@cube-nl/dmp-sdk 1.1.0-rc.1 → 1.1.0-rc.3

package/README.md

@@ -50,9 +50,9 @@ For an app without a build step, the single-file browser build is on the npm CDN
 version:
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/@cube-nl/dmp-sdk@1.1.0-rc.1/dist/cube-sdk.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/@cube-nl/dmp-sdk@1.1.0-rc.3/dist/cube-sdk.js"></script>
 <!-- or -->
-<script src="https://unpkg.com/@cube-nl/dmp-sdk@1.1.0-rc.1/dist/cube-sdk.js"></script>
+<script src="https://unpkg.com/@cube-nl/dmp-sdk@1.1.0-rc.3/dist/cube-sdk.js"></script>
 ```
 
 Fallback, for an unreleased commit: `npm install
@@ -578,6 +578,76 @@ What the preview cannot do: mock data names no relations, so an `include` or `wi
 in `meta.omitted` (show it as "not visible", as live) and `has` is not applied; custom operations
 are `404 not_found`; `location` and `etag` are null.
 
+### Trial (proefversie)
+
+A maker can try an app on their own data before it is approved: the DMP serves the app's files in a sandboxed page
+(CSP `sandbox`, an opaque origin) and writes a read-only token into that page. The SDK then runs the app as a third
+mode, `'trial'`, with the same code as preview and live.
+
+The DMP inserts one data block as the first child of `<head>` (a JSON data block, not a script, so the CSP does not
+apply to it):
+
+```html
+<script type="application/json" id="cube-trial-config">{"mode":"trial","dmpUrl":"https://dmp.example.nl",
+"apiUrl":"https://dmp.example.nl/apps/api/v1","token":"cubeproef_…","expiresAt":"2026-10-20T15:42:00+02:00",
+"statusUrl":"https://dmp.example.nl/apps/api/v1/_trial","version":"1.0.3","soort":null,"userId":"42",
+"leest":["orders","klanten"]}</script>
+```
+
+| Member | |
+|---|---|
+| `mode` | Must be `"trial"` |
+| `dmpUrl`, `apiUrl`, `token`, `expiresAt`, `statusUrl` | Required non-empty strings. `expiresAt` is ISO 8601 |
+| `version`, `soort`, `userId` | A string or `null` |
+| `leest` | The resources the trial reads, for the banner; default `[]` |
+
+- **Read once, then removed.** When `cube-sdk.js` (or the ES module, in a browser) evaluates, it reads the element,
+  removes it from the DOM and keeps the config in memory. A config that is not JSON, not `mode: "trial"` or misses a
+  member gives one `console.warn` (without its content) and the app starts as it would without it.
+- **The session.** `connect()` checks the trial config first: it does not fetch `cube-app.config.json`, does no OAuth
+  (no discovery, no PKCE, no callback) and touches neither `sessionStorage` nor `localStorage`. Every request carries
+  `Authorization: Bearer cubeproef_…` to `apiUrl`. `user()` is `{ id: userId, name: null, scopes: ['api:read'] }`;
+  `signIn()` reloads the page (the DMP writes a token on every load); `signOut()` makes calls from the app stop carrying
+  the token (they answer `401`); the banner's status poll keeps it. The SDK refuses a write in a trial before it
+  leaves the page (the browser would block it at the CORS preflight): it fails as the DMP's `403` would, a `DmpError`
+  with status 403 that blocks show as "no access", never faked; only a
+  wireframe (`soort: "wireframe"`) runs in the same mixed mode as live, with simulated writes.
+- **The token is never stored and never logged.** It lives in a variable of the page for as long as the page. This
+  keeps it out of storage, logs and an innocent `innerHTML` dump; it is no defence against hostile code in the page,
+  which the DMP bounds instead (read-only, bound to the maker's IP and `Origin: null`, at most 60 minutes).
+- **The banner.** `cube-sdk.js` puts `<cube-trial-banner>` first in `<body>` (shadow DOM, constructable stylesheet,
+  house-style tokens): *"Proefversie · alleen jij · alleen lezen · verloopt om 15:42 CEST · leest: orders, klanten ·
+  Plak geen gegevens uit deze proefversie in je AI-gesprek."*
+- **Which clock.** The time shown is the DMP's expiry moment (`expiresAt` from the page's config), formatted in nl-NL
+  in the browser's time zone with that zone's short name (a browser in UTC shows "13:42 UTC"). A page in the DMP,
+  such as the app page, shows the time in the DMP's time zone; the zone name keeps the two from seeming to disagree.
