@oddington/sdk 0.1.44 → 0.1.46

package/dist/browser.js

@@ -319,6 +319,52 @@ function validateRoutineSchemaValue(schema2, value, rejected) {
   check(schema2, value, "$");
 }
 
+function validDropboxRootPath(value) {
+  return typeof value == "string" && value.length <= 2048 && value.startsWith("/") && !/[\\\x00-\x1f\x7f]/.test(value) && value.slice(1).split("/").every((segment) => segment.length > 0 && segment.trim() === segment && segment !== "." && segment !== "..");
+}
+function validMicrosoftId(value) {
+  return typeof value == "string" && /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(value);
+}
+function validMicrosoftMailbox(value) {
+  return typeof value == "string" && value.length <= 254 && /^[^\s@/?#\\\x00-\x1f\x7f]+@[^\s@/?#\\\x00-\x1f\x7f]+\.[^\s@/?#\\\x00-\x1f\x7f]+$/.test(value);
+}
+function sharePointHost(value) {
+  return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.sharepoint\.com$/.test(value);
+}
+function canonicalSharePointSiteUrl(value) {
+  if (!(typeof value != "string" || value.length > 2048 || /[\s\\?#\x00-\x1f\x7f]/.test(value) || !/^https:\/\/[^/:@]+(?:\/|$)/i.test(value)))
+    try {
+      let url = new URL(value);
+      if (url.protocol !== "https:" || !sharePointHost(url.hostname) || url.username || url.password || url.port) return;
+      let rawPath = value.replace(/^https:\/\/[^/]+/i, "") || "/", path = rawPath.endsWith("/") ? rawPath.slice(0, -1) : rawPath, segments = path.slice(1).split("/");
+      if (path && segments.some((segment) => !segment)) return;
+      let encoded = path ? segments.map((segment) => {
+        let decoded = decodeURIComponent(segment);
+        if (decoded === "." || decoded === ".." || /[/%\\?#\x00-\x1f\x7f]/.test(decoded)) throw new Error();
+        return encodeURIComponent(decoded);
+      }).join("/") : "", canonical = `https://${url.hostname}/${encoded}`;
+      return canonical.length <= 2048 ? canonical : void 0;
+    } catch {
+      return;
+    }
+}
+function validSharePointSiteId(value, siteUrl) {
+  if (typeof value != "string" || value.length > 512) return !1;
+  let [host, collection, site, extra] = value.split(",");
+  return extra === void 0 && host === new URL(siteUrl).hostname && validMicrosoftId(collection) && validMicrosoftId(site);
+}
+function validGoogleScopes(value) {
+  return Array.isArray(value) && value.length > 0 && value.length <= 32 && value.every((scope) => typeof scope == "string" && scope.length <= 256 && /^(https:\/\/www\.googleapis\.com\/auth\/[A-Za-z0-9._-]+|https:\/\/mail\.google\.com\/|openid|email|profile)$/.test(scope)) && new Set(value).size === value.length;
+}
+var DROPBOX_FILE_SCOPES = ["account_info.read", "files.metadata.read", "files.content.read", "files.content.write"];
+function validDropboxFileScopes(value) {
+  return Array.isArray(value) && value.length === DROPBOX_FILE_SCOPES.length && new Set(value).size === value.length && DROPBOX_FILE_SCOPES.every((scope) => value.includes(scope));
+}
+
+function validDataRepositoryName(value) {
+  return typeof value == "string" && /^[a-z0-9][a-z0-9._-]{0,127}$/.test(value) && !value.includes("..");
+}
+
 var InboxContractError = class extends Error {
   constructor(message2) {
     super(message2), this.name = "InboxContractError";
@@ -575,9 +621,26 @@ function defineHandler(value) {
 function respond(handler, input) {
   return defineHandler(handler), handlerReference({ id: handler.id, input });
 }
+function recordRequirements(value) {
+  let source2 = object(value, "Record requirements");
+  keys(source2, ["repository", "records"], "Record requirements"), validDataRepositoryName(source2.repository) || fail("Invalid requirements repository");
+  let repository = source2.repository, records = array(source2.records, "required Records").map((entry) => {
+    let row = object(entry, "required Record");
+    keys(row, ["ref", "version"], "required Record");
+    let { ref } = validateRecordReference({ repository, ref: row.ref });
+    return (typeof row.version != "string" || !row.version.length || row.version.length > 512) && fail("Invalid required Record version"), { ref, version: row.version };
+  });
+  return new Set(records.map((record4) => record4.ref)).size !== records.length && fail("Duplicate required Record"), { repository, records };
+}
+function requireRecords(repository, records) {
+  return recordRequirements({ repository, records: array(records, "required Records").map((entry) => {
+    let record4 = object(entry, "Data Record");
+    return { ref: record4.$ref, version: record4.$version };
+  }) });
+}
 function question(value) {
   let source2 = object(value, "question");
-  keys(source2, ["id", "to", "allowedResponders", "prompt", "instructions", "response", "handler"], "question");
+  keys(source2, ["id", "to", "allowedResponders", "prompt", "instructions", "response", "handler", "requirements"], "question");
   let to = personReference(source2.to, "question assignee"), allowedResponders = source2.allowedResponders === void 0 ? [to] : distinctPeople(source2.allowedResponders, "allowed responders");
   return allowedResponders.includes(to) || fail("Allowed responders must include the assignee"), {
     id: id(source2.id, "question ID"),
@@ -586,7 +649,8 @@ function question(value) {
     prompt: text(source2.prompt, "question prompt"),
     ...source2.instructions === void 0 ? {} : { instructions: text(source2.instructions, "instructions") },
     response: validateResponseDefinition(source2.response),
-    ...Object.hasOwn(source2, "handler") ? { handler: handlerReference(source2.handler) } : {}
+    ...Object.hasOwn(source2, "handler") ? { handler: handlerReference(source2.handler) } : {},
+    ...Object.hasOwn(source2, "requirements") ? { requirements: recordRequirements(source2.requirements) } : {}
   };
 }
 function presentation(source2) {
@@ -1274,6 +1338,7 @@ var fieldProblems = ["unknown", "missing", "invalid", "source_schema"], reasons
   boolean: "a boolean",
   date: "a date in YYYY-MM-DD format",
   const: "the constant declared in the schema",
+  datetime: "a UTC date and time in YYYY-MM-DDTHH:mm:ss.sssZ format, for example 2026-09-15T14:30:00.000Z",
   enum: "one of the choices declared in the schema",
   link: "a link to an existing record of an allowed type",
   object: "an object matching the schema",
@@ -1517,14 +1582,43 @@ function captureRecordsReadRefs(value) {
 }
 function captureRecordsReadOptions(value) {
   if (value === void 0) return {};
-  let row;
   try {
-    row = Object.fromEntries(Object.entries(historyProperties(value)).map(([key, descriptor]) => [key, descriptor.value]));
+    historyProperties(value);
   } catch {
     throw new DataOperationError("invalid_query");
   }
-  if (!value || typeof value != "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value)) || Reflect.ownKeys(value).some((key) => key !== "body" || !Object.hasOwn(Object.getOwnPropertyDescriptor(value, key), "value")) || Object.hasOwn(row, "body") && typeof row.body != "boolean") throw new DataOperationError("invalid_query");
-  return Object.hasOwn(row, "body") ? { body: row.body } : {};
