@oddington/sdk 0.1.18 → 0.1.20

package/dist/browser.js

@@ -475,7 +475,11 @@ var AppRoutineContractError = class extends Error {
     this.code = code;
   }
   code;
-}, propertyName = /^[a-z][A-Za-z0-9]*(?![\s\S])/, stepId = /^[a-z0-9]+(?:-[a-z0-9]+)*(?![\s\S])/, routineName = /^[a-z0-9][a-z0-9-]{0,62}(?![\s\S])/, owns = (value, key) => Object.hasOwn(value, key), invalidContract = () => {
+}, propertyName = /^[a-z][A-Za-z0-9]*(?![\s\S])/, stepId = /^[a-z0-9]+(?:-[a-z0-9]+)*(?![\s\S])/, routineName = /^[a-z0-9][a-z0-9-]{0,62}(?![\s\S])/;
+function isAppRoutineName(value) {
+  return typeof value == "string" && routineName.test(value);
+}
+var owns = (value, key) => Object.hasOwn(value, key), invalidContract = () => {
   throw new AppRoutineContractError("invalid_contract");
 }, invalidValue = () => {
   throw new AppRoutineContractError("invalid_value");
@@ -530,7 +534,7 @@ function parseAppRoutineContract(value) {
         return invalidContract();
     }
   }
-  if (!record(value) || !fields2(value, ["routine", "input", "steps"], ["result"]) || typeof value.routine != "string" || !routineName.test(value.routine) || !denseArray(value.steps) || value.steps.length < 1 || value.steps.length > 64) return invalidContract();
+  if (!record(value) || !fields2(value, ["routine", "input", "steps"], ["result"]) || !isAppRoutineName(value.routine) || !denseArray(value.steps) || value.steps.length < 1 || value.steps.length > 64) return invalidContract();
   let input = schema2(value.input), result2 = owns(value, "result") ? schema2(value.result) : void 0, ids = /* @__PURE__ */ new Set(), steps = value.steps.map((step) => !record(step) || !fields2(step, ["id"], ["summary"]) || typeof step.id != "string" || !stepId.test(step.id) || ids.has(step.id) ? invalidContract() : (ids.add(step.id), { id: step.id, ...owns(step, "summary") ? { summary: schema2(step.summary) } : {} }));
   return { routine: value.routine, input, steps, ...result2 === void 0 ? {} : { result: result2 } };
 }
@@ -1937,14 +1941,14 @@ function response(value) {
   let answer = object3(value);
   return assert(Object.keys(answer).every((key) => ["selection", "note"].includes(key))), typeof answer.selection == "string" ? assert(text3(answer.selection) && answer.selection === answer.selection.trim()) : recordReference(answer.selection), Object.hasOwn(answer, "note") && assert(text3(answer.note)), answer;
 }
-function parseInboxRequest(value) {
+function parseInboxRequest(value, questionListContext = "local") {
   try {
     let envelope = object3(value);
     assert(Object.keys(envelope).sort().join(",") === "input,operation"), assert(typeof envelope.operation == "string" && Object.hasOwn(operations, envelope.operation));
-    let operation2 = envelope.operation, input = object3(envelope.input), required = operations[operation2];
-    assert(required.every((key) => Object.hasOwn(input, key)) && Object.keys(input).every((key) => required.includes(key) || operation2 === "questions.searchRecords" && key === "selected" || (operation2 === "items.list" || operation2 === "questions.list") && key === "beforeNumber"));
+    let operation2 = envelope.operation, input = { ...object3(envelope.input) }, required = operations[operation2];
+    assert(required.every((key) => Object.hasOwn(input, key)) && Object.keys(input).every((key) => required.includes(key) || operation2 === "questions.searchRecords" && key === "selected" || (operation2 === "items.list" || operation2 === "questions.list") && key === "beforeNumber" || operation2 === "questions.list" && questionListContext === "hosted" && key === "routines")), operation2 === "questions.list" && questionListContext === "hosted" && (assert(Object.hasOwn(input, "routines")), assert(array2(input.routines).every(isAppRoutineName)));
     for (let key of ["itemId", "personId", "fileId"]) key in input && assert(id2(input[key]));
-    return "revision" in input && assert(integer(input.revision)), "beforeNumber" in input && assert(integer(input.beforeNumber)), "questionId" in input && assert(text3(input.questionId) && input.questionId === input.questionId.trim()), "title" in input && assert(text3(input.title)), "lifecycle" in input && assert(input.lifecycle === "open" || input.lifecycle === "closed"), "query" in input && assert(text3(input.query, !0) && input.query.length <= 256), "selected" in input && recordReference(input.selected), "response" in input && response(input.response), assert(new TextEncoder().encode(JSON.stringify(envelope)).byteLength <= INBOX_INPUT_BYTES), { operation: operation2, input };