+  The banner ends as expired without a request when the browser's clock passes `expiresAt`; a `401 trial_expired`
+  from the DMP ends it whatever the browser's clock says. The DMP's refusal is what ends the trial: a browser clock
+  that runs behind only shows the expired state later, and one that runs ahead shows "verlopen" early while the DMP
+  would still answer.
+- **The poll.** It asks `GET statusUrl` (with the token, `cache: 'no-store'`, a 10 s timeout) every 5 s while the
+  page is visible and every 60 s while hidden, and right away when the page becomes visible again. When `expiresAt`
+  passes it shows the expired state without a request. A `429` with a `Retry-After` in whole seconds (digits only)
+  makes the next request wait that long, at least the normal interval and at most 60 s (`RETRY_AFTER_CAP_MS`), and
+  never past `expiresAt`; while that back-off holds, becoming visible again waits out its rest instead of asking at
+  once; it covers only the request it delays. Another `Retry-After` (absent, an HTTP date) keeps the normal rhythm.
+  The page can only read `Retry-After` when the DMP exposes it (`cube/apps` does by default for trial requests, via
+  `Access-Control-Expose-Headers`); without it the normal rhythm holds.
+
+| Answer | Banner |
+|---|---|
+| `200` | Nothing changes, polling goes on |
+| Network error, timeout, `5xx` | Polling goes on |
+| `429` | Polling goes on, after a numeric `Retry-After` (capped at 60 s) when it is longer than the interval |
+| `401 trial_replaced`, `wider: false` | *"Nieuwe versie wordt geladen…"*, then `location.assign(newer)` |
+| `401 trial_replaced`, otherwise | *"Er is een nieuwe versie die meer gegevens leest."* with **Laden**: only the maker's click navigates |
+| `401 trial_elsewhere` | *"Laad de pagina opnieuw."* with **Opnieuw laden** |
+| `401 trial_expired` | *"Deze proefversie is verlopen. Vraag in je gesprek om een nieuwe."* |
+| `401 trial_closed`, any other answer | *"Deze proefversie is gesloten."* |
+
+`newer` is followed only when it has `dmpUrl`'s origin and a path under `/apps/proef/`; any other URL counts as
+closed. Every state except `200` and the transient ones stops the polling.
+
 ### Mock data
 
 The shape is `cube.mock_data`'s output as is: per REST resource the `dmp.describe` payload and the
@@ -617,12 +687,12 @@ Without them the preview is permissive: every field, every function; only a fiel
 |---|---|
 | `CubeApp.connect(options?)` | `Promise<CubeAppSession>`. Options: `mock`, `manifest` (an object, or `false` to check nothing), `pageUrl` (default the page's URL), `fetch`, `tokenStorage` (`'session'`, the default, or `'memory'`), `autoSignIn` (default `false`) |
 | `CubeApp.mock(data)` | Registers preview data for the next `connect()`; `null` forgets it |
-| `CubeApp.version` | This SDK's version, e.g. `'1.1.0-rc.1'` |
+| `CubeApp.version` | This SDK's version, e.g. `'1.1.0-rc.3'` |
 | `CubeApp.sdk` | The manifest `"sdk"` this build serves, `'1'` |
-| `session.mode` | `'preview'` or `'live'` |
+| `session.mode` | `'preview'`, `'live'` or `'trial'` (a proefversie the DMP serves: the maker's own data, read-only, with a token written into the page) |
 | `session.user()` | `{ id, name, scopes }` or `null` |
-| `session.signIn()` | Live: navigates to the DMP's sign-in. Preview: signs the stand-in in |
-| `session.signOut()` | Forgets the tokens in this browser (not a revocation). Preview: signs the stand-in out |
+| `session.signIn()` | Live: navigates to the DMP's sign-in. Preview: signs the stand-in in. Trial: reloads the page |
+| `session.signOut()` | Forgets the tokens in this browser (not a revocation). Preview: signs the stand-in out. Trial: forgets the token, calls then answer 401 |
 | `session.resource(name)` | A `ResourceClient`: `list`, `pages`, `all`, `get`, `aggregate`, `create`, `update`, `delete`, `operation`, `collectionOperation` |
 | `session.signInError` | The error the last sign-in came back with (a refused consent: `code` `access_denied`), else `null`; `connect()` does not reject for it |
 | `session.schema(name)` | `Promise<ResourceSchema \| null>`: one resource as a block sees it (fields, actions, what may be filtered, sorted, grouped); `null` when unknown. In a wireframe it includes the missing fields |
@@ -645,8 +715,8 @@ app with a build (route A).
