@oddington/sdk 0.1.34 → 0.1.36

package/dist/browser.js

@@ -1,14 +1,49 @@
+var fileValidationReasons = {
+  invalid_metadata: "File metadata must contain only the supported fields.",
+  invalid_name: "File name must be 1\u2013255 characters, with no reserved names, path separators, control characters or trailing spaces/dots.",
+  invalid_path: "File path must contain safe relative folder names and cannot start with .os.",
+  invalid_storage: "File storage must be local or remote.",
+  invalid_media_type: "File media type must name one valid type/subtype.",
+  invalid_size: "File size must be a non-negative safe integer byte count.",
+  invalid_request_key: "File request key must contain 1\u2013256 characters, with no surrounding whitespace or control characters.",
+  invalid_enrichment_name: "Enrichment name must be a safe filename and cannot be original or original.*.",
+  invalid_replacement: "Enrichment replacement must be a SHA-256 hash of 64 lowercase hexadecimal characters.",
+  invalid_bytes: "File content must contain byte chunks."
+};
+function parseFileErrorDetail(value) {
+  if (!value || typeof value != "object" || Array.isArray(value)) return;
+  let v = value;
+  if (typeof v.reason != "string") return;
+  if (Object.hasOwn(fileValidationReasons, v.reason))
+    return Object.keys(v).length === 1 ? { reason: v.reason } : void 0;
+  if (v.reason !== "size_mismatch" && v.reason !== "size_limit") return;
+  let count = v.reason === "size_mismatch" ? "expectedBytes" : "limitBytes";
+  if (!(Object.keys(v).some((key) => !["reason", count, "receivedBytes", "receivedAtLeast"].includes(key)) || !Number.isSafeInteger(v[count]) || v[count] < 0 || !Number.isSafeInteger(v.receivedBytes) || v.receivedBytes < 0 || v.receivedAtLeast !== void 0 && v.receivedAtLeast !== !0))
+    return {
+      reason: v.reason,
+      [count]: v[count],
+      receivedBytes: v.receivedBytes,
+      ...v.receivedAtLeast ? { receivedAtLeast: !0 } : {}
+    };
+}
+function fileErrorExplanation(detail) {
+  return detail.reason === "size_mismatch" ? `File byte count mismatch: expected ${detail.expectedBytes} bytes; received ${detail.receivedAtLeast ? "at least " : ""}${detail.receivedBytes} bytes.` : detail.reason === "size_limit" ? `File size exceeds the ${detail.limitBytes}-byte limit; received ${detail.receivedAtLeast ? "at least " : ""}${detail.receivedBytes} bytes.` : fileValidationReasons[detail.reason];
+}
 var FileOperationError = class extends Error {
-  constructor(code, status, retryable = !1) {
-    super(code);
+  constructor(code, status, retryable = !1, detail) {
+    let safe = ["invalid_input", "request_too_large"].includes(code) ? parseFileErrorDetail(detail) : void 0;
+    super(safe ? `${code}: ${fileErrorExplanation(safe)}` : code);
     this.code = code;
     this.status = status;
     this.retryable = retryable;
+    safe && (this.detail = Object.freeze(safe));
   }
   code;
   status;
   retryable;
-}, FILE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/, FILE_ORIGINAL_MAX_BYTES = 5 * 1024 ** 3;
+  detail;
+};
+var FILE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/, FILE_ORIGINAL_MAX_BYTES = 5 * 1024 ** 3;
 function parseFileDescriptor(value) {
   let invalid9 = () => {
     throw new FileOperationError("unavailable", 503, !0);
@@ -34,13 +69,22 @@ function safeEnrichmentName(value) {
   return safeFileName(value) && !/^original(?:\.|$)/i.test(value);
 }
 function parseFileEnrichMetadata(value, maxBytes) {
-  let invalid9 = () => {
-    throw new FileOperationError("invalid_input", 400);
+  let invalid9 = (reason = "invalid_metadata") => {
+    throw new FileOperationError("invalid_input", 400, !1, { reason });
   };
   if (!value || typeof value != "object" || Array.isArray(value)) return invalid9();
   let d = value;
-  if (Object.keys(d).some((key) => !["name", "size", "mediaType", "replace"].includes(key)) || !safeEnrichmentName(d.name) || !Number.isSafeInteger(d.size) || d.size < 0 || d.mediaType !== void 0 && (typeof d.mediaType != "string" || d.mediaType.length > 255 || /[\u0000-\u001f\u007f]/.test(d.mediaType)) || d.replace !== void 0 && (typeof d.replace != "string" || !/^[0-9a-f]{64}$/.test(d.replace))) return invalid9();
-  if (d.size > maxBytes) throw new FileOperationError("request_too_large", 413);
+  if (Object.keys(d).some((key) => !["name", "size", "mediaType", "replace"].includes(key))) return invalid9();
+  if (!safeEnrichmentName(d.name)) return invalid9("invalid_enrichment_name");
+  if (!Number.isSafeInteger(d.size) || d.size < 0) return invalid9("invalid_size");
+  if (d.mediaType !== void 0 && (typeof d.mediaType != "string" || d.mediaType.length > 255 || /[\u0000-\u001f\u007f]/.test(d.mediaType))) return invalid9("invalid_media_type");
+  if (d.replace !== void 0 && (typeof d.replace != "string" || !/^[0-9a-f]{64}$/.test(d.replace))) return invalid9("invalid_replacement");
+  if (d.size > maxBytes) throw new FileOperationError(
+    "request_too_large",
+    413,
+    !1,
+    { reason: "size_limit", limitBytes: maxBytes, receivedBytes: d.size }
+  );
   return d;
 }
 function safeFileName(value) {
@@ -54,9 +98,9 @@ function safeManagedFilePath(value) {
 }
 function declaredOriginalMediaType(value) {
   if (typeof value != "string" || value.length > 255 || /[\u0000-\u001f\u007f-\u009f]/.test(value))
-    throw new FileOperationError("invalid_input", 400);
+    throw new FileOperationError("invalid_input", 400, !1, { reason: "invalid_media_type" });
   let normalized = value.split(";", 1)[0].trim().toLowerCase(), token = "[a-z0-9!#$%&'+.^_`|~-]+";
-  if (!new RegExp(`^${token}/${token}$`).test(normalized)) throw new FileOperationError("invalid_input", 400);
+  if (!new RegExp(`^${token}/${token}$`).test(normalized)) throw new FileOperationError("invalid_input", 400, !1, { reason: "invalid_media_type" });
   return normalized;
 }
 function isCanonicalOriginalMediaType(value) {
@@ -67,18 +111,25 @@ function isCanonicalOriginalMediaType(value) {
   }
 }
 function parseFileCreateMetadata(value, maxBytes) {
-  let invalid9 = () => {
-    throw new FileOperationError("invalid_input", 400);
+  let invalid9 = (reason = "invalid_metadata") => {
+    throw new FileOperationError("invalid_input", 400, !1, { reason });
   };
   if (!value || typeof value != "object" || Array.isArray(value)) return invalid9();
   let input = value;
   if (Object.keys(input).some((key) => !["name", "path", "storage", "mediaType", "size", "requestKey"].includes(key))) return invalid9();
   let path = input.path === void 0 ? "Files" : input.path;
-  if (!safeFileName(input.name) || !safeManagedFilePath(path) || input.storage !== void 0 && input.storage !== "remote" && input.storage !== "local") return invalid9();
+  if (!safeFileName(input.name)) return invalid9("invalid_name");
+  if (!safeManagedFilePath(path)) return invalid9("invalid_path");
+  if (input.storage !== void 0 && input.storage !== "remote" && input.storage !== "local") return invalid9("invalid_storage");
   let mediaType = input.mediaType === void 0 ? "application/octet-stream" : declaredOriginalMediaType(input.mediaType);
-  if (!Number.isSafeInteger(input.size) || input.size < 0) return invalid9();
-  if (input.size > maxBytes) throw new FileOperationError("request_too_large", 413);
-  return typeof input.requestKey != "string" || input.requestKey.length < 1 || input.requestKey.length > 256 || input.requestKey !== input.requestKey.trim() || /[\u0000-\u001f\u007f]/.test(input.requestKey) ? invalid9() : {
+  if (!Number.isSafeInteger(input.size) || input.size < 0) return invalid9("invalid_size");
+  if (input.size > maxBytes) throw new FileOperationError(
+    "request_too_large",
+    413,
+    !1,
+    { reason: "size_limit", limitBytes: maxBytes, receivedBytes: input.size }