+    return "revision" in input && assert(integer(input.revision)), "beforeNumber" in input && assert(integer(input.beforeNumber)), "questionId" in input && assert(text3(input.questionId) && input.questionId === input.questionId.trim()), "title" in input && assert(text3(input.title)), "lifecycle" in input && assert(input.lifecycle === "open" || input.lifecycle === "closed"), "query" in input && assert(text3(input.query, !0) && input.query.length <= 256), "selected" in input && recordReference(input.selected), "response" in input && response(input.response), assert(new TextEncoder().encode(JSON.stringify(envelope)).byteLength <= INBOX_INPUT_BYTES), "routines" in input && (input.routines = [...new Set(input.routines)]), { operation: operation2, input };
   } catch {
     throw new InboxOperationError(400, "invalid_input");
   }
@@ -2149,6 +2153,19 @@ var sessionKey = "_os.app.session", responseChecks = /* @__PURE__ */ new WeakMap
 }, AppContextDenied = class extends Error {
 }, AppRenewalUnavailable = class extends Error {
 };
+async function untilAborted(work, signal) {
+  if (signal.aborted)
+    throw work.catch(() => {
+    }), new AppRenewalUnavailable();
+  let abort, cancelled = new Promise((_resolve, reject) => {
+    abort = () => reject(new AppRenewalUnavailable()), signal.addEventListener("abort", abort, { once: !0 });
+  });
+  try {
+    return await Promise.race([work, cancelled]);
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
 async function appResponse(response2, maximum, signal) {
   if (signal.aborted || !response2.body || response2.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json") throw new Error();
   let reader = response2.body.getReader(), abort = () => {
@@ -2188,159 +2205,164 @@ function isAppOrigin(value) {
   }
 }
 function appContext(origin, active2) {
-  let binding, credential, denied = !1, controller = new AbortController(), expiry, startup, renewalTimer, renewal, observation, resolution2, disposed = !1, stored = () => globalThis.localStorage.getItem(sessionKey), alive = () => {
+  let binding, credential, pair, serialized, denied = !1, controller = new AbortController(), access = new AbortController(), expiry, startup, renewalTimer, renewal, observation, resolution2, disposed = !1, stored = () => globalThis.localStorage.getItem(sessionKey), alive = () => {
     try {
-      return !denied && !disposed && active2() && globalThis.location.origin === origin && (!binding || binding.expiresAt > Date.now());
+      return !denied && !disposed && active2() && globalThis.location.origin === origin;
     } catch {
       return !1;
     }
   }, cancel = () => {
-    controller.abort(), clearTimeout(expiry), clearTimeout(startup), clearTimeout(renewalTimer), clearInterval(monitor), globalThis.removeEventListener?.("storage", storageChanged);
+    controller.abort(), access.abort(), clearTimeout(expiry), clearTimeout(startup), clearTimeout(renewalTimer), clearInterval(monitor), globalThis.removeEventListener?.("storage", storageChanged);
+    for (let event2 of ["pageshow", "focus", "visibilitychange"]) globalThis.removeEventListener?.(event2, wake);
   }, invalidate = () => {
     denied = !0, cancel();
     try {
-      !disposed && active2() && globalThis.location.origin === origin && (!credential || globalThis.localStorage.getItem(sessionKey) === credential) && globalThis.localStorage.removeItem(sessionKey);
+      !disposed && active2() && globalThis.location.origin === origin && (!serialized || globalThis.localStorage.getItem(sessionKey) === serialized) && globalThis.localStorage.removeItem(sessionKey);
     } catch {
     }
   }, current2 = () => {
     try {
-      return alive() && stored() === credential;
+      return alive() && !!binding && binding.expiresAt > Date.now() && stored() === serialized;
     } catch {
       return !1;
     }
-  }, sameSession = (value) => !binding || value.appId === binding.appId && value.memberId === binding.memberId && value.workspace === binding.workspace && value.sessionId === binding.sessionId, bounded = (value) => validBinding(value) && value.expiresAt > Date.now() && value.expiresAt <= Date.now() + 6e5 && sameSession(value);
