) => required.includes(key) || operation2 === "questions.searchRecords" && key === "selected" || (operation2 === "items.list" || operation2 === "questions.list") && key === "beforeNumber"));
     for (let key of ["itemId", "personId", "fileId"]) key in input && assert(id2(input[key]));
     return "revision" in input && assert(integer(input.revision)), "beforeNumber" in input && assert(integer(input.beforeNumber)), "questionId" in input && assert(text3(input.questionId) && input.questionId === input.questionId.trim()), "title" in input && assert(text3(input.title)), "lifecycle" in input && assert(input.lifecycle === "open" || input.lifecycle === "closed"), "query" in input && assert(text3(input.query, !0) && input.query.length <= 256), "selected" in input && recordReference(input.selected), "response" in input && response(input.response), assert(new TextEncoder().encode(JSON.stringify(envelope)).byteLength <= INBOX_INPUT_BYTES), { operation: operation2, input };
   } catch {
@@ -1990,12 +1995,32 @@ function parseInboxItem(value) {
     assert(id2(work.id) && text3(work.questionId) && text3(work.reason) && optionalDate(work.settledAt));
   }), item;
 }
+function parseAnswerableQuestion(value) {
+  let entry = object3(json2(value));
+  keys3(entry, ["item", "origin", "question", "recordRefs"]);
+  let item = object3(entry.item);
+  keys3(item, ["id", "number", "revision", "title", "href"]), assert(id2(item.id) && integer(item.number) && integer(item.revision) && text3(item.title) && text3(item.href));
+  let link = new URL(item.href), slug = link.hostname.slice(0, -13);
+  assert(link.hostname.endsWith(".oddington.ai") && slug.length <= 63 && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug) && !["auth", "www", "api", "os"].includes(slug) && item.href === `https://${slug}.oddington.ai/inbox/${item.id}`);
+  let origin = object3(entry.origin);
+  keys3(origin, ["routine"]), assert(text3(origin.routine) && origin.routine === origin.routine.trim());
+  let question2 = object3(entry.question);
+  keys3(question2, ["id", "prompt", "instructions", "response"]), assert(text3(question2.id) && question2.id === question2.id.trim() && text3(question2.prompt) && (question2.instructions === null || text3(question2.instructions, !0))), responseDefinition(question2.response);
+  let refs = array2(entry.recordRefs);
+  return assert(refs.every((ref) => text3(ref) && ref === ref.trim()) && new Set(refs).size === refs.length), entry;
+}
 function parseInboxAcceptance(value) {
   let accepted = object3(value);
   return assert(id2(accepted.responseId) && date(accepted.acceptedAt)), "executionId" in accepted && assert(id2(accepted.executionId)), "acceptanceOrder" in accepted && assert(integer(accepted.acceptanceOrder)), "label" in accepted && assert(text3(accepted.label)), accepted;
 }
 function parseInboxResult(operation2, value) {
   if (operation2 === "current") return parseInboxCurrent(value);
+  if (operation2 === "questions.list") {
+    let page = object3(value);
+    keys3(page, ["questions", "nextBeforeNumber"]);
+    let questions = array2(page.questions).map(parseAnswerableQuestion);
+    return assert(page.nextBeforeNumber === null || integer(page.nextBeforeNumber)), { questions, nextBeforeNumber: page.nextBeforeNumber };
+  }
   if (operation2 === "items.read") return parseInboxItem(value);
   if (operation2 === "items.list") {
     let page = object3(value), items = array2(page.items).map(parseInboxItem);
@@ -2063,128 +2088,61 @@ async function limitedBody(request, limit, timeoutMs) {
   }
 }
 
-var unavailable2 = () => new InboxOperationError(503, "unavailable"), stale = () => new InboxOperationError(401, "authority_unavailable");
-async function send2(operation2, input) {
-  let envelope = parseInboxRequest({ operation: operation2, input }), context2;
-  try {
-    context2 = await resolveAppContext();
-  } catch {
-    throw stale();
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function parseInboxHostContext(value) {
+  if (!value || typeof value != "object" || Array.isArray(value)) throw new Error("Inbox context unavailable");
+  let v = value;
