@cube-nl/dmp-sdk 1.1.0-rc.2 → 1.1.0-rc.4

package/README.md

@@ -50,9 +50,9 @@ For an app without a build step, the single-file browser build is on the npm CDN
 version:
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/@cube-nl/dmp-sdk@1.1.0-rc.2/dist/cube-sdk.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/@cube-nl/dmp-sdk@1.1.0-rc.4/dist/cube-sdk.js"></script>
 <!-- or -->
-<script src="https://unpkg.com/@cube-nl/dmp-sdk@1.1.0-rc.2/dist/cube-sdk.js"></script>
+<script src="https://unpkg.com/@cube-nl/dmp-sdk@1.1.0-rc.4/dist/cube-sdk.js"></script>
 ```
 
 Fallback, for an unreleased commit: `npm install
@@ -616,16 +616,31 @@ apply to it):
   keeps it out of storage, logs and an innocent `innerHTML` dump; it is no defence against hostile code in the page,
   which the DMP bounds instead (read-only, bound to the maker's IP and `Origin: null`, at most 60 minutes).
 - **The banner.** `cube-sdk.js` puts `<cube-trial-banner>` first in `<body>` (shadow DOM, constructable stylesheet,
-  house-style tokens): *"Proefversie · alleen jij · alleen lezen · verloopt om 15:42 · leest: orders, klanten · Plak
-  geen gegevens uit deze proefversie in je AI-gesprek."* (the time in nl-NL local time).
+  house-style tokens): *"Proefversie · alleen jij · alleen lezen · verloopt om 15:42 CEST · leest: orders, klanten ·
+  Plak geen gegevens uit deze proefversie in je AI-gesprek."*
+- **Which clock.** The time shown is the DMP's expiry moment (`expiresAt` from the page's config), formatted in the
+  page's language (`<html lang>`, nl-NL by default, like the app page in the DMP) in the browser's time zone with that
+  zone's short name (a browser in UTC shows "13:42 UTC"). The app page in the DMP formats the same moment the same way
+  (the viewer's zone, the page's language, the zone name), so both show the same time; before its script runs, and
+  without JavaScript, the app page shows the DMP's zone with that zone's name.
+  The banner ends as expired without a request when the browser's clock passes `expiresAt`; a `401 trial_expired`
+  from the DMP ends it whatever the browser's clock says. The DMP's refusal is what ends the trial: a browser clock
+  that runs behind only shows the expired state later, and one that runs ahead shows "verlopen" early while the DMP
+  would still answer.
 - **The poll.** It asks `GET statusUrl` (with the token, `cache: 'no-store'`, a 10 s timeout) every 5 s while the
   page is visible and every 60 s while hidden, and right away when the page becomes visible again. When `expiresAt`
-  passes it shows the expired state without a request.
+  passes it shows the expired state without a request. A `429` with a `Retry-After` in whole seconds (digits only)
+  makes the next request wait that long, at least the normal interval and at most 60 s (`RETRY_AFTER_CAP_MS`), and
+  never past `expiresAt`; while that back-off holds, becoming visible again waits out its rest instead of asking at
+  once; it covers only the request it delays. Another `Retry-After` (absent, an HTTP date) keeps the normal rhythm.
+  The page can only read `Retry-After` when the DMP exposes it (`cube/apps` does by default for trial requests, via
+  `Access-Control-Expose-Headers`); without it the normal rhythm holds.
 
 | Answer | Banner |
 |---|---|
 | `200` | Nothing changes, polling goes on |
-| Network error, timeout, `429`, `5xx` | Polling goes on |
+| Network error, timeout, `5xx` | Polling goes on |
+| `429` | Polling goes on, after a numeric `Retry-After` (capped at 60 s) when it is longer than the interval |
 | `401 trial_replaced`, `wider: false` | *"Nieuwe versie wordt geladen…"*, then `location.assign(newer)` |
 | `401 trial_replaced`, otherwise | *"Er is een nieuwe versie die meer gegevens leest."* with **Laden**: only the maker's click navigates |
 | `401 trial_elsewhere` | *"Laad de pagina opnieuw."* with **Opnieuw laden** |
@@ -674,7 +689,7 @@ Without them the preview is permissive: every field, every function; only a fiel
 |---|---|
 | `CubeApp.connect(options?)` | `Promise<CubeAppSession>`. Options: `mock`, `manifest` (an object, or `false` to check nothing), `pageUrl` (default the page's URL), `fetch`, `tokenStorage` (`'session'`, the default, or `'memory'`), `autoSignIn` (default `false`) |
 | `CubeApp.mock(data)` | Registers preview data for the next `connect()`; `null` forgets it |
-| `CubeApp.version` | This SDK's version, e.g. `'1.1.0-rc.2'` |
+| `CubeApp.version` | This SDK's version, e.g. `'1.1.0-rc.4'` |
 | `CubeApp.sdk` | The manifest `"sdk"` this build serves, `'1'` |
 | `session.mode` | `'preview'`, `'live'` or `'trial'` (a proefversie the DMP serves: the maker's own data, read-only, with a token written into the page) |
 | `session.user()` | `{ id, name, scopes }` or `null` |
@@ -702,8 +717,8 @@ app with a build (route A).