 | | |
 |---|---|
 | File | `dist/cube-sdk.js` in the package, `@cube-nl/dmp-sdk/cube-sdk.js` as an export; on jsDelivr/unpkg as `@cube-nl/dmp-sdk@<version>/dist/cube-sdk.js`; the CI's `pack` job also keeps it as an artifact |
-| Size | 126.9 KiB minified, 42.4 KiB gzipped (17.0 KiB core + 25.5 KiB blocks) in 1.1.0-rc.1; `dist/size.json` has the exact numbers |
-| Version | The banner's first line, `/*! @cube-nl/dmp-sdk 1.1.0-rc.1 cube-sdk.js … */`, and `CubeApp.version` |
+| Size | 136.2 KiB minified, 45.9 KiB gzipped (17.7 KiB core + 28.1 KiB blocks and the trial banner) in 1.1.0-rc.3; `dist/size.json` has the exact numbers |
+| Version | The banner's first line, `/*! @cube-nl/dmp-sdk 1.1.0-rc.3 cube-sdk.js … */`, and `CubeApp.version` |
 
 Pin it by copying the built file of a known version into the host, rather than fetching it at
 runtime: `npm pack @cube-nl/dmp-sdk@<version>` downloads the tarball, `package/dist/cube-sdk.js` is
@@ -778,19 +848,19 @@ blocks work from 320 px wide.
 |---|---|
 | `cube-app-shell` | `name` (required), `logo`, `logo-alt`. Header, user with Inloggen/Uitloggen, page navigation that follows `#/<name>` |
 | `cube-page` | `name` (id in the address), `label` (text in the navigation). A configuration element: it only holds blocks |
-| `cube-state` | `kind`: `loading`, `empty`, `error`, `forbidden`, `signed-out`; `message` replaces the standard text; `retry="false"` leaves out the retry button. Event `cube-retry` |
+| `cube-state` | `kind`: `loading`, `empty`, `error`, `forbidden`, `signed-out`; `message` replaces the standard text; `retry="false"` leaves out the retry button. Event `cube-retry`. A block's error state shows the Dutch reason for a wrong attribute; any other failure shows the general text, and a network error or the SDK's own `TypeError` is also logged in the console |
 | `cube-period-picker` | `default` (`this-month`, `12m`, `this-year`, `custom`), `label`, `today`. Feeds other blocks; `value` is `{ key, from, to, previous, today }`, event `cube-change` |
 | `cube-kpi` | `resource`, `measure` (required), `label`, `format`, `currency`, `filter`, `period`, `date-field`, `compare`. One figure; `compare` adds the change against the previous period (`nieuw` when that was zero) |
 | `cube-chart` | `resource`, `measure`, `by` (required), `kind` (`line`/`bar`), `label`, `format`, `currency`, `filter`, `period`, `date-field`, `lookup`, `height`, `limit`. Own SVG, no chart library; a table for screen readers |
 | `cube-top` | `resource`, `measure`, `by` (required), `limit`, `order`, `label`, `format`, `currency`, `filter`, `period`, `date-field`, `lookup`. Sorted and cut in the browser (an aggregate cannot be sorted by the API). Over 1000 groups the DMP refuses the aggregate (`422 cardinality_exceeded`, reason `too_many_groups`); the block then asks for a shorter period or a filter, without a retry. Event `cube-select` |
 | `cube-field` | `name` (required), `label`, `format` (`text`, `number`, `integer`, `currency`, `percent`, `date`, `datetime`, `boolean`), `multiline`, `options` (`value=Label,...`), `hidden`. A configuration element, a direct child of `cube-table`, `cube-detail`, `cube-form` or `cube-board`; it is never rendered. Live `_capabilities` carries no `format` or `enum`, so a date column or a choice filter there comes from `format`/`options` here or from the values themselves, never from a guess at the type |
-| `cube-table` | `resource` (required), `fields`, `search` (one field, box "Zoeken"), `filters` (a control per field: choices, Alle/Ja/Nee, from-to dates or numbers, else contains), `sort` (`-` for descending), `page-size` (default 25, at most 200), `export`, `detail` (selector of a `cube-detail`), `filter`, `period`, `date-field`. Needs `list`. Search waits 300 ms and the last answer wins. Enter or Space chooses a row, which stays marked (`aria-current`). Event `cube-select` |