+  if (v.kind !== "inbox" && v.kind !== "focused" || Object.keys(v).sort().join(",") !== (v.kind === "inbox" ? "generation,kind,memberId,workspaceId" : "appId,generation,kind,memberId,workspaceId") || typeof v.workspaceId != "string" || !UUID.test(v.workspaceId) || typeof v.memberId != "string" || !UUID.test(v.memberId) || typeof v.generation != "string" || !UUID.test(v.generation) || v.kind === "focused" && (typeof v.appId != "string" || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(v.appId)))
+    throw new Error("Inbox context unavailable");
+  let base = { workspaceId: v.workspaceId, memberId: v.memberId, generation: v.generation };
+  return Object.freeze(v.kind === "inbox" ? { ...base, kind: "inbox" } : { ...base, kind: "focused", appId: v.appId });
+}
+
+var InboxContextError = class extends Error {
+  constructor(status) {
+    super("Inbox context unavailable");
+    this.status = status;
   }
-  if (context2.kind === "local" || context2.endpoint !== `https://${context2.workspace}.oddington.ai` || ["auth", "www", "api", "os"].includes(context2.workspace)) throw stale();
-  let check = () => {
-    if (!context2.isCurrent() || !Number.isFinite(context2.expiresAt) || context2.expiresAt <= Date.now()) throw stale();
-  };
-  check();
-  try {
-    let response2 = await fetch(`${context2.endpoint}/api/inbox`, {
-      method: "POST",
-      headers: { authorization: `Bearer ${context2.accessToken}`, "content-type": "application/json" },
-      body: JSON.stringify(envelope),
+  status;
+}, contexts = /* @__PURE__ */ new WeakMap();
+function resolveHostedInboxContext(host) {
+  if (!host.binding || !host.memberId) throw new Error("Inbox context unavailable");
+  let resolve = contexts.get(host.binding);
+  return resolve || (resolve = hostedInboxContext(), contexts.set(host.binding, resolve)), resolve({ ...host, memberId: host.memberId });
+}
+function hostedInboxContext() {
+  let installed2, revision = 0, issued = 0, settled = 0;
+  return async (host) => {
+    let started = ++issued, check = () => {
+      if (!host.isCurrent() || host.expiresAt <= Date.now()) throw new Error("Inbox context unavailable");
+    };
+    check();
+    let response2 = await fetch(`${host.endpoint}/api/inbox/context`, {
+      method: "GET",
+      headers: { authorization: `Bearer ${host.accessToken}` },
+      credentials: "omit",
       redirect: "error",
       cache: "no-store",
-      signal: AbortSignal.timeout(3e4)
+      signal: AbortSignal.timeout(15e3)
     });
     try {
-      check();
-    } catch (error) {
-      throw response2.body?.cancel().catch(() => {
-      }), error;
-    }
-    if (!response2.ok)
-      throw response2.body?.cancel().catch(() => {
-      }), new InboxOperationError(
-        [400, 401, 403, 409].includes(response2.status) ? response2.status : 503,
-        response2.status === 400 ? "invalid_input" : response2.status === 401 ? "authority_unavailable" : response2.status === 403 ? "access_denied" : response2.status === 409 ? "conflict" : "unavailable"
-      );
-    if (response2.status !== 200)
-      throw response2.body?.cancel().catch(() => {
-      }), unavailable2();
-    if (operation2 === "files.read") {
-      if (!response2.body) throw unavailable2();
-      let source = response2.body, reader, size = 0, cancel = async (reason) => {
-        try {
-          await (reader ? reader.cancel(reason) : source.cancel(reason));
-        } finally {
-          reader?.releaseLock();
-        }
-      }, body2 = new ReadableStream({
-        async pull(controller) {
-          try {
-            check(), reader ??= source.getReader();
-            let next = await reader.read();
-            if (check(), next.done) {
-              reader.releaseLock(), controller.close();
-              return;
-            }
-            if (size += next.value.byteLength, size > 25 * 1024 * 1024) throw unavailable2();
-            controller.enqueue(next.value);
-          } catch (error) {
-            controller.error(error), await cancel(error).catch(() => {
-            });
-          }
-        },
-        cancel
-      }, { highWaterMark: 0 });
-      return new Response(body2, { status: response2.status, headers: response2.headers });
-    }
-    let bytes = await limitedBody(response2, INBOX_RESULT_BYTES);
-    if (check(), !bytes) throw unavailable2();
-    let value = JSON.parse(new TextDecoder("utf-8", { fatal: !0 }).decode(bytes)), parsed = parseInboxResult(operation2, value);
