@oddington/sdk 0.1.18 → 0.1.19

package/README.md

@@ -312,12 +312,13 @@ both shipped SDK inputs and every emitted helper, rejects unexpected inputs and
 imports, and retains the full credential/server/customer leak scan. Node retains
 the complete package-root exports; provider classes are never public.
 
-Current auth measurement is **149,045 minified bytes**, including **5,177 fixture
-bytes** and **143,868 SDK bytes**, with **38,870 total gzip bytes**. Current
-unchanged Data/Files fixture measures **46,164 total / 5,893 fixture / 40,271 SDK
-bytes**, with **14,316 total gzip bytes**.
-Both fit their explicitly reviewed ceilings: **41,000 SDK bytes** for the pinned
-Data/Files fixture and **150,000 SDK bytes** for the separately pinned auth fixture.
+Current auth measurement is **171,346 minified bytes**, including **6,322 fixture
+bytes** and **165,024 SDK bytes**, with **45,466 total gzip bytes**. Current
+Data/Files fixture measures **47,254 total / 5,893 fixture / 41,361 SDK
+bytes**, with **14,906 total gzip bytes**. The shipped runtime now also carries
+the local Questions transport and transparent Local Host renewal.
+Both fit their explicitly reviewed ceilings: **42,000 SDK bytes** for the pinned
+Data/Files fixture and **166,000 SDK bytes** for the separately pinned auth fixture.
 Those ceilings are fixed review decisions, not values regenerated from later
 measurements. The installed auth realm/host-handoff proof passes alongside the
 Node exports, declarations, tarball leak scan and browser compatibility audits.
@@ -331,17 +332,17 @@ bytes; generated helpers count toward the SDK. Gzip is diagnostic only.
 
 | Same named-import fixture | Legacy diagnostic | Current strict proof |
 | --- | ---: | ---: |
-| Total minified JavaScript bytes | 488,539 | 46,164 |
+| Total minified JavaScript bytes | 488,539 | 47,254 |
 | Fixture-attributed bytes | 5,954 | 5,893 |
-| SDK bytes | 482,585 | 40,271 |
-| Total gzip bytes | 198,612 | 14,316 |
+| SDK bytes | 482,585 | 41,361 |
+| Total gzip bytes | 198,612 | 14,906 |
 
 The legacy diagnostic externalized three unresolved Node built-ins and failed
 browser compatibility. The current strict proof has no imports, shims or warnings
-and reduces SDK bytes by 91.7%. Its literal ceiling is **41,000 SDK bytes**:
-729 bytes of deliberately limited headroom. The reviewed measurement includes
-the Local Host bootstrap and opaque browser-auth handoff that `os.init` must
-select at runtime. The verifier pins the fixture
+and reduces SDK bytes by 91.4%. Its literal ceiling is **42,000 SDK bytes**:
+639 bytes of deliberately limited headroom. The reviewed measurement includes
+the Local Host bootstrap, local Questions transport, transparent renewal and
+opaque browser-auth handoff that `os.init` must select at runtime. The verifier pins the fixture
 hash and bundler version; changing either requires a reviewed measurement
 comparison. Future ceiling increases require explicit review of added browser
 capability and must never be automatically regenerated from an oversized output.