+  if (!value || typeof value != "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value)) || Reflect.ownKeys(value).length)
+    throw new DataOperationError("invalid_query");
+  return {};
+}
+
+function capture3(value, ancestors = /* @__PURE__ */ new Set(), depth = 0) {
+  if (value === null || typeof value == "string" || typeof value == "boolean" || typeof value == "number" && Number.isFinite(value)) return value;
+  if (!value || typeof value != "object" || ancestors.has(value) || depth > 32) throw new DataOperationError("invalid_query");
+  ancestors.add(value);
+  try {
+    return Array.isArray(value) ? historyArray(value).map((item) => capture3(item, ancestors, depth + 1)) : Object.fromEntries(Object.entries(historyProperties(value)).map(([key, descriptor]) => [key, capture3(descriptor.value, ancestors, depth + 1)]));
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function captureRecordsAll(query, options) {
+  let invalid9 = () => {
+    throw new DataOperationError("invalid_query");
+  };
+  try {
+    let properties = historyProperties(options), maxRecords = properties.maxRecords?.value;
+    if (Object.keys(properties).join(",") !== "maxRecords" || !Number.isSafeInteger(maxRecords) || maxRecords < 1) return invalid9();
+    let detached = capture3(query), selections = historyProperties(detached);
+    if (Object.keys(selections).length < 1 || Object.keys(selections).length > 16) return invalid9();
+    for (let selection2 of Object.values(selections)) {
+      let fields5 = historyProperties(selection2.value);
+      if (fields5.$ && Object.hasOwn(historyProperties(fields5.$.value), "after")) return invalid9();
+    }
+    return { query: detached, maxRecords };
+  } catch {
+    return invalid9();
+  }
 }
 
 function validRecordBody(value) {
@@ -1711,19 +1805,19 @@ var invalid6 = () => {
 }, unavailable = () => {
   throw new DataOperationError("unavailable");
 }, text2 = (value) => typeof value == "string" && value.length > 0;
-function capture3(value, ancestors = /* @__PURE__ */ new Set(), depth = 0) {
+function capture4(value, ancestors = /* @__PURE__ */ new Set(), depth = 0) {
   if (value === null || typeof value == "string" || typeof value == "boolean" || typeof value == "number" && Number.isFinite(value)) return value;
   if (!value || typeof value != "object" || ancestors.has(value) || depth > 32) return invalid6();
   ancestors.add(value);
   try {
-    return Array.isArray(value) ? historyArray(value).map((item) => capture3(item, ancestors, depth + 1)) : Object.fromEntries(Object.entries(historyProperties(value)).map(([key, descriptor]) => [key, capture3(descriptor.value, ancestors, depth + 1)]));
+    return Array.isArray(value) ? historyArray(value).map((item) => capture4(item, ancestors, depth + 1)) : Object.fromEntries(Object.entries(historyProperties(value)).map(([key, descriptor]) => [key, capture4(descriptor.value, ancestors, depth + 1)]));
   } finally {
     ancestors.delete(value);
   }
 }
 function recordPagination(queryRecords) {
   function pages(query) {
-    let captured = capture3(query), names = Object.keys(historyProperties(captured));
+    let captured = capture4(query), names = Object.keys(historyProperties(captured));
     for (let name2 of names) {
       let selection2 = historyProperties(captured[name2]);
       if (Object.hasOwn(selection2, "$")) {
@@ -1735,7 +1829,6 @@ function recordPagination(queryRecords) {
     async function* iterate() {
       let state = new Map(names.map((name2) => [name2, {
         seen: /* @__PURE__ */ new Set(),
-        total: 0,
         count: void 0,
         next: void 0
       }])), active2 = names, version;
@@ -1745,11 +1838,11 @@ function recordPagination(queryRecords) {
           return [name2, next === void 0 ? selection2 : { ...selection2, $: { ...selection2.$, after: next } }];
         })), response2 = await queryRecords(request2), page;
         try {
-          page = capture3(response2);
+          page = capture4(response2);
           let keys4 = Object.keys(historyProperties(page));
           (keys4.length !== active2.length + 1 || keys4.some((key) => key !== "$meta" && !active2.includes(key))) && unavailable();
           let meta = page.$meta;
-          (Object.keys(historyProperties(meta)).sort().join(",") !== "collections,version" || !text2(meta.version) || version !== void 0 && version !== meta.version) && unavailable(), version = meta.version, Object.keys(historyProperties(meta.collections)).some((key) => !active2.includes(key)) && unavailable();
+          (Object.keys(historyProperties(meta)).sort().join(",") !== "collections,version" || !text2(meta.version)) && unavailable(), version = meta.version, Object.keys(historyProperties(meta.collections)).some((key) => !active2.includes(key)) && unavailable();
           for (let name2 of active2) {
             let records = historyArray(page[name2]), metadata = Object.hasOwn(meta.collections, name2) ? meta.collections[name2] : {};
             (Object.keys(historyProperties(metadata)).some((key) => key !== "count" && key !== "next") || Object.hasOwn(metadata, "next") && !text2(metadata.next)) && unavailable();
@@ -1759,7 +1852,7 @@ function recordPagination(queryRecords) {
               (!validRecordRef(row.$ref) || !text2(row.$version)) && unavailable();
             }
             let current2 = state.get(name2);
-            captured[name2].$?.count === !0 ? ((!Number.isSafeInteger(metadata.count) || metadata.count < 0 || current2.count !== void 0 && current2.count !== metadata.count) && unavailable(), current2.count = metadata.count) : Object.hasOwn(metadata, "count") && unavailable(), current2.total += records.length, (!Number.isSafeInteger(current2.total) || current2.count !== void 0 && (current2.total > current2.count || metadata.next === void 0 && current2.total !== current2.count)) && unavailable(), metadata.next !== void 0 && (current2.seen.has(metadata.next) && unavailable(), current2.seen.add(metadata.next)), current2.next = metadata.next;
+            captured[name2].$?.count === !0 ? ((!Number.isSafeInteger(metadata.count) || metadata.count < 0) && unavailable(), current2.count = metadata.count) : Object.hasOwn(metadata, "count") && unavailable(), metadata.next !== void 0 && (current2.seen.has(metadata.next) && unavailable(), current2.seen.add(metadata.next)), current2.next = metadata.next;
           }
         } catch {
           return unavailable();
@@ -1775,32 +1868,7 @@ function recordPagination(queryRecords) {
       } while (active2.length);
     }
   }
-  async function all(query, options) {
-    let properties = historyProperties(options), maxRecords = properties.maxRecords?.value;
-    (Object.keys(properties).join(",") !== "maxRecords" || !Number.isSafeInteger(maxRecords) || maxRecords < 1) && invalid6();
-    let captured = capture3(query), names = Object.keys(historyProperties(captured));
-    if (names.length === 1) {
-      let name2 = names[0], selection2 = historyProperties(captured[name2]), selectionNames = Object.keys(selection2), authored = selection2.$ ? historyProperties(selection2.$.value) : {};