-    if (check(), operation2 === "current" && parsed.workspace.slug !== context2.workspace) throw unavailable2();
-    if ("itemId" in envelope.input) {
-      let item = operation2 === "items.read" ? parsed : operation2 === "items.rename" || operation2 === "items.setLifecycle" || operation2 === "items.addRecipient" ? parsed.item : void 0;
-      if (item && (item.id !== envelope.input.itemId || "revision" in envelope.input && item.revision !== envelope.input.revision) || operation2 === "items.addRecipient" && parsed.addedPersonId !== envelope.input.personId || operation2 === "questions.answer" && typeof envelope.input.response.selection == "object" && !parsed.label?.trim()) throw unavailable2();
-    }
-    return parsed;
-  } catch (error) {
-    throw check(), error instanceof InboxOperationError ? error : unavailable2();
-  }
-}
-var inbox = {
-  current: async () => await send2("current", {}),
-  items: {
-    async list() {
-      let items = [], beforeNumber, initial;
-      try {
-        initial = await resolveAppContext();
-      } catch {
-        throw stale();
+      if (check(), (response2.status === 401 || response2.status === 403) && (installed2 = void 0, revision++, settled = Math.max(settled, started)), !response2.ok || response2.status !== 200) throw new InboxContextError(response2.status);
+      let bytes = await limitedBody(response2, 4096);
+      if (check(), !bytes) throw new Error("Inbox context unavailable");
+      let context2 = parseInboxHostContext(JSON.parse(new TextDecoder("utf-8", { fatal: !0 }).decode(bytes)));
+      if (context2.memberId !== host.memberId) throw new Error("Inbox context unavailable");
+      if (JSON.stringify(installed2) !== JSON.stringify(context2)) {
+        if (started < settled) throw new Error("Inbox context unavailable");
+        installed2 = context2, revision++;
       }
-      let check = () => {
-        if (!initial.isCurrent() || initial.expiresAt <= Date.now()) throw stale();
-      };
-      do {
-        check();
-        let page = await send2("items.list", beforeNumber === void 0 ? {} : { beforeNumber });
-        if (check(), beforeNumber !== void 0 && (page.items.some((item) => item.number >= beforeNumber) || page.nextBeforeNumber !== null && page.nextBeforeNumber >= beforeNumber)) throw unavailable2();
-        if (items.push(...page.items), page.nextBeforeNumber === null) return items;
-        beforeNumber = page.nextBeforeNumber;
-      } while (!0);
-    },
-    read: async (itemId) => await send2("items.read", { itemId }),
-    see: async (itemId) => {
-      await send2("items.see", { itemId });
-    },
-    markDigestRead: async (itemId) => await send2("items.markDigestRead", { itemId }),
-    rename: async (input) => await send2("items.rename", input),
-    setLifecycle: async (input) => await send2("items.setLifecycle", input),
-    listRecipientCandidates: async (itemId) => await send2("items.listRecipientCandidates", { itemId }),
-    addRecipient: async (input) => await send2("items.addRecipient", input)
-  },
-  questions: {
-    answer: async (input) => await send2("questions.answer", input),
-    searchRecords: async (input) => await send2("questions.searchRecords", input)
-  },
-  files: { read: async (input) => await send2("files.read", input) }
-};
-
-var sources = /* @__PURE__ */ new WeakMap();
-function registerBrowserAuth(handle2, source) {
-  sources.set(handle2, source);
-}
-function browserAuthSource(handle2) {
-  return sources.get(handle2);
+      settled = Math.max(settled, started);
+      let current2 = revision;
+      return Object.freeze({ context: context2, isCurrent: () => host.isCurrent() && host.expiresAt > Date.now() && current2 === revision });
+    } finally {
+      response2.body?.cancel().catch(() => {
+      });
+    }
+  };
 }
 
 var sessionKey = "_os.app.session", responseChecks = /* @__PURE__ */ new WeakMap(), AppResponseReadError = class extends Error {
@@ -2426,10 +2384,17 @@ function appContext(origin, active2) {
       throw error instanceof DataOperationError ? error : !current2() || controller.signal.aborted ? new DataOperationError("context_unavailable") : new DataOperationError("unavailable", !0);
     }
   }
+  async function requestInbox(operation2, input) {