package/dist/browser.js

@@ -2149,6 +2149,19 @@ var sessionKey = "_os.app.session", responseChecks = /* @__PURE__ */ new WeakMap
 }, AppContextDenied = class extends Error {
 }, AppRenewalUnavailable = class extends Error {
 };
+async function untilAborted(work, signal) {
+  if (signal.aborted)
+    throw work.catch(() => {
+    }), new AppRenewalUnavailable();
+  let abort, cancelled = new Promise((_resolve, reject) => {
+    abort = () => reject(new AppRenewalUnavailable()), signal.addEventListener("abort", abort, { once: !0 });
+  });
+  try {
+    return await Promise.race([work, cancelled]);
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
 async function appResponse(response2, maximum, signal) {
   if (signal.aborted || !response2.body || response2.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json") throw new Error();
   let reader = response2.body.getReader(), abort = () => {
@@ -2188,159 +2201,164 @@ function isAppOrigin(value) {
   }
 }
 function appContext(origin, active2) {
-  let binding, credential, denied = !1, controller = new AbortController(), expiry, startup, renewalTimer, renewal, observation, resolution2, disposed = !1, stored = () => globalThis.localStorage.getItem(sessionKey), alive = () => {
+  let binding, credential, pair, serialized, denied = !1, controller = new AbortController(), access = new AbortController(), expiry, startup, renewalTimer, renewal, observation, resolution2, disposed = !1, stored = () => globalThis.localStorage.getItem(sessionKey), alive = () => {
     try {
-      return !denied && !disposed && active2() && globalThis.location.origin === origin && (!binding || binding.expiresAt > Date.now());
+      return !denied && !disposed && active2() && globalThis.location.origin === origin;
     } catch {
       return !1;
     }
   }, cancel = () => {
-    controller.abort(), clearTimeout(expiry), clearTimeout(startup), clearTimeout(renewalTimer), clearInterval(monitor), globalThis.removeEventListener?.("storage", storageChanged);
+    controller.abort(), access.abort(), clearTimeout(expiry), clearTimeout(startup), clearTimeout(renewalTimer), clearInterval(monitor), globalThis.removeEventListener?.("storage", storageChanged);
+    for (let event2 of ["pageshow", "focus", "visibilitychange"]) globalThis.removeEventListener?.(event2, wake);
   }, invalidate = () => {
     denied = !0, cancel();
     try {
-      !disposed && active2() && globalThis.location.origin === origin && (!credential || globalThis.localStorage.getItem(sessionKey) === credential) && globalThis.localStorage.removeItem(sessionKey);
+      !disposed && active2() && globalThis.location.origin === origin && (!serialized || globalThis.localStorage.getItem(sessionKey) === serialized) && globalThis.localStorage.removeItem(sessionKey);
     } catch {
     }
   }, current2 = () => {
     try {
-      return alive() && stored() === credential;
+      return alive() && !!binding && binding.expiresAt > Date.now() && stored() === serialized;
     } catch {
       return !1;
     }
-  }, sameSession = (value) => !binding || value.appId === binding.appId && value.memberId === binding.memberId && value.workspace === binding.workspace && value.sessionId === binding.sessionId, bounded = (value) => validBinding(value) && value.expiresAt > Date.now() && value.expiresAt <= Date.now() + 6e5 && sameSession(value);
-  async function proof(candidate, signal = controller.signal) {
-    if (!alive() || !/^[A-Za-z0-9_-]{43}$/.test(candidate)) throw new Error();
-    let url = `${origin}/_os/app/context`, response2 = await fetch(url, {
-      credentials: "omit",
-      redirect: "error",
-      cache: "no-store",
-      referrerPolicy: "no-referrer",
-      headers: { authorization: `Bearer ${candidate}` },
-      signal
-    });
+  }, sameSession = (value) => !binding || ["appId", "memberId", "workspace", "sessionId"].every((key) => value[key] === binding[key]), bounded = (value) => validBinding(value) && value.expiresAt > Date.now() && value.expiresAt <= Date.now() + 6e5 && sameSession(value), readPair = (candidate) => {
+    let value = JSON.parse(candidate ?? "null");
+    if (!validPair(value) || value.context.expiresAt > Date.now() + 6e5 || !sameSession(value.context)) throw new Error();
+    return value;
+  }, expireAccess = () => {
+    binding && binding.expiresAt <= Date.now() && access.abort();
+  };