-  async function proof(candidate, signal = controller.signal) {
-    if (!alive() || !/^[A-Za-z0-9_-]{43}$/.test(candidate)) throw new Error();
-    let url = `${origin}/_os/app/context`, response2 = await fetch(url, {
-      credentials: "omit",
-      redirect: "error",
-      cache: "no-store",
-      referrerPolicy: "no-referrer",
-      headers: { authorization: `Bearer ${candidate}` },
-      signal
-    });
+  }, sameSession = (value) => !binding || ["appId", "memberId", "workspace", "sessionId"].every((key) => value[key] === binding[key]), bounded = (value) => validBinding(value) && value.expiresAt > Date.now() && value.expiresAt <= Date.now() + 6e5 && sameSession(value), readPair = (candidate) => {
+    let value = JSON.parse(candidate ?? "null");
+    if (!validPair(value) || value.context.expiresAt > Date.now() + 6e5 || !sameSession(value.context)) throw new Error();
+    return value;
+  }, expireAccess = () => {
+    binding && binding.expiresAt <= Date.now() && access.abort();
+  };
+  async function send3(path, candidate, signal, init2 = {}) {
+    let url = `${origin}/_os/app/${path}`, response2;
+    try {
+      response2 = await fetch(url, {
+        ...init2,
+        credentials: "omit",
+        redirect: "error",
+        cache: "no-store",
+        referrerPolicy: "no-referrer",
+        signal,
+        headers: {
+          ...init2.body === void 0 ? {} : { "content-type": "application/json" },
+          authorization: `Bearer ${candidate}`
+        }
+      });
+    } catch {
+      throw new AppRenewalUnavailable();
+    }
     if (response2.redirected || response2.url && response2.url !== url) throw new Error();
+    return response2;
+  }
+  async function proof(candidate, signal = controller.signal) {
+    if (!alive() || !validProof(candidate)) throw new Error();
+    let response2 = await send3("context", candidate, signal);
     if (response2.status === 401 || response2.status === 403) throw new AppContextDenied();
+    if (response2.status >= 500) throw new AppRenewalUnavailable();
     if (!response2.ok) throw new Error();
     let value = await appResponse(response2, 4096, signal);
     if (!alive() || !bounded(value)) throw new Error();
     return value;
   }
-  function install(value, candidate) {
-    binding = { ...value }, credential = candidate, clearTimeout(expiry), clearTimeout(renewalTimer);
+  function install(value, candidate, raw) {
+    expireAccess(), access.signal.aborted && (access = new AbortController()), binding = { ...value }, pair = candidate, credential = candidate.credential, serialized = raw, clearTimeout(expiry), clearTimeout(renewalTimer);
     let remaining = binding.expiresAt - Date.now();
-    expiry = setTimeout(invalidate, remaining), renewalTimer = setTimeout(() => {
-      renew();
+    expiry = setTimeout(expireAccess, remaining), renewalTimer = setTimeout(() => {
+      renew().catch(() => {
+      });
     }, remaining - Math.min(6e4, remaining / 5));
   }
-  async function synchronize() {
+  async function synchronize(signal = controller.signal) {
     if (!alive()) throw new Error();
-    if (credential && stored() !== credential) {
-      if (!binding) throw new Error();
-      if (observation) return observation;
-      observation = (async () => {
-        for (; alive(); ) {
-          let candidate = stored();
-          if (!candidate) throw new Error();
-          let value;
-          try {
-            value = await proof(candidate);
-          } catch {
-            if (stored() !== candidate) continue;
-            throw new Error();
-          }
-          if (stored() === candidate) {
-            install(value, candidate);
-            return;
-          }
+    if (signal.aborted) throw new AppRenewalUnavailable();
+    if (!credential || stored() === serialized) return;
+    if (!binding) throw new Error();
+    if (observation) return untilAborted(observation, signal);
+    observation = (async () => {
+      for (; alive(); ) {
+        let candidate = stored();
+        if (!candidate) throw new Error();
+        let value, replacement;
+        try {
+          replacement = readPair(candidate), value = await proof(replacement.credential, signal);
+        } catch (error) {
+          if (stored() !== candidate) continue;
+          throw error;
+        }
+        if (stored() === candidate) {
