@gamaro.io/core-types 1.1.3 → 2.1.0

package/README.md

@@ -42,7 +42,7 @@ B2B qualification, scoring rules, …) stay in the workspace that owns the domai
 | `viewport`              | Viewport bucket helpers (`mobile` / `tablet` / `desktop`) + breakpoints          |
 | `widget-config`         | `WidgetConfig` — the public contract of `createWidget(config)`                   |
 | `widget-runtime-config` | Internal runtime view of the resolved widget config (after server merge)         |
-| `application-config`    | Server-side Agent metadata (vertical, allowed origins, identity)                 |
+| `application-config`    | Server-side Agent metadata (allowed origins, identity)                           |
 | `postmessage`           | Discriminated unions for `window.postMessage` host ↔ iframe protocol             |
 | `geo`                   | Lightweight geo primitives (`LatLng`, `BoundingBox`)                             |
 | `motion`                | Motion tokens (`MOTION_DURATIONS`, `MOTION_EASINGS`, `MOTION_STAGGER`) — ADR-018 |
@@ -68,10 +68,10 @@ Some helpers are exposed on a **dedicated subpath**, deliberately kept out of
 the barrel above so they carry no `zod` dependency (import them directly, not
 from the package root):
 
-| Subpath    | Contents                                                                                                                                                                                                                            |
-| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `/session` | `getApplicationSessionCookieName` (App-scoped, #3577), `getSessionCookieName` (legacy per-vertical, `@deprecated` — no longer read by the server, removed in the next major), `isValidSessionId` — pure session cookie / id helpers |
-| `/motion`  | Motion tokens — also re-exported from the root barrel (ADR-018)                                                                                                                                                                     |
+| Subpath    | Contents                                                                                                     |
+| ---------- | ------------------------------------------------------------------------------------------------------------ |
+| `/session` | `getApplicationSessionCookieName` (App-scoped, #3577), `isValidSessionId` — pure session cookie / id helpers |
+| `/motion`  | Motion tokens — also re-exported from the root barrel (ADR-018)                                              |
 
 ```typescript
 import {

package/dist/application-config.d.ts

@@ -4,15 +4,16 @@
  * The app (`apps/app`) produces this response through a stricter server-side
  * whitelist schema (`publicApplicationConfigSchema` in the route), and the
  * widget (`@gamaro.io/widget`) consumes it here. Keeping the widget-side Zod
- * schema as the canonical shape prevents drift — the server schema MUST remain
- * a compatible subset (it may be stricter, never more permissive).
+ * schema as the canonical shape prevents drift — every response the server
+ * schema accepts MUST parse here (it may be stricter, never more permissive).
+ * A key the server still sends but this schema no longer declares is stripped
+ * on parse, which is how a field is retired across a major (#4161).
  */
 import { z } from "zod";
 export declare const applicationConfigResponseSchema: z.ZodObject<{
     applicationId: z.ZodString;
     applicationSlug: z.ZodString;
     applicationName: z.ZodString;
-    vertical: z.ZodString;
     theme: z.ZodNullable<z.ZodObject<{
         primaryColor: z.ZodOptional<z.ZodString>;
         backgroundColor: z.ZodOptional<z.ZodString>;

package/dist/application-config.js

@@ -4,8 +4,10 @@
  * The app (`apps/app`) produces this response through a stricter server-side
  * whitelist schema (`publicApplicationConfigSchema` in the route), and the
  * widget (`@gamaro.io/widget`) consumes it here. Keeping the widget-side Zod
- * schema as the canonical shape prevents drift — the server schema MUST remain
- * a compatible subset (it may be stricter, never more permissive).
+ * schema as the canonical shape prevents drift — every response the server
+ * schema accepts MUST parse here (it may be stricter, never more permissive).
+ * A key the server still sends but this schema no longer declares is stripped
+ * on parse, which is how a field is retired across a major (#4161).
  */
 import { z } from "zod";
 import { themeConfigSchema } from "./theme";
@@ -17,10 +19,6 @@ export const applicationConfigResponseSchema = z.object({
         .max(100)
         .describe("Application slug (kebab-case)"),
     applicationName: z.string().max(200).describe("Application display name"),
-    vertical: z
-        .string()
-        .max(50)
-        .describe("Deprecated: the widget no longer reads it. Still served for already-published widgets that validate it; removed in the next major."),
     theme: themeConfigSchema.nullable().describe("Application theme"),
     allowedOrigins: z
         .array(z.string().max(200))

package/dist/session.d.ts

@@ -21,17 +21,6 @@
  * Application UUID (`AuthContext.applicationId`), globally unique.
  */
 export declare function getApplicationSessionCookieName(applicationId: string): string;
-/**
- * Per-vertical session cookie name — LEGACY (#918 → #3577).
- *
- * The server no longer reads, re-emits nor purges cookies under this name
- * (#4119): every one of them expired. The export only survives because
- * removing it is a breaking change of this package.
- *
- * @deprecated Use {@link getApplicationSessionCookieName}. No server reads
- * this name any more; the export is removed in the next major.
- */
-export declare function getSessionCookieName(verticalId: string): string;
 /**
  * Validate the UUID shape of a session id. The length pre-check is
  * defense-in-depth (avoids running the regex on arbitrarily long strings).

package/dist/session.js

@@ -13,8 +13,7 @@
  */
 /**
  * Any character outside `[a-z0-9-]` (case-insensitive) is sanitized to `_`
- * (each char maps to one `_`, no collapsing), so `real-estate` stays
- * `gamaro_session_real-estate`.
+ * (each char maps to one `_`, no collapsing); a UUID passes through intact.
  */
 function sanitizeCookieId(id) {
     return id.replace(/[^a-z0-9-]/gi, "_");
@@ -31,19 +30,6 @@ function sanitizeCookieId(id) {
 export function getApplicationSessionCookieName(applicationId) {
     return `gamaro_session_${sanitizeCookieId(applicationId)}`;
 }
-/**
- * Per-vertical session cookie name — LEGACY (#918 → #3577).
- *
- * The server no longer reads, re-emits nor purges cookies under this name
- * (#4119): every one of them expired. The export only survives because
- * removing it is a breaking change of this package.
- *
- * @deprecated Use {@link getApplicationSessionCookieName}. No server reads
- * this name any more; the export is removed in the next major.
- */
-export function getSessionCookieName(verticalId) {
-    return `gamaro_session_${sanitizeCookieId(verticalId)}`;
-}
 /**
  * Validate the UUID shape of a session id. The length pre-check is
  * defense-in-depth (avoids running the regex on arbitrarily long strings).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gamaro.io/core-types",
-  "version": "1.1.3",
+  "version": "2.1.0",
   "description": "Cross-workspace TypeScript contracts and Zod schemas consumed by @gamaro.io/widget. Intended as a peer of the widget SDK.",
   "type": "module",
   "main": "./dist/index.js",