@tinkerlandai/indiana-sdk 0.3.1 → 0.5.0

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 Release facts and artifact evidence: [SDK release ledger](../../docs/sdk-releases.md). Earlier personal-package versions are preserved in [@houzhen888/groove-grow history](../../docs/sdk-changelog-groove-grow.md). The two packages have independent version histories.
 
+## Unreleased
+
+## 0.5.0 — 2026-10-19
+
+- Use protocol 0.5 for billing-window `anchor` responses and `sourceKind: manual` Invoices. The anchor semantics come from pinned Autumn; the Invoice source classification is an Indiana response adaptation. Add Invoice management methods and current subscription invoice-mode/anchor inputs. Requires a matching server/database release; package publication does not promote production.
+
+- Separate remote Screen navigation (10 seconds), bridge handshake (5 seconds) and first render (5 seconds) startup budgets. Count visible time only, identify the timed-out phase and cancel timers/listeners on render or disposal. A slow valid document no longer consumes the bridge budget before it loads.
+
+## Distribution tags — 2026-10-19
+
+- Point `latest` to the existing `0.4.0`; retain `beta = 0.4.0`. Default npm installation now resolves 0.4.0. Package bytes, protocol, and runtime are unchanged; no package was republished.
+
+## 0.4.0 — 2026-10-18
+
+- Use protocol 0.4 with environment-scoped behavior, experiment-exposure and Feature-usage collection policies. New required delivery and tracking acknowledgement fields require a matching service release.
+- Acknowledge disabled categories through `skipped`; preserve UUID/timestamp replay identity and keep database enforcement authoritative. Collection settings do not delete history or affect billable usage.
+- Cache SDK collection hints for 30 seconds and refresh on demand after expiry. Identity changes clear hints; re-enabling collection resumes eligible exposure/Feature-usage recording without repeating visual changes.
+- Publish on `beta`; keep `latest` unchanged. Production and native package/store rollout remain separate.
+
 ## 0.3.1 — 2026-10-17
 
 - Make English the default package README and include a separately linked Simplified Chinese translation.

package/README.md

@@ -2,30 +2,33 @@
 
 [简体中文](./README.zh-CN.md)
 
-Indiana's JavaScript and TypeScript SDK for browsers, Node.js, screen rendering, and optional AI usage integrations. Version `0.3.1` uses protocol `0.3` and requires a matching Indiana server and database deployment.
+Version `0.5.0` uses protocol `0.5`. It adds billing-window `anchor` responses, standalone Invoice classification (`sourceKind: manual`), Invoice management methods and current subscription invoice-mode/anchor inputs. The anchor name, values and billing semantics come from pinned Autumn; the Invoice source classification is an Indiana adaptation.
 
-Protocol `0.3` includes standalone Feature delivery, screen render references, and protocol header validation. Historical `0.2` clients, including requests without a protocol header, are rejected before business operations run.
+Indiana's JavaScript and TypeScript SDK supports browsers, Node.js, screen rendering and optional AI usage integrations. This package requires a server and database implementing protocol `0.5`; publishing the SDK does not deploy them. For a server still advertising protocol `0.3`, use SDK `0.3.1`.
+
+Environment collection controls introduced in protocol `0.4` remain available. Disabled collection keeps existing history and does not change billable usage. SDKs cache the policy for 30 seconds; the database checks each batch. Older `0.x` protocols are rejected before business operations.
 
 ```sh
-npm install @tinkerlandai/indiana-sdk@0.3.1
+npm install --save-exact @tinkerlandai/indiana-sdk@0.5.0
 ```
 
 ## Version compatibility and support
 
 During `0.x`, only the current protocol is supported. Starting with `1.0`, compatibility is preserved within each stable major version. Once the next stable major is published, the preceding stable major remains supported for at least 12 calendar months, with at least 180 days' public notice before retirement. The later deadline applies. See the [support policy](https://tinker.cash/docs/release-notes#support-policy).
 