+          if (value.expiresAt !== replacement.context.expiresAt) throw new Error();
+          install(value, replacement, candidate);
+          return;
         }
-        throw new Error();
-      })();
-      try {
-        await observation;
-      } catch {
-        throw invalidate(), new Error("Local app context unavailable.");
-      } finally {
-        observation = void 0;
       }
+      throw new Error();
+    })();
+    let observed = observation;
+    try {
+      await untilAborted(observed, signal);
+    } catch (error) {
+      throw error instanceof AppRenewalUnavailable || error instanceof AppResponseReadError || invalidate(), error;
+    } finally {
+      observation === observed && (observation = void 0);
     }
   }
   async function renew() {
-    if (!(renewal || !binding || !alive())) {
-      renewal = (async () => {
-        let deadline = binding.expiresAt, requestController = new AbortController(), abort = () => requestController.abort();
-        controller.signal.addEventListener("abort", abort, { once: !0 });
-        let timeout = setTimeout(abort, Math.min(2e4, deadline - Date.now())), previous = credential;
-        try {
-          if (await synchronize(), credential !== previous) return;
-          let url = `${origin}/_os/app/renew`, response2;
-          try {
-            response2 = await fetch(url, {
-              method: "POST",
-              credentials: "omit",
-              redirect: "error",
-              cache: "no-store",
-              referrerPolicy: "no-referrer",
-              signal: requestController.signal,
-              headers: { authorization: `Bearer ${previous}` }
+    if (renewal) return renewal;
+    if (!binding || !pair || !alive()) throw new Error();
+    renewal = (async () => {
+      let requestController = new AbortController(), abort = () => requestController.abort();
+      controller.signal.addEventListener("abort", abort, { once: !0 });
+      let timeout = setTimeout(abort, 2e4), previous = serialized;
+      try {
+        if (await synchronize(requestController.signal), serialized !== previous) return;
+        let response2 = await send3("renew", pair.renewalCredential, requestController.signal, { method: "POST" }), value = await appResponse(response2, 4096, requestController.signal);
+        if (response2.status === 503 && value && typeof value == "object" && !Array.isArray(value) && Object.keys(value).join(",") === "error" && "error" in value && value.error === "renewal_unavailable")
+          throw new AppRenewalUnavailable();
+        if (response2.status === 403 && value && typeof value == "object" && !Array.isArray(value) && Object.keys(value).join(",") === "error" && "error" in value && value.error === "renewal_conflict") {
+          for (; alive() && stored() === previous && !requestController.signal.aborted; )
+            await new Promise((resolve2, reject) => {
+              let abortWait = () => {
+                clearTimeout(timer), reject(new Error());
+              }, timer = setTimeout(() => {
+                requestController.signal.removeEventListener("abort", abortWait), resolve2();
+              }, 100);
+              requestController.signal.addEventListener("abort", abortWait, { once: !0 });
             });
-          } catch {
-            throw new AppRenewalUnavailable();
-          }
-          if (response2.redirected || response2.url && response2.url !== url) throw new Error();
-          let value = await appResponse(response2, 4096, requestController.signal);
-          if (response2.status === 503 && value && typeof value == "object" && !Array.isArray(value) && Object.keys(value).join(",") === "error" && "error" in value && value.error === "renewal_unavailable")
-            throw new AppRenewalUnavailable();
-          if (response2.status === 403 && value && typeof value == "object" && !Array.isArray(value) && Object.keys(value).join(",") === "error" && "error" in value && value.error === "renewal_conflict") {
-            for (; alive() && stored() === previous && !requestController.signal.aborted; )
-              await new Promise((resolve2, reject) => {
-                let abortWait = () => {
-                  clearTimeout(timer), reject(new Error());
-                }, timer = setTimeout(() => {
-                  requestController.signal.removeEventListener("abort", abortWait), resolve2();
-                }, 100);