+| `cube-table` | `resource` (required), `fields`, `search` (one field, box "Zoeken"), `filters` (a control per field: choices, Alle/Ja/Nee, from-to dates or numbers, else contains), `sort` (`-` for descending), `page-size` (default 25, at most 200), `export`, `detail` (selector of a `cube-detail`), `filter`, `period`, `date-field`. Needs `list`. Search waits 300 ms and the last answer wins. The rows are one Tab stop: arrow keys, Home and End move between rows; Enter or Space chooses one, which stays marked (`aria-current`). Event `cube-select` |
 | `cube-detail` | `resource` (required), `record-id`, `fields`, `editable`. Needs `get`, and `update` for `editable`. Events `cube-saved`, `cube-data-change` |
 | `cube-form` | `resource` (required), `fields`, `submit-label` (default "Opslaan"), `success-text` (default "Opgeslagen. Dank je wel!"). Needs `create`. Events `cube-created`, `cube-data-change` |
 | `cube-calc` | `label`. A calculator that needs no data: an editor per `cube-input`, an output per `cube-result`, recalculated on every keystroke by the `formula` property. Read-only `values` and `results`, event `cube-change` (`{ values, results }`) |
 | `cube-input` | `name`, `label` (required), `type` (`number`, `integer`, `currency`, `percent`, `text`, `select`, `checkbox`), `value`, `min`, `max`, `step`, `options` (a select needs it; `value=Label,...` as in `cube-field`). A configuration element, a direct child of `cube-calc`; it is never rendered. Numbers are typed the Dutch way (`7,5`) |
 | `cube-result` | `name`, `label` (required), `format` (`number`, `integer`, `currency`, `percent`, `text`), `currency` (default `EUR`), `emphasis` (the large figure). A configuration element, a direct child of `cube-calc`; it is never rendered |
-| `cube-board` | `resource`, `status-field`, `title-field` (required), `fields` (extra lines on a card), `sort`, `filter`, `page-size` (default 50, at most 200; a column with more says "en nog N"). `cube-field` children label and format the `fields` of a card. Cards in a column per status value. `status-field` must be filterable and `sort` a sortable field. Needs `list`; `update` is optional (without it the board is read-only). Event `cube-move` (`{ resource, id, from, to }`), followed by `cube-data-change` |
+| `cube-board` | `resource`, `status-field`, `title-field` (required), `fields` (extra lines on a card), `sort`, `filter`, `page-size` (default 50, at most 200; a column with more says "en nog N"), `detail` (selector of a `cube-detail`). `cube-field` children label and format the `fields` of a card. Cards in a column per status value. `status-field` must be filterable and `sort` a sortable field. Needs `list`; `update` is optional (without it the board is read-only). Event `cube-move` (`{ resource, id, from, to }`), followed by `cube-data-change`; event `cube-select` (`{ resource, id, row }`) when a card is chosen |
 | `cube-column` | `value` (required), `label`. A configuration element, a direct child of `cube-board`, in order; it is never rendered |
 
 `cube-table`, `cube-detail` and `cube-form` need the matching actions in the app's `uses`
@@ -804,7 +874,9 @@ blocks work from 320 px wide.
   cancels.
 - **Filters**: `filter` and the followed period are always applied; the controls can only narrow them. A bound
   takes the stricter of the two (a "Vanaf" before the period start keeps the period start), and a field that
-  `filter` fixes to one value gets no control. A `filters` or `search` field the resource cannot be filtered on
+  `filter` fixes to one value gets no control. A `search` box or a contains filter on a field that `filter` fixes or
+  gives an `ilike`, or a choice filter on a field that `filter` limits with an operator (such as `in`), changes
+  nothing (the base wins); the console warns once. A `filters` or `search` field the resource cannot be filtered on
   (not in the schema's `filterable`) shows an error naming that field instead of a table.
