@idosgames/core 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -14,6 +14,25 @@ and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.ht
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-08-04
+
+### Added
+
+- `auth.loginWithSsoCode(code)` — exchange a one-time code issued by idosgames.com for a
+  title session. This is how a game signs a player in without ever receiving a platform
+  token: the code lives 60 seconds, is burnt on first exchange, and only works for the
+  title it was issued for. Deliberately **not** replayable by `autoLogin()` — a stale
+  session is re-established by bouncing through `/sso` again, which is silent while the
+  site session is alive.
+- `readSsoCodeFromUrl()` — read that code out of the URL fragment and strip it from the
+  address bar (a fragment never reaches a server, so it stays out of proxy logs and
+  `Referer`; clearing it stops a reload from re-submitting a burnt code). Verifies the
+  returned `state` against the one this browser stored before leaving.
+- `beginSsoRedirect({titleID, returnTo?, ssoUrl?})` — send the browser to the platform
+  sign-in page. Top-level redirect rather than a popup: popups are blocked by default on
+  mobile browsers and inside standalone/PWA windows, which is exactly where games run.
+- `AuthenticationAction.LoginWithSsoCode` and `AuthenticationRequest.SsoCode`.
+
 ## [0.1.0] - 2026-06-29
 
 ### Added