@tinkerlandai/longplay-sdk 0.0.0-stage → 0.10.4

package/CHANGELOG.md

@@ -0,0 +1,209 @@
+# Changelog
+
+## 0.10.4 — 2026-10-31
+
+- Add Longplay public package names, `createLongplay*` factories, error/options aliases, browser readiness and native/Python entry points. Retain legacy exports, commands, downloads, protocol and saved identities; publication is a separate release step.
+
+## 0.10.3 — 2026-10-31
+
+- Validate Local Funnel Split routes and configuration dependencies by the assigned Variation ID instead of the experiment's display key or index.
+- Align Python and Go dependency validation with the JavaScript SDK, including rejection of non-string Split values and display-key routes.
+- Regenerate the shared iOS, Android and React Native presentation resources with the corrected Local Funnel validation. Wire protocol remains `0.10`.
+
+## 0.10.2 — 2026-10-30
+
+- Move the default production API to `https://api.longplayai.com` in all six SDKs; use `https://api.dev.longplayai.com` explicitly for the test deployment. Wire protocol remains `0.10`.
+- Move the Go module to `longplayai.com/sdk/go`. Update imports and module requirements; the old module path has no compatibility alias.
+- Update visual diagnostics to trust the new Console origins and regenerate bundled native and browser resources.
+- Dismiss Funnel presentations when their Run ends elsewhere and release the corresponding IAM entry host.
+
+Release facts and artifact evidence: [SDK release ledger](../../docs/sdk-releases.md).
+
+## 0.10.1 — 2026-10-29
+
+- Add the Server SDK supplemental Invoice preparation API with explicit Customer scope, reason normalization and bounded amounts; align Python/Go methods and transport fixtures.
+- Preserve the original merchant purchase while recovering Paywall failures, and open its Checkout only once.
+- Accept the App Console host in visual diagnostics after the public-site domain split.
+
+- Support merchant-native purchase, subscription changes, refunds and billing records without requiring Stripe object identifiers or credentials.
+- Upgrade the merchant receiver to version 3 with declared commercial profiles, explicit original-operation lookup and fresh Indiana authority before financial execution. Unknown results retain recovery of the original operation.
+- Add the Server SDK authority resolver and align generated DTOs, financial validation and native merchant-provider entry points across all six SDKs.
+- Use only wire protocol 0.10. Requests and responses from protocol 0.9 are refused; Customer Access/Refresh credentials retain their existing lifecycle.
+
+## 0.9.5 — 2026-10-29
+
+- Synchronize JavaScript, React Native, Swift, Kotlin, Python and Go with the current Customer operations, scope checks, response validation and document semantics.
+- Expand Go configuration, Feature and Local Funnel support, and align native content presentation, Customer capabilities and shared renderer resources.
+- Add merchant Server SDK billing records, Merchant Bridge integration and current quantity and prepaid-credit contracts.
+- Validate nested Paywall access decisions in Swift and Kotlin with the same denial and recommendation rules as direct entitlement checks.
+- Make the iOS Push restart-recovery test explicitly retain a failed logout instead of racing a successful background detach.
+- Retain protocol 0.9 as the only supported wire protocol. Missing or older protocol identities have no fallback or compatibility adapter.
+
+## 0.9.2 — 2026-10-29
+
+- Add Python Server-Key APIs for Funnel decisions and recovery, Offering resolution, Feature evaluation and marketing events, with synchronous and asynchronous clients.
+- Support Pika V1 marketing data delivery entirely on the merchant backend, without creating or distributing a Customer Token. Keep payment and entitlements in Pika's existing flow.
+- Keep wire protocol 0.9 and the existing JavaScript, React Native, Swift, Kotlin and Go business behavior.
+
+## 0.9.1 — 2026-10-29
+
+- Add `showPaywall.onPurchaseIntent` for merchant-owned selection handling, with validated Product and Feature quantities and no SDK quote or payment operation.
+- Return scoped Access/Refresh credential pairs from backend issuance and Guest session resumption. Replace backend renewal with client Refresh Token rotation; backend revocation invalidates both credentials.
+- Automatically refresh in Web, React Native, Swift and Kotlin without resetting Customer state, analytics queues, Funnel Runs or Paywalls. Fence account changes and retain Refresh Tokens after lost responses.