+  async function send3(path, candidate, signal, init2 = {}) {
+    let url = `${origin}/_os/app/${path}`, response2;
+    try {
+      response2 = await fetch(url, {
+        ...init2,
+        credentials: "omit",
+        redirect: "error",
+        cache: "no-store",
+        referrerPolicy: "no-referrer",
+        signal,
+        headers: {
+          ...init2.body === void 0 ? {} : { "content-type": "application/json" },
+          authorization: `Bearer ${candidate}`
+        }
+      });
+    } catch {
+      throw new AppRenewalUnavailable();
+    }
     if (response2.redirected || response2.url && response2.url !== url) throw new Error();
+    return response2;
+  }
+  async function proof(candidate, signal = controller.signal) {
+    if (!alive() || !validProof(candidate)) throw new Error();
+    let response2 = await send3("context", candidate, signal);
     if (response2.status === 401 || response2.status === 403) throw new AppContextDenied();
+    if (response2.status >= 500) throw new AppRenewalUnavailable();
     if (!response2.ok) throw new Error();
     let value = await appResponse(response2, 4096, signal);
     if (!alive() || !bounded(value)) throw new Error();
     return value;
   }
-  function install(value, candidate) {
-    binding = { ...value }, credential = candidate, clearTimeout(expiry), clearTimeout(renewalTimer);
+  function install(value, candidate, raw) {
+    expireAccess(), access.signal.aborted && (access = new AbortController()), binding = { ...value }, pair = candidate, credential = candidate.credential, serialized = raw, clearTimeout(expiry), clearTimeout(renewalTimer);
     let remaining = binding.expiresAt - Date.now();
-    expiry = setTimeout(invalidate, remaining), renewalTimer = setTimeout(() => {
-      renew();
+    expiry = setTimeout(expireAccess, remaining), renewalTimer = setTimeout(() => {
+      renew().catch(() => {
+      });
     }, remaining - Math.min(6e4, remaining / 5));
   }
-  async function synchronize() {
+  async function synchronize(signal = controller.signal) {
     if (!alive()) throw new Error();
-    if (credential && stored() !== credential) {
-      if (!binding) throw new Error();
-      if (observation) return observation;
-      observation = (async () => {
-        for (; alive(); ) {
-          let candidate = stored();
-          if (!candidate) throw new Error();
-          let value;
-          try {
-            value = await proof(candidate);
-          } catch {
-            if (stored() !== candidate) continue;
-            throw new Error();
-          }
-          if (stored() === candidate) {
-            install(value, candidate);
-            return;
-          }
+    if (signal.aborted) throw new AppRenewalUnavailable();
+    if (!credential || stored() === serialized) return;
+    if (!binding) throw new Error();
+    if (observation) return untilAborted(observation, signal);
+    observation = (async () => {
+      for (; alive(); ) {
+        let candidate = stored();
+        if (!candidate) throw new Error();
+        let value, replacement;
+        try {
+          replacement = readPair(candidate), value = await proof(replacement.credential, signal);
+        } catch (error) {
+          if (stored() !== candidate) continue;
+          throw error;
+        }
+        if (stored() === candidate) {
+          if (value.expiresAt !== replacement.context.expiresAt) throw new Error();
+          install(value, replacement, candidate);
+          return;
         }
-        throw new Error();
-      })();
-      try {
-        await observation;
-      } catch {
-        throw invalidate(), new Error("Local app context unavailable.");
-      } finally {
-        observation = void 0;
       }
+      throw new Error();
+    })();
+    let observed = observation;
+    try {
+      await untilAborted(observed, signal);
+    } catch (error) {
+      throw error instanceof AppRenewalUnavailable || error instanceof AppResponseReadError || invalidate(), error;
+    } finally {
+      observation === observed && (observation = void 0);
     }
   }
   async function renew() {
-    if (!(renewal || !binding || !alive())) {
-      renewal = (async () => {
-        let deadline = binding.expiresAt, requestController = new AbortController(), abort = () => requestController.abort();
-        controller.signal.addEventListener("abort", abort, { once: !0 });