 - **Required fields**: a field the DMP requires shows " (verplicht)" after its label, besides `aria-required`.
 - **Writes**: every submit attempt carries an `Idempotency-Key` (`newIdempotencyKey()`), the button is disabled
@@ -847,7 +919,7 @@ say so ("Te veel groepen…") and ask for a shorter period or a filter, without
 #### Calculator and board
 
 - **Formula** (`cube-calc`): `formula` is a synchronous JavaScript function property, set from a script, never an
-  attribute (an `async` one returns a Promise, which shows "—"). A string is refused and nothing is evaluated, so it
+  attribute (an `async` one is refused with an error). A string is refused and nothing is evaluated, so it
   works under the CSP. It gets `values` by `cube-input` name and returns an object by `cube-result` name (or one
   number or text when there is a single result):
 
@@ -859,8 +931,12 @@ say so ("Te veel groepen…") and ask for a shorter period or a filter, without
 
   A `percent` input is typed as `21` and arrives as the fraction `0.21`; an empty or invalid input arrives as
   `null` (also below `min`, above `max` or off `step`). A result that is `null` or `undefined` just shows "—". A
-  formula that throws, or a result that is `NaN` or `Infinity`, shows "—" and one alert; the inputs keep working. Two
-  or more `cube-result`s need an object back: a single number or text then shows an error instead of the calculator.
+  formula that throws, or a result that is `NaN`, `Infinity` or an object (for a number, integer, currency or percent
+  result), shows "—" and one alert that stays in place; the inputs keep working. A formula that throws logs
+  one `console.warn` per failure streak. Two or more `cube-result`s need an object back: a single number or text then
+  shows an error instead of the calculator on draw, but while typing it is a failed calculation ("—" and the alert),
+  as the formula may just have taken another branch. The `name` of each `cube-input`, and of each `cube-result`,
+  must be unique: a duplicate is refused.
   `cube-change` follows a recalculation by typing or by a new formula on a drawn calculator; not the first draw.
 - **Columns** (`cube-board`): the columns come from the `cube-column` children, in that order. Without them the
   board takes the `enum` of the status field, but live `_capabilities` carries no `enum`, so a starter must always
@@ -869,9 +945,17 @@ say so ("Te veel groepen…") and ask for a shorter period or a filter, without
   shows an error; a status value without a column is not shown.
 - **Moving**: drag and drop, or a compact button per other column on each card, so it works with the keyboard too.
   A button shows an arrow and the column name ("→ Bezig"); its accessible name is "Verplaats naar Bezig". The card
-  moves at once, then is saved (`update` of only the status field); a refusal puts it back with an alert.
-- **Read-only**: without `update` in the app's `uses`, or when the status field is read-only, cards cannot move and
-  show no buttons. Columns stack on a narrow screen (from 320 px).
+  moves at once, then is saved (`update` of only the status field); a refusal puts it back with an alert. The card
+  is placed in the new column by `sort` until the next load, which shows the server's order (on top without
+  `sort`). A status field of type integer or number
+  gets the column value as a number.
+- **Read-only**: without `update` in the app's `uses`, when the status field is read-only, or when the resource has no
+  `id` field (the board then does not request `id`), cards cannot move and show no buttons.
+- **Choosing**: a click on a card, or Enter or Space while the card itself has focus, chooses it: `cube-select` with
+  `{ resource, id, row }` (as `cube-table`), and `detail` sets the `record-id` of that `cube-detail`. A move (a
+  button or a drop) is never a choice. The chosen card stays marked (`aria-current`) across a move and a reload until
+  another `resource` is shown; a card without `id` emits `id: null`, is not marked and fills no detail.
+  Columns stack on a narrow screen (from 320 px).
 
 ### Wireframe
 
@@ -898,19 +982,23 @@ missing resource:
 `resource` is a REST resource name, `veld` the missing field (left out when the whole resource is missing), `type`
 one of `tekst`, `getal`, `bedrag`, `datum`, `keuze`, `ja/nee`, `waarden` the choices (required for `keuze`), `scherm`
 the screen that shows it and `reden` why it is needed. The SDK only reads this; `cube/apps` validates it. A
-malformed entry is dropped with one `console.warn`.