-      selectionNames.every((key) => key === "$") && !Object.hasOwn(authored, "limit") && (captured[name2] = { ...captured[name2], $: { ...captured[name2].$, limit: Math.min(500, maxRecords) } });
-    }
-    let result2, total = 0;
-    for await (let page of pages(captured)) {
-      let names2 = Object.keys(page.$meta.collections), size = names2.reduce((sum, name2) => sum + page[name2].length, 0);
-      if (size > maxRecords - total) throw new DataOperationError("capacity", !1, void 0, void 0, {
-        code: "record_limit_exceeded",
-        maxRecords,
-        collections: names2
-      });
-      total += size, result2 ??= { ...Object.fromEntries(names2.map((name2) => [name2, []])), $meta: page.$meta };
-      for (let name2 of names2) {
-        let target = result2[name2];
-        for (let record4 of page[name2]) target.push(record4);
-      }
-      result2.$meta = page.$meta;
-    }
-    return result2;
-  }
-  return { pages, all };
+  return { pages };
 }
 
 var genericData = {
@@ -1837,6 +1905,7 @@ var genericData = {
         read: read2,
         query: queryRecords,
         ...recordPagination(queryRecords),
+        all: async (query, options) => send3({ operation: "records.all", ...captureRecordsAll(query, options) }),
         search: async (query, options) => send3({ operation: "records.search", ...captureRecordsSearchInput(query, options) })
       },
       history: {
@@ -2374,48 +2443,6 @@ var files = {
   read
 };
 
-function validDropboxRootPath(value) {
-  return typeof value == "string" && value.length <= 2048 && value.startsWith("/") && !/[\\\x00-\x1f\x7f]/.test(value) && value.slice(1).split("/").every((segment) => segment.length > 0 && segment.trim() === segment && segment !== "." && segment !== "..");
-}
-function validMicrosoftId(value) {
-  return typeof value == "string" && /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(value);
-}
-function validMicrosoftMailbox(value) {
-  return typeof value == "string" && value.length <= 254 && /^[^\s@/?#\\\x00-\x1f\x7f]+@[^\s@/?#\\\x00-\x1f\x7f]+\.[^\s@/?#\\\x00-\x1f\x7f]+$/.test(value);
-}
-function sharePointHost(value) {
-  return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.sharepoint\.com$/.test(value);
-}
-function canonicalSharePointSiteUrl(value) {
-  if (!(typeof value != "string" || value.length > 2048 || /[\s\\?#\x00-\x1f\x7f]/.test(value) || !/^https:\/\/[^/:@]+(?:\/|$)/i.test(value)))
-    try {
-      let url = new URL(value);
-      if (url.protocol !== "https:" || !sharePointHost(url.hostname) || url.username || url.password || url.port) return;
-      let rawPath = value.replace(/^https:\/\/[^/]+/i, "") || "/", path = rawPath.endsWith("/") ? rawPath.slice(0, -1) : rawPath, segments = path.slice(1).split("/");
-      if (path && segments.some((segment) => !segment)) return;
-      let encoded = path ? segments.map((segment) => {
-        let decoded = decodeURIComponent(segment);
-        if (decoded === "." || decoded === ".." || /[/%\\?#\x00-\x1f\x7f]/.test(decoded)) throw new Error();
-        return encodeURIComponent(decoded);
-      }).join("/") : "", canonical = `https://${url.hostname}/${encoded}`;
-      return canonical.length <= 2048 ? canonical : void 0;
-    } catch {
-      return;
-    }
-}
-function validSharePointSiteId(value, siteUrl) {
-  if (typeof value != "string" || value.length > 512) return !1;
-  let [host, collection, site, extra] = value.split(",");
-  return extra === void 0 && host === new URL(siteUrl).hostname && validMicrosoftId(collection) && validMicrosoftId(site);
-}
-function validGoogleScopes(value) {
-  return Array.isArray(value) && value.length > 0 && value.length <= 32 && value.every((scope) => typeof scope == "string" && scope.length <= 256 && /^(https:\/\/www\.googleapis\.com\/auth\/[A-Za-z0-9._-]+|https:\/\/mail\.google\.com\/|openid|email|profile)$/.test(scope)) && new Set(value).size === value.length;
-}
-var DROPBOX_FILE_SCOPES = ["account_info.read", "files.metadata.read", "files.content.read", "files.content.write"];
-function validDropboxFileScopes(value) {
-  return Array.isArray(value) && value.length === DROPBOX_FILE_SCOPES.length && new Set(value).size === value.length && DROPBOX_FILE_SCOPES.every((scope) => value.includes(scope));
-}
-
 var ROUTINE_CONNECTION_CREDENTIALS_ENV = "OS_ROUTINE_CONNECTION_CREDENTIALS";
 function parseRoutineConnectionNames(value) {
   if (!Array.isArray(value) || value.some((name2) => typeof name2 != "string" || !/^(gmail|airtable|dropbox|outlook|sharepoint)\/[a-z0-9][a-z0-9-]{0,62}$/.test(name2)) || new Set(value).size !== value.length)
@@ -2903,14 +2930,41 @@ var source = {
 };
 
 var InboxOperationError = class extends Error {
-  constructor(status, reason) {
-    super(reason === "conflict" ? "This question already has an accepted answer" : reason === "unavailable" ? "Inbox request unavailable. Retry the same action." : reason === "invalid_input" ? "Invalid Inbox request" : "Inbox access unavailable");
+  constructor(status, reason, requirementsRepository) {
+    super(reason === "records_need_attention" ? "Records need to be pushed or reviewed." : reason === "records_unavailable" ? "Records temporarily unavailable. Try again shortly." : reason === "handler_unavailable" ? "Deploy the routine that owns this question\u2019s response handler." : reason === "conflict" ? "This question already has an accepted answer" : reason === "unavailable" ? "Inbox request unavailable. Retry the same action." : reason === "invalid_input" ? "Invalid Inbox request" : "Inbox access unavailable");
     this.status = status;
     this.reason = reason;
+    this.requirementsRepository = requirementsRepository;
   }
   status;
   reason;
-}, INBOX_RESULT_BYTES = 8 * 1024 * 1024, INBOX_INPUT_BYTES = 8192, INBOX_LOCAL_INPUT_BYTES = 256 * 1024, INBOX_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+  requirementsRepository;
+};
+function parseQuestionAvailability(value, available = !1) {
+  let state = object4(value);
+  return keys3(state, ["unavailableReason", "requirementsRepository"], []), "unavailableReason" in state ? (assert(!available && typeof state.unavailableReason == "string" && ["handler_unavailable", "records_need_attention", "records_unavailable"].includes(String(state.unavailableReason))), state.unavailableReason === "records_need_attention" ? assert(validDataRepositoryName(state.requirementsRepository)) : assert(!("requirementsRepository" in state)), {
+    unavailableReason: state.unavailableReason,
+    ...state.unavailableReason === "records_need_attention" ? { requirementsRepository: state.requirementsRepository } : {}
+  }) : (assert(!("requirementsRepository" in state)), {});
+}
+function questionAvailability(value, available = !1) {
+  return parseQuestionAvailability({
+    ..."unavailableReason" in value ? { unavailableReason: value.unavailableReason } : {},
+    ..."requirementsRepository" in value ? { requirementsRepository: value.requirementsRepository } : {}
+  }, available);
+}
+function parseInboxUnavailableFailure(value, status) {
+  try {
+    if (status !== 503) return;
+    let envelope = object4(value);