-        let timeout = setTimeout(abort, Math.min(2e4, deadline - Date.now())), previous = credential;
-        try {
-          if (await synchronize(), credential !== previous) return;
-          let url = `${origin}/_os/app/renew`, response2;
-          try {
-            response2 = await fetch(url, {
-              method: "POST",
-              credentials: "omit",
-              redirect: "error",
-              cache: "no-store",
-              referrerPolicy: "no-referrer",
-              signal: requestController.signal,
-              headers: { authorization: `Bearer ${previous}` }
+    if (renewal) return renewal;
+    if (!binding || !pair || !alive()) throw new Error();
+    renewal = (async () => {
+      let requestController = new AbortController(), abort = () => requestController.abort();
+      controller.signal.addEventListener("abort", abort, { once: !0 });
+      let timeout = setTimeout(abort, 2e4), previous = serialized;
+      try {
+        if (await synchronize(requestController.signal), serialized !== previous) return;
+        let response2 = await send3("renew", pair.renewalCredential, requestController.signal, { method: "POST" }), value = await appResponse(response2, 4096, requestController.signal);
+        if (response2.status === 503 && value && typeof value == "object" && !Array.isArray(value) && Object.keys(value).join(",") === "error" && "error" in value && value.error === "renewal_unavailable")
+          throw new AppRenewalUnavailable();
+        if (response2.status === 403 && value && typeof value == "object" && !Array.isArray(value) && Object.keys(value).join(",") === "error" && "error" in value && value.error === "renewal_conflict") {
+          for (; alive() && stored() === previous && !requestController.signal.aborted; )
+            await new Promise((resolve2, reject) => {
+              let abortWait = () => {
+                clearTimeout(timer), reject(new Error());
+              }, timer = setTimeout(() => {
+                requestController.signal.removeEventListener("abort", abortWait), resolve2();
+              }, 100);
+              requestController.signal.addEventListener("abort", abortWait, { once: !0 });
             });
-          } catch {
-            throw new AppRenewalUnavailable();
-          }
-          if (response2.redirected || response2.url && response2.url !== url) throw new Error();
-          let value = await appResponse(response2, 4096, requestController.signal);
-          if (response2.status === 503 && value && typeof value == "object" && !Array.isArray(value) && Object.keys(value).join(",") === "error" && "error" in value && value.error === "renewal_unavailable")
-            throw new AppRenewalUnavailable();
-          if (response2.status === 403 && value && typeof value == "object" && !Array.isArray(value) && Object.keys(value).join(",") === "error" && "error" in value && value.error === "renewal_conflict") {
-            for (; alive() && stored() === previous && !requestController.signal.aborted; )
-              await new Promise((resolve2, reject) => {
-                let abortWait = () => {
-                  clearTimeout(timer), reject(new Error());
-                }, timer = setTimeout(() => {
-                  requestController.signal.removeEventListener("abort", abortWait), resolve2();
-                }, 100);
-                requestController.signal.addEventListener("abort", abortWait, { once: !0 });
-              });
-            if (requestController.signal.aborted) throw new Error();
-            await synchronize();
-            return;
-          }
-          if (!response2.ok) throw new Error();
-          if (!alive() || Date.now() >= deadline || !value || typeof value != "object" || Array.isArray(value) || Object.keys(value).sort().join(",") !== "context,credential") throw new Error();
-          let result2 = value;
-          if (!bounded(result2.context) || typeof result2.credential != "string" || !/^[A-Za-z0-9_-]{43}$/.test(result2.credential) || result2.credential === previous) throw new Error();
-          if (stored() !== previous) {
-            await synchronize();
+          if (requestController.signal.aborted) throw new Error();
+          await synchronize(requestController.signal);
+          return;
+        }
+        if (!response2.ok) throw new Error();