+  );
+  return typeof input.requestKey != "string" || input.requestKey.length < 1 || input.requestKey.length > 256 || input.requestKey !== input.requestKey.trim() || /[\u0000-\u001f\u007f]/.test(input.requestKey) ? invalid9("invalid_request_key") : {
     name: input.name,
     path,
     ...input.storage ? { storage: input.storage } : {},
@@ -88,6 +139,129 @@ function parseFileCreateMetadata(value, maxBytes) {
   };
 }
 
+var AppRoutineContractError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+  code;
+}, propertyName = /^[a-z][A-Za-z0-9]*(?![\s\S])/, stepId = /^[a-z0-9]+(?:-[a-z0-9]+)*(?![\s\S])/, routineName = /^[a-z0-9][a-z0-9-]{0,62}(?![\s\S])/;
+function isAppRoutineName(value) {
+  return typeof value == "string" && routineName.test(value);
+}
+var owns = (value, key) => Object.hasOwn(value, key), invalidContract = () => {
+  throw new AppRoutineContractError("invalid_contract");
+}, invalidValue = () => {
+  throw new AppRoutineContractError("invalid_value");
+};
+function record(value) {
+  return value !== null && typeof value == "object" && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+}
+function fields(value, required, optional = []) {
+  return required.every((key) => owns(value, key)) && Object.keys(value).every((key) => required.includes(key) || optional.includes(key));
+}
+function denseArray(value) {
+  return Array.isArray(value) && Object.keys(value).length === value.length && Array.from({ length: value.length }, (_, index) => owns(value, String(index))).every(Boolean);
+}
+function parseAppRoutineContract(value) {
+  let properties = 0;
+  function schema2(value2, depth = 1) {
+    if (depth > 8 || !record(value2)) return invalidContract();
+    switch (value2.type) {
+      case "object": {
+        if (!fields(value2, ["type", "properties", "additionalProperties"], ["required"]) || value2.additionalProperties !== !1 || !record(value2.properties)) return invalidContract();
+        let entries = Object.entries(value2.properties);
+        if (properties += entries.length, properties > 64 || entries.some(([key]) => !propertyName.test(key))) return invalidContract();
+        let required;
+        if (owns(value2, "required")) {
+          if (!denseArray(value2.required) || value2.required.some((key) => typeof key != "string" || !owns(value2.properties, key)) || new Set(value2.required).size !== value2.required.length) return invalidContract();
+          required = [...value2.required];
+        }
+        return {
+          type: "object",
+          properties: Object.fromEntries(entries.map(([key, child]) => [key, schema2(child, depth + 1)])),
+          ...required === void 0 ? {} : { required },
+          additionalProperties: !1
+        };
+      }
+      case "array":
+        return !fields(value2, ["type", "items", "maxItems"]) || !Number.isSafeInteger(value2.maxItems) || value2.maxItems < 1 || value2.maxItems > 64 ? invalidContract() : { type: "array", items: schema2(value2.items, depth + 1), maxItems: value2.maxItems };
+      case "boolean":
+        return fields(value2, ["type"]) ? { type: value2.type } : invalidContract();
+      case "file":
+        return !fields(value2, ["type"], ["storage", "path"]) || owns(value2, "storage") && value2.storage !== "local" && value2.storage !== "remote" || owns(value2, "path") && !safeManagedFilePath(value2.path) ? invalidContract() : {
+          type: "file",
+          ...owns(value2, "storage") ? { storage: value2.storage } : {},
+          ...owns(value2, "path") ? { path: value2.path } : {}
+        };
+      case "string":
+        return !fields(value2, ["type"], ["maxLength"]) || owns(value2, "maxLength") && (!Number.isSafeInteger(value2.maxLength) || value2.maxLength < 0 || value2.maxLength > 4096) ? invalidContract() : { type: "string", ...owns(value2, "maxLength") ? { maxLength: value2.maxLength } : {} };
+      case "integer":
+      case "number": {
+        let validNumber = value2.type === "integer" ? Number.isSafeInteger : Number.isFinite;
+        return !fields(value2, ["type"], ["minimum", "maximum"]) || owns(value2, "minimum") && !validNumber(value2.minimum) || owns(value2, "maximum") && !validNumber(value2.maximum) || owns(value2, "minimum") && owns(value2, "maximum") && value2.minimum > value2.maximum ? invalidContract() : {
+          type: value2.type,
+          ...owns(value2, "minimum") ? { minimum: value2.minimum } : {},
+          ...owns(value2, "maximum") ? { maximum: value2.maximum } : {}
+        };
+      }
+      default:
+        return invalidContract();
+    }
+  }
+  if (!record(value) || !fields(value, ["routine", "input", "steps"], ["result"]) || !isAppRoutineName(value.routine) || !denseArray(value.steps) || value.steps.length < 1 || value.steps.length > 64) return invalidContract();
+  let input = schema2(value.input), result2 = owns(value, "result") ? schema2(value.result) : void 0, ids = /* @__PURE__ */ new Set(), steps = value.steps.map((step) => !record(step) || !fields(step, ["id"], ["summary"]) || typeof step.id != "string" || !stepId.test(step.id) || ids.has(step.id) ? invalidContract() : (ids.add(step.id), { id: step.id, ...owns(step, "summary") ? { summary: schema2(step.summary) } : {} }));
+  return { routine: value.routine, input, steps, ...result2 === void 0 ? {} : { result: result2 } };
+}
+function jsonData(value, ancestors = /* @__PURE__ */ new Set()) {
+  if (!(value === null || typeof value == "string" || typeof value == "boolean" || typeof value == "number" && Number.isFinite(value))) {
+    if (!record(value) && !denseArray(value) || ancestors.has(value)) return invalidValue();
+    ancestors.add(value);
+    for (let child of Object.values(value)) jsonData(child, ancestors);
+    ancestors.delete(value);
+  }
+}
+function validateRoutineSchemaValue(schema2, value, rejected) {
+  let type = (value2) => value2 === null ? "null" : Array.isArray(value2) ? "array" : ["object", "boolean", "string", "number"].includes(typeof value2) ? typeof value2 : "other";
+  function check(schema3, value2, path) {
+    let fail4 = (reason, extra = {}) => (rejected?.({ reason, path: path.length <= 256 ? path : "$", expected: schema3.type, received: type(value2), ...extra }), invalidValue());
+    switch (schema3.type) {
+      case "object":
+        if (!record(value2)) return fail4("wrong_type");
+        for (let key of schema3.required ?? []) if (!owns(value2, key)) return fail4("missing_field", {
+          path: `${path}.${key}`.length <= 256 ? `${path}.${key}` : "$",
+          expected: schema3.properties[key].type,
+          received: "missing"
+        });
+        if (Object.keys(value2).some((key) => !owns(schema3.properties, key))) return fail4("unexpected_field");
+        for (let [key, child] of Object.entries(value2)) check(schema3.properties[key], child, `${path}.${key}`);
+        return;
+      case "array":
+        if (!denseArray(value2)) return fail4("wrong_type");
+        if (value2.length > schema3.maxItems) return fail4("out_of_bounds", { constraint: "maxItems", limit: schema3.maxItems });
+        value2.forEach((child, index) => check(schema3.items, child, `${path}[${index}]`));
+        return;
+      case "boolean":
+        return typeof value2 != "boolean" ? fail4("wrong_type") : void 0;
+      case "string":
+        return typeof value2 != "string" ? fail4("wrong_type") : Array.from(value2).length > (schema3.maxLength ?? 4096) ? fail4("out_of_bounds", { constraint: "maxLength", limit: schema3.maxLength ?? 4096 }) : void 0;
+      case "integer":
+      case "number":