+    keys3(envelope, ["error", "unavailableReason", "requirementsRepository"], ["error", "unavailableReason"]), assert(text4(envelope.error));
+    let state = questionAvailability(envelope);
+    return new InboxOperationError(503, state.unavailableReason, state.requirementsRepository);
+  } catch {
+    return;
+  }
+}
+var INBOX_RESULT_BYTES = 8 * 1024 * 1024, INBOX_INPUT_BYTES = 8192, INBOX_LOCAL_INPUT_BYTES = 256 * 1024, INBOX_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function isAppQuestionOperation(operation2) {
   return operation2 === "questions.list" || operation2 === "questions.answer" || operation2 === "questions.searchRecords";
 }
@@ -3090,7 +3144,7 @@ function parseInboxItem(value) {
     assert(id2(person.id) && text4(person.name));
   }), array2(item.questions).forEach((value2) => {
     let question2 = object4(value2);
-    if (assert(text4(question2.id) && id2(question2.to) && text4(question2.prompt) && (question2.instructions === null || text4(question2.instructions, !0)) && typeof question2.available == "boolean"), responseDefinition(question2.response), assert(array2(question2.allowedResponders).every(id2)), question2.acceptedResponse !== null) {
+    if (assert(text4(question2.id) && id2(question2.to) && text4(question2.prompt) && (question2.instructions === null || text4(question2.instructions, !0)) && typeof question2.available == "boolean"), questionAvailability(question2, question2.available), assert(!("requirements" in question2) && !("handler" in question2)), responseDefinition(question2.response), assert(array2(question2.allowedResponders).every(id2)), question2.acceptedResponse !== null) {
       let accepted = object4(question2.acceptedResponse);
       assert(id2(accepted.id) && id2(accepted.userId) && date(accepted.acceptedAt)), response(accepted.response), accepted.label === null ? delete accepted.label : "label" in accepted && assert(text4(accepted.label)), "acceptanceOrder" in accepted && assert(integer(accepted.acceptanceOrder));
     }
@@ -3123,11 +3177,11 @@ function parseAnswerableQuestion(value) {
   let entry = object4(json(value));
   keys3(
     entry,
-    ["itemId", "number", "revision", "title", "inboxUrl", "questionId", "routine", "prompt", "response", "answerable", "tags", "recordRefs", "instructions"],
+    ["itemId", "number", "revision", "title", "inboxUrl", "questionId", "routine", "prompt", "response", "answerable", "tags", "recordRefs", "instructions", "unavailableReason", "requirementsRepository"],
     ["itemId", "number", "revision", "title", "inboxUrl", "questionId", "routine", "prompt", "response", "answerable"]
   ), assert(id2(entry.itemId) && integer(entry.number) && integer(entry.revision) && text4(entry.title) && text4(entry.inboxUrl));
   let link = new URL(entry.inboxUrl), slug = link.hostname.slice(0, -13);
-  return assert(link.hostname.endsWith(".oddington.ai") && slug.length <= 63 && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug) && !["auth", "www", "api", "os"].includes(slug) && entry.inboxUrl === `https://${slug}.oddington.ai/inbox/${entry.itemId}`), assert(isAppRoutineName(entry.routine) && text4(entry.questionId) && entry.questionId === entry.questionId.trim() && text4(entry.prompt) && (!("instructions" in entry) || text4(entry.instructions, !0)) && typeof entry.answerable == "boolean"), responseDefinition(entry.response), askMetadata(entry), entry;
+  return assert(link.hostname.endsWith(".oddington.ai") && slug.length <= 63 && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug) && !["auth", "www", "api", "os"].includes(slug) && entry.inboxUrl === `https://${slug}.oddington.ai/inbox/${entry.itemId}`), assert(isAppRoutineName(entry.routine) && text4(entry.questionId) && entry.questionId === entry.questionId.trim() && text4(entry.prompt) && (!("instructions" in entry) || text4(entry.instructions, !0)) && typeof entry.answerable == "boolean"), questionAvailability(entry, entry.answerable), responseDefinition(entry.response), askMetadata(entry), entry;
 }
 function askMetadata(entry) {
   let tags = array2(entry.tags === void 0 ? [] : entry.tags);
@@ -3332,7 +3386,7 @@ function isAppOrigin(value) {
     return !1;
   }
 }
-function appContext(origin, active2) {
+function appContext(origin, active2, changed) {
   let binding, credential, pair, serialized, denied = !1, controller = new AbortController(), access = new AbortController(), expiry, startup, renewalTimer, renewal, observation, resolution2, disposed = !1, stored = () => globalThis.localStorage.getItem(sessionKey), alive = () => {
     try {
       return !denied && !disposed && active2() && globalThis.location.origin === origin;
@@ -3342,12 +3396,20 @@ function appContext(origin, active2) {
   }, cancel = () => {
     controller.abort(), access.abort(), clearTimeout(expiry), clearTimeout(startup), clearTimeout(renewalTimer), clearInterval(monitor), globalThis.removeEventListener?.("storage", storageChanged);
     for (let event of ["pageshow", "focus", "visibilitychange"]) globalThis.removeEventListener?.(event, wake);
-  }, invalidate = () => {
-    denied = !0, cancel();
+  }, notify = (state) => {
     try {
-      !disposed && active2() && globalThis.location.origin === origin && (!serialized || globalThis.localStorage.getItem(sessionKey) === serialized) && globalThis.localStorage.removeItem(sessionKey);
+      changed?.(state);
     } catch {
     }
+  }, invalidate = (state = "unavailable") => {
+    if (!denied) {
+      denied = !0, cancel();
+      try {
+        !disposed && active2() && globalThis.location.origin === origin && (!serialized || globalThis.localStorage.getItem(sessionKey) === serialized) && globalThis.localStorage.removeItem(sessionKey);
+      } catch {
+      }
+      notify(state);
+    }
   }, current2 = () => {
     try {
       return alive() && !!binding && binding.expiresAt > Date.now() && stored() === serialized;
@@ -3359,10 +3421,10 @@ function appContext(origin, active2) {
     if (!validPair(value) || value.context.expiresAt > Date.now() + 6e5 || !sameSession(value.context)) throw new Error();
     return value;
   }, expireAccess = () => {
-    binding && binding.expiresAt <= Date.now() && access.abort();
+    binding && binding.expiresAt <= Date.now() && !access.signal.aborted && (access.abort(), notify("expired"));
   };
   async function send3(path, candidate, signal, init2 = {}) {
-    let url = `${origin}/_os/app/${path}`, response2;
+    let url = path === "auth" ? `${origin}/api/auth` : `${origin}/_os/app/${path}`, response2;
     try {
       response2 = await fetch(url, {
         ...init2,
@@ -3400,7 +3462,7 @@ function appContext(origin, active2) {
     expiry = setTimeout(expireAccess, remaining), renewalTimer = setTimeout(() => {
       renew().catch(() => {
       });
-    }, remaining - Math.min(6e4, remaining / 5));
+    }, remaining - Math.min(6e4, remaining / 5)), notify("connected");
   }
   async function synchronize(signal = controller.signal) {
     if (!alive()) throw new Error();
@@ -3436,7 +3498,7 @@ function appContext(origin, active2) {
       observation === observed && (observation = void 0);
     }
   }
-  async function renew() {