-                requestController.signal.addEventListener("abort", abortWait, { once: !0 });
-              });
-            if (requestController.signal.aborted) throw new Error();
-            await synchronize();
-            return;
-          }
-          if (!response2.ok) throw new Error();
-          if (!alive() || Date.now() >= deadline || !value || typeof value != "object" || Array.isArray(value) || Object.keys(value).sort().join(",") !== "context,credential") throw new Error();
-          let result2 = value;
-          if (!bounded(result2.context) || typeof result2.credential != "string" || !/^[A-Za-z0-9_-]{43}$/.test(result2.credential) || result2.credential === previous) throw new Error();
-          if (stored() !== previous) {
-            await synchronize();
+          if (requestController.signal.aborted) throw new Error();
+          await synchronize(requestController.signal);
+          return;
+        }
+        if (!response2.ok) throw new Error();
+        if (!alive() || !validPair(value) || !bounded(value.context) || (/* @__PURE__ */ new Set([value.credential, value.renewalCredential, pair.credential, pair.renewalCredential])).size !== 4) throw new Error();
+        if (stored() !== previous) {
+          await synchronize(requestController.signal);
+          return;
+        }
+        let raw = JSON.stringify(value);
+        globalThis.localStorage.setItem(sessionKey, raw), install(value.context, value, raw);
+      } catch (error) {
+        try {
+          if (alive() && stored() && stored() !== previous) {
+            await synchronize(requestController.signal);
             return;
           }
-          globalThis.localStorage.setItem(sessionKey, result2.credential), install(result2.context, result2.credential);
-        } catch (error) {
-          try {
-            if (alive() && stored() && stored() !== previous) {
-              await synchronize();
-              return;
-            }
-          } catch {
-          }
-          try {
-            if (alive() && stored() && stored() !== previous) {
-              await synchronize();
-              return;
-            }
-          } catch {
-          }
-          (error instanceof AppRenewalUnavailable || error instanceof AppResponseReadError || requestController.signal.aborted) && current2() && Date.now() < deadline ? renewalTimer = setTimeout(() => {
-            renew();
-          }, Math.min(5e3, (deadline - Date.now()) / 5)) : invalidate();
-        } finally {
-          clearTimeout(timeout), controller.signal.removeEventListener("abort", abort);
+        } catch {
         }
-      })();
-      try {
-        await renewal;
+        throw (error instanceof AppRenewalUnavailable || error instanceof AppResponseReadError || requestController.signal.aborted) && alive() ? current2() && (renewalTimer = setTimeout(
+          () => {
+            renew().catch(() => {
+            });
+          },
+          Math.min(5e3, (binding.expiresAt - Date.now()) / 5)
+        )) : invalidate(), new AppRenewalUnavailable();
       } finally {
-        renewal = void 0;
+        clearTimeout(timeout), controller.signal.removeEventListener("abort", abort);
       }
+    })();
+    try {
+      await renewal;
+    } finally {
+      renewal = void 0;
     }
   }
   let storageChanged = () => {
@@ -2349,36 +2371,33 @@ function appContext(origin, active2) {
         invalidate();
         return;
       }
-      synchronize().catch(invalidate);
+      expireAccess(), synchronize().catch(() => {
+      });
     }
   }, monitor = setInterval(() => {
     storageChanged();
   }, 100);
   globalThis.addEventListener?.("storage", storageChanged);
+  let wake = () => {
+    alive() && resolve().catch(() => {
+    });
+  };
+  for (let event2 of ["pageshow", "focus", "visibilitychange"]) globalThis.addEventListener?.(event2, wake);
   let dispose = () => {
     disposed = !0, cancel();
   };
+  async function settledAccess(signal) {
+    for (await synchronize(); alive() && stored() !== serialized; ) await synchronize();
+    if (signal.aborted || !current2()) throw new Error();
+  }
   async function requestData(operation2, input) {
     try {
       if (operation2 !== "data/query" || !current2()) throw new Error();
-      let url = `${origin}/_os/app/data`, admitted = credential, response2 = await fetch(url, {
