@revturbine/sdk 0.9.3 → 0.10.0

package/CHANGELOG.md

@@ -33,8 +33,75 @@ the old shape was accepted and did nothing. Those windows are the expensive ones
 > **minor** position (`0.6.0` → `0.7.0`), not the major. `npm`'s caret on a `0.x`
 > range does **not** span minors, so `^0.7.0` will not silently pull `0.8.0`.
 
+Built-in decision reason values have a separate reviewed
+[compatibility baseline](docs/reason-code-contract.md). Live fixture checks
+protect those values independently of `@public` method tags; baseline changes
+also require a changelog entry.
+
 ---
 
+## 0.10.0
+
+### `publicKey` is the browser credential; `apiKey` is the server key
+
+**What changed.** The browser init option for the ingest (public) key is
+`publicKey` — on `initRevTurbine`, `<RevTurbineProvider options>`, and the
+headless init alike. Every browser bearer (ingest, launched-Playbook delivery,
+user context, branding, trial status) uses that one key. `apiKey` now means
+one thing everywhere: the secret **server key**, as it always did on
+`@revturbine/sdk/server` — pass it from backend code only (a route handler
+using `@revturbine/sdk/headless` keeps using `apiKey`). The name states what the
+credential is at the call site: a security scanner or an agent that meets
+`publicKey` in a bundle knows it belongs there, where `apiKey` reads as a leak.
+
+`apiKey` and `ingestPublicKey` are still accepted on a browser init as aliases
+of `publicKey` for one minor (precedence: `publicKey`, then `ingestPublicKey`,
+then `apiKey`). Using an alias without `publicKey` in a browser logs a one-time
+development warning naming `publicKey`; production builds are silent. On the
+browser `RevTurbineInitOptions` type, `apiKey` is now optional (it was required)
+and `ingestPublicKey` is `@deprecated`. Keyless local-only init is unchanged,
+and the plan 95 anonymous `sdk_init` beacon still fires only when no public key
+(`publicKey` or `ingestPublicKey`) was supplied.
+
+Ruling: Kent, 2026-09-21, devkit PR #808 (closed).
+
+**Landed in** `0.10.0`. **Fail-closed in** not yet — the aliases are removed one
+minor later; until then the old shape works and warns.
+
+**Proving test:** `web-sdk/public-key-option.test.ts` — precedence, the single
+bearer across ingest and control-plane fetches, the browser-only warning, and
+the keyless local-only init. Type-level: `web-sdk/init-options-exactness.test-d.ts`
+accepts `publicKey` and rejects the `publickey` casing typo.
+
+### `endpoint` and `mode` are optional on `initRevTurbine` and `<RevTurbineProvider>`
+
+**What changed.** `RevTurbineInitOptions.endpoint` defaults to
+`https://revturbine.com/app` (`DEFAULT_HOSTED_ENDPOINT`, exported) and
+`RevTurbineInitOptions.mode` defaults to `'snippet'` (`DEFAULT_SDK_MODE`,
+exported); `<RevTurbineProvider>` passes `'react'` when the app does not set it.
+Both were required; `mode` only ever labelled telemetry (`page_view.mode` and a
+diagnostics message), and every hosted integration used the same endpoint.
+Existing calls that pass them are unchanged. Local mode is unchanged (its
+placeholder defaults already applied). Additive, no version bump required.
+
+**Landed in** `0.10.0`. **Fail-closed in** n/a — nothing old is rejected.
+
+**Proving test:** `web-sdk/public-init.test.ts` — "defaults endpoint and mode
+for a hosted init that omits them".
+
+### Reason-code compatibility verification
+
+Added a reviewed baseline for 27 entitlement and 21 placement reason values,
+checked against live SDK/core fixtures. Removal/rename controls exercise every
+protected value, and baseline changes require this changelog to change through
+the existing public-API gate. Custom provider reasons remain extensible and
+free-form diagnostics are excluded. This adds verification only; no runtime
+reason values or package versions change.
+
+Proving tests: `web-sdk/reason-contract.test.ts` and
+`web-sdk/reason-contract-policy.test.ts`. The intentional-change procedure is
+in `docs/reason-code-contract.md`.
+
 ## 0.9.3
 
 ### Fixed