+        return typeof value2 != "number" || !(schema3.type === "integer" ? Number.isSafeInteger(value2) : Number.isFinite(value2)) ? fail4("wrong_type") : schema3.minimum !== void 0 && value2 < schema3.minimum ? fail4("out_of_bounds", { constraint: "minimum", limit: schema3.minimum }) : schema3.maximum !== void 0 && value2 > schema3.maximum ? fail4("out_of_bounds", { constraint: "maximum", limit: schema3.maximum }) : void 0;
+      case "file": {
+        let file2;
+        try {
+          jsonData(value2), file2 = parseFileDescriptor(value2);
+        } catch {
+          return fail4("invalid_file");
+        }
+        if (schema3.path !== void 0 && file2.path !== schema3.path) return fail4("invalid_file");
+      }
+    }
+  }
+  check(schema2, value, "$");
+}
+
 var InboxContractError = class extends Error {
   constructor(message2) {
     super(message2), this.name = "InboxContractError";
@@ -157,7 +331,7 @@ function validateInboxFile(value) {
   let size = natural(v.size, "file size");
   return size > FILE_ORIGINAL_MAX_BYTES && fail("File exceeds supported size"), { id: fileId, name: name2, mediaType, size, sha256: v.sha256 };
 }
-function fields(value) {
+function fields2(value) {
   let result2 = array(value, "selected fields").map((entry) => {
     let field = object(entry, "field");
     return keys(field, ["label", "value"], "field"), { label: text(field.label, "field label"), value: text(field.value, "field value") };
@@ -184,7 +358,7 @@ function validateBlock(value) {
       label,
       ...target,
       ...expanded,
-      record: { ref: id(r.ref, "record reference"), title: text(r.title, "record title"), fields: fields(r.fields) }
+      record: { ref: id(r.ref, "record reference"), title: text(r.title, "record title"), fields: fields2(r.fields) }
     };
   }
   if (b.kind === "records") {
@@ -194,7 +368,7 @@ function validateBlock(value) {
         ref: id(r.ref, "record reference"),
         title: text(r.title, "record title"),
         ...r.description === void 0 ? {} : { description: text(r.description, "record description") },
-        ...r.facts === void 0 ? {} : { facts: fields(r.facts) },
+        ...r.facts === void 0 ? {} : { facts: fields2(r.facts) },
         ...r.view === void 0 ? {} : { view: id(r.view, "row View target") }
       };
     });
@@ -452,138 +626,6 @@ function createInboxPublisher(transport) {
   };
 }
 
-var REPOSITORY = /^[a-z0-9][a-z0-9._/-]{0,127}$/;
-function validRepositoryAlias(value) {
-  return typeof value == "string" && REPOSITORY.test(value) && !value.includes("//") && !value.includes("..");
-}
-
-var RECORD_READ_INPUT_LIMIT = 1024 * 1024, RECORD_CAPTURE_OUTPUT_LIMIT = 25 * 1024 * 1024;
-function validRecordRef(value) {
-  return typeof value == "string" && value.length <= 512 && /^[_a-zA-Z0-9][a-zA-Z0-9_-]*(\/[_a-zA-Z0-9][a-zA-Z0-9_-]*)+$/.test(value);
-}
-function validateRecordRead(value) {
-  if (!value || typeof value != "object" || Array.isArray(value))
-    throw new InboxContractError("Invalid selected-record read");
-  let input = value;
-  if (Object.keys(input).some((key) => !["repository", "refs", "atCommit"].includes(key)) || !validRepositoryAlias(input.repository) || !Array.isArray(input.refs) || !input.refs.length || input.refs.length > 1e4 || input.refs.some((ref) => !validRecordRef(ref)) || new Set(input.refs).size !== input.refs.length || input.atCommit !== void 0 && (typeof input.atCommit != "string" || !/^[0-9a-f]{40}$/.test(input.atCommit)))
-    throw new InboxContractError("Invalid selected-record read");
-  return {
-    repository: input.repository,
-    refs: [...input.refs],
-    ...input.atCommit === void 0 ? {} : { atCommit: input.atCommit }
-  };
-}
-
-var AppRoutineContractError = class extends Error {
-  constructor(code) {
-    super(code);
-    this.code = code;
-  }
-  code;
-}, propertyName = /^[a-z][A-Za-z0-9]*(?![\s\S])/, stepId = /^[a-z0-9]+(?:-[a-z0-9]+)*(?![\s\S])/, routineName = /^[a-z0-9][a-z0-9-]{0,62}(?![\s\S])/;
-function isAppRoutineName(value) {
-  return typeof value == "string" && routineName.test(value);
-}
-var owns = (value, key) => Object.hasOwn(value, key), invalidContract = () => {
-  throw new AppRoutineContractError("invalid_contract");
-}, invalidValue = () => {
-  throw new AppRoutineContractError("invalid_value");
-};
-function record(value) {
-  return value !== null && typeof value == "object" && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
-}
-function fields2(value, required, optional = []) {
-  return required.every((key) => owns(value, key)) && Object.keys(value).every((key) => required.includes(key) || optional.includes(key));
-}
-function denseArray(value) {
-  return Array.isArray(value) && Object.keys(value).length === value.length && Array.from({ length: value.length }, (_, index) => owns(value, String(index))).every(Boolean);
-}
-function parseAppRoutineContract(value) {
-  let properties = 0;
-  function schema2(value2, depth = 1) {
-    if (depth > 8 || !record(value2)) return invalidContract();
-    switch (value2.type) {
-      case "object": {
-        if (!fields2(value2, ["type", "properties", "additionalProperties"], ["required"]) || value2.additionalProperties !== !1 || !record(value2.properties)) return invalidContract();
-        let entries = Object.entries(value2.properties);
-        if (properties += entries.length, properties > 64 || entries.some(([key]) => !propertyName.test(key))) return invalidContract();
-        let required;
-        if (owns(value2, "required")) {
-          if (!denseArray(value2.required) || value2.required.some((key) => typeof key != "string" || !owns(value2.properties, key)) || new Set(value2.required).size !== value2.required.length) return invalidContract();
-          required = [...value2.required];
-        }
-        return {
-          type: "object",
-          properties: Object.fromEntries(entries.map(([key, child]) => [key, schema2(child, depth + 1)])),
-          ...required === void 0 ? {} : { required },
-          additionalProperties: !1
-        };
-      }
-      case "array":
-        return !fields2(value2, ["type", "items", "maxItems"]) || !Number.isSafeInteger(value2.maxItems) || value2.maxItems < 1 || value2.maxItems > 64 ? invalidContract() : { type: "array", items: schema2(value2.items, depth + 1), maxItems: value2.maxItems };
-      case "boolean":
-        return fields2(value2, ["type"]) ? { type: value2.type } : invalidContract();
-      case "file":
-        return !fields2(value2, ["type"], ["storage", "path"]) || owns(value2, "storage") && value2.storage !== "local" && value2.storage !== "remote" || owns(value2, "path") && !safeManagedFilePath(value2.path) ? invalidContract() : {
-          type: "file",
-          ...owns(value2, "storage") ? { storage: value2.storage } : {},
-          ...owns(value2, "path") ? { path: value2.path } : {}
-        };
-      case "string":
-        return !fields2(value2, ["type"], ["maxLength"]) || owns(value2, "maxLength") && (!Number.isSafeInteger(value2.maxLength) || value2.maxLength < 0 || value2.maxLength > 4096) ? invalidContract() : { type: "string", ...owns(value2, "maxLength") ? { maxLength: value2.maxLength } : {} };
-      case "integer":
-      case "number": {
-        let validNumber = value2.type === "integer" ? Number.isSafeInteger : Number.isFinite;
-        return !fields2(value2, ["type"], ["minimum", "maximum"]) || owns(value2, "minimum") && !validNumber(value2.minimum) || owns(value2, "maximum") && !validNumber(value2.maximum) || owns(value2, "minimum") && owns(value2, "maximum") && value2.minimum > value2.maximum ? invalidContract() : {
-          type: value2.type,
-          ...owns(value2, "minimum") ? { minimum: value2.minimum } : {},
-          ...owns(value2, "maximum") ? { maximum: value2.maximum } : {}
-        };
-      }
-      default:
-        return invalidContract();
-    }
-  }