+- Go owns opaque-session lifecycle and authorization policy; PostgreSQL serializes rotation and revocation. Protocol 0.9 requires the matching runtime and SQL migrations and refuses older development protocols.
+
+## 0.8.5 — 2026-10-27
+
+- Add direct browser script loading through `/sdk.js`, sharing the npm browser APIs and page/visual experiment factories without requiring a bundler. Website deployment distributes this entry independently of npm publication.
+- Keep IAM release markers attached through host updates, group render-signature queries, and recover bounded visual work without duplicate exposure events.
+- Disable Funnel Back navigation until the current presentation is rendered, and include the SDK version in experiment-event requests.
+- Synchronize the packaged Web, iOS and Android renderers while retaining HTTP protocol 0.8.
+
+## 0.8.4 — 2026-10-26
+
+- Add `prepareContent` and `preparePopup` to render authorized content before the opening click and reveal the same iframe on demand.
+- Prepare bounded HTML DOM templates for supplied pages and Product variants; update variable text in place while preserving styles, images and unrelated content. Reuse inactive variants with empty variable slots.
+- Prepare Local Funnel rule definitions once per pure segment and send advance signals without waiting for advisory prediction downloads. Late predictions remain fenced by Run position and identity.
+- Synchronize the packaged Web, iOS and Android renderers. Retain HTTP protocol 0.8 and server authority over Funnel acceptance and commercial operations.
+- Carry the committed Merchandise context through Feature evaluation, page experiments, Analytics events and Coupon applicability; refresh the generated native Paywall schema.
+- Include the committed Android Push recovery proofs, visual target diagnostics and Paywall/Funnel focus restoration fixes.
+
+## 0.8.3 — 2026-10-26
+
+- Refresh sanitized custom HTML fallback content when Product availability changes.
+- Preserve the selected Product across empty availability refreshes, keeping purchase disabled while that Product is unavailable.
+- Synchronize the shared Web and native renderers with the current Product selection rules.
+- Align Server SDK request helpers with the committed messaging contract.
+
+## 0.8.1 — 2026-10-25
+
+- Organize SDK implementations by capability while preserving public entry points and interfaces.
+- Consolidate Funnel observed state, pending-command and purchase recovery, and shared request validation without changing credential or execution authority.
+- Share Paywall binding and purchase-observation rules across hosts; keep rendering independent of authenticated clients.
+- Keep the current mutation schema in durable command storage and remove an invalid comparison against the unsupported `evaluate` operation.
+
+## 0.8.0 — 2026-10-24
+
+- Resolve independent Pages, Popups and Banners and render them through the explicit `mountContent` host entry.
+- Send a Flow Local `commit_segment` as an advance signal with only the parked position, policy revision and configuration generation; the server calculates and accepts the pure path. The local walk is a display-only `controller.prediction` that clears when the accepted response arrives. A pending 0.7 `commit_segment` left in `funnelCommandStorage` is re-derived from the Run's current position instead of replayed. Uses HTTP protocol 0.8; protocol 0.7 is refused.
+- Evaluate every Funnel GB node, Local and Remote, against one attribute view: the Run attributes without raw `parameters`, `answers` or `results`, plus the registered `variables` at that node.
+- Remove the `./iam` entry. Build-time IAM generation moves to `@tinkerlandai/longplay-iam`; the visual entry exports `loadAppManifestRelease` and keeps the `appManifestRelease` option for binding a page to its IAM release.
+
+## 0.7.0 — 2026-10-23
+
+- Bundle the Funnel shell and shared renderer in iOS and Android; render independent Paywalls through the same SDK program.
+- Read reviewed Local Funnel and Paywall JSON from immutable CDN artifacts with scope, format, byte-length and SHA-256 checks. Keep personal data and commercial facts in authenticated APIs.
+- Separate presentation loading from Funnel command settlement and durable purchase recovery.
+- Use HTTP protocol 0.7 for the new Paywall delivery contract. Older 0.x protocols are refused before business execution.
+
+- Add the independent `@tinkerlandai/longplay-react-native` package and shared React Native core entry for Customer identity, holdings, entitlement checks and backend-mediated usage reporting.