+  async function renew(initialConnection = !1) {
     if (renewal) return renewal;
     if (!binding || !pair || !alive()) throw new Error();
     renewal = (async () => {
@@ -3462,7 +3524,7 @@ function appContext(origin, active2) {
           await synchronize(requestController.signal);
           return;
         }
-        if (!response2.ok) throw new Error();
+        if (!response2.ok) throw response2.status === 401 || response2.status === 403 ? new AppContextDenied() : new Error();
         if (!alive() || !validPair(value) || !bounded3(value.context) || (/* @__PURE__ */ new Set([value.credential, value.renewalCredential, pair.credential, pair.renewalCredential])).size !== 4) throw new Error();
         if (stored() !== previous) {
           await synchronize(requestController.signal);
@@ -3471,6 +3533,7 @@ function appContext(origin, active2) {
         let raw = JSON.stringify(value);
         globalThis.localStorage.setItem(sessionKey, raw), install(value.context, value, raw);
       } catch (error) {
+        if (initialConnection && error instanceof AppContextDenied) throw error;
         try {
           if (alive() && stored() && stored() !== previous) {
             await synchronize(requestController.signal);
@@ -3520,28 +3583,28 @@ function appContext(origin, active2) {
     for (await synchronize(); alive() && stored() !== serialized; ) await synchronize();
     if (signal.aborted || !current2()) throw new Error();
   }
-  async function requestData(operation2, input) {
+  async function requestData(operation2, input, parent) {
     try {
       if (operation2 !== "data/query" || !current2()) throw new Error();
-      let admitted = credential, signal = access.signal, response2 = await send3("data", credential, signal, { method: "POST", body: JSON.stringify(input) });
+      let admitted = credential, signal = parent ? AbortSignal.any([access.signal, parent]) : access.signal, response2 = await send3("data", credential, signal, { method: "POST", body: JSON.stringify(input) });
       if (await settledAccess(signal), response2.status === 401 || response2.status === 403)
         throw admitted === credential && current2() && invalidate(), new DataOperationError("access_denied");
       let result2 = await appResponse(response2, Number.MAX_SAFE_INTEGER, signal);
       if (await settledAccess(signal), !response2.ok) throw dataTransportError(response2.status, result2);
       return result2;
     } catch (error) {
-      throw error instanceof DataOperationError ? error : !current2() || controller.signal.aborted ? new DataOperationError("context_unavailable") : new DataOperationError("unavailable", !0);
+      throw error instanceof DataOperationError ? error : !current2() || controller.signal.aborted || parent?.aborted ? new DataOperationError("context_unavailable") : new DataOperationError("unavailable", !0);
     }
   }
-  async function requestInbox(operation2, input) {
+  async function requestInbox(operation2, input, signal) {
     if (!["questions.list", "questions.answer", "questions.searchRecords"].includes(operation2)) throw new Error("Inbox operation unavailable");
-    return requestChecked("inbox", { method: "POST", body: JSON.stringify({ operation: operation2, input }) }, !0);
+    return requestChecked("inbox", { method: "POST", body: JSON.stringify({ operation: operation2, input }), signal }, !0);
   }
   async function requestRoutine(key, suffix, init2 = {}) {
     return requestChecked(`routines/${encodeURIComponent(key)}/${suffix}`, init2);
   }
-  async function requestRetainedRoutine(key, suffix) {
-    return requestChecked(`routines/${encodeURIComponent(key)}/${suffix}`, {}, !1, !0);
+  async function requestRetainedRoutine(key, suffix, signal) {
+    return requestChecked(`routines/${encodeURIComponent(key)}/${suffix}`, { signal }, !1, !0);
   }
   async function requestFiles(suffix, init2, parent) {
     let unavailable5 = () => new FileOperationError("unsupported_context", 400);
@@ -3564,7 +3627,7 @@ function appContext(origin, active2) {
   }
   async function requestChecked(path, init2, inbox2 = !1, retained2 = !1) {
     if (!current2()) throw new Error("Local app context unavailable.");
-    let admitted = credential, signal = access.signal, response2 = await send3(path, credential, signal, init2), check = async () => {
+    let admitted = credential, signal = init2.signal ? AbortSignal.any([access.signal, init2.signal]) : access.signal, response2 = await send3(path, credential, signal, init2), check = async () => {
       if (retained2) {
         if (signal.aborted || !current2()) throw new Error("Local app context unavailable.");
       } else await settledAccess(signal);
@@ -3599,8 +3662,32 @@ function appContext(origin, active2) {
     try {
       if (!alive()) throw new Error();
       if (!pair) {
-        let candidate2 = stored(), retained3 = readPair(candidate2);
-        pair = retained3, binding = { ...retained3.context }, credential = retained3.credential, serialized = candidate2;
+        let candidate2 = stored();
+        if (candidate2)
+          try {
+            let retained3 = readPair(candidate2);
+            if (retained3.context.expiresAt <= Date.now()) {
+              if (pair = retained3, binding = { ...retained3.context }, credential = retained3.credential, serialized = candidate2, await renew(!0), !current2()) throw new AppRenewalUnavailable();
+              return context();
+            }
+            let value3 = await proof(retained3.credential);
+            return stored() !== candidate2 ? resolveOnce() : (install(value3, retained3, candidate2), context());
+          } catch (error) {
+            if (error instanceof AppRenewalUnavailable || error instanceof AppResponseReadError || !(error instanceof AppContextDenied) || !alive() || expiry) throw error;
+            pair = void 0, binding = void 0, credential = void 0, serialized = void 0;
+          }
+        let response2 = await untilAborted(fetch(`${origin}/_os/app/connect`, {
+          method: "POST",
+          credentials: "omit",
+          redirect: "error",
+          cache: "no-store",
+          referrerPolicy: "no-referrer",
+          signal: controller.signal
+        }), controller.signal), value2 = await appResponse(response2, 4096, controller.signal);
+        if (!response2.ok || response2.redirected || response2.url && response2.url !== `${origin}/_os/app/connect` || !alive() || !validPair(value2) || !bounded3(value2.context)) throw new Error();
+        if (stored() !== candidate2 && stored()) return resolveOnce();
+        let raw = JSON.stringify(value2);
+        return globalThis.localStorage.setItem(sessionKey, raw), install(value2.context, value2, raw), context();
       }
       if (expireAccess(), binding.expiresAt <= Date.now()) {
         if (await renew(), !current2()) throw new AppRenewalUnavailable();
@@ -3629,17 +3716,41 @@ function appContext(origin, active2) {
   }, resolve = () => resolution2 || (resolution2 = resolveOnce().finally(() => {
     resolution2 = void 0;
   }), resolution2);
-  return { resolve, retained: async () => {