+    if (!["questions.list", "questions.answer", "questions.searchRecords"].includes(operation2)) throw new Error("Inbox operation unavailable");
+    return requestChecked(`${origin}/_os/app/inbox`, { method: "POST", body: JSON.stringify({ operation: operation2, input }) }, !0);
+  }
   async function requestRoutine(key, suffix, init2 = {}) {
+    return requestChecked(`${origin}/_os/app/routines/${encodeURIComponent(key)}/${suffix}`, init2);
+  }
+  async function requestChecked(url, init2, inbox2 = !1) {
     if (!current2())
       throw invalidate(), new Error("Local app context unavailable.");
-    let url = `${origin}/_os/app/routines/${encodeURIComponent(key)}/${suffix}`, admitted = credential, response2 = await fetch(url, {
+    let admitted = credential, response2 = await fetch(url, {
       ...init2,
       credentials: "omit",
       redirect: "error",
@@ -2441,7 +2406,7 @@ function appContext(origin, active2) {
     for (await synchronize(); alive() && stored() !== credential; ) await synchronize();
     if (!current2() || response2.redirected || response2.url && response2.url !== url)
       throw invalidate(), new Error("Local app context unavailable.");
-    return (response2.status === 401 || response2.status === 403) && admitted === credential && invalidate(), responseChecks.set(response2, async (value) => {
+    return (response2.status === 401 || !inbox2 && response2.status === 403) && admitted === credential && invalidate(), responseChecks.set(response2, async (value) => {
       for (await synchronize(); alive() && stored() !== credential; ) await synchronize();
       admitted === credential && value && typeof value == "object" && "error" in value && value.error === "authority_unavailable" && invalidate();
     }), response2;
@@ -2461,6 +2426,7 @@ function appContext(origin, active2) {
       },
       requestRoutine,
       requestData,
+      requestInbox,
       requestAvailability: (key) => requestRoutine(key, "availability", { method: "GET" })
     };
   }
@@ -2503,6 +2469,193 @@ function validBinding(value) {
   return typeof binding.appId == "string" && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(binding.appId) && typeof binding.workspace == "string" && /^[a-z0-9][a-z0-9-]{0,62}$/.test(binding.workspace) && typeof binding.memberId == "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(binding.memberId) && typeof binding.sessionId == "string" && /^[A-Za-z0-9_-]{43}$/.test(binding.sessionId) && typeof binding.expiresAt == "number" && Number.isFinite(binding.expiresAt);
 }
 
+var unavailable2 = () => new InboxOperationError(503, "unavailable"), stale = () => new InboxOperationError(401, "authority_unavailable");
+function hostFailure(error, context2) {
+  return !context2.isCurrent() || context2.expiresAt <= Date.now() || error instanceof InboxContextError && error.status === 401 ? stale() : error instanceof InboxContextError && error.status === 403 ? new InboxOperationError(403, "access_denied") : unavailable2();
+}
+async function send2(operation2, input) {
+  let envelope = parseInboxRequest({ operation: operation2, input }), context2;
+  try {
+    context2 = await resolveAppContext();
+  } catch {
+    throw stale();
+  }
+  if (context2.kind === "local") {
+    if (!isAppQuestionOperation(operation2)) throw new InboxOperationError(403, "access_denied");
+    let check2 = () => {
+      if (!context2.isCurrent() || context2.signal.aborted || context2.expiresAt <= Date.now()) throw stale();
+    };
+    try {
+      let response2 = await context2.requestInbox(operation2, envelope.input), value = await appResponse(response2, INBOX_RESULT_BYTES, context2.signal);
+      if (check2(), !response2.ok) throw new InboxOperationError(
+        [400, 401, 403, 409].includes(response2.status) ? response2.status : 503,
+        response2.status === 400 ? "invalid_input" : response2.status === 401 ? "authority_unavailable" : response2.status === 403 ? "access_denied" : response2.status === 409 ? "conflict" : "unavailable"
+      );
+      if (response2.status !== 200) throw unavailable2();
+      let parsed = parseInboxResult(operation2, value);
+      if (check2(), operation2 === "questions.answer" && typeof envelope.input.response.selection == "object" && !parsed.label?.trim()) throw unavailable2();