-        method: "POST",
-        credentials: "omit",
-        redirect: "error",
-        cache: "no-store",
-        referrerPolicy: "no-referrer",
-        signal: controller.signal,
-        headers: { "content-type": "application/json", authorization: `Bearer ${credential}` },
-        body: JSON.stringify(input)
-      });
-      for (await synchronize(); alive() && stored() !== credential; ) await synchronize();
-      if (!current2() || response2.redirected || response2.url && response2.url !== url) throw new Error();
-      if (response2.status === 401 || response2.status === 403)
-        throw admitted === credential && invalidate(), new DataOperationError("access_denied");
-      let result2 = await appResponse(response2, Number.MAX_SAFE_INTEGER, controller.signal);
-      for (await synchronize(); alive() && stored() !== credential; ) await synchronize();
-      if (!current2()) throw new Error();
-      if (!response2.ok) throw dataTransportError(response2.status, result2);
+      let admitted = credential, signal = access.signal, response2 = await send3("data", credential, signal, { method: "POST", body: JSON.stringify(input) });
+      if (await settledAccess(signal), response2.status === 401 || response2.status === 403)
+        throw admitted === credential && current2() && invalidate(), new DataOperationError("access_denied");
+      let result2 = await appResponse(response2, Number.MAX_SAFE_INTEGER, signal);
+      if (await settledAccess(signal), !response2.ok) throw dataTransportError(response2.status, result2);
       return result2;
     } catch (error) {
       throw error instanceof DataOperationError ? error : !current2() || controller.signal.aborted ? new DataOperationError("context_unavailable") : new DataOperationError("unavailable", !0);
@@ -2386,43 +2405,30 @@ function appContext(origin, active2) {
   }
   async function requestInbox(operation2, input) {
     if (!["questions.list", "questions.answer", "questions.searchRecords"].includes(operation2)) throw new Error("Inbox operation unavailable");
-    return requestChecked(`${origin}/_os/app/inbox`, { method: "POST", body: JSON.stringify({ operation: operation2, input }) }, !0);
+    return requestChecked("inbox", { method: "POST", body: JSON.stringify({ operation: operation2, input }) }, !0);
   }
   async function requestRoutine(key, suffix, init2 = {}) {
-    return requestChecked(`${origin}/_os/app/routines/${encodeURIComponent(key)}/${suffix}`, init2);
+    return requestChecked(`routines/${encodeURIComponent(key)}/${suffix}`, init2);
   }
-  async function requestChecked(url, init2, inbox2 = !1) {
-    if (!current2())
-      throw invalidate(), new Error("Local app context unavailable.");
-    let admitted = credential, response2 = await fetch(url, {
-      ...init2,
-      credentials: "omit",
-      redirect: "error",
-      cache: "no-store",
-      referrerPolicy: "no-referrer",
-      signal: controller.signal,
-      headers: { ...init2.body === void 0 ? {} : { "content-type": "application/json" }, authorization: `Bearer ${credential}` }
-    });
-    for (await synchronize(); alive() && stored() !== credential; ) await synchronize();
-    if (!current2() || response2.redirected || response2.url && response2.url !== url)
-      throw invalidate(), new Error("Local app context unavailable.");
-    return (response2.status === 401 || !inbox2 && response2.status === 403) && admitted === credential && invalidate(), responseChecks.set(response2, async (value) => {
-      for (await synchronize(); alive() && stored() !== credential; ) await synchronize();
-      admitted === credential && value && typeof value == "object" && "error" in value && value.error === "authority_unavailable" && invalidate();
+  async function requestChecked(path, init2, inbox2 = !1) {
+    if (!current2()) throw new Error("Local app context unavailable.");
+    let admitted = credential, signal = access.signal, response2 = await send3(path, credential, signal, init2);
+    return await settledAccess(signal), (response2.status === 401 || !inbox2 && response2.status === 403) && admitted === credential && current2() && invalidate(), responseChecks.set(response2, async (value) => {
+      await settledAccess(signal), admitted === credential && current2() && value && typeof value == "object" && "error" in value && value.error === "authority_unavailable" && invalidate();