-    if (!expiry && alive() && (binding ? current2() && resolution2 : readPair(stored()).context.expiresAt > Date.now()))
-      return resolve();
-    if (!expiry || !current2()) throw new Error("Local app context unavailable.");
-    return context();
-  }, start: () => {
-    startup = setTimeout(() => {
-      alive() && !resolution2 && !binding && resolve().catch(() => {
-      });
-    }, 0);
-  }, invalidate, dispose };
+  return {
+    resolve,
+    retained: async () => {
+      if (!expiry && alive() && (binding ? current2() && resolution2 : !stored() || readPair(stored()).context.expiresAt > Date.now()))
+        return resolve();
+      if (!expiry || !current2()) throw new Error("Local app context unavailable.");
+      return context();
+    },
+    start: () => {
+      startup = setTimeout(() => {
+        alive() && !resolution2 && !binding && resolve().catch(() => {
+        });
+      }, 0);
+    },
+    invalidate,
+    dispose,
+    account: async () => {
+      await resolve();
+      let signal = access.signal, response2 = await requestChecked("auth", { method: "GET" }), value = await appResponse(response2, 4096, signal);
+      if (!response2.ok || !current2() || !value || Object.keys(value).join(",") !== "account" || !value.account || Object.keys(value.account).sort().join(",") !== "displayName,email" || typeof value.account.email != "string" || value.account.email.length > 320 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.account.email) || typeof value.account.displayName != "string" || !value.account.displayName.trim() || value.account.displayName.length > 320)
+        throw new Error("Local app account unavailable.");
+      return Object.freeze({ email: value.account.email, displayName: value.account.displayName });
+    },
+    signOut: async () => {
+      if (current2() || await resolve(), !current2()) throw new Error("Local app context unavailable.");
+      let signal = AbortSignal.timeout(2e4), pending = send3("sign-out", credential, signal, { method: "POST" });
+      invalidate("signed_out");
+      let response2 = await pending, value = await appResponse(response2, 4096, signal);
+      if (!response2.ok || !value || Object.keys(value).join(",") !== "signedOut" || value.signedOut !== !0)
+        throw new Error("Local app sign-out unavailable.");
+    },
+    isCurrent() {
+      return expireAccess(), current2();
+    }
+  };
 }
 function validProof(value) {
   return typeof value == "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
@@ -3681,7 +3792,7 @@ async function send2(operation2, input, resolved) {
     };
     try {
       let response2 = await context.requestInbox(operation2, envelope.input), value = await appResponse(response2, INBOX_RESULT_BYTES, context.signal);
-      if (check2(), !response2.ok) throw new InboxOperationError(
+      if (check2(), !response2.ok) throw parseInboxUnavailableFailure(value, response2.status) ?? new InboxOperationError(
         [400, 401, 403, 409].includes(response2.status) ? response2.status : 503,
         response2.status === 400 ? "invalid_input" : response2.status === 401 ? "authority_unavailable" : response2.status === 403 ? "access_denied" : response2.status === 409 ? "conflict" : "unavailable"
       );
@@ -3723,12 +3834,20 @@ async function send2(operation2, input, resolved) {
       throw response2.body?.cancel().catch(() => {
       }), error;
     }
-    if (!response2.ok)
-      throw response2.body?.cancel().catch(() => {
-      }), new InboxOperationError(
+    if (!response2.ok) {
+      let value2;
+      try {
+        let bytes2 = await limitedBody(response2, 8192);
+        check(), bytes2 && (value2 = JSON.parse(new TextDecoder().decode(bytes2)));
+      } catch {
+        check();
+      }
+      let refusal = parseInboxUnavailableFailure(value2, response2.status);
+      throw refusal || new InboxOperationError(
         [400, 401, 403, 409].includes(response2.status) ? response2.status : 503,
         response2.status === 400 ? "invalid_input" : response2.status === 401 ? "authority_unavailable" : response2.status === 403 ? "access_denied" : response2.status === 409 ? "conflict" : "unavailable"
       );
+    }
     if (response2.status !== 200)
       throw response2.body?.cancel().catch(() => {
       }), unavailable3();
@@ -3839,8 +3958,37 @@ function init({ auth: input }) {
     url.protocol === "https:" && !url.port && !url.username && !url.password && !url.search && !url.hash && url.pathname === "/" && /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(slug) && slug !== "auth" && (endpoint = url.origin, workspace = slug);
   } catch {
   }
-  let active2 = !0, revision = 0, person, token, binding = {}, local2 = localOrigin ? appContext(localOrigin, () => active2) : void 0, subscription, stopDisposal, resolve = async () => {
-    if (local2) return local2.resolve();
+  let active2 = !0, revision = 0, person, token, binding = {}, installation = new AbortController(), sharedLocal = localOrigin && registered?.localContext?.origin === localOrigin ? registered.localContext.connection : void 0, local2 = sharedLocal ?? (localOrigin ? appContext(localOrigin, () => active2) : void 0), subscription, stopDisposal, owned = (context) => {
+    let signal = AbortSignal.any([context.signal, installation.signal]);
+    return {
+      ...context,
+      get expiresAt() {
+        return context.expiresAt;
+      },
+      signal,
+      isCurrent: () => active2 && !signal.aborted && context.isCurrent(),
+      requestData: (operation2, input2) => context.requestData(operation2, input2, signal),
+      requestInbox: (operation2, input2) => context.requestInbox(operation2, input2, signal),
+      requestFiles: (suffix, init2, parent) => context.requestFiles(
+        suffix,
+        init2,
+        parent ? AbortSignal.any([signal, parent]) : signal
+      ),
+      requestRoutine: (key, suffix, init2 = {}) => context.requestRoutine(
+        key,
+        suffix,
+        { ...init2, signal: init2.signal ? AbortSignal.any([signal, init2.signal]) : signal }
+      ),
+      requestRetainedRoutine: (key, suffix) => context.requestRetainedRoutine(key, suffix, signal),
+      requestAvailability: (key) => context.requestRoutine(key, "availability", { method: "GET", signal })
+    };
+  }, resolve = async () => {
+    if (local2) {
+      if (!active2) throw new Error("Local app context unavailable.");
+      let context = await local2.resolve();
+      if (!active2) throw new Error("Local app context unavailable.");
+      return owned(context);
+    }
     if (registered && await registered.ready(), !active2 || !endpoint || !workspace || globalThis.location.origin !== endpoint) throw new Error("Hosted Data context unavailable.");
     let started = revision, { data: { session }, error } = await auth2.getSession();
     if (!active2 || globalThis.location.origin !== endpoint || started !== revision || error || !session || person !== void 0 && person !== session.user.id)
@@ -3860,13 +4008,18 @@ function init({ auth: input }) {
       memberId: session.user.id,
       binding
     };
-  }, uninstall = installMemberContext(resolve, local2 ? local2.retained : resolve), dispose = () => {