-  if (!record(value) || !fields2(value, ["routine", "input", "steps"], ["result"]) || !isAppRoutineName(value.routine) || !denseArray(value.steps) || value.steps.length < 1 || value.steps.length > 64) return invalidContract();
-  let input = schema2(value.input), result2 = owns(value, "result") ? schema2(value.result) : void 0, ids = /* @__PURE__ */ new Set(), steps = value.steps.map((step) => !record(step) || !fields2(step, ["id"], ["summary"]) || typeof step.id != "string" || !stepId.test(step.id) || ids.has(step.id) ? invalidContract() : (ids.add(step.id), { id: step.id, ...owns(step, "summary") ? { summary: schema2(step.summary) } : {} }));
-  return { routine: value.routine, input, steps, ...result2 === void 0 ? {} : { result: result2 } };
-}
-function jsonData(value, ancestors = /* @__PURE__ */ new Set()) {
-  if (!(value === null || typeof value == "string" || typeof value == "boolean" || typeof value == "number" && Number.isFinite(value))) {
-    if (!record(value) && !denseArray(value) || ancestors.has(value)) return invalidValue();
-    ancestors.add(value);
-    for (let child of Object.values(value)) jsonData(child, ancestors);
-    ancestors.delete(value);
-  }
-}
-function validateRoutineSchemaValue(schema2, value) {
-  switch (schema2.type) {
-    case "object":
-      if (!record(value) || (schema2.required ?? []).some((key) => !owns(value, key)) || Object.keys(value).some((key) => !owns(schema2.properties, key))) return invalidValue();
-      for (let [key, child] of Object.entries(value)) validateRoutineSchemaValue(schema2.properties[key], child);
-      return;
-    case "array":
-      if (!denseArray(value) || value.length > schema2.maxItems) return invalidValue();
-      for (let child of value) validateRoutineSchemaValue(schema2.items, child);
-      return;
-    case "boolean":
-      return typeof value != "boolean" ? invalidValue() : void 0;
-    case "string":
-      return typeof value != "string" || Array.from(value).length > (schema2.maxLength ?? 4096) ? invalidValue() : void 0;
-    case "integer":
-    case "number":
-      return typeof value != "number" || !(schema2.type === "integer" ? Number.isSafeInteger(value) : Number.isFinite(value)) || schema2.minimum !== void 0 && value < schema2.minimum || schema2.maximum !== void 0 && value > schema2.maximum ? invalidValue() : void 0;
-    case "file":
-      try {
-        jsonData(value);
-        let file2 = parseFileDescriptor(value);
-        if (schema2.path !== void 0 && file2.path !== schema2.path) return invalidValue();
-      } catch {
-        return invalidValue();
-      }
-  }
-}
-
 var ROUTINE_DECLARATION_SCHEMA = "https://schemas.oddington.ai/routine/v1.json", ROUTINE_SOURCE_LIMITS = { files: 2e4, bytes: 256 * 1024 * 1024, declarationBytes: 64 * 1024 };
 var invalid = (field) => {
   throw new Error(`Invalid routine declaration: ${field}`);
@@ -603,11 +645,9 @@ function parseRoutineDeclaration(value) {
     (!routineAlias(key) || !["read", "write"].includes(repositories[key])) && invalid(`access.repositories.${key}`), grants[key] = repositories[key];
   access.files !== void 0 && !["read", "read-write"].includes(access.files) && invalid("access.files");
   let runtime = object2(v.runtime === void 0 ? {} : v.runtime, ["features", "resources", "maxDuration"], "runtime");
-  runtime.resources !== void 0 && !["standard", "large"].includes(runtime.resources) && invalid("runtime.resources");
-  let duration = runtime.maxDuration === void 0 ? "15m" : runtime.maxDuration;
-  (typeof duration != "string" || !/^(?:[1-5][0-9]|60)m$/.test(duration) || Number(duration.slice(0, -1)) < 15) && invalid("runtime.maxDuration");
-  let retry = object2(v.retry === void 0 ? {} : v.retry, ["maxAttempts"], "retry"), maxAttempts = retry.maxAttempts === void 0 ? 1 : retry.maxAttempts;
-  (!Number.isInteger(maxAttempts) || maxAttempts < 1 || maxAttempts > 3) && invalid("retry.maxAttempts");
+  runtime.features !== void 0 && (!Array.isArray(runtime.features) || runtime.features.length !== 0) && invalid("runtime.features"), runtime.resources !== void 0 && runtime.resources !== "standard" && invalid("runtime.resources"), runtime.maxDuration !== void 0 && runtime.maxDuration !== "15m" && invalid("runtime.maxDuration");
+  let retry = object2(v.retry === void 0 ? {} : v.retry, ["maxAttempts"], "retry");
+  retry.maxAttempts !== void 0 && retry.maxAttempts !== 1 && invalid("retry.maxAttempts");
   let assets = v.assets === void 0 ? [] : v.assets;
   return (!Array.isArray(assets) || assets.length > 64 || assets.some((item) => !routineAssetPattern(item)) || new Set(assets).size !== assets.length) && invalid("assets"), {
     $schema: ROUTINE_DECLARATION_SCHEMA,
@@ -618,12 +658,8 @@ function parseRoutineDeclaration(value) {
       ...access.files === void 0 ? {} : { files: access.files },
       publish: list(access.publish, "access.publish", ["asks", "digests"])
     },
-    runtime: {
-      features: list(runtime.features, "runtime.features", ["python", "documents", "browser"]),
-      resources: runtime.resources ?? "standard",
-      maxDuration: duration
-    },
-    retry: { maxAttempts },
+    runtime: { features: [], resources: "standard", maxDuration: "15m" },
+    retry: { maxAttempts: 1 },
     assets: [...assets].sort()
   };
 }
@@ -672,20 +708,82 @@ function parseRoutineAccess(value) {
   }
 }
 
-var ROUTINE_AI_VALUE_BYTES = 256 * 1024, ROUTINE_AI_EVIDENCE_BYTES = 4 * 1024;
+function parseRoutineAIOutputIssue(value) {
+  if (!value || typeof value != "object" || Array.isArray(value)) return;
+  let v = value;
+  if (["invalid_json", "invalid_response", "empty_text"].includes(String(v.reason)))
+    return Object.keys(v).join(",") === "reason" ? { reason: v.reason } : void 0;
+  if (!(!["missing_field", "unexpected_field", "wrong_type", "out_of_bounds", "invalid_file"].includes(String(v.reason)) || typeof v.path != "string" || v.path.length > 256 || !/^\$(?:\.[a-z][A-Za-z0-9]*|\[(?:0|[1-9][0-9]*)\])*$/.test(v.path) || !["object", "array", "boolean", "string", "integer", "number", "file"].includes(String(v.expected)) || !["missing", "null", "object", "array", "boolean", "string", "number", "other"].includes(String(v.received)) || Object.keys(v).some((key) => !["reason", "path", "expected", "received", "constraint", "limit"].includes(key)))) {
+    if (v.reason === "out_of_bounds") {
+      if (!["maxLength", "maxItems", "minimum", "maximum"].includes(String(v.constraint)) || typeof v.limit != "number" || !Number.isFinite(v.limit)) return;
+    } else if (Object.hasOwn(v, "constraint") || Object.hasOwn(v, "limit")) return;
+    return {
+      reason: v.reason,
+      path: v.path,
+      expected: v.expected,
+      received: v.received,
+      ...v.reason === "out_of_bounds" ? { constraint: v.constraint, limit: v.limit } : {}
+    };
+  }
+}
+function routineAIOutputMessage(issue) {
+  if (issue.reason === "invalid_json") return "AI replied, but its answer could not be read as JSON.";
+  if (issue.reason === "invalid_response") return "AI returned a response OS could not read.";
+  if (issue.reason === "empty_text") return "AI returned an empty answer.";
+  let field = issue.path === "$" ? "response" : issue.path.slice(issue.path.startsWith("$.") ? 2 : 1), expected = {
+    object: "an object",
+    array: "a list",
+    boolean: "true or false",
+    string: "text",
+    integer: "a whole number",
+    number: "a number",
+    file: "a File"
+  }[issue.expected], received = {
+    missing: "a missing field",
+    null: "null",
+    object: "an object",
+    array: "a list",
+    boolean: "true or false",
+    string: "text",
+    number: "a number",
+    other: "an unsupported value"
+  }[issue.received];
+  if (issue.reason === "missing_field") return `AI response is missing a required field.
