@oddington/sdk 0.1.18 → 0.1.20

package/README.md

@@ -12,9 +12,16 @@ same key and content returns the original result; changed content conflicts.
 Existing Inbox-retained files remain separate from shared Files, with their
 original identities, bytes and audience. The SDK exposes no raw-credential API.
 
-Focused apps use `inbox.questions.list()` for `AnswerableQuestion[]`, with relevance
-bound by the trusted host to the canonical routines in the app declaration.
-The same list, answer and Record-search methods work in hosted and local apps.
+Hosted apps use `inbox.questions.list({ routines })` for `AnswerableQuestion[]`.
+Derive `routines` from the existing app declaration with
+`[...new Set(Object.values(appDeclaration.routines).map(binding => binding.routine))]`.
+These inner canonical names narrow relevance only; they grant no answer or
+Record-search authority. The ordinary authenticated Inbox context needs no app
+identity or declaration provisioning. The filter is required; `[]` returns no
+Questions after authentication. The SDK validates and privately snapshots the
+filter across pagination. Local apps use `inbox.questions.list()` instead, bound
+to their trusted host's declaration; any supplied filter is invalid locally.
+Both use the same answer and Record-search methods, without a filter or prior list.
 `InboxItem` remains the complete first-party Inbox value. Record refs are placement
 hints only: match them against independently authorized Data, and omit ambiguous
 detail placement. Keep drafts on failed or uncertain acceptance, prevent duplicate
@@ -312,12 +319,13 @@ both shipped SDK inputs and every emitted helper, rejects unexpected inputs and
 imports, and retains the full credential/server/customer leak scan. Node retains
 the complete package-root exports; provider classes are never public.
 
-Current auth measurement is **149,045 minified bytes**, including **5,177 fixture
-bytes** and **143,868 SDK bytes**, with **38,870 total gzip bytes**. Current
-unchanged Data/Files fixture measures **46,164 total / 5,893 fixture / 40,271 SDK
-bytes**, with **14,316 total gzip bytes**.
-Both fit their explicitly reviewed ceilings: **41,000 SDK bytes** for the pinned
-Data/Files fixture and **150,000 SDK bytes** for the separately pinned auth fixture.
+Current auth measurement is **171,346 minified bytes**, including **6,322 fixture
+bytes** and **165,024 SDK bytes**, with **45,466 total gzip bytes**. Current
+Data/Files fixture measures **47,254 total / 5,893 fixture / 41,361 SDK
+bytes**, with **14,906 total gzip bytes**. The shipped runtime now also carries
+the local Questions transport and transparent Local Host renewal.
+Both fit their explicitly reviewed ceilings: **42,000 SDK bytes** for the pinned
+Data/Files fixture and **166,000 SDK bytes** for the separately pinned auth fixture.
 Those ceilings are fixed review decisions, not values regenerated from later
 measurements. The installed auth realm/host-handoff proof passes alongside the
 Node exports, declarations, tarball leak scan and browser compatibility audits.
@@ -331,17 +339,17 @@ bytes; generated helpers count toward the SDK. Gzip is diagnostic only.
 
 | Same named-import fixture | Legacy diagnostic | Current strict proof |
 | --- | ---: | ---: |
-| Total minified JavaScript bytes | 488,539 | 46,164 |
+| Total minified JavaScript bytes | 488,539 | 47,254 |
 | Fixture-attributed bytes | 5,954 | 5,893 |
-| SDK bytes | 482,585 | 40,271 |
-| Total gzip bytes | 198,612 | 14,316 |
+| SDK bytes | 482,585 | 41,361 |
+| Total gzip bytes | 198,612 | 14,906 |
 
 The legacy diagnostic externalized three unresolved Node built-ins and failed
 browser compatibility. The current strict proof has no imports, shims or warnings
-and reduces SDK bytes by 91.7%. Its literal ceiling is **41,000 SDK bytes**:
-729 bytes of deliberately limited headroom. The reviewed measurement includes
-the Local Host bootstrap and opaque browser-auth handoff that `os.init` must
-select at runtime. The verifier pins the fixture
+and reduces SDK bytes by 91.4%. Its literal ceiling is **42,000 SDK bytes**:
+639 bytes of deliberately limited headroom. The reviewed measurement includes
+the Local Host bootstrap, local Questions transport, transparent renewal and
+opaque browser-auth handoff that `os.init` must select at runtime. The verifier pins the fixture
 hash and bundler version; changing either requires a reviewed measurement
 comparison. Future ceiling increases require explicit review of added browser
 capability and must never be automatically regenerated from an oversized output.