-
-- **Mixed mode.** What exists runs live. A missing field is added to the live rows with a value invented from the
-  row's `id` (the same row shows the same value every time); a missing resource is answered from `cube-mock.json`.
-  The live request never names a missing field: a filter or sort on it applies to the returned page only, and an
-  aggregate that groups by or sums it is answered from the mock rows. The preview does the same; there, an aggregate
-  on a missing field needs that field in the rows of `cube-mock.json`.
+malformed entry, or an `ontbreekt` that is not a list, is dropped with one `console.warn`.
+
+- **Mixed mode.** What exists runs live. A missing field is added to the live rows with a value invented from the row's
+  `id` (the same row shows the same value every time); a missing resource is answered from `cube-mock.json`. The live
+  request never names a missing field: a filter or sort on it applies to the returned page only (the page's count then
+  counts only the rows it shows), and an aggregate that groups by or sums it is answered from the mock rows. The preview
+  does the same; there, an aggregate on a missing field needs that field in the rows of `cube-mock.json`. A gap of type
+  `bedrag` shows as money also when the mock data has the field; other types follow the field's values.
 - **Marking.** Blocks mark what is invented: `Voorbeeld — bestaat nog niet`. A table or detail marks the column or
   field; the other blocks mark the whole block.
 - **Simulated writes.** `create`, `update`, `delete`, `operation` and `collectionOperation` are answered in the
   browser, in live and in preview, and forgotten on reload. A block that writes says
-  `Voorbeeld — wordt niet opgeslagen`. A wireframe never writes real data: that covers everything that goes through
-  the session (`session.resource()` and the blocks). App code that builds its own client with the exported
+  `Voorbeeld — wordt niet opgeslagen`. A sorted list places created rows, rows that join it and rows changed in a
+  sort field into the server's order when its rows carry the sort field; without a sort, created rows come first on
+  page 1. They also work signed out, and the preview does not check them against `uses`: a wireframe shows the idea,
+  not the access rules. A wireframe never writes real data: that covers everything that
+  goes through the session (`session.resource()` and the blocks). App code that builds its own client with the exported
   `createClient` bypasses it.
 - **Numbers.** KPI and chart numbers do not reflect simulated writes: they come from the rows the session holds
   without them.

package/dist/app.d.ts

@@ -60,8 +60,11 @@ export interface CubeAppUser {
     scopes: string[];
 }
 export interface CubeAppSession {
-    /** `'preview'`: mock data in this browser, no DMP. `'live'`: the real DMP, as the signed-in person. */
-    readonly mode: 'preview' | 'live';
+    /**
+     * `'preview'`: mock data in this browser, no DMP. `'live'`: the real DMP, as the signed-in person. `'trial'`: the
+     * maker's own data, read-only, with the token the DMP wrote into the page.
+     */
+    readonly mode: 'preview' | 'live' | 'trial';
     /** Who is signed in, or null. In the preview a stand-in user is signed in from the start. */
     user(): CubeAppUser | null;
     /** Live: navigates to the DMP's sign-in (the page is gone after this). Preview: signs the stand-in in again. */
@@ -112,8 +115,8 @@ export declare const CubeApp: Readonly<{
     ready: typeof ready;
     mock: typeof mock;
     theme: typeof theme;
-    /** This SDK's version, e.g. `'1.1.0-rc.1'`. */
-    version: "1.1.0-rc.1";
+    /** This SDK's version, e.g. `'1.1.0-rc.3'`. */
+    version: "1.1.0-rc.3";
     /** The manifest `"sdk"` value this build serves. */
     sdk: "1";
 }>;

package/dist/app.js

@@ -5,6 +5,7 @@ import { PreviewStore } from './preview.js';
 import { schemaFromCapability } from './ui/schema.js';
 import { PREVIEW_USER_NAME } from './ui/texts.js';
 import { resolveTheme, setTheme } from './ui/theme.js';
+import { trialConfig } from './trial.js';
 import { MANIFEST_SDK, VERSION } from './version.js';
 import { mixedResource, readGaps, simulatedWrites, withGaps } from './wireframe.js';
 const CONFIG_FILE = './cube-app.config.json';
@@ -91,13 +92,18 @@ function announceSessionChange() {
 async function start(options, isCurrent) {
     const doFetch = options.fetch ?? globalThis.fetch.bind(globalThis);
     const pageUrl = options.pageUrl ?? currentPage();
+    // A trial page never has cube-app.config.json and never signs in with OAuth: the DMP wrote the token into it.