-    active2 && (active2 = !1, local2?.dispose(), revision++, subscription?.unsubscribe(), stopDisposal?.(), uninstall(), installedDispose === dispose && (installedDispose = void 0));
+  }, uninstall = installMemberContext(resolve, local2 ? async () => {
+    if (!active2 || !local2) throw new Error("Local app context unavailable.");
+    let context = await local2.retained();
+    if (!active2) throw new Error("Local app context unavailable.");
+    return owned(context);
+  } : resolve), dispose = () => {
+    active2 && (active2 = !1, installation.abort(), sharedLocal || local2?.dispose(), revision++, subscription?.unsubscribe(), stopDisposal?.(), uninstall(), installedDispose === dispose && (installedDispose = void 0));
   };
-  installedDispose = dispose, stopDisposal = registered?.onDispose(dispose), active2 && (subscription = auth2.onAuthStateChange((event, session) => {
+  installedDispose = dispose, stopDisposal = registered?.onDispose(dispose), active2 && (sharedLocal || (subscription = auth2.onAuthStateChange((event, session) => {
     let next = session?.user.id ?? null;
     (event === "SIGNED_OUT" || person !== void 0 && next !== person || person !== void 0 && event === "SIGNED_IN" && token !== session?.access_token) && (revision++, local2?.invalidate()), person = next, token = session?.access_token;
-  }).data.subscription, local2?.start());
+  }).data.subscription), sharedLocal || local2?.start());
 }
 var os = { init };
 
@@ -3906,9 +4059,127 @@ function authorizationFailure(error) {
   return Object.freeze({ status: status === 404 || status === 410 || status === 400 ? "expired" : status === 401 ? "signed_out" : status === 403 || status === 422 ? "invalid" : "unavailable" });
 }
 
+var coordinators = /* @__PURE__ */ new Map(), publish = (c, state) => {
+  c.state = Object.freeze(state);
+  for (let listener of c.listeners)
+    try {
+      listener(c.state);
+    } catch {
+    }
+};
+function refresh(c) {
+  let revision = c.revision;
+  if (c.loading?.revision === revision) return c.loading.promise;
+  let promise = (async () => {
+    try {
+      let account = await c.context.account();
+      c.active && !c.closed && c.revision === revision && publish(c, { status: "signed_in", account });
+    } catch {
+      c.active && !c.closed && c.revision === revision && publish(c, { status: "unavailable", error: "unavailable" });
+    }
+  })().finally(() => {
+    c.loading?.promise === promise && (c.loading = void 0);
+  });
+  return c.loading = { revision, promise }, promise;
+}
+function createLocalBrowserAuth(origin, failure) {
+  let c = coordinators.get(origin);
+  if (!c) {
+    let coordinator2 = {
+      context: void 0,
+      state: Object.freeze({ status: "initializing" }),
+      active: !0,
+      closed: !1,
+      refs: 0,
+      revision: 0,
+      listeners: /* @__PURE__ */ new Set(),
+      ready: Promise.resolve()
+    };
+    coordinator2.context = appContext(origin, () => coordinator2.active, (state) => {
+      !coordinator2.active || coordinator2.closed || (state === "connected" ? coordinator2.state.status !== "initializing" && (coordinator2.revision++, refresh(coordinator2)) : (coordinator2.revision++, publish(coordinator2, { status: state === "expired" ? "expired" : state === "signed_out" ? "signed_out" : "unavailable" })));
+    }), c = coordinator2, coordinators.set(origin, c), c.ready = Promise.resolve().then(() => refresh(coordinator2));
+  }
+  let coordinator = c;
+  coordinator.refs++;
+  let active2 = !0, lastState = coordinator.state, listeners = /* @__PURE__ */ new Set(), disposals = /* @__PURE__ */ new Set(), observe = (state) => {
+    lastState = state;
+    for (let listener of listeners)
+      try {
+        listener(state);
+      } catch {
+      }
+  };
+  coordinator.listeners.add(observe);
+  let assertActive = () => {
+    if (!active2) throw failure("disposed");
+  }, unavailable5 = async () => Object.freeze({
+    status: active2 ? coordinator.state.status === "signed_out" ? "signed_out" : "unavailable" : "disposed"
+  }), handle2 = Object.freeze({
+    authorization: Object.freeze({ get: unavailable5, approve: unavailable5, deny: unavailable5 }),
+    getState() {
+      return active2 && !coordinator.state.pending && coordinator.state.status === "signed_in" && !coordinator.context.isCurrent() && coordinator.state.status === "signed_in" && publish(coordinator, { status: "unavailable", error: "unavailable" }), lastState;
+    },
+    subscribe(listener) {
+      return assertActive(), listeners.add(listener), () => {
+        listeners.delete(listener);
+      };
+    },
+    async sendCode() {
+      throw assertActive(), failure("unavailable");
+    },
+    async verifyCode() {
+      throw assertActive(), failure("unavailable");
+    },
+    async signOut() {
+      if (assertActive(), coordinator.state.pending === "sign_out") throw failure("busy");
+      if (coordinator.closed) throw failure("unavailable");
+      coordinator.closed = !0, coordinator.revision++, publish(coordinator, { status: coordinator.state.status, pending: "sign_out" });
+      try {
+        await coordinator.context.signOut();
+      } catch {
+        throw coordinator.context.invalidate(), coordinator.active && publish(coordinator, { status: "unavailable", error: "unavailable" }), failure(active2 ? "unavailable" : "disposed");
+      }
+      coordinator.active && publish(coordinator, { status: "signed_out" }), assertActive();
+    },
+    dispose() {
+      if (active2) {
+        active2 = !1, coordinator.listeners.delete(observe), listeners.clear();
+        for (let callback of disposals)
+          try {
+            callback();
+          } catch {
+          }
+        disposals.clear(), --coordinator.refs === 0 && (coordinator.active = !1, coordinator.revision++, coordinator.context.dispose(), coordinator.listeners.clear(), coordinators.delete(origin));
+      }
+    }
+  });
+  return registerBrowserAuth(handle2, {
+    localContext: { origin, connection: coordinator.context },
+    async ready() {
+      assertActive(), await coordinator.ready, assertActive();
+    },
+    async checkWorkspaceAccess() {
+      assertActive(), await coordinator.context.resolve(), assertActive();
+    },
+    onDispose(callback) {
+      return active2 ? (disposals.add(callback), () => {
+        disposals.delete(callback);
+      }) : (callback(), () => {
+      });
+    },
+    async getSession() {
+      return assertActive(), { data: { session: null }, error: null };
+    },
+    onAuthStateChange(callback) {
+      return callback("INITIAL_SESSION", null), { data: { subscription: { unsubscribe() {
+      } } } };
+    }
+  }), handle2;
+}
+
 function createBrowserAuth(runtime) {
-  let coordinators = /* @__PURE__ */ new Map();
-  function publish(c, state) {
+  let coordinators2 = /* @__PURE__ */ new Map();
+  function publish2(c, state) {
     c.state = Object.freeze(state);
     for (let listener of c.listeners)
       try {
@@ -3924,7 +4195,7 @@ function createBrowserAuth(runtime) {
       }
   }
   function expire(c) {
