@idosgames/core 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -14,6 +14,118 @@ and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.ht
 
 ## [Unreleased]
 
+## [0.10.0] - 2026-08-31
+
+Where a player came from is now captured and delivered automatically, and playtime finally reaches
+the publisher's analytics. Referral codes become short human codes with a server-built invite link.
+Breaking — see below.
+
+### Breaking
+
+- **`SpendRewardDefinition.Percent` is now `Rate`, and it is a FRACTION.** `0.05` means 5%, not
+  `5`. The old field never reached the server: it was dropped at deserialisation, so every kickback
+  rule written through it silently paid nobody. Render a percentage if you like, but keep the wire
+  value a fraction.
+- **`UserData.patchReferralSubscription` takes the referrer's ID, not the code.** While a code and
+  a `UserID` were the same string, echoing the code back happened to be right; with a short code it
+  writes a code into an ID field. The activation response now carries `ReferrerUserID` separately
+  from `ReferralCode`.
+- **A referral code is no longer a `UserID`.** `activateReferralCode` accepts only the short code
+  (or the invite link containing it); an internal identifier is rejected before any lookup. Nothing
+  had shipped on the old form, so there is no migration path and none is needed.
+
+### Added
+
+- **`AcquisitionCapture`** — reads the launch URL and Telegram launch parameters when the client is
+  created (`utm_*`, `gclid`/`fbclid`/`ttclid`/`msclkid`/`yclid`, `?ref=`, `idos_click`,
+  `document.referrer`), keeps them across the login screen with a 30-day TTL, and attaches them to
+  whichever sign-in the player uses. Nothing to wire; nothing to call.
+- **`PlaytimeTracker`** — counts playtime and reports it from login. Without it `addUsageTime` had
+  no caller at all, so a web title reported **zero** active users no matter how many people played:
+  DAU, WAU, MAU, stickiness and every retention cohort are derived from what it sends. Flush
+  interval and idle threshold match the Unity SDK so the two platforms count the same thing.
+- **`IDosGamesSettings.appVersion`** — the build number that rides along with the acquisition
+  signal. The web has no `Application.version`, so the host has to pass it; without it no player is
+  attributed to a release and cohort-by-version is unanswerable.
+- **`UserReferralState.Code`** — the player's own short invite code, minted lazily by the server on
+  the first `getUserState()`.
+- **`UserReferralState.PendingActivationReward`** — set when the binding happened at login rather
+  than by typing a code; the debt is settled by the next `getUserState()`.
+- **`UserReferralStateResponse.InviteUrl`** — a ready-made invite link built by the server. Do not
+  assemble one from a template: a client-built link is an open redirect.
+- **`SpendRewardDefinition`** gains `Basis`, `MinSourceAmount`, `MaxRewardPerOperation` and
+  `Limits` — the anti-farm controls that existed on the server and could not be expressed here.
+- **`PlatformAdapter.getReferrer?()`** — optional, so existing custom adapters keep compiling.
+
+### Fixed
+
+- **Playtime was lost on every tab switch.** `visibilitychange` fires _after_ the state flips, so
+  the tracker asked the document, was told "hidden", and discarded the visible stretch that led up
+  to the switch — up to a full flush interval, every time.
+- **Response schemas no longer strip unknown fields.** `zUserReferralStateResponse`,
+  `zActivateReferralCodeResponse`, `zClaimInviteRewardResponse` and
+  `zReferralDefinitionsResponse` were missing `.passthrough()`, so `InviteUrl` never reached the
+  client at all.
+
+## [0.9.0] - 2026-08-24
+
+Signing in by e-mail becomes a **two-step flow** with a confirmation code, and a password now
+belongs to a **title**, not to the platform. Friend requests gain the outgoing direction, and the
+usage history is rolled up into periods. Breaking — see below.
+
+### Breaking
+
+- **`registerWithEmail` no longer signs the player in.** It returns `EmailRegistrationOutcome`
+  (`codeTtlMinutes`, `resendCooldownSeconds`) instead of `ClientState`: the server only stores the
+  attempt and mails a code, and the player is created by `confirmEmailRegistration`. A screen that
+  waits for a session here waits forever. There is no flag to branch on — confirmation is platform
+  behaviour and no title can switch it off.
+- **`EMAIL_ALREADY_EXISTS` is no longer returned by registration.** A free and a taken address
+  answer identically, so the form cannot be used to ask "does this person have an account here";
+  the owner of a taken address gets a "you already have an account" e-mail instead, without a code.
+- **`loginWithPlatformToken` and `AuthenticationAction.LoginWithPlatformToken` removed.** The
+  backend stopped issuing the audience it accepted, so the endpoint was unreachable code. Use
+  `loginWithSsoCode` (see `beginSsoRedirect`).
+- **`UserReferralState.FollowerIDs` removed.** It was an unbounded list in the hot player document
+  with no readers; the count that replaced it is server-sent, and the relationship itself lives on
+  the subscriber's side.
+
+### Added
+
+- **`confirmEmailRegistration(email, code)`** — exchanges the mailed code for a session and creates
+  the player. Persists the credentials for `autoLogin()` exactly as `loginWithEmail` does; the
+  password comes from step one and is never sent again.
+- **`resendVerificationCode(email)`** — mails a NEW code (only a hash is stored server-side, so the
+  previous one cannot be re-sent). Answers successfully whatever happened, with one exception worth
+  surfacing: `EMAIL_SENDER_NOT_CONFIGURED`, which is about the server's configuration and not about
+  the address.
+- **`zEmailRegistrationResponse` / `EmailRegistrationResponse`** and
+  `AuthenticationRequest.VerificationCode`.
+- **`client.social.getOutgoingRequests()`** + `SocialAction.GetOutgoingRequests` and the
+  `social:outgoingRequestsLoaded` event. Direction and status are separate axes, and the outgoing
+  list cannot be derived from a counter — without it the "Sent" mark on a card lived only until the
+  app restarted.
+- **`UserSocialState.FriendsCount` / `IncomingCount` / `OutgoingCount`** — server-sent counters.
+  The friend lists themselves are now a local cache, filled by the matching `get*` call.
+- **`UsagePeriodRecord`** — the rolled-up month/year record (`Seconds`, `Sessions`, `ActiveDays`,
+  `LongestSessionSeconds`, `ActiveHoursMask`, `FirstActiveDay`).
+- **`BoardRollResponse.DiceValues`** — the individual dice behind the rolled total.
+
+### Changed
+
+- ⚠ **A password now belongs to the TITLE.** The same address in two games means two independent
+  passwords, and resetting in one game does not change the login for the other. The reset e-mail
+  goes out through the **publisher's** SMTP, so a shared password would let one publisher's mail
+  server control access to every other publisher's game. The identity stays shared — Google, Apple
+  and the idosgames.com sign-in still recognise the same person everywhere; identity answers "who
+  is this", not "what proves they may sign in". Don't tell the player "the same password as in your
+  other game", and don't reuse stored credentials across titles.
+- **Every outcome of `resetPassword` answers the same** — `INVALID_RESET_CODE` for an unknown
+  address, a code never requested, an expired code and a wrong code alike; an exhausted code
+  answers `RESET_CODE_ATTEMPTS_EXCEEDED`. The remaining-attempt count is gone from the response: it
+  confirmed the account existed and told an attacker how much room was left. Don't parse a number
+  out of `error`.
+
 ## [0.7.0] - 2026-08-10
 