+    const trial = trialConfig();
     const [config, theme] = await Promise.all([
-        readJson(doFetch, resolve(CONFIG_FILE, pageUrl)),
+        trial === null ? readJson(doFetch, resolve(CONFIG_FILE, pageUrl)) : null,
         loadTheme(options, doFetch, pageUrl),
     ]);
     if (isCurrent()) {
         setTheme(theme);
     }
+    if (trial !== null) {
+        return trialSession(trial, options, doFetch, pageUrl);
+    }
     if (config === null) {
         return preview(options, doFetch, pageUrl);
     }
@@ -198,6 +204,47 @@ async function preview(options, doFetch, pageUrl) {
         schema: async (name) => withGaps(store(name).describe(name), marked.gaps),
     };
 }
+/** A wireframe's marks and its mock data. Only a wireframe reads the mock: an ordinary app never fetches it. */
+async function wireframeParts(soort, options, doFetch, pageUrl) {
+    const [mock, manifest] = soort === 'wireframe' ? await appFiles(options, doFetch, pageUrl) : [{}, null];
+    // The manifest's ceiling is the live client's: a missing resource is not in it, so the store checks none.
+    return { marked: marks(soort, manifest), examples: new PreviewStore(mock) };
+}
+/** The session on the DMP, live or trial: a wireframe mixes in its gaps, everything else goes to the client. */
+function onDmp(connection, { marked, examples }) {
+    const { client } = connection;
+    let capabilities = null;
+    return {
+        ...marked,
+        mode: connection.mode,
+        get signInError() {
+            return connection.signInError();
+        },
+        user: connection.user,
+        signIn: connection.signIn,
+        signOut: connection.signOut,
+        resource: writes(marked.simulatesWrites, (name) => marked.isExample(name)
+            ? examples.resource(name)
+            : marked.gaps.some((gap) => gap.resource === name)
+                ? mixedResource(client.resources(name), marked.gaps, examples, examples.rows(name))
+                : client.resources(name)),
+        async schema(name) {
+            if (marked.isExample(name)) {
+                return withGaps(examples.describe(name), marked.gaps);
+            }
+            capabilities ??= client.capabilities();
+            try {
+                const found = (await capabilities).resources.find((resource) => resource.name === name);
+                return found === undefined ? null : withGaps(schemaFromCapability(found), marked.gaps);
+            }
+            catch (error) {
+                // A failed call (signed out, offline) must not stay cached for the whole session.
+                capabilities = null;
+                throw error;
+            }
+        },
+    };
+}
 async function live(config, options, doFetch, pageUrl) {
     const dmpUrl = config.dmpUrl.replace(/\/+$/, '');
     let tokens = null;
@@ -215,12 +262,7 @@ async function live(config, options, doFetch, pageUrl) {
     });
     const client = createClient({ baseUrl: config.apiUrl ?? `${dmpUrl}/apps/api/v1`, auth: oauth, fetch: doFetch });
     let signInError = null;
-    let capabilities = null;
-    // Only a wireframe reads the mock data: an ordinary live app never fetches cube-mock.json, even when it ships one.
-    const [mock, manifest] = config.soort === 'wireframe' ? await appFiles(options, doFetch, pageUrl) : [{}, null];
-    const marked = marks(config.soort, manifest);
-    // The manifest's ceiling is the live client's: a missing resource is not in it, so the store checks none.
-    const examples = new PreviewStore(mock);
+    const parts = await wireframeParts(config.soort, options, doFetch, pageUrl);
     tokens = await store.get();
     try {
         await oauth.handleCallback();
@@ -232,12 +274,10 @@ async function live(config, options, doFetch, pageUrl) {
     if (tokens === null && signInError === null && options.autoSignIn === true) {
         await oauth.signIn();
     }
-    return {
-        ...marked,
+    return onDmp({
         mode: 'live',
-        get signInError() {
-            return signInError;
-        },
+        client,
+        signInError: () => signInError,
         user: () => (tokens === null ? null : userFrom(tokens)),
         async signIn() {
             signInError = null;
@@ -246,28 +286,44 @@ async function live(config, options, doFetch, pageUrl) {
         async signOut() {
             await oauth.signOut();
         },
-        resource: writes(marked.simulatesWrites, (name) => marked.isExample(name)
-            ? examples.resource(name)
-            : marked.gaps.some((gap) => gap.resource === name)
-                ? mixedResource(client.resources(name), marked.gaps, examples, examples.rows(name))
-                : client.resources(name)),
-        async schema(name) {
-            if (marked.isExample(name)) {
-                return withGaps(examples.describe(name), marked.gaps);
-            }
-            capabilities ??= client.capabilities();
-            try {
-                const found = (await capabilities).resources.find((resource) => resource.name === name);
-                return found === undefined ? null : withGaps(schemaFromCapability(found), marked.gaps);
-            }
-            catch (error) {
-                // A failed call (signed out, offline) must not stay cached for the whole session.