+  ${field}: expected ${expected}; the field was missing.`;
+  if (issue.reason === "unexpected_field") return `AI response includes an unexpected field.
+  ${field}: only the fields declared by the routine are allowed.`;
+  if (issue.reason === "invalid_file") return `AI response contains an invalid File.
+  ${field}: expected a valid File matching the routine's requirements.`;
+  if (issue.reason === "out_of_bounds") {
+    let constraint = {
+      maxLength: `at most ${issue.limit} characters`,
+      maxItems: `at most ${issue.limit} items`,
+      minimum: `a value of at least ${issue.limit}`,
+      maximum: `a value of at most ${issue.limit}`
+    }[issue.constraint];
+    return `AI response is outside a permitted limit.
+  ${field}: expected ${constraint}.`;
+  }
+  return `AI response has the wrong type.
+  ${field}: expected ${expected}; received ${received}.`;
+}
+
+var ROUTINE_AI_VALUE_BYTES = 256 * 1024, ROUTINE_AI_RESULT_BYTES = 6 * ROUTINE_AI_VALUE_BYTES + 1024, ROUTINE_AI_EVIDENCE_BYTES = 4 * 1024;
 var RoutineAIError = class extends Error {
-  constructor(code) {
-    super(code);
+  constructor(code, options = {}) {
+    let detail = code === "invalid_output" ? parseRoutineAIOutputIssue(options.detail) : void 0;
+    super(detail ? routineAIOutputMessage(detail) : code);
     this.code = code;
-    this.name = "RoutineAIError";
+    this.name = "RoutineAIError", detail && (this.detail = Object.freeze(detail)), code === "invalid_output" && typeof options.text == "string" && new TextEncoder().encode(options.text).byteLength <= ROUTINE_AI_VALUE_BYTES && Object.defineProperty(this, "text", { value: options.text });
   }
   code;
+  detail;
 };
-function capture(value, invalid9, oversized) {
+function capture(value, invalid9, oversized, limit = ROUTINE_AI_VALUE_BYTES) {
   try {
     assertRoutineJson(value);
     let encoded = JSON.stringify(value);
-    if (new TextEncoder().encode(encoded).byteLength > ROUTINE_AI_VALUE_BYTES) throw new RoutineAIError(oversized);
+    if (new TextEncoder().encode(encoded).byteLength > limit) throw new RoutineAIError(oversized);
     return freezeRoutineMetadata(JSON.parse(encoded));
   } catch (error) {
     throw error instanceof RoutineAIError ? error : new RoutineAIError(invalid9);
@@ -704,19 +802,47 @@ function parseRoutineAIRequest(value) {
   }
 }
 function parseRoutineAIResult(request2, value) {
-  let v = capture(value, "invalid_output", "output_too_large");
+  let v;
   try {
-    if (request2.kind === "generateText") {
-      if (assertRoutineFields(v, ["text"]), typeof v.text != "string" || !v.text.trim()) throw new Error();
-      return freezeRoutineMetadata({ text: v.text });
-    } else {
-      if (assertRoutineFields(v, ["object"]), !Object.hasOwn(v, "object")) throw new Error();
-      return validateRoutineSchemaValue(request2.schema, v.object), freezeRoutineMetadata({ object: v.object });
+    if (v = capture(
+      value,
+      "invalid_output",
+      "output_too_large",
+      request2.kind === "generateText" ? ROUTINE_AI_RESULT_BYTES : ROUTINE_AI_VALUE_BYTES
+    ), assertRoutineFields(v, request2.kind === "generateText" ? ["text"] : ["object"]), request2.kind === "generateText") {
+      if (typeof v.text != "string") throw new Error();
+      return acceptText(request2, v.text);
     }
+    if (!Object.hasOwn(v, "object")) throw new Error();
+  } catch (error) {
+    throw error instanceof RoutineAIError ? error : new RoutineAIError("invalid_output", { detail: { reason: "invalid_response" } });
+  }
+  return validateObject(request2.schema, v.object), freezeRoutineMetadata({ object: v.object });
+}
+function validateObject(schema2, object5, text5) {
+  let detail = { reason: "invalid_response" };
+  try {
+    validateRoutineSchemaValue(schema2, object5, (issue) => {
+      detail = issue;
+    });
   } catch {
-    throw new RoutineAIError("invalid_output");
+    throw new RoutineAIError("invalid_output", { ...text5 === void 0 ? {} : { text: text5 }, detail });
   }
 }
+function acceptText(request2, text5) {
+  if (new TextEncoder().encode(text5).byteLength > ROUTINE_AI_VALUE_BYTES) throw new RoutineAIError("output_too_large");
+  if (request2.kind === "generateText") {
+    if (!text5.trim()) throw new RoutineAIError("invalid_output", { text: text5, detail: { reason: "empty_text" } });
+    return freezeRoutineMetadata({ text: text5 });
+  }
+  let object5;
+  try {
+    object5 = JSON.parse(text5);
+  } catch {
+    throw new RoutineAIError("invalid_output", { text: text5, detail: { reason: "invalid_json" } });
+  }
+  return validateObject(request2.schema, object5, text5), capture({ object: object5 }, "invalid_output", "output_too_large");
+}
 
 var LIMIT = 256 * 1024, invalid3 = () => {
   throw new AppRoutineContractError("invalid_value");
@@ -842,7 +968,7 @@ function captureRoutineInput(definition, input) {
   return capture2(contract.input, input === void 0 && Object.hasOwn(contract, "inputDefault") ? contract.inputDefault : input);
 }
 async function executeRoutineDefinition(definition, input, runtime) {
-  let captured = captureRoutineInput(definition, input), { contract, steps, run } = definitions.get(definition), active2 = !0, accepting = !0, broken = !1, work = Promise.resolve(), aiFailure, aiWork = /* @__PURE__ */ new Set(), generate = (kind, value) => {
+  let captured = captureRoutineInput(definition, input), { contract, steps, run } = definitions.get(definition), active2 = !0, accepting = !0, broken = !1, work = Promise.resolve(), aiWork = /* @__PURE__ */ new Set(), generate = (kind, value) => {
     let operation2 = (async () => {
       if (!active2 || broken || contract.access.ai !== !0) throw new RoutineAIError("access_denied");
       if (!runtime.ai) throw new RoutineAIError("capability_unavailable");
@@ -861,9 +987,7 @@ async function executeRoutineDefinition(definition, input, runtime) {
       if (!active2 || broken) throw new RoutineAIError("access_denied");
       return parseRoutineAIResult(request2, result3);
     })();
-    return aiWork.add(operation2), operation2.then(() => aiWork.delete(operation2), (error) => {
-      aiFailure ??= error, broken = !0, aiWork.delete(operation2);
-    }), operation2;
+    return aiWork.add(operation2), operation2.then(() => aiWork.delete(operation2), () => aiWork.delete(operation2)), operation2;
   }, called = /* @__PURE__ */ new Set(), reached = /* @__PURE__ */ new Set(), guarded = (value, receiver) => typeof value == "function" ? (...args) => {
     if (!active2 || broken) throw new Error("Run authority ended");
     return guarded(Reflect.apply(value, receiver, args));
@@ -927,7 +1051,7 @@ async function executeRoutineDefinition(definition, input, runtime) {
   for (accepting = !1, await work; aiWork.size; ) await Promise.allSettled([...aiWork]);
   active2 = !1;
   for (let step of contract.steps) reached.has(step.id) || await runtime.step(step.id, { status: "skipped" });
-  if (broken) throw failure ?? aiFailure ?? new AppRoutineContractError("invalid_value");
+  if (broken) throw failure ?? new AppRoutineContractError("invalid_value");
   if (contract.result !== void 0) return capture2(contract.result, result2);
   if (result2 !== void 0) return invalid3();
 }
@@ -947,6 +1071,11 @@ var DataOperationError = class extends Error {
   component;
 };
 
+var RECORD_READ_INPUT_LIMIT = 1024 * 1024, RECORD_CAPTURE_OUTPUT_LIMIT = 25 * 1024 * 1024;
+function validRecordRef(value) {
+  return typeof value == "string" && value.length <= 512 && /^[_a-zA-Z0-9][a-zA-Z0-9_-]*(\/[_a-zA-Z0-9][a-zA-Z0-9_-]*)+$/.test(value);
+}
+
 var invalid4 = () => {
