@oddington/sdk 0.1.8 → 0.1.10

package/README.md

@@ -54,9 +54,10 @@ an OS-launched IPv4 loopback origin. It checks `/_os/app/context` on that exact
 origin for every protected operation, without reading hosted access credentials.
 It accepts no workspace, endpoint or token option. Missing, forged, expired or
 changed local context fails closed, as do sign-out and initialization replacement.
-Local Data and Files currently return `context_unavailable` and
-`unsupported_context` respectively after checking context; they do not return
-empty data, upload locally or fall back to hosted services. Local app routine
+Local Data selects from the Host's exact published index; a warm selection
+neither initiates nor waits for renewal or synchronous hosted authority checks.
+Local Files returns `unsupported_context` after checking context. Neither path
+falls back to hosted services. Local app routine
 execution uses the installed routine's immediate-publication authority.
 
 Apps can assess a declared routine without starting it:
@@ -104,14 +105,26 @@ Only event reads reconnect, with bounded backoff and duplicate suppression;
 launch and cancellation requests are never automatically retried. Failed
 cancellation requests do not acknowledge cancellation. Handles expose no IDs,
 cursors, raw output or process controls. Local sign-out, expiry, context
-replacement and origin/credential changes invalidate pending work.
+replacement, origin changes and unconfirmed credential changes invalidate pending work.
 
 The exact-origin browser credential survives reload and tab closure in local
-storage. Host expiry and current membership remain authoritative; stored state
-cannot revive a stopped host. Recovery covers only the operation's current
-session and bounded terminal grace, without relaunching or durable history.
+storage. Each active initialization proactively renews before expiry, normally
+sixty seconds early with a shorter lead for shorter lifetimes. Only the exact
+Local Host silently refreshes the secure CLI login and confirms unchanged
+complete access. Successful renewal rotates only the bounded browser credential;
+it exposes no CLI credential or login prompt. Other tabs and SDK instances
+retain only their unchanged deadline during a temporary renewal outage and
+retry proactively without starting or delaying Data reads. They
+confirm the stored winner against the same Host and logical session before
+silently adopting it. Rotation preserves admitted Data/results and owned runs;
+old credentials cannot admit new requests and failed writes, launches and
+cancellations are never replayed. Sign-out, replacement and expiry cancel
+renewal, including pending response bodies. Host expiry and current membership
+remain authoritative; stored state cannot revive a stopped host. Recovery
+covers only the operation's current logical session and bounded terminal grace,
+without relaunching or durable history.
 Supplied File inputs currently reject `execution_unavailable` before launch;
-File-use transfer and local Data/Files adapters are separate work.
+File-use transfer and a local browser Files adapter are separate work.
 
 The fixed child imports `appRun` from the same package and shares the app's
 customer-owned input/result/step types:
@@ -286,9 +299,37 @@ Each graph selection sends one request and returns only selected canonical
 values, expanded forward links and exact opaque public versions. Cursors
 continue the exact retained artifact and collection selection, even after
 replacement; repeat its options and links while omitting unrelated collections.
-There is no automatic retry or separate version fetch. History is not included.
+There is no automatic retry or separate version fetch.
 Collection schemas omit Markdown storage hints.
 
+Read published History through the same inert repository handle:
+
+```ts
+const versions = await general.history.list({ limit: 50 });
+const older = versions.length
+  ? await general.history.list({ before: versions.at(-1)!.version }) : [];
+const close = await general.history.at('2026-10-09T16:30:00Z');
+```
+
+List returns an entry array in descending published sequence, with an exclusive
+visible `before` and a default limit of 50 (integer 1–100). Cutoff accepts a real
+RFC 3339 instant with an explicit offset and returns the greatest visible sequence
+published at or before it, or null. Entries contain exactly `version`, `publishedAt`,
+`author`, `authoredAt`, `committer`, `committedAt`, `message`, `created`, `updated`,
+and `deleted`. Git identities and complete messages are repository facts; changed
+refs are lexical. Versions are opaque published identities, never Git expressions.
+Each operation captures input before resolving authority and makes one request.
+Incomplete selected metadata fails the whole result retryably with `unavailable`;
+current Records remain independent. Hosted routines retain their captured ceiling
+until their own authoritative publication advances it. History is served through
+the member/run Data transport. Local apps and local routines use the same calls;
+their OS parent may acquire one bounded page or cutoff result, retain it against
+the exact repository target and published ceiling, and serve an identical warm
+request without another hosted call. Authority loss, expiry, target replacement
+or published-version replacement invalidates that retained result. Prepared local
+changes do not appear in published History.
+Historical Record selection and `history.changes` are not exposed by this slice.
+
 Use bounded plain-text lookup to find full Records and guards:
 
 ```ts