-                capabilities = null;
-                throw error;
-            }
-        },
+    }, parts);
+}
+/**
+ * A trial reads only. A write never leaves the page (the browser would block it at the CORS preflight and the app would
+ * see a TypeError): it answers the 403 the DMP would, so it surfaces as a DmpError like any refusal.
+ */
+function readOnly(doFetch) {
+    return async (input, init) => {
+        const method = (init?.method ?? 'GET').toUpperCase();
+        if (method === 'GET' || method === 'HEAD') {
+            return doFetch(input, init);
+        }
+        return new Response(JSON.stringify({ status: 403, code: 'insufficient_scope' }), {
+            status: 403,
+            headers: { 'Content-Type': 'application/problem+json' },
+        });
     };
 }
+/** The live session with the injected token instead of OAuth: no discovery, no callback, no storage. */
+async function trialSession(config, options, doFetch, pageUrl) {
+    let token = config.token;
+    // Read on every request: once signed out no token goes out, so the DMP answers 401.
+    const client = createClient({ baseUrl: config.apiUrl, auth: () => token, fetch: readOnly(doFetch) });
+    const parts = await wireframeParts(config.soort ?? undefined, options, doFetch, pageUrl);
+    return onDmp({
+        mode: 'trial',
+        client,
+        signInError: () => null,
+        user: () => (token === null ? null : { id: config.userId, name: null, scopes: ['api:read'] }),
+        // The DMP writes a token into the page on every load: a reload is the sign-in.
+        async signIn() {
+            globalThis.location?.reload();
+        },
+        async signOut() {
+            token = null;
+        },
+    }, parts);
+}
 /**
  * Who the token belongs to, read from the access token itself (cube/oauth-server issues JWTs).
  * For display only: the DMP checks the token on every request, this SDK does not verify it.
@@ -420,7 +476,7 @@ export const CubeApp = Object.freeze({
     ready,
     mock,
     theme,
-    /** This SDK's version, e.g. `'1.1.0-rc.1'`. */
+    /** This SDK's version, e.g. `'1.1.0-rc.3'`. */
     version: VERSION,
     /** The manifest `"sdk"` value this build serves. */
     sdk: MANIFEST_SDK,

package/dist/browser.js

@@ -1,8 +1,16 @@
 import { CubeApp as Core } from './app.js';
+import { trialConfig } from './trial.js';
 import { defineBlocks } from './ui/define.js';
+import { showTrialBanner } from './ui/trial-banner.js';
 // The entry of dist/cube-sdk.js: one classic script, no imports, `window.CubeApp` for a page without a build step.
 const CubeApp = Object.freeze({ ...Core, defineBlocks });
 globalThis.CubeApp = CubeApp;
 // An engine without custom elements (an old browser, a script run outside a page) keeps the plain CubeApp.
 if (typeof customElements !== 'undefined')
     defineBlocks();
+// A trial page (the config was read when trial.ts evaluated): say so at the top, and follow the trial's status.
+const trial = trialConfig();
+const page = globalThis;
+if (trial !== null && page.document !== undefined && page.CSSStyleSheet !== undefined) {
+    showTrialBanner(page, trial);
+}

package/dist/client.js

@@ -99,7 +99,11 @@ export function createClient(options) {
                 body: input ?? {},
                 headers: writeHeaders(opts),
             });
-            return { ...response, data: response.status === 204 ? null : response.data, accepted: response.status === 202 };
+            return {
+                ...response,
+                data: response.status === 204 ? null : response.data,
+                accepted: response.status === 202,
+            };
         };
         return {
             name,