   throw new DataOperationError("invalid_query");
 }, historyText = (value) => typeof value == "string" && !/[\u0000\uD800-\uDFFF]/u.test(value);
@@ -1471,8 +1600,13 @@ async function boundedBytes(stream, limit, signal) {
       let { done, value } = await reader.read();
       if (signal?.aborted) throw unavailable2();
       if (done) break;
-      if (!(value instanceof Uint8Array)) throw invalid7();
-      if (size += value.byteLength, size > limit) throw new FileOperationError("request_too_large", 413);
+      if (!(value instanceof Uint8Array)) throw new FileOperationError("invalid_input", 400, !1, { reason: "invalid_bytes" });
+      if (size += value.byteLength, size > limit) throw new FileOperationError(
+        "request_too_large",
+        413,
+        !1,
+        { reason: "size_limit", limitBytes: limit, receivedBytes: size, receivedAtLeast: !0 }
+      );
       bytes.set(value, size - value.byteLength);
     }
   } catch (error) {
@@ -1524,7 +1658,12 @@ async function send(suffix, init2, descriptor, initial, parent) {
       })();
       if (!response2.ok) {
         let value2 = await result(response2), error = value2 && typeof value2 == "object" && "error" in value2 ? value2.error : void 0, received = error && typeof error == "object" && "code" in error ? error.code : void 0, code = failures[response2.status]?.find((code2) => code2 === received);
-        throw code ? new FileOperationError(code, response2.status, code === "capacity" || code === "unavailable") : unavailable2();
+        throw code ? new FileOperationError(
+          code,
+          response2.status,
+          code === "capacity" || code === "unavailable",
+          parseFileErrorDetail(error?.detail)
+        ) : unavailable2();
       }
       if (response2.status !== (descriptor === 204 ? 204 : 200) || descriptor === 204 && response2.body !== null)
         throw response2.body?.cancel().catch(() => {
@@ -1588,7 +1727,7 @@ async function multipartCreate(input, metadata, exchange, release = () => {
     };
     for (let sent = 0, partNumber = 1; sent < metadata.size || metadata.size === 0 && partNumber === 1; partNumber++) {
       let length = Math.min(PART_BYTES, metadata.size - sent), part;
-      if (input.file instanceof Uint8Array) part = input.file.subarray(sent, sent + length).slice();
+      if (input.file instanceof Uint8Array) part = new Uint8Array(input.file.subarray(sent, sent + length));
       else if (input.file instanceof Blob) {
         let slice = input.file.slice(sent, sent + length);
         part = new Uint8Array(await request2(() => slice.arrayBuffer()));
@@ -1717,7 +1856,13 @@ var files = {
     let blob = input.file instanceof Blob, array3 = input.file instanceof Uint8Array, stream = input.file instanceof ReadableStream;
     if (!blob && !array3 && !stream) throw invalid7();
     let intrinsic = blob ? input.file.size : array3 ? input.file.byteLength : void 0;
-    if (intrinsic !== void 0 && input.size !== void 0 && input.size !== intrinsic) throw invalid7();
+    if (intrinsic !== void 0 && input.size !== void 0 && input.size !== intrinsic)
+      throw !Number.isSafeInteger(input.size) || input.size < 0 ? new FileOperationError("invalid_input", 400, !1, { reason: "invalid_size" }) : new FileOperationError(
+        "invalid_input",
+        400,
+        !1,
+        { reason: "size_mismatch", expectedBytes: input.size, receivedBytes: intrinsic }
+      );
     let name2 = input.name;
     name2 === void 0 && blob && "name" in input.file && typeof input.file.name == "string" && (name2 = typeof globalThis.File < "u" && input.file instanceof globalThis.File ? input.file.name : input.file.name.split(/[\\/]/).at(-1));
     let mediaType = declaredOriginalMediaType(input.mediaType === void 0 ? blob && input.file.type ? input.file.type : "application/octet-stream" : input.mediaType), metadata = parseFileCreateMetadata({
@@ -1754,12 +1899,17 @@ var files = {
     }
     return metadata.size > MAX_BYTES ? multipartCreate(input, metadata, (suffix, init2, kind, signal) => kind === !0 ? send(suffix, init2, !0, context, signal) : send(suffix, init2, "control", context, signal)) : timed(async (signal) => {
       try {
-        let bytes = array3 ? input.file.slice() : await boundedBytes(
+        let bytes = array3 ? new Uint8Array(input.file) : await boundedBytes(
           blob ? input.file.stream() : input.file,
           metadata.size,
           signal
         );
-        if (bytes.byteLength !== metadata.size) throw invalid7();
+        if (bytes.byteLength !== metadata.size) throw new FileOperationError(
+          "invalid_input",
+          400,
+          !1,
+          { reason: "size_mismatch", expectedBytes: metadata.size, receivedBytes: bytes.byteLength }
+        );
         if (signal.aborted) throw unavailable2();
         return await send("", {
           method: "POST",
@@ -1785,7 +1935,7 @@ var files = {
         let buffer = new Uint8Array(Math.min(MAX_BYTES, input.content.length * 3)), encoded = new TextEncoder().encodeInto(input.content, buffer);
         if (encoded.read !== input.content.length) throw new FileOperationError("request_too_large", 413);
         bytes = buffer.slice(0, encoded.written);
-      } else bytes = input.content.slice();
+      } else bytes = new Uint8Array(input.content);
       let metadata = parseFileEnrichMetadata({
         name: input.name,
         size: bytes.byteLength,
@@ -2130,68 +2280,6 @@ var connections = /* @__PURE__ */ runtimeConnections();
 
 var LOCAL_ROUTINE_VALUE_BYTES = 256 * 1024;
 
-var RECORD_WRITE_INPUT_LIMIT = 8 * 1024 * 1024, RoutineRecordWriteError = class extends Error {
-  constructor(message2, effect) {
-    super(message2);
-    this.effect = effect;
-    this.name = "RoutineRecordWriteError";
-  }
-  effect;
-};
-function validateRecordWrite(value) {
-  let input = serializable(value);
-  if (!input || Array.isArray(input) || typeof input != "object" || Object.keys(input).sort().join(",") !== "records,repository" || !validRepositoryAlias(input.repository) || !Array.isArray(input.records) || !input.records.length || input.records.length > 1e4 || new Set(input.records.map((edit) => edit?.ref)).size !== input.records.length)
-    throw new InboxContractError("Invalid record update batch");
-  for (let edit of input.records) {
-    if (!edit || Array.isArray(edit) || typeof edit != "object" || !validRecordRef(edit.ref))
-      throw new InboxContractError("Invalid record edit");
-    if ("expectedVersion" in edit) {
-      if (Object.keys(edit).sort().join(",") !== "expectedVersion,ref,set" || typeof edit.expectedVersion != "string" || !/^record-v1:[0-9a-f]{64}$/.test(edit.expectedVersion) || !edit.set || Array.isArray(edit.set) || typeof edit.set != "object" || !Object.keys(edit.set).length)
-        throw new InboxContractError("Invalid record edit");
-      continue;
-    }
-    if (Object.keys(edit).sort().join(",") !== "fields,path,ref" || typeof edit.path != "string" || !validCreatePath(edit.path) || !edit.fields || Array.isArray(edit.fields) || typeof edit.fields != "object" || !Object.keys(edit.fields).length)
-      throw new InboxContractError("Invalid record creation");
-  }
-  return structuredClone(input);
-}
-function validateRecordUpdate(value) {
-  let input = validateRecordWrite(value);
-  if (input.records.some((record4) => !("expectedVersion" in record4)))
-    throw new InboxContractError("Record creation is unavailable for this operation");
-  return input;
-}
-function validateRecordDelete(value) {
-  let input = serializable(value);