+      return parsed;
+    } catch (error) {
+      throw check2(), error instanceof InboxOperationError ? error : unavailable2();
+    }
+  }
+  if (context2.endpoint !== `https://${context2.workspace}.oddington.ai` || ["auth", "www", "api", "os"].includes(context2.workspace)) throw stale();
+  let host;
+  try {
+    host = await resolveHostedInboxContext(context2);
+  } catch (error) {
+    throw hostFailure(error, context2);
+  }
+  if (!host) throw unavailable2();
+  let check = () => {
+    if (!context2.isCurrent() || !host.isCurrent() || !Number.isFinite(context2.expiresAt) || context2.expiresAt <= Date.now()) throw stale();
+  };
+  if (check(), host.context.kind === "focused" && !isAppQuestionOperation(operation2))
+    throw new InboxOperationError(403, "access_denied");
+  try {
+    let response2 = await fetch(`${context2.endpoint}/api/inbox`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${context2.accessToken}`, "content-type": "application/json" },
+      body: JSON.stringify(envelope),
+      redirect: "error",
+      cache: "no-store",
+      signal: AbortSignal.timeout(3e4)
+    });
+    try {
+      check();
+    } catch (error) {
+      throw response2.body?.cancel().catch(() => {
+      }), error;
+    }
+    if (!response2.ok)
+      throw response2.body?.cancel().catch(() => {
+      }), new InboxOperationError(
+        [400, 401, 403, 409].includes(response2.status) ? response2.status : 503,
+        response2.status === 400 ? "invalid_input" : response2.status === 401 ? "authority_unavailable" : response2.status === 403 ? "access_denied" : response2.status === 409 ? "conflict" : "unavailable"
+      );
+    if (response2.status !== 200)
+      throw response2.body?.cancel().catch(() => {
+      }), unavailable2();
+    if (operation2 === "files.read") {
+      if (!response2.body) throw unavailable2();
+      let source = response2.body, reader, size = 0, cancel = async (reason) => {
+        try {
+          await (reader ? reader.cancel(reason) : source.cancel(reason));
+        } finally {
+          reader?.releaseLock();
+        }
+      }, body2 = new ReadableStream({
+        async pull(controller) {
+          try {
+            check(), reader ??= source.getReader();
+            let next = await reader.read();
+            if (check(), next.done) {
+              reader.releaseLock(), controller.close();
+              return;
+            }
+            if (size += next.value.byteLength, size > 25 * 1024 * 1024) throw unavailable2();
+            controller.enqueue(next.value);
+          } catch (error) {
+            controller.error(error), await cancel(error).catch(() => {
+            });
+          }
+        },
+        cancel
+      }, { highWaterMark: 0 });
+      return new Response(body2, { status: response2.status, headers: response2.headers });
+    }
+    let bytes = await limitedBody(response2, INBOX_RESULT_BYTES);
+    if (check(), !bytes) throw unavailable2();
+    let value = JSON.parse(new TextDecoder("utf-8", { fatal: !0 }).decode(bytes)), parsed = parseInboxResult(operation2, value);
+    if (check(), operation2 === "current" && parsed.workspace.slug !== context2.workspace) throw unavailable2();
+    if ("itemId" in envelope.input) {
+      let item = operation2 === "items.read" ? parsed : operation2 === "items.rename" || operation2 === "items.setLifecycle" || operation2 === "items.addRecipient" ? parsed.item : void 0;
+      if (item && (item.id !== envelope.input.itemId || "revision" in envelope.input && item.revision !== envelope.input.revision) || operation2 === "items.addRecipient" && parsed.addedPersonId !== envelope.input.personId || operation2 === "questions.answer" && typeof envelope.input.response.selection == "object" && !parsed.label?.trim()) throw unavailable2();
+    }
+    return parsed;
+  } catch (error) {
+    throw check(), error instanceof InboxOperationError ? error : unavailable2();
+  }
+}
+var inbox = {
+  current: async () => await send2("current", {}),
+  items: {
+    async list() {
+      let items = [], beforeNumber, initial;
+      try {
+        initial = await resolveAppContext();
+      } catch {
+        throw stale();
+      }
+      let host;
+      try {
+        host = initial.kind !== "local" && await resolveHostedInboxContext(initial);