+        if (!alive() || !validPair(value) || !bounded(value.context) || (/* @__PURE__ */ new Set([value.credential, value.renewalCredential, pair.credential, pair.renewalCredential])).size !== 4) throw new Error();
+        if (stored() !== previous) {
+          await synchronize(requestController.signal);
+          return;
+        }
+        let raw = JSON.stringify(value);
+        globalThis.localStorage.setItem(sessionKey, raw), install(value.context, value, raw);
+      } catch (error) {
+        try {
+          if (alive() && stored() && stored() !== previous) {
+            await synchronize(requestController.signal);
             return;
           }
-          globalThis.localStorage.setItem(sessionKey, result2.credential), install(result2.context, result2.credential);
-        } catch (error) {
-          try {
-            if (alive() && stored() && stored() !== previous) {
-              await synchronize();
-              return;
-            }
-          } catch {
-          }
-          try {
-            if (alive() && stored() && stored() !== previous) {
-              await synchronize();
-              return;
-            }
-          } catch {
-          }
-          (error instanceof AppRenewalUnavailable || error instanceof AppResponseReadError || requestController.signal.aborted) && current2() && Date.now() < deadline ? renewalTimer = setTimeout(() => {
-            renew();
-          }, Math.min(5e3, (deadline - Date.now()) / 5)) : invalidate();
-        } finally {
-          clearTimeout(timeout), controller.signal.removeEventListener("abort", abort);
+        } catch {
         }
-      })();
-      try {
-        await renewal;
+        throw (error instanceof AppRenewalUnavailable || error instanceof AppResponseReadError || requestController.signal.aborted) && alive() ? current2() && (renewalTimer = setTimeout(
+          () => {
+            renew().catch(() => {
+            });
+          },
+          Math.min(5e3, (binding.expiresAt - Date.now()) / 5)
+        )) : invalidate(), new AppRenewalUnavailable();
       } finally {
-        renewal = void 0;
+        clearTimeout(timeout), controller.signal.removeEventListener("abort", abort);
       }
+    })();
+    try {
+      await renewal;
+    } finally {
+      renewal = void 0;
     }
   }
   let storageChanged = () => {
@@ -2349,36 +2367,33 @@ function appContext(origin, active2) {
         invalidate();
         return;
       }
-      synchronize().catch(invalidate);
+      expireAccess(), synchronize().catch(() => {
+      });
     }
   }, monitor = setInterval(() => {
     storageChanged();
   }, 100);
   globalThis.addEventListener?.("storage", storageChanged);
+  let wake = () => {
+    alive() && resolve().catch(() => {
+    });
+  };
+  for (let event2 of ["pageshow", "focus", "visibilitychange"]) globalThis.addEventListener?.(event2, wake);
   let dispose = () => {
     disposed = !0, cancel();
   };
+  async function settledAccess(signal) {
+    for (await synchronize(); alive() && stored() !== serialized; ) await synchronize();
+    if (signal.aborted || !current2()) throw new Error();
+  }
   async function requestData(operation2, input) {
     try {
       if (operation2 !== "data/query" || !current2()) throw new Error();
-      let url = `${origin}/_os/app/data`, admitted = credential, response2 = await fetch(url, {
-        method: "POST",
-        credentials: "omit",
-        redirect: "error",
-        cache: "no-store",
-        referrerPolicy: "no-referrer",
-        signal: controller.signal,
-        headers: { "content-type": "application/json", authorization: `Bearer ${credential}` },
-        body: JSON.stringify(input)
-      });
-      for (await synchronize(); alive() && stored() !== credential; ) await synchronize();
-      if (!current2() || response2.redirected || response2.url && response2.url !== url) throw new Error();
-      if (response2.status === 401 || response2.status === 403)
-        throw admitted === credential && invalidate(), new DataOperationError("access_denied");
-      let result2 = await appResponse(response2, Number.MAX_SAFE_INTEGER, controller.signal);
-      for (await synchronize(); alive() && stored() !== credential; ) await synchronize();
-      if (!current2()) throw new Error();
-      if (!response2.ok) throw dataTransportError(response2.status, result2);