-    !c.active || !c.session && c.state.status === "expired" || (c.revision++, c.timer && clearTimeout(c.timer), c.session = null, publish(c, { status: "expired" }), notify(c, "SIGNED_OUT"));
+    !c.active || !c.session && c.state.status === "expired" || (c.revision++, c.timer && clearTimeout(c.timer), c.session = null, publish2(c, { status: "expired" }), notify(c, "SIGNED_OUT"));
   }
   function accept(c, event, session) {
     if (!c.active || event === "INITIAL_SESSION" && c.state.status !== "initializing" || event === "TOKEN_REFRESHED" && !c.session && c.state.status !== "initializing") return;
@@ -3932,7 +4203,7 @@ function createBrowserAuth(runtime) {
     replaced && c.revision++, c.timer && clearTimeout(c.timer);
     let pending = c.state.pending;
     if (!session) {
-      c.session = null, publish(c, { status: c.state.status === "expired" ? "expired" : "signed_out", ...pending ? { pending } : {} }), notify(c, "SIGNED_OUT");
+      c.session = null, publish2(c, { status: c.state.status === "expired" ? "expired" : "signed_out", ...pending ? { pending } : {} }), notify(c, "SIGNED_OUT");
       return;
     }
     if (!validSession(session)) {
@@ -3941,7 +4212,7 @@ function createBrowserAuth(runtime) {
     }
     c.session = session;
     let email = typeof session.user.email == "string" ? session.user.email.trim() : "", metadata = session.user.user_metadata, name2 = ["name", "full_name", "first_name"].map((key) => metadata?.[key]).find((value) => typeof value == "string" && value.trim())?.trim() || email, account = !replaced && c.state.account?.email === email && c.state.account.displayName === name2 ? c.state.account : Object.freeze({ email, displayName: name2 });
-    notify(c, event), publish(c, { status: "signed_in", account, ...pending ? { pending } : {} });
+    notify(c, event), publish2(c, { status: "signed_in", account, ...pending ? { pending } : {} });
     let checkExpiry = () => {
       if (!c.active || !c.session) return;
       let remaining = c.session.expires_at * 1e3 - Date.now();
@@ -3988,9 +4259,9 @@ function createBrowserAuth(runtime) {
         c.unsubscribe = () => subscription.unsubscribe();
         let started = c.revision, { data: data3, error } = await c.provider.getSession();
         if (!current2(c, origin, started)) return;
-        error ? terminalSessionFailure(error) ? expire(c) : (!c.session || !validSession(c.session)) && publish(c, { status: "unavailable", error: "unavailable" }) : c.state.pending !== "sign_out" && accept(c, "INITIAL_SESSION", data3.session);
+        error ? terminalSessionFailure(error) ? expire(c) : (!c.session || !validSession(c.session)) && publish2(c, { status: "unavailable", error: "unavailable" }) : c.state.pending !== "sign_out" && accept(c, "INITIAL_SESSION", data3.session);
       } catch {
-        current2(c, origin, revision) && publish(c, { status: "unavailable", error: "unavailable" });
+        current2(c, origin, revision) && publish2(c, { status: "unavailable", error: "unavailable" });
       }
     })(), c;
   }
@@ -4028,8 +4299,10 @@ function createBrowserAuth(runtime) {
     if (await c.workspaceAccess.result, !current2(c, origin, revision)) throw runtime.failure("stale");
   }
   return { create() {
-    let origin = globalThis.location?.origin ?? "", c = coordinators.get(origin);
-    c || (c = createCoordinator(origin), coordinators.set(origin, c));
+    let origin = globalThis.location?.origin ?? "";
+    if (isAppOrigin(origin) && origin !== "http://127.0.0.1:5176") return createLocalBrowserAuth(origin, runtime.failure);
+    let c = coordinators2.get(origin);
+    c || (c = createCoordinator(origin), coordinators2.set(origin, c));
     let coordinator = c;
     coordinator.refs++;
     let active2 = !0, ownedAction, authorizationId, authorizationGeneration = 0, inspected, observers = /* @__PURE__ */ new Set(), sessionObservers = /* @__PURE__ */ new Set(), disposalObservers = /* @__PURE__ */ new Set(), lastState = coordinator.state, observation = (state) => {
@@ -4050,15 +4323,15 @@ function createBrowserAuth(runtime) {
       let marker = {};
       coordinator.action = marker, ownedAction = marker;
       let revision = coordinator.revision;
-      publish(coordinator, { ...coordinator.state, error: void 0, pending: kind });
+      publish2(coordinator, { ...coordinator.state, error: void 0, pending: kind });
       try {
         if (await coordinator.ready, assertActive(), !coordinator.provider || !coordinator.active || globalThis.location?.origin !== origin) throw runtime.failure("unavailable");
         if (!current2(coordinator, origin, revision) || coordinator.action !== marker || (await work(coordinator.provider), assertActive(), coordinator.action !== marker) || !current2(coordinator, origin, revision) && kind !== "verify_code" && kind !== "sign_out") throw runtime.failure("stale");
       } catch (error) {
         let reason = active2 ? current2(coordinator, origin, revision) ? safeReason(error) ?? "unavailable" : "stale" : "disposed";
-        throw active2 && current2(coordinator, origin, revision) && publish(coordinator, { ...coordinator.state, error: reason }), runtime.failure(reason);
+        throw active2 && current2(coordinator, origin, revision) && publish2(coordinator, { ...coordinator.state, error: reason }), runtime.failure(reason);
       } finally {
-        coordinator.action === marker && (coordinator.action = void 0, coordinator.active && (publish(coordinator, { ...coordinator.state, pending: void 0 }), kind === "sign_out" && coordinator.session && notify(coordinator, "TOKEN_REFRESHED"))), ownedAction === marker && (ownedAction = void 0);
+        coordinator.action === marker && (coordinator.action = void 0, coordinator.active && (publish2(coordinator, { ...coordinator.state, pending: void 0 }), kind === "sign_out" && coordinator.session && notify(coordinator, "TOKEN_REFRESHED"))), ownedAction === marker && (ownedAction = void 0);
       }
     }
     async function authorize(kind, id3) {
@@ -4155,7 +4428,7 @@ function createBrowserAuth(runtime) {
             }
           disposalObservers.clear();
           for (let listener of sessionObservers) coordinator.sessions.delete(listener);
-          sessionObservers.clear(), --coordinator.refs === 0 && (coordinator.active = !1, coordinator.revision++, coordinator.timer && clearTimeout(coordinator.timer), coordinator.unsubscribe?.(), coordinator.provider?.dispose(), coordinator.provider = void 0, coordinator.session = null, coordinator.listeners.clear(), coordinator.sessions.clear(), coordinators.delete(origin));
+          sessionObservers.clear(), --coordinator.refs === 0 && (coordinator.active = !1, coordinator.revision++, coordinator.timer && clearTimeout(coordinator.timer), coordinator.unsubscribe?.(), coordinator.provider?.dispose(), coordinator.provider = void 0, coordinator.session = null, coordinator.listeners.clear(), coordinator.sessions.clear(), coordinators2.delete(origin));
         }
       }
     });
@@ -4728,6 +5001,7 @@ export {
   question,
   recordBlock,
   recordsBlock,
+  requireRecords,
   resolveAsk,
   respond,
   richTextBlock,