 | | |
 |---|---|
 | File | `dist/cube-sdk.js` in the package, `@cube-nl/dmp-sdk/cube-sdk.js` as an export; on jsDelivr/unpkg as `@cube-nl/dmp-sdk@<version>/dist/cube-sdk.js`; the CI's `pack` job also keeps it as an artifact |
-| Size | 134.7 KiB minified, 45.4 KiB gzipped (17.7 KiB core + 27.6 KiB blocks and the trial banner) in 1.1.0-rc.2; `dist/size.json` has the exact numbers |
-| Version | The banner's first line, `/*! @cube-nl/dmp-sdk 1.1.0-rc.2 cube-sdk.js … */`, and `CubeApp.version` |
+| Size | 136.3 KiB minified, 45.9 KiB gzipped (17.7 KiB core + 28.2 KiB blocks and the trial banner) in 1.1.0-rc.4; `dist/size.json` has the exact numbers |
+| Version | The banner's first line, `/*! @cube-nl/dmp-sdk 1.1.0-rc.4 cube-sdk.js … */`, and `CubeApp.version` |
 
 Pin it by copying the built file of a known version into the host, rather than fetching it at
 runtime: `npm pack @cube-nl/dmp-sdk@<version>` downloads the tarball, `package/dist/cube-sdk.js` is
@@ -764,9 +779,17 @@ await CubeApp.connect();
 
 The manifest `dist/cube-ui.manifest.json` (export `@cube-nl/dmp-sdk/cube-ui.manifest.json`) lists every element
 with its attributes, events, an example and the version it appeared in (`since`), plus the 27 theme tokens and
-the fonts. Its shape is final for 1.1. It is what Claude reads to compose an app. The build also writes `dist/size.json`
-(`core_gzip`, `total_gzip`, `ui_gzip`, `budget_gzip`): the blocks may add at most 40 KiB gzipped to the core and the
-build fails above it.
+the fonts. Its shape is final for 1.1; keys may be added. It is what Claude reads to compose an app.
+
+The build also writes `dist/size.json` (`core_gzip`, `total_gzip`, `ui_gzip`, `budget_gzip`): the blocks may add at
+most 40 KiB gzipped to the core and the build fails above it.
+
+Every block lists its `actions` (everything it can use on its `resource`) and, right after it, `optional_actions`:
+the members of `actions` the block works without (`[]` when none). The `uses` an app needs for a block is
+`actions` minus `optional_actions`, plus an optional action only when the app uses that feature: a `cube-board`
+that moves cards needs `update`, a `cube-detail` with `editable` needs `update`. A view-only board needs only `list`
+and a read-only detail only `get`. The rule works on the block's `actions`; the `actions` of an attribute only
+say which attribute uses an action (`editable` uses `update`).
 
 ### Huisstijl
 
@@ -842,12 +865,12 @@ blocks work from 320 px wide.