-Version `0.3.1` sends protocol and SDK version headers and validates the protocol declared by successful responses. Headerless historical clients retain the fixed identity `0.2`; they do not follow the current protocol automatically. Updating source code does not change an existing npm artifact or deploy a server.
+Version `0.5.0` sends protocol and SDK version headers and validates the protocol declared by successful responses. Headerless historical clients retain the fixed identity `0.2`; they do not follow the current protocol automatically. Updating source code does not change an existing npm artifact or deploy a server.
 
-## One package, six entry points
+## One package, seven entry points
 
-| Import | Purpose |
-| --- | --- |
-| `@tinkerlandai/indiana-sdk` | Browser Customer, Funnel, Feature, and standalone Paywall clients |
-| `@tinkerlandai/indiana-sdk/server` | Trusted Node.js backend, Customer Sessions, business writes, and Funnel decisions |
-| `@tinkerlandai/indiana-sdk/popup` | Standalone screen rendering, sanitization, and previews |
-| `@tinkerlandai/indiana-sdk/openrouter` | Optional OpenRouter usage integration; requires its peer dependency |
-| `@tinkerlandai/indiana-sdk/native-shell` | Static Funnel shell assets for native WebViews |
-| `@tinkerlandai/indiana-sdk/page` | Anonymous website URL experiments using a public App environment ID |
+| Import                                   | Purpose                                                                            |
+| ---------------------------------------- | ---------------------------------------------------------------------------------- |
+| `@tinkerlandai/indiana-sdk`              | Browser Customer, Funnel, Feature, and standalone Paywall clients                  |
+| `@tinkerlandai/indiana-sdk/server`       | Trusted Node.js backend, Customer Sessions, business writes, and Funnel decisions  |
+| `@tinkerlandai/indiana-sdk/popup`        | Standalone screen rendering, sanitization, and previews                            |
+| `@tinkerlandai/indiana-sdk/openrouter`   | Optional OpenRouter usage integration; requires its peer dependency                |
+| `@tinkerlandai/indiana-sdk/native-shell` | Static Funnel shell assets for native WebViews                                     |
+| `@tinkerlandai/indiana-sdk/page`         | Anonymous website URL experiments using a public App environment ID                |
+| `@tinkerlandai/indiana-sdk/visual`       | Anonymous visual experiments and exposure collection using a public environment ID |
 
 The same package supports JavaScript and TypeScript and includes type declarations. Internal `@indiana/contracts` code is bundled; consumers do not install private workspace packages. Swift and Kotlin use their own package ecosystems and are released separately.
 