+- Include SwiftPM and Maven distributions in the unified release, with generated native package versions and independent public installation checks.
+- Remove the live-page visual editor handshake: the `__indiana_visual_editor` query parameter no longer pauses page experiments. Visual changes are authored in the Console App page map.
+- Calculate Local Funnel segments (`evaluate_segment`) after `createFunnelClient().start()` and in the native WebView host. The packaged native shell has no network access; the Swift and Kotlin hosts read the public configuration it needs.
+- Give errors the SDK raises locally the `recovery` their message names instead of `contact_support`, for example `recover_operation` for `COMMAND_PENDING` and `DECISION_PENDING`, `reload_state` for `CONFIGURATION_EXPIRED` and `retry_same_request` for `EVENT_QUEUE_FULL`. Server error codes keep their recovery.
+
+## 0.6.3 — 2026-10-23
+
+- Align JS, Python and Go package versions at 0.6.3; retain HTTP protocol 0.6 and immutable earlier releases.
+- Bound optional persistent-cache reads and download the pinned Funnel and GB artifacts together, preserving the five-second initialization budget and artifact validation.
+- Wait for the original display acknowledgement to settle and read the current Run before processing the first action; retain the original request identity during recovery.
+
+## 0.6.2 — 2026-10-22
+
+- Publish checked artifacts through GitHub Actions with npm Trusted Publishing and verify the public package bytes and independent installation after publication.
+- Export the deterministic hosted renderer shell, content address and CSP from the popup entry so SDK consumers share the same renderer identity.
+- Keep protocol 0.6, the existing API origin and the Customer, entitlement and usage contracts. The 0.6.1 Funnel input, command settlement and Back recovery fixes remain included.
+
+## 0.6.1 — 2026-10-22
+
+- Submit only the current Funnel screen's declared input bindings. Preserve historical answers, unsaved drafts during refresh and values when navigating Back.
+- Validate public Local Funnel Feature dependencies against their declared write variables.
+- Settle the original accepted command during host polling so background completion releases the next screen and terminal recovery.
+- Recover a rejected screen display acknowledgement after Back without resubmitting the user's action.
+- Keep protocol 0.6 and the existing immutable renderer identity. Runtime and production acceptance are recorded separately in the release ledger.
+
+## 0.6.0 — 2026-10-21
+
+- Default SDK API requests to `https://api.tinker.cash` while retaining explicit `baseUrl` overrides. Public configuration synchronization uses the same default through its optional `origin`; page/visual clients follow the same entry. Test apps explicitly use `https://api.dev.tinker.cash`. Native Swift/Kotlin source follows the default, with separate package releases.
+- Publish on `beta`, retaining `latest = 0.5.0`. Package publication does not deploy runtime/database changes or certify Go business readiness; the latest API entry checks returned HTTP 503 for business readiness.
+
+- Use protocol 0.6 and current-page JSON rendering. Local and Remote use one canonical Run, native command/action receipts, business executor and Queue recovery.
+- Add `Customer.forFunnel(...)` to bind exact Funnel/version context for Coupon, Offering, Paywall and attach-quote requests. Independent use retains capability-owned rules.
+- Preserve exact purchase-command restoration; retire optional client observations and cross-capability binding switches. Publication and hosted environment facts are recorded separately in the release ledger.
+
+- Adopt Funnel 4 / graph 5 unified variable registration: source-constrained input/node writes, explicit imports, `inputs[].variable`, named `writes` and shared variable reads. Preserve existing answer/result storage, Back invalidation and independent commercial eligibility. Native contracts are regenerated; database acceptance remains separately scoped.
+
+- Unify formal Local and Remote Funnels on the same server Run, business executor, command/action idempotency and Queue recovery. Local submits fenced native GB calculations; pending calculations release the worker. Retire the standalone host business executor and presentation-state owner. Preserve original Customer/Key proof, independent Coupon self-claim/grant authorization, exact retries and native wire generation. Old host checkpoints require explicit reconciliation.
+
+- Use SDK 0.6.0 / protocol 0.6: Remote Funnel responses embed only the current page document. Local and Remote share JSON rendering; the host no longer downloads page-specific HTML. Preserve authenticated dynamic data, pause handling, accepted-command recovery and server-side execution. Regenerate native wire schemas and restrict native frame navigation to the shared same-origin renderer. Existing npm 0.5.0 keeps its original render-reference contract.