 | `cube-top` | `resource`, `measure`, `by` (required), `limit`, `order`, `label`, `format`, `currency`, `filter`, `period`, `date-field`, `lookup`. Sorted and cut in the browser (an aggregate cannot be sorted by the API). Over 1000 groups the DMP refuses the aggregate (`422 cardinality_exceeded`, reason `too_many_groups`); the block then asks for a shorter period or a filter, without a retry. Event `cube-select` |
 | `cube-field` | `name` (required), `label`, `format` (`text`, `number`, `integer`, `currency`, `percent`, `date`, `datetime`, `boolean`), `multiline`, `options` (`value=Label,...`), `hidden`. A configuration element, a direct child of `cube-table`, `cube-detail`, `cube-form` or `cube-board`; it is never rendered. Live `_capabilities` carries no `format` or `enum`, so a date column or a choice filter there comes from `format`/`options` here or from the values themselves, never from a guess at the type |
 | `cube-table` | `resource` (required), `fields`, `search` (one field, box "Zoeken"), `filters` (a control per field: choices, Alle/Ja/Nee, from-to dates or numbers, else contains), `sort` (`-` for descending), `page-size` (default 25, at most 200), `export`, `detail` (selector of a `cube-detail`), `filter`, `period`, `date-field`. Needs `list`. Search waits 300 ms and the last answer wins. The rows are one Tab stop: arrow keys, Home and End move between rows; Enter or Space chooses one, which stays marked (`aria-current`). Event `cube-select` |
-| `cube-detail` | `resource` (required), `record-id`, `fields`, `editable`. Needs `get`, and `update` for `editable`. Events `cube-saved`, `cube-data-change` |
+| `cube-detail` | `resource` (required), `record-id`, `fields`, `editable`. Needs `get`; `update` is optional and needed only for `editable`. Events `cube-saved`, `cube-data-change` |
 | `cube-form` | `resource` (required), `fields`, `submit-label` (default "Opslaan"), `success-text` (default "Opgeslagen. Dank je wel!"). Needs `create`. Events `cube-created`, `cube-data-change` |
 | `cube-calc` | `label`. A calculator that needs no data: an editor per `cube-input`, an output per `cube-result`, recalculated on every keystroke by the `formula` property. Read-only `values` and `results`, event `cube-change` (`{ values, results }`) |
 | `cube-input` | `name`, `label` (required), `type` (`number`, `integer`, `currency`, `percent`, `text`, `select`, `checkbox`), `value`, `min`, `max`, `step`, `options` (a select needs it; `value=Label,...` as in `cube-field`). A configuration element, a direct child of `cube-calc`; it is never rendered. Numbers are typed the Dutch way (`7,5`) |
 | `cube-result` | `name`, `label` (required), `format` (`number`, `integer`, `currency`, `percent`, `text`), `currency` (default `EUR`), `emphasis` (the large figure). A configuration element, a direct child of `cube-calc`; it is never rendered |
-| `cube-board` | `resource`, `status-field`, `title-field` (required), `fields` (extra lines on a card), `sort`, `filter`, `page-size` (default 50, at most 200; a column with more says "en nog N"). `cube-field` children label and format the `fields` of a card. Cards in a column per status value. `status-field` must be filterable and `sort` a sortable field. Needs `list`; `update` is optional (without it the board is read-only). Event `cube-move` (`{ resource, id, from, to }`), followed by `cube-data-change` |
+| `cube-board` | `resource`, `status-field`, `title-field` (required), `fields` (extra lines on a card), `sort`, `filter`, `page-size` (default 50, at most 200; a column with more says "en nog N"), `detail` (selector of a `cube-detail`). `cube-field` children label and format the `fields` of a card. Cards in a column per status value. `status-field` must be filterable and `sort` a sortable field. Needs `list`; `update` is optional (`optional_actions`; without it the board is read-only). Event `cube-move` (`{ resource, id, from, to }`), followed by `cube-data-change`; event `cube-select` (`{ resource, id, row }`) when a card is chosen |
 | `cube-column` | `value` (required), `label`. A configuration element, a direct child of `cube-board`, in order; it is never rendered |
 
 `cube-table`, `cube-detail` and `cube-form` need the matching actions in the app's `uses`
@@ -938,6 +961,10 @@ say so ("Te veel groepen…") and ask for a shorter period or a filter, without
   gets the column value as a number.
 - **Read-only**: without `update` in the app's `uses`, when the status field is read-only, or when the resource has no
   `id` field (the board then does not request `id`), cards cannot move and show no buttons.
+- **Choosing**: a click on a card, or Enter or Space while the card itself has focus, chooses it: `cube-select` with
+  `{ resource, id, row }` (as `cube-table`), and `detail` sets the `record-id` of that `cube-detail`. A move (a
+  button or a drop) is never a choice. The chosen card stays marked (`aria-current`) across a move and a reload until
+  another `resource` is shown; a card without `id` emits `id: null`, is not marked and fills no detail.
   Columns stack on a narrow screen (from 320 px).
 
 ### Wireframe

package/dist/app.d.ts

@@ -115,8 +115,8 @@ export declare const CubeApp: Readonly<{
     ready: typeof ready;
     mock: typeof mock;
     theme: typeof theme;
-    /** This SDK's version, e.g. `'1.1.0-rc.2'`. */
-    version: "1.1.0-rc.2";
+    /** This SDK's version, e.g. `'1.1.0-rc.4'`. */
+    version: "1.1.0-rc.4";
     /** The manifest `"sdk"` value this build serves. */
     sdk: "1";
 }>;

package/dist/app.js

@@ -476,7 +476,7 @@ export const CubeApp = Object.freeze({
     ready,
     mock,
     theme,
-    /** This SDK's version, e.g. `'1.1.0-rc.2'`. */
+    /** This SDK's version, e.g. `'1.1.0-rc.4'`. */
     version: VERSION,
     /** The manifest `"sdk"` value this build serves. */
     sdk: MANIFEST_SDK,