@@ -118,6 +121,8 @@ unsubscribe();
 flags.destroy();
 ```
 
+Since protocol 0.4, the selected environment's integration settings control behavior events, experiment exposures and Feature usage independently. New environments enable only exposure collection; existing environments retain all three. `flush()` includes a `skipped` count for intentionally disabled collection. The database rechecks every batch, including direct SDK/server and Funnel ingestion. Running experiment/Bandit dependencies prevent incompatible collection changes. These controls do not delete history or affect commercial usage accounting.
+
 Flags default to local evaluation; Owner/Admin can switch each flag to server evaluation. Server-evaluated flags deliver only keys and results, using the caller's fallback until the first result arrives. Attribute changes immediately discard old results. List hashes are not a secrecy boundary. Local Funnels cannot depend on server-evaluated flags; mode switches also check active historical Runs. `identify` / `reset` release the previous identity's Feature instances and event queue.
 
 Offering pins the Product Version scope and hierarchy. Paywall pins a published Offering Version and independently chooses its displayed Product subset, groups, ordering, and default selection. `createPaywallStartClient`, `createPaywallSession`, and `showPaywall` use a standalone Paywall Session. After payment, read Entitlements again. Your backend still authorizes requests and consumes usage idempotently.

package/README.zh-CN.md

@@ -2,12 +2,14 @@
 
 # @tinkerlandai/indiana-sdk
 
-Indiana 的 JavaScript／TypeScript SDK，包含浏览器、Node.js、屏幕渲染与可选 AI 用量集成。本包版本为 `0.3.1`，使用协议 `0.3`；服务端和数据库必须使用匹配的当前协议。本版本有破坏性变更，不提供旧名称、旧输入或旧数据模型的兼容层。
+SDK `0.5.0` 使用协议 `0.5`，新增用量窗口 `anchor` 返回字段、独立发票 `sourceKind: manual` 分类、Invoice 管理方法及订阅 invoice-mode／anchor 输入。anchor 的名称、取值与账期语义来自固定版本 Autumn；发票来源分类是 Indiana 的适配。
 
-**0.3.1 / 协议 0.3** 包含独立 Feature 下发、屏幕 render reference 与当前请求头校验。历史 0.2.0 包不能连接使用协议 0.3 的 HTTP handlers；显式或无版本头的旧 0.2 请求都在业务执行前被拒绝。
+Indiana 的 JavaScript／TypeScript SDK 支持浏览器、Node.js、屏幕渲染及可选 AI 用量集成。此版本需要实现协议 `0.5` 的匹配服务端和数据库；发布 SDK 不会部署服务。服务仍声明协议 `0.3` 时使用 SDK `0.3.1`。
+
+协议 0.4 引入的环境采集控制继续保留。当前环境的接入设置分别控制行为事件、实验曝光和 Feature 求值记录。`flush()` 的 `skipped` 表示明确关闭的采集；SDK 缓存配置 30 秒，数据库对每批再次检查。开关不删除历史，也不影响业务计费用量。旧 0.x 协议会在业务执行前被拒绝。
 
 ```sh
-npm install @tinkerlandai/indiana-sdk@0.3.1
+npm install --save-exact @tinkerlandai/indiana-sdk@0.5.0
 ```
 
 ## 版本兼容与支持
@@ -16,7 +18,7 @@ npm install @tinkerlandai/indiana-sdk@0.3.1
 
 0.3.0 发送协议及 SDK 版本请求头，并校验成功响应的协议声明。历史 0.2.0 不发送这些请求头；服务端将无版本头的请求固定识别为 0.2，不自动跟随新协议。源码更新不会修改已有 npm 包，也不会自动部署服务端。
 
-## 一个 npm 包，六个入口
+## 一个 npm 包，七个入口
 
 | 导入入口                                 | 用途                                                        |
 | ---------------------------------------- | ----------------------------------------------------------- |
@@ -26,6 +28,7 @@ npm install @tinkerlandai/indiana-sdk@0.3.1
 | `@tinkerlandai/indiana-sdk/openrouter`   | 可选 OpenRouter 用量集成，需要安装对应 peer dependency      |
 | `@tinkerlandai/indiana-sdk/native-shell` | 原生 WebView 的静态 Funnel shell 资源；不代表商店购买验收   |
 | `@tinkerlandai/indiana-sdk/page`         | 匿名商户页面的网址实验；使用公开的 App environment ID       |
+| `@tinkerlandai/indiana-sdk/visual`       | 匿名商户页面的视觉实验及曝光采集；使用公开的环境 ID         |
 
 JavaScript 与 TypeScript 共用本包，声明文件随包提供。内部 `@indiana/contracts` 在构建时内联，接入方无需安装私有包。Swift 和 Kotlin 使用各自的包管理生态，不在本次 npm 发布范围内。
 

package/THIRD_PARTY_NOTICES.md

@@ -44,3 +44,30 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
+
+# dom-mutator 0.7.0
+
+GrowthBook declarative DOM mutations use the original `dom-mutator` package.
+Source: https://github.com/growthbook/dom-mutator
+
+MIT License
+
+Copyright (c) 2021 Jeremy Dorn
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.