@idosgames/core 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -14,6 +14,65 @@ and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.ht
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-08-24
+
+Signing in by e-mail becomes a **two-step flow** with a confirmation code, and a password now
+belongs to a **title**, not to the platform. Friend requests gain the outgoing direction, and the
+usage history is rolled up into periods. Breaking — see below.
+
+### Breaking
+
+- **`registerWithEmail` no longer signs the player in.** It returns `EmailRegistrationOutcome`
+  (`codeTtlMinutes`, `resendCooldownSeconds`) instead of `ClientState`: the server only stores the
+  attempt and mails a code, and the player is created by `confirmEmailRegistration`. A screen that
+  waits for a session here waits forever. There is no flag to branch on — confirmation is platform
+  behaviour and no title can switch it off.
+- **`EMAIL_ALREADY_EXISTS` is no longer returned by registration.** A free and a taken address
+  answer identically, so the form cannot be used to ask "does this person have an account here";
+  the owner of a taken address gets a "you already have an account" e-mail instead, without a code.
+- **`loginWithPlatformToken` and `AuthenticationAction.LoginWithPlatformToken` removed.** The
+  backend stopped issuing the audience it accepted, so the endpoint was unreachable code. Use
+  `loginWithSsoCode` (see `beginSsoRedirect`).
+- **`UserReferralState.FollowerIDs` removed.** It was an unbounded list in the hot player document
+  with no readers; the count that replaced it is server-sent, and the relationship itself lives on
+  the subscriber's side.
+
+### Added
+
+- **`confirmEmailRegistration(email, code)`** — exchanges the mailed code for a session and creates
+  the player. Persists the credentials for `autoLogin()` exactly as `loginWithEmail` does; the
+  password comes from step one and is never sent again.
+- **`resendVerificationCode(email)`** — mails a NEW code (only a hash is stored server-side, so the
+  previous one cannot be re-sent). Answers successfully whatever happened, with one exception worth
+  surfacing: `EMAIL_SENDER_NOT_CONFIGURED`, which is about the server's configuration and not about
+  the address.
+- **`zEmailRegistrationResponse` / `EmailRegistrationResponse`** and
+  `AuthenticationRequest.VerificationCode`.
+- **`client.social.getOutgoingRequests()`** + `SocialAction.GetOutgoingRequests` and the
+  `social:outgoingRequestsLoaded` event. Direction and status are separate axes, and the outgoing
+  list cannot be derived from a counter — without it the "Sent" mark on a card lived only until the
+  app restarted.
+- **`UserSocialState.FriendsCount` / `IncomingCount` / `OutgoingCount`** — server-sent counters.
+  The friend lists themselves are now a local cache, filled by the matching `get*` call.
+- **`UsagePeriodRecord`** — the rolled-up month/year record (`Seconds`, `Sessions`, `ActiveDays`,
+  `LongestSessionSeconds`, `ActiveHoursMask`, `FirstActiveDay`).
+- **`BoardRollResponse.DiceValues`** — the individual dice behind the rolled total.
+
+### Changed
+
+- ⚠ **A password now belongs to the TITLE.** The same address in two games means two independent
+  passwords, and resetting in one game does not change the login for the other. The reset e-mail
+  goes out through the **publisher's** SMTP, so a shared password would let one publisher's mail
+  server control access to every other publisher's game. The identity stays shared — Google, Apple
+  and the idosgames.com sign-in still recognise the same person everywhere; identity answers "who
+  is this", not "what proves they may sign in". Don't tell the player "the same password as in your
+  other game", and don't reuse stored credentials across titles.
+- **Every outcome of `resetPassword` answers the same** — `INVALID_RESET_CODE` for an unknown
+  address, a code never requested, an expired code and a wrong code alike; an exhausted code
+  answers `RESET_CODE_ATTEMPTS_EXCEEDED`. The remaining-attempt count is gone from the response: it
+  confirmed the account existed and told an attacker how much room was left. Don't parse a number
+  out of `error`.
+
 ## [0.7.0] - 2026-08-10
 
 Real-money payment support. Every configured price becomes a **`PriceOptions` dictionary**, a