+      } catch (error) {
+        throw hostFailure(error, initial);
+      }
+      if (initial.kind === "local") throw new InboxOperationError(403, "access_denied");
+      if (!host) throw unavailable2();
+      let check = () => {
+        if (!initial.isCurrent() || !host.isCurrent() || initial.expiresAt <= Date.now()) throw stale();
+      };
+      do {
+        check();
+        let page = await send2("items.list", beforeNumber === void 0 ? {} : { beforeNumber });
+        if (check(), beforeNumber !== void 0 && (page.items.some((item) => item.number >= beforeNumber) || page.nextBeforeNumber !== null && page.nextBeforeNumber >= beforeNumber)) throw unavailable2();
+        if (items.push(...page.items), page.nextBeforeNumber === null) return items;
+        beforeNumber = page.nextBeforeNumber;
+      } while (!0);
+    },
+    read: async (itemId) => await send2("items.read", { itemId }),
+    see: async (itemId) => {
+      await send2("items.see", { itemId });
+    },
+    markDigestRead: async (itemId) => await send2("items.markDigestRead", { itemId }),
+    rename: async (input) => await send2("items.rename", input),
+    setLifecycle: async (input) => await send2("items.setLifecycle", input),
+    listRecipientCandidates: async (itemId) => await send2("items.listRecipientCandidates", { itemId }),
+    addRecipient: async (input) => await send2("items.addRecipient", input)
+  },
+  questions: {
+    async list() {
+      let questions = [], beforeNumber, initial;
+      try {
+        initial = await resolveAppContext();
+      } catch {
+        throw stale();
+      }
+      let host;
+      try {
+        host = initial.kind !== "local" && await resolveHostedInboxContext(initial);
+      } catch (error) {
+        throw hostFailure(error, initial);
+      }
+      if (initial.kind !== "local" && !host) throw unavailable2();
+      let check = () => {
+        if (!initial.isCurrent() || host && !host.isCurrent() || initial.expiresAt <= Date.now()) throw stale();
+      };
+      do {
+        check();
+        let page = await send2("questions.list", beforeNumber === void 0 ? {} : { beforeNumber });
+        if (check(), page.questions.some((question2) => question2.item.href !== `https://${initial.workspace}.oddington.ai/inbox/${question2.item.id}`) || beforeNumber !== void 0 && (page.questions.some((question2) => question2.item.number >= beforeNumber) || page.nextBeforeNumber !== null && page.nextBeforeNumber >= beforeNumber)) throw unavailable2();
+        if (questions.push(...page.questions), page.nextBeforeNumber === null) return questions;
+        beforeNumber = page.nextBeforeNumber;
+      } while (!0);
+    },
+    answer: async (input) => await send2("questions.answer", input),
+    searchRecords: async (input) => await send2("questions.searchRecords", input)
+  },
+  files: { read: async (input) => await send2("files.read", input) }
+};
+
+var sources = /* @__PURE__ */ new WeakMap();
+function registerBrowserAuth(handle2, source) {
+  sources.set(handle2, source);
+}
+function browserAuthSource(handle2) {
+  return sources.get(handle2);
+}
+
 var installedDispose;
 function init({ auth: input }) {
   installedDispose?.();
@@ -2521,10 +2674,7 @@ function init({ auth: input }) {
     url.protocol === "https:" && !url.port && !url.username && !url.password && !url.search && !url.hash && url.pathname === "/" && /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(slug) && slug !== "auth" && (endpoint = url.origin, workspace = slug);
   } catch {
   }
-  let active2 = !0, revision = 0, person, token, local = localOrigin ? appContext(localOrigin, () => active2) : void 0, { data: { subscription } } = auth2.onAuthStateChange((event2, session) => {
-    let next = session?.user.id ?? null;
-    (event2 === "SIGNED_OUT" || person !== void 0 && next !== person || registered && person !== void 0 && event2 === "SIGNED_IN" && token !== session?.access_token) && (revision++, local?.invalidate()), person = next, token = session?.access_token;
-  }), uninstall = installMemberContext(async () => {
+  let active2 = !0, revision = 0, person, token, binding = {}, local = localOrigin ? appContext(localOrigin, () => active2) : void 0, subscription, stopDisposal, uninstall = installMemberContext(async () => {