     }), response2;
   }
   function context2() {
-    let issued = credential;
+    let issued = credential, signal = access.signal;
     return {
       kind: "local",
       ...binding,
       get expiresAt() {
         return binding.expiresAt;
       },
-      isCurrent: current2,
-      signal: controller.signal,
+      isCurrent: () => !signal.aborted && current2(),
+      signal,
       invalidate: () => {
-        issued === credential && invalidate();
+        issued === credential && current2() && invalidate();
       },
       requestRoutine,
       requestData,
@@ -2433,25 +2439,34 @@ function appContext(origin, active2) {
   let resolveOnce = async () => {
     let attempted;
     try {
-      if (denied || !active2() || globalThis.location.origin !== origin) throw new Error();
-      credential && await synchronize();
-      let candidate = stored();
-      if (!candidate || !/^[A-Za-z0-9_-]{43}$/.test(candidate)) throw new Error();
-      if (credential = candidate, attempted = candidate, !current2()) throw new Error();
-      let value = await proof(candidate);
-      if (stored() !== candidate || credential !== candidate)
-        return binding || (binding = { ...value }), await synchronize(), context2();
+      if (!alive()) throw new Error();
+      if (!pair) {
+        let candidate2 = stored(), retained2 = readPair(candidate2);
+        pair = retained2, binding = { ...retained2.context }, credential = retained2.credential, serialized = candidate2;
+      }
+      if (expireAccess(), binding.expiresAt <= Date.now()) {
+        if (await renew(), !current2()) throw new AppRenewalUnavailable();
+        return context2();
+      }
+      await synchronize();
+      let candidate = stored(), retained = readPair(candidate);
+      if (attempted = candidate ?? void 0, !current2()) throw new AppRenewalUnavailable();
+      let value = await proof(retained.credential);
+      if (stored() !== candidate || serialized !== candidate)
+        return await synchronize(), context2();
       if (!current2()) throw new Error();
-      if (binding && value.expiresAt > binding.expiresAt) throw new Error();
-      return (!binding || value.expiresAt !== binding.expiresAt) && install(value, candidate), context2();
+      if (expiry && binding && value.expiresAt > binding.expiresAt) throw new Error();
+      return (!expiry || value.expiresAt !== binding.expiresAt) && install(value, retained, candidate), context2();
     } catch (error) {
+      if (alive() && error instanceof AppRenewalUnavailable)
+        throw new Error();
       try {
-        if (binding && current2() && attempted && attempted !== credential) return context2();
-        if (binding && alive() && stored() && stored() !== credential)
+        if (binding && current2() && attempted && attempted !== serialized) return context2();
+        if (binding && alive() && stored() && stored() !== serialized)
           return await synchronize(), context2();
       } catch {
       }
-      throw error instanceof AppContextDenied && binding && alive() && renewal ? new Error("Local app context unavailable.") : (invalidate(), new Error("Local app context unavailable."));
+      throw error instanceof AppContextDenied && binding && alive() && renewal ? new Error() : alive() && (error instanceof AppResponseReadError || pair && stored() === serialized && !current2()) ? new Error() : (invalidate(), new Error());
     }
   }, resolve = () => resolution2 || (resolution2 = resolveOnce().finally(() => {
     resolution2 = void 0;
@@ -2463,10 +2478,18 @@ function appContext(origin, active2) {
     }, 0);
   }, invalidate, dispose };
 }
+function validProof(value) {
+  return typeof value == "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
 function validBinding(value) {
   if (!value || typeof value != "object" || Array.isArray(value) || Object.keys(value).sort().join(",") !== "appId,expiresAt,memberId,sessionId,workspace") return !1;
   let binding = value;
-  return typeof binding.appId == "string" && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(binding.appId) && typeof binding.workspace == "string" && /^[a-z0-9][a-z0-9-]{0,62}$/.test(binding.workspace) && typeof binding.memberId == "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(binding.memberId) && typeof binding.sessionId == "string" && /^[A-Za-z0-9_-]{43}$/.test(binding.sessionId) && typeof binding.expiresAt == "number" && Number.isFinite(binding.expiresAt);