+
+- Add opt-in `createConfigurationSync` for shared public Local GB/Funnel/page configuration, bounded initialization, immutable artifact verification and strict control freshness. Remote graphs are excluded, and explicit Indiana commands bypass CDN admission. Matching gateway is restricted to Indiana-test; no npm or production publication is implied.
+
+- Add explicit server-side `createFunnelDecisionClient().local()` evaluation for pure Funnels, with scoped configuration reuse, host-persisted Sticky and opt-in session exposure deduplication. A dedicated `local_configuration` operation preserves existing configuration responses; remote `decide` and committed financial/Run receipts retain their authority. Requires matching server source; no package or runtime promotion is implied.
+
+## Distribution tags — 0.5.0 latest — 2026-10-19
+
+- Point `latest` to the existing `0.5.0`; retain `beta = 0.5.0`. Default npm installation resolves 0.5.0, matching the separately deployed production protocol 0.5. Package bytes and runtime remain unchanged; no package was republished.
+
+## 0.5.0 — 2026-10-19
+
+- Use protocol 0.5 for billing-window `anchor` responses and `sourceKind: manual` Invoices. The anchor semantics come from pinned Autumn; the Invoice source classification is an Indiana response adaptation. Add Invoice management methods and current subscription invoice-mode/anchor inputs. Requires a matching server/database release; package publication does not promote production.
+
+- Separate remote Screen navigation (10 seconds), bridge handshake (5 seconds) and first render (5 seconds) startup budgets. Count visible time only, identify the timed-out phase and cancel timers/listeners on render or disposal. A slow valid document no longer consumes the bridge budget before it loads.
+
+## Distribution tags — 2026-10-19
+
+- Point `latest` to the existing `0.4.0`; retain `beta = 0.4.0`. Default npm installation now resolves 0.4.0. Package bytes, protocol, and runtime are unchanged; no package was republished.
+
+## 0.4.0 — 2026-10-18
+
+- Use protocol 0.4 with environment-scoped behavior, experiment-exposure and Feature-usage collection policies. New required delivery and tracking acknowledgement fields require a matching service release.
+- Acknowledge disabled categories through `skipped`; preserve UUID/timestamp replay identity and keep database enforcement authoritative. Collection settings do not delete history or affect billable usage.
+- Cache SDK collection hints for 30 seconds and refresh on demand after expiry. Identity changes clear hints; re-enabling collection resumes eligible exposure/Feature-usage recording without repeating visual changes.
+- Publish on `beta`; keep `latest` unchanged. Production and native package/store rollout remain separate.
+
+## 0.3.1 — 2026-10-17
+
+- Make English the default package README and include a separately linked Simplified Chinese translation.
+- Update the package and SDK request version identifiers to 0.3.1; wire protocol 0.3 and business behavior are unchanged from the immutable 0.3.0 release.
+
+## 0.3.0
+
+- 0.3.0 uses wire protocol 0.3 for published screen render references. Obsolete 0.2 and its fixed headerless identity are explicitly refused before business execution; no pre-1.0 compatibility adapter is provided. Existing 0.2.0 publication evidence remains immutable.
+- Add `ScreenPreviewHandle.resizeViewport(height)` to resize previews while preserving their active document and interaction state.
+- Keep Funnel background reads separate from the command lock, so polling cannot swallow a screen action. Unchanged GET/shown data preserves the mounted form and selection.
+- Clear a lost-command error when an external `controller.retry()` settles that exact command. A GET before settlement retains the error; unrelated renderer failures remain visible.
+
+- Expose error recovery, retryability, registered business reasons and Retry-After timing on IndianaError. Distinguish unavailable capabilities from missing configuration. Retain HTTP status and request references for non-JSON failures; unknown results, timeouts and lost responses require original-operation recovery and never trigger automatic retries.
+
+- Pause renderer startup deadlines while the host document is hidden, preserving the five-second visible-time budget and cancellation on ready/disposal.
+- Identify the wire protocol and package version with `X-Indiana-Protocol` / `X-Indiana-SDK-