     if (local) return local.resolve();
     if (!active2 || !endpoint || !workspace || globalThis.location.origin !== endpoint) throw new Error("Hosted Data context unavailable.");
     let started = revision, { data: { session }, error } = await auth2.getSession();
@@ -2533,17 +2683,24 @@ function init({ auth: input }) {
     let expiresAt = (session.expires_at ?? 0) * 1e3;
     if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() || !session.user.id)
       throw new Error("Hosted Data context unavailable.");
-    return person = session.user.id, {
+    person = session.user.id;
+    let isCurrent = () => active2 && globalThis.location.origin === endpoint && revision === started && person === session.user.id;
+    return {
       workspace,
       endpoint,
       accessToken: session.access_token,
       expiresAt,
-      isCurrent: () => active2 && globalThis.location.origin === endpoint && revision === started && person === session.user.id
+      isCurrent,
+      memberId: session.user.id,
+      binding
     };
   }), dispose = () => {
-    active2 && (active2 = !1, local?.dispose(), revision++, subscription.unsubscribe(), uninstall(), installedDispose === dispose && (installedDispose = void 0));
+    active2 && (active2 = !1, local?.dispose(), revision++, subscription?.unsubscribe(), stopDisposal?.(), uninstall(), installedDispose === dispose && (installedDispose = void 0));
   };
-  installedDispose = dispose, local?.start();
+  installedDispose = dispose, stopDisposal = registered?.onDispose(dispose), active2 && (subscription = auth2.onAuthStateChange((event2, session) => {
+    let next = session?.user.id ?? null;
+    (event2 === "SIGNED_OUT" || person !== void 0 && next !== person || registered && person !== void 0 && event2 === "SIGNED_IN" && token !== session?.access_token) && (revision++, local?.invalidate()), person = next, token = session?.access_token;
+  }).data.subscription, local?.start());
 }
 var os = { init };
 
@@ -2678,7 +2835,7 @@ function createBrowserAuth(runtime) {
     c || (c = createCoordinator(origin), coordinators.set(origin, c));
     let coordinator = c;
     coordinator.refs++;
-    let active2 = !0, ownedAction, authorizationId, authorizationGeneration = 0, inspected, observers = /* @__PURE__ */ new Set(), sessionObservers = /* @__PURE__ */ new Set(), lastState = coordinator.state, observation = (state) => {
+    let active2 = !0, ownedAction, authorizationId, authorizationGeneration = 0, inspected, observers = /* @__PURE__ */ new Set(), sessionObservers = /* @__PURE__ */ new Set(), disposalObservers = /* @__PURE__ */ new Set(), lastState = coordinator.state, observation = (state) => {
       lastState = state;
       for (let listener of observers)
         try {
@@ -2787,13 +2944,24 @@ function createBrowserAuth(runtime) {
       dispose() {
         if (active2) {
           active2 = !1, authorizationGeneration++, inspected = void 0, ownedAction && coordinator.action === ownedAction && coordinator.revision++, observers.clear(), coordinator.listeners.delete(observation);
-          for (let listener of sessionObservers)
-            coordinator.sessions.delete(listener), listener("SIGNED_OUT", null);
+          for (let listener of disposalObservers)
+            try {
+              listener();
+            } catch {
+            }
+          disposalObservers.clear();
+          for (let listener of sessionObservers) coordinator.sessions.delete(listener);
           sessionObservers.clear(), --coordinator.refs === 0 && (coordinator.active = !1, coordinator.revision++, coordinator.timer && clearTimeout(coordinator.timer), coordinator.unsubscribe?.(), coordinator.provider?.dispose(), coordinator.provider = void 0, coordinator.session = null, coordinator.listeners.clear(), coordinator.sessions.clear(), coordinators.delete(origin));
         }
       }
     });
     return registerBrowserAuth(handle2, {
+      onDispose(callback) {
+        return active2 ? (disposalObservers.add(callback), () => {
+          disposalObservers.delete(callback);
+        }) : (callback(), () => {
+        });
+      },
       async getSession() {
         assertActive(), await coordinator.ready, assertActive();
         let revision = coordinator.revision;