+  return typeof binding.appId == "string" && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(binding.appId) && typeof binding.workspace == "string" && /^[a-z0-9][a-z0-9-]{0,62}$/.test(binding.workspace) && typeof binding.memberId == "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(binding.memberId) && validProof(binding.sessionId) && typeof binding.expiresAt == "number" && Number.isFinite(binding.expiresAt);
+}
+function validPair(value) {
+  if (!value || typeof value != "object" || Array.isArray(value) || Object.keys(value).sort().join(",") !== "context,credential,renewalCredential") return !1;
+  let pair = value;
+  return validProof(pair.credential) && validProof(pair.renewalCredential) && pair.credential !== pair.renewalCredential && validBinding(pair.context);
 }
 
 var unavailable2 = () => new InboxOperationError(503, "unavailable"), stale = () => new InboxOperationError(401, "authority_unavailable");
@@ -2474,13 +2497,13 @@ function hostFailure(error, context2) {
   return !context2.isCurrent() || context2.expiresAt <= Date.now() || error instanceof InboxContextError && error.status === 401 ? stale() : error instanceof InboxContextError && error.status === 403 ? new InboxOperationError(403, "access_denied") : unavailable2();
 }
 async function send2(operation2, input) {
-  let envelope = parseInboxRequest({ operation: operation2, input }), context2;
+  let envelope = operation2 === "questions.list" ? void 0 : parseInboxRequest({ operation: operation2, input }), context2;
   try {
     context2 = await resolveAppContext();
   } catch {
     throw stale();
   }
-  if (context2.kind === "local") {
+  if (envelope ??= parseInboxRequest({ operation: operation2, input }, context2.kind === "local" ? "local" : "hosted"), context2.kind === "local") {
     if (!isAppQuestionOperation(operation2)) throw new InboxOperationError(403, "access_denied");
     let check2 = () => {
       if (!context2.isCurrent() || context2.signal.aborted || context2.expiresAt <= Date.now()) throw stale();
@@ -2617,13 +2640,17 @@ var inbox = {
     addRecipient: async (input) => await send2("items.addRecipient", input)
   },
   questions: {
-    async list() {
-      let questions = [], beforeNumber, initial;
+    async list(input) {
+      let supplied = input === void 0 ? void 0 : parseInboxRequest({ operation: "questions.list", input }, "hosted").input;
+      if (supplied && Object.hasOwn(supplied, "beforeNumber")) throw new InboxOperationError(400, "invalid_input");
+      let routines = supplied ? Object.freeze(supplied.routines) : void 0, questions = [], beforeNumber, initial;
       try {
         initial = await resolveAppContext();
       } catch {
         throw stale();
       }
+      if (initial.kind === "local" ? input !== void 0 : routines === void 0)
+        throw new InboxOperationError(400, "invalid_input");
       let host;
       try {
         host = initial.kind !== "local" && await resolveHostedInboxContext(initial);
@@ -2636,8 +2663,11 @@ var inbox = {
       };
       do {
         check();
-        let page = await send2("questions.list", beforeNumber === void 0 ? {} : { beforeNumber });
-        if (check(), page.questions.some((question2) => question2.item.href !== `https://${initial.workspace}.oddington.ai/inbox/${question2.item.id}`) || beforeNumber !== void 0 && (page.questions.some((question2) => question2.item.number >= beforeNumber) || page.nextBeforeNumber !== null && page.nextBeforeNumber >= beforeNumber)) throw unavailable2();
+        let page = await send2("questions.list", {
+          ...routines === void 0 ? {} : { routines },
+          ...beforeNumber === void 0 ? {} : { beforeNumber }
+        });
+        if (check(), page.questions.some((question2) => question2.item.href !== `https://${initial.workspace}.oddington.ai/inbox/${question2.item.id}` || routines !== void 0 && !routines.includes(question2.origin.routine)) || beforeNumber !== void 0 && (page.questions.some((question2) => question2.item.number >= beforeNumber) || page.nextBeforeNumber !== null && page.nextBeforeNumber >= beforeNumber)) throw unavailable2();
         if (questions.push(...page.questions), page.nextBeforeNumber === null) return questions;
         beforeNumber = page.nextBeforeNumber;
       } while (!0);