-  if (!input || Array.isArray(input) || typeof input != "object" || Object.keys(input).sort().join(",") !== "records,repository" || !validRepositoryAlias(input.repository) || !Array.isArray(input.records) || !input.records.length || input.records.length > 1e4 || new Set(input.records.map((record4) => record4?.ref)).size !== input.records.length)
-    throw new InboxContractError("Invalid record deletion batch");
-  for (let record4 of input.records)
-    if (!record4 || Array.isArray(record4) || typeof record4 != "object" || Object.keys(record4).sort().join(",") !== "expectedVersion,ref" || !validRecordRef(record4.ref) || typeof record4.expectedVersion != "string" || !/^record-v1:[0-9a-f]{64}$/.test(record4.expectedVersion))
-      throw new InboxContractError("Invalid record deletion");
-  return structuredClone(input);
-}
-function validateRecordChange(value) {
-  let input = serializable(value);
-  if (!input || Array.isArray(input) || typeof input != "object" || Object.keys(input).sort().join(",") !== "records,repository" || !validRepositoryAlias(input.repository) || !Array.isArray(input.records) || !input.records.length || input.records.length > 1e4 || new Set(input.records.map((record4) => record4?.ref)).size !== input.records.length || new TextEncoder().encode(JSON.stringify(input)).byteLength > RECORD_WRITE_INPUT_LIMIT)
-    throw new InboxContractError("Invalid record change batch");
-  let writes = [], deletes = [];
-  for (let record4 of input.records) {
-    if (!record4 || typeof record4 != "object" || Array.isArray(record4))
-      throw new InboxContractError("Invalid record change");
-    "set" in record4 || "fields" in record4 ? writes.push(record4) : deletes.push(record4);
-  }
-  return writes.length && validateRecordWrite({ repository: input.repository, records: writes }), deletes.length && validateRecordDelete({ repository: input.repository, records: deletes }), structuredClone(input);
-}
-function validateRoutineRecordWrite(value) {
-  let body = serializable(value);
-  if (!body || typeof body != "object" || Array.isArray(body) || Object.keys(body).sort().join(",") !== "input,requestKey" || typeof body.requestKey != "string" || !body.requestKey.trim() || body.requestKey !== body.requestKey.trim() || body.requestKey.length > 512)
-    throw new InboxContractError("A stable routine request key is required");
-  return { input: validateRecordChange(body.input), requestKey: body.requestKey };
-}
-function validCreatePath(value) {
-  return value === value.trim() && value.endsWith(".md") && !value.startsWith("/") && value.split("/").every((segment) => !!segment && ![".", ".."].includes(segment) && /^[a-zA-Z0-9_.-]+$/.test(segment));
-}
-
 function locationIdentity(location) {
   let coordinates = location.provider === "os" ? [location.file] : location.provider === "gmail" ? [location.connection, location.message, location.attachment] : location.provider === "dropbox" ? [location.connection, location.file] : void 0;
   if (coordinates?.every((value) => typeof value == "string" && value.length > 0))
@@ -3008,7 +3096,15 @@ function validPair(value) {
   return validProof(pair.credential) && validProof(pair.renewalCredential) && pair.credential !== pair.renewalCredential && validBinding(pair.context);
 }
 
-var unavailable3 = () => new InboxOperationError(503, "unavailable"), stale = () => new InboxOperationError(401, "authority_unavailable");
+var WorkspaceAdmissionError = class extends Error {
+  constructor(status) {
+    super("Workspace admission unavailable");
+    this.status = status;
+  }
+  status;
+};
+
+var unavailable3 = () => new InboxOperationError(503, "unavailable"), stale = () => new InboxOperationError(401, "authority_unavailable"), contextFailure = (error) => error instanceof WorkspaceAdmissionError ? new InboxOperationError(error.status, error.status === 401 ? "authority_unavailable" : error.status === 403 ? "access_denied" : "unavailable") : stale();
 function hostFailure(error, context) {
   return !context.isCurrent() || context.expiresAt <= Date.now() || error instanceof InboxContextError && error.status === 401 ? stale() : error instanceof InboxContextError && error.status === 403 ? new InboxOperationError(403, "access_denied") : unavailable3();
 }
@@ -3016,8 +3112,8 @@ async function send2(operation2, input, admitted) {
   let envelope = parseInboxRequest({ operation: operation2, input }), context;
   try {
     context = admitted ?? await resolveAppContext();
-  } catch {
-    throw stale();
+  } catch (error) {
+    throw contextFailure(error);
   }
   if (context.kind === "local") {
     if (!isAppQuestionOperation(operation2)) throw new InboxOperationError(403, "access_denied");
@@ -3125,8 +3221,8 @@ var inbox = {
       let items = [], beforeNumber, initial;
       try {
         initial = await resolveAppContext();
-      } catch {
-        throw stale();
+      } catch (error) {
+        throw contextFailure(error);
       }
       let host;
       try {
@@ -3164,8 +3260,8 @@ var inbox = {
       let routines = Object.freeze(supplied.routines), questions = [], beforeNumber, initial;
       try {
         initial = await resolveAppContext();
-      } catch {
-        throw stale();
+      } catch (error) {
+        throw contextFailure(error);
       }
       let check = () => {
         if (!initial.isCurrent() || initial.expiresAt <= Date.now()) throw stale();
@@ -3215,14 +3311,15 @@ function init({ auth: input }) {
   }
   let active2 = !0, revision = 0, person, token, binding = {}, local2 = localOrigin ? appContext(localOrigin, () => active2) : void 0, subscription, stopDisposal, resolve = async () => {
     if (local2) return local2.resolve();
-    if (!active2 || !endpoint || !workspace || globalThis.location.origin !== endpoint) throw new Error("Hosted Data context unavailable.");
+    if (registered && await registered.ready(), !active2 || !endpoint || !workspace || globalThis.location.origin !== endpoint) throw new Error("Hosted Data context unavailable.");
     let started = revision, { data: { session }, error } = await auth2.getSession();
     if (!active2 || globalThis.location.origin !== endpoint || started !== revision || error || !session || person !== void 0 && person !== session.user.id)
       throw new Error("Hosted Data context unavailable.");
     let expiresAt = (session.expires_at ?? 0) * 1e3;
     if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() || !session.user.id)
       throw new Error("Hosted Data context unavailable.");
-    person = session.user.id;
+    if (person = session.user.id, registered && await registered.admitWorkspace(), !active2 || globalThis.location.origin !== endpoint || started !== revision || person !== session.user.id)
+      throw new Error("Hosted Data context unavailable.");
     let isCurrent = () => active2 && globalThis.location.origin === endpoint && revision === started && person === session.user.id;
     return {
       workspace,
@@ -3369,6 +3466,36 @@ function createBrowserAuth(runtime) {
   function current2(c, origin, revision) {
     return c.session && !validSession(c.session) && expire(c), c.active && c.revision === revision && globalThis.location?.origin === origin;
   }
+  async function admitWorkspace(c, origin) {
+    if (origin === "https://auth.oddington.ai" || origin === "http://127.0.0.1:5176") return;
+    let revision = c.revision;
+    if (!current2(c, origin, revision) || !c.session || c.state.pending === "sign_out") throw runtime.failure("stale");
+    if (c.admission?.revision !== revision) {
+      let token = c.session.access_token, result2 = (async () => {
+        let status;
+        try {