 Real-money payment support. Every configured price becomes a **`PriceOptions` dictionary**, a

package/dist/chunk-MEUEUF7D.js

@@ -0,0 +1 @@
+var n=class{getString(e){if(typeof localStorage>"u")return null;try{return localStorage.getItem(e)}catch{return null}}setString(e,t){if(!(typeof localStorage>"u"))try{localStorage.setItem(e,t);}catch{}}remove(e){if(!(typeof localStorage>"u"))try{localStorage.removeItem(e);}catch{}}},o=class{map=new Map;getString(e){return this.map.get(e)??null}setString(e,t){this.map.set(e,t);}remove(e){this.map.delete(e);}};function r(){return globalThis.Telegram?.WebApp??null}function l(){return crypto.randomUUID()}var s="idos_device_id",i=class{storage;constructor(e=new n){this.storage=e;}getPlatform(){return r()?.platform??"Web"}getFullURL(){return typeof location<"u"?location.href:""}getStartParameter(){let e=r()?.initDataUnsafe?.start_param;return typeof e=="string"?e:null}getReferrer(){if(typeof document>"u")return null;let e=document.referrer;return e&&e.length>0?e:null}getTelegramInitDataRaw(){let e=r()?.initData;return e&&e.length>0?e:null}getDeviceID(){let e=this.storage.getString(s);return e||(e=l(),this.storage.setString(s,e)),e}getDeviceModel(){return typeof navigator<"u"&&navigator.userAgent?navigator.userAgent:"Web"}shareLink(e){let t=r();if(t?.openTelegramLink){t.openTelegramLink(e);return}typeof window<"u"&&window.open(e,"_blank");}openInvoice(e){let t=r();if(t?.openInvoice){t.openInvoice(e);return}typeof window<"u"&&window.open(e,"_blank");}async showAd(e){let t=globalThis;typeof t.showAd=="function"&&await t.showAd(e);}async copyToClipboard(e){typeof navigator<"u"&&navigator.clipboard&&await navigator.clipboard.writeText(e);}};var p="idos_device_id",g=class{storage;constructor(e=new o){this.storage=e;}getPlatform(){return "Web"}getFullURL(){return ""}getStartParameter(){return null}getTelegramInitDataRaw(){return null}getDeviceID(){let e=this.storage.getString(p);return e||(e="noop-device",this.storage.setString(p,e)),e}getDeviceModel(){return "Noop"}shareLink(){}openInvoice(){}async showAd(){}async copyToClipboard(){}};export{n as a,o as b,r as c,l as d,i as e,g as f};