@oddington/sdk 0.1.12 → 0.1.14

package/README.md

@@ -93,7 +93,11 @@ browserAuth.dispose();
 ```
 
 `auth.create()` accepts no options. Trusted same-origin OS setup selects the
-provider internally. State is `initializing`, `signed_out`, `signed_in`, `expired`
+provider internally through exact-origin `GET /api/auth`, owned by OS. The SDK
+uses same-origin credentials, refuses redirects and bypasses caching. Missing or
+invalid setup makes authentication unavailable without a legacy endpoint or
+app-configured provider fallback; ordinary app modules do not consume this
+internal bootstrap. State is `initializing`, `signed_out`, `signed_in`, `expired`
 or `unavailable`; actions complete without returning a session. Invitation-only
 code delivery never creates accounts or reveals account existence. Keep form
 selection, entered values, copy and navigation in the app. The handle exposes no
@@ -101,6 +105,11 @@ provider, configuration, membership list or access/refresh credential. Consumers
 never construct bearer headers. Multiple handles share provider coordination on
 the same origin; each owns its subscription/disposal independently.
 
+The hosted runtime routes that exact capability path directly to OS while the
+app keeps its independently deployed interface and other paths. Operators must
+activate and verify the OS route before releasing a consumer that depends on
+it; installing this SDK does not deploy routes or migrate an app's sign-in UI.
+
 Only trusted workspace host startup passes that exact registered handle to
 `os.init`. Copying its public shape grants no authority. Fresh per-operation
 authority fails closed on sign-out, replacement, expiry or disposal. Existing
@@ -271,10 +280,10 @@ both shipped SDK inputs and every emitted helper, rejects unexpected inputs and
 imports, and retains the full credential/server/customer leak scan. Node retains
 the complete package-root exports; provider classes are never public.
 
-Current auth measurement is **148,677 minified bytes**, including **4,799 fixture
-bytes** and **143,878 SDK bytes**, with **38,758 total gzip bytes**. The provider
-accounts for 104,577 emitted bytes. Current unchanged Data/Files fixture measures
-**46,178 total / 5,893 fixture / 40,285 SDK bytes**, with **14,338 total gzip bytes**.
+Current auth measurement is **149,045 minified bytes**, including **5,177 fixture
+bytes** and **143,868 SDK bytes**, with **38,870 total gzip bytes**. Current
+unchanged Data/Files fixture measures **46,164 total / 5,893 fixture / 40,271 SDK
+bytes**, with **14,316 total gzip bytes**.
 Both fit their explicitly reviewed ceilings: **41,000 SDK bytes** for the pinned
 Data/Files fixture and **150,000 SDK bytes** for the separately pinned auth fixture.
 Those ceilings are fixed review decisions, not values regenerated from later
@@ -290,15 +299,15 @@ bytes; generated helpers count toward the SDK. Gzip is diagnostic only.
 
 | Same named-import fixture | Legacy diagnostic | Current strict proof |
 | --- | ---: | ---: |
-| Total minified JavaScript bytes | 488,539 | 46,178 |
+| Total minified JavaScript bytes | 488,539 | 46,164 |
 | Fixture-attributed bytes | 5,954 | 5,893 |
-| SDK bytes | 482,585 | 40,285 |
-| Total gzip bytes | 198,612 | 14,338 |
+| SDK bytes | 482,585 | 40,271 |
+| Total gzip bytes | 198,612 | 14,316 |
 
 The legacy diagnostic externalized three unresolved Node built-ins and failed
 browser compatibility. The current strict proof has no imports, shims or warnings
 and reduces SDK bytes by 91.7%. Its literal ceiling is **41,000 SDK bytes**:
-715 bytes of deliberately limited headroom. The reviewed measurement includes
+729 bytes of deliberately limited headroom. The reviewed measurement includes
 the Local Host bootstrap and opaque browser-auth handoff that `os.init` must
 select at runtime. The verifier pins the fixture
 hash and bundler version; changing either requires a reviewed measurement