+          let response2 = await fetch(`${origin}/api/auth`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${token}` },
+            credentials: "same-origin",
+            redirect: "error",
+            cache: "no-store",
+            signal: AbortSignal.timeout(15e3)
+          });
+          status = response2.status;
+          let value = status === 200 ? await response2.json() : null;
+          status === 200 && value?.admitted !== !0 && (status = 503), status !== 200 && response2.body?.cancel().catch(() => {
+          });
+        } catch {
+          status = 503;
+        }
+        if (!current2(c, origin, revision) || c.state.pending === "sign_out") throw runtime.failure("stale");
+        if (status !== 200) throw new WorkspaceAdmissionError(status === 401 ? 401 : status === 403 ? 403 : 503);
+      })();
+      c.admission = { revision, result: result2 };
+    }
+    if (await c.admission.result, !current2(c, origin, revision)) throw runtime.failure("stale");
+  }
   return { create() {
     let origin = globalThis.location?.origin ?? "", c = coordinators.get(origin);
     c || (c = createCoordinator(origin), coordinators.set(origin, c));
@@ -3458,7 +3585,9 @@ function createBrowserAuth(runtime) {
       async sendCode(email) {
         if (assertActive(), !validEmail(email)) throw runtime.failure("invalid_input");
         await action("send_code", async (provider2) => {
-          let { error } = await provider2.signInWithOtp({ email: email.trim(), options: { shouldCreateUser: !1 } });
+          let { error } = await provider2.signInWithOtp({ email: email.trim(), options: {
+            shouldCreateUser: origin !== "https://auth.oddington.ai" && origin !== "http://127.0.0.1:5176"
+          } });
           if (error && !accountRefusal(error)) throw runtime.failure("unavailable");
         });
       },
@@ -3470,6 +3599,11 @@ function createBrowserAuth(runtime) {
           if (!data3.session || !validSession(data3.session)) throw runtime.failure("invalid_code");
           if (!current2(coordinator, origin, revision) && (coordinator.session?.access_token !== data3.session.access_token || coordinator.revision !== revision + 1 || coordinator.state.pending !== "verify_code")) throw runtime.failure("stale");
           accept(coordinator, "SIGNED_IN", data3.session);
+          try {
+            await admitWorkspace(coordinator, origin);
+          } catch (error2) {
+            if (!(error2 instanceof WorkspaceAdmissionError)) throw error2;
+          }
         });
       },
       async signOut() {
@@ -3495,6 +3629,12 @@ function createBrowserAuth(runtime) {
       }
     });
     return registerBrowserAuth(handle2, {
+      async ready() {
+        assertActive(), await coordinator.ready, assertActive();
+      },
+      async admitWorkspace() {
+        assertActive(), await admitWorkspace(coordinator, origin), assertActive();
+      },
       onDispose(callback) {
         return active2 ? (disposalObservers.add(callback), () => {
           disposalObservers.delete(callback);
@@ -3926,18 +4066,11 @@ function validateFileAddOptions(value) {
   return v;
 }
 
-var PREPARED_RECORD_INPUT_LIMIT = 64 * 1024 * 1024;
-
-function routineDataEnvelope(command) {
-  return "apply" in command ? { operation: "changes.publish", captured: command.apply } : { operation: "changes.publish", request: command };
-}
-
 function routinePublicationClient2(options = {}) {
   let environment = {}, installed2 = routineTransport(), local2 = installed2?.request ?? void 0, workspace = installed2 ? "installed" : options.workspace ?? environment.OS_ROUTINE_WORKSPACE, capability = options.capability ?? environment.OS_ROUTINE_RUN;
   if (!workspace || !/^[a-z0-9][a-z0-9-]*$/.test(workspace) || capability !== void 0 && !/^[0-9a-f]{64}$/.test(capability))
     throw new Error("A workspace and valid optional routine capability are required");
   let workingRoot = options.workingRoot ?? environment.OS_INBOX_WORKING_ROOT ?? void 0, headers = capability ? { "x-os-run": capability } : {}, request2 = options.request ?? (capability ? async (path, init2) => {
-    if (path === "/api/data") return fetch(`https://${workspace}.oddington.ai/api/data`, { ...init2, redirect: "error" });
     let origin = `https://${workspace}.oddington.ai`, target = new URL(path, `${origin}/`);
     if (workspace.length > 63 || ["auth", "www", "api", "os"].includes(workspace) || target.origin !== origin || target.search || target.hash || target.username || target.password || !/^\/api\/inbox\/(check|publish|resolve|files)$/.test(path) || init2?.method !== "POST")
       throw new Error("Invalid routine endpoint");
@@ -3947,49 +4080,23 @@ function routinePublicationClient2(options = {}) {
   });
   async function send3(operation2, body) {
     if (local2) return await local2(operation2, body);
-    let writing = operation2 === "records/update", reading = operation2 === "records/read", response2 = await request2(writing || reading ? "/api/data" : `/api/inbox/${operation2}`, {
+    let response2 = await request2(`/api/inbox/${operation2}`, {
       method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...headers,
-        ...writing || reading ? { "x-os-workspace": workspace, "x-os-captured-records": "1" } : {}
-      },
-      body: JSON.stringify(writing ? routineDataEnvelope(validateRoutineRecordWrite(body)) : reading ? { operation: "records.select", request: validateRecordRead(body) } : body)
+      headers: { "content-type": "application/json", ...headers },
+      body: JSON.stringify(body)
     }), result2 = await response2.json();
-    if (!response2.ok && operation2 === "records/update")
-      throw new RoutineRecordWriteError(result2.error ?? "Could not confirm routine preparation", result2.effect ?? "uncertain");
     if (!response2.ok) throw new Error(result2.error ?? "Could not confirm routine publication");
     return result2;
   }
-  let transport = {
-    async publish(body) {
-      return await send3("publish", body);
-    },
-    async resolve(body) {
-      await send3("resolve", body);
-    }
-  };
-  async function readRecords(input) {
-    return await send3("records/read", validateRecordRead(input));
-  }
   return {
-    ...createInboxPublisher(transport),
-    readRecords,
-    repository: {
-      readRecords,
-      async writeRecords(input, options2) {
-        if (!capability && !installed2) throw new Error("A trusted routine launch is required");
-        return await send3("records/update", validateRoutineRecordWrite({ input, requestKey: options2?.requestKey }));
-      },
-      async updateRecords(input, options2) {
-        if (!capability && !installed2) throw new Error("A trusted routine launch is required");
-        return await send3("records/update", validateRoutineRecordWrite({ input: validateRecordUpdate(input), requestKey: options2?.requestKey }));
+    ...createInboxPublisher({
+      async publish(body) {
+        return await send3("publish", body);
       },
-      async deleteRecords(input, options2) {
-        if (!capability && !installed2) throw new Error("A trusted routine launch is required");
-        return await send3("records/update", validateRoutineRecordWrite({ input: validateRecordDelete(input), requestKey: options2?.requestKey }));
+      async resolve(body) {
+        await send3("resolve", body);
       }
-    },
+    }),
     files: {
       async add(value) {
         let input = validateFileAddOptions(value);
@@ -4010,7 +4117,7 @@ export {
   FileOperationError,
   InboxContractError,
   InboxOperationError,
-  RoutineRecordWriteError,
+  RoutineAIError,
   app,
   asksBlock,
   auth,