+      let admitted = credential, signal = access.signal, response2 = await send3("data", credential, signal, { method: "POST", body: JSON.stringify(input) });
+      if (await settledAccess(signal), response2.status === 401 || response2.status === 403)
+        throw admitted === credential && current2() && invalidate(), new DataOperationError("access_denied");
+      let result2 = await appResponse(response2, Number.MAX_SAFE_INTEGER, signal);
+      if (await settledAccess(signal), !response2.ok) throw dataTransportError(response2.status, result2);
       return result2;
     } catch (error) {
       throw error instanceof DataOperationError ? error : !current2() || controller.signal.aborted ? new DataOperationError("context_unavailable") : new DataOperationError("unavailable", !0);
@@ -2386,43 +2401,30 @@ function appContext(origin, active2) {
   }
   async function requestInbox(operation2, input) {
     if (!["questions.list", "questions.answer", "questions.searchRecords"].includes(operation2)) throw new Error("Inbox operation unavailable");
-    return requestChecked(`${origin}/_os/app/inbox`, { method: "POST", body: JSON.stringify({ operation: operation2, input }) }, !0);
+    return requestChecked("inbox", { method: "POST", body: JSON.stringify({ operation: operation2, input }) }, !0);
   }
   async function requestRoutine(key, suffix, init2 = {}) {
-    return requestChecked(`${origin}/_os/app/routines/${encodeURIComponent(key)}/${suffix}`, init2);
+    return requestChecked(`routines/${encodeURIComponent(key)}/${suffix}`, init2);
   }
-  async function requestChecked(url, init2, inbox2 = !1) {
-    if (!current2())
-      throw invalidate(), new Error("Local app context unavailable.");
-    let admitted = credential, response2 = await fetch(url, {
-      ...init2,
-      credentials: "omit",
-      redirect: "error",
-      cache: "no-store",
-      referrerPolicy: "no-referrer",
-      signal: controller.signal,
-      headers: { ...init2.body === void 0 ? {} : { "content-type": "application/json" }, authorization: `Bearer ${credential}` }
-    });
-    for (await synchronize(); alive() && stored() !== credential; ) await synchronize();
-    if (!current2() || response2.redirected || response2.url && response2.url !== url)
-      throw invalidate(), new Error("Local app context unavailable.");
-    return (response2.status === 401 || !inbox2 && response2.status === 403) && admitted === credential && invalidate(), responseChecks.set(response2, async (value) => {
-      for (await synchronize(); alive() && stored() !== credential; ) await synchronize();
-      admitted === credential && value && typeof value == "object" && "error" in value && value.error === "authority_unavailable" && invalidate();
+  async function requestChecked(path, init2, inbox2 = !1) {
+    if (!current2()) throw new Error("Local app context unavailable.");
+    let admitted = credential, signal = access.signal, response2 = await send3(path, credential, signal, init2);
+    return await settledAccess(signal), (response2.status === 401 || !inbox2 && response2.status === 403) && admitted === credential && current2() && invalidate(), responseChecks.set(response2, async (value) => {
+      await settledAccess(signal), admitted === credential && current2() && value && typeof value == "object" && "error" in value && value.error === "authority_unavailable" && invalidate();
     }), response2;
   }
   function context2() {
-    let issued = credential;
+    let issued = credential, signal = access.signal;
     return {
       kind: "local",
       ...binding,
       get expiresAt() {
         return binding.expiresAt;
       },
-      isCurrent: current2,
-      signal: controller.signal,
+      isCurrent: () => !signal.aborted && current2(),
+      signal,
       invalidate: () => {
-        issued === credential && invalidate();
+        issued === credential && current2() && invalidate();
       },
       requestRoutine,
       requestData,
@@ -2433,25 +2435,34 @@ function appContext(origin, active2) {
   let resolveOnce = async () => {
     let attempted;
     try {
-      if (denied || !active2() || globalThis.location.origin !== origin) throw new Error();
-      credential && await synchronize();
-      let candidate = stored();
-      if (!candidate || !/^[A-Za-z0-9_-]{43}$/.test(candidate)) throw new Error();
-      if (credential = candidate, attempted = candidate, !current2()) throw new Error();
-      let value = await proof(candidate);
-      if (stored() !== candidate || credential !== candidate)
-        return binding || (binding = { ...value }), await synchronize(), context2();
+      if (!alive()) throw new Error();
+      if (!pair) {
+        let candidate2 = stored(), retained2 = readPair(candidate2);
+        pair = retained2, binding = { ...retained2.context }, credential = retained2.credential, serialized = candidate2;
+      }
+      if (expireAccess(), binding.expiresAt <= Date.now()) {
+        if (await renew(), !current2()) throw new AppRenewalUnavailable();
+        return context2();
+      }
+      await synchronize();
+      let candidate = stored(), retained = readPair(candidate);
+      if (attempted = candidate ?? void 0, !current2()) throw new AppRenewalUnavailable();
+      let value = await proof(retained.credential);
+      if (stored() !== candidate || serialized !== candidate)
+        return await synchronize(), context2();
       if (!current2()) throw new Error();
-      if (binding && value.expiresAt > binding.expiresAt) throw new Error();
-      return (!binding || value.expiresAt !== binding.expiresAt) && install(value, candidate), context2();
+      if (expiry && binding && value.expiresAt > binding.expiresAt) throw new Error();
+      return (!expiry || value.expiresAt !== binding.expiresAt) && install(value, retained, candidate), context2();
     } catch (error) {
+      if (alive() && error instanceof AppRenewalUnavailable)
+        throw new Error();
       try {
-        if (binding && current2() && attempted && attempted !== credential) return context2();
-        if (binding && alive() && stored() && stored() !== credential)
+        if (binding && current2() && attempted && attempted !== serialized) return context2();
+        if (binding && alive() && stored() && stored() !== serialized)
           return await synchronize(), context2();
       } catch {
       }
-      throw error instanceof AppContextDenied && binding && alive() && renewal ? new Error("Local app context unavailable.") : (invalidate(), new Error("Local app context unavailable."));
+      throw error instanceof AppContextDenied && binding && alive() && renewal ? new Error() : alive() && (error instanceof AppResponseReadError || pair && stored() === serialized && !current2()) ? new Error() : (invalidate(), new Error());
     }
   }, resolve = () => resolution2 || (resolution2 = resolveOnce().finally(() => {
     resolution2 = void 0;
@@ -2463,10 +2474,18 @@ function appContext(origin, active2) {
     }, 0);
   }, invalidate, dispose };
 }
+function validProof(value) {
+  return typeof value == "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
 function validBinding(value) {
   if (!value || typeof value != "object" || Array.isArray(value) || Object.keys(value).sort().join(",") !== "appId,expiresAt,memberId,sessionId,workspace") return !1;
   let binding = value;
-  return typeof binding.appId == "string" && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(binding.appId) && typeof binding.workspace == "string" && /^[a-z0-9][a-z0-9-]{0,62}$/.test(binding.workspace) && typeof binding.memberId == "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(binding.memberId) && typeof binding.sessionId == "string" && /^[A-Za-z0-9_-]{43}$/.test(binding.sessionId) && typeof binding.expiresAt == "number" && Number.isFinite(binding.expiresAt);
+  return typeof binding.appId == "string" && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(binding.appId) && typeof binding.workspace == "string" && /^[a-z0-9][a-z0-9-]{0,62}$/.test(binding.workspace) && typeof binding.memberId == "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(binding.memberId) && validProof(binding.sessionId) && typeof binding.expiresAt == "number" && Number.isFinite(binding.expiresAt);
+}
+function validPair(value) {
+  if (!value || typeof value != "object" || Array.isArray(value) || Object.keys(value).sort().join(",") !== "context,credential,renewalCredential") return !1;
+  let pair = value;
+  return validProof(pair.credential) && validProof(pair.renewalCredential) && pair.credential !== pair.renewalCredential && validBinding(pair.context);
 }
 
 var unavailable2 = () => new InboxOperationError(503, "unavailable"), stale = () => new InboxOperationError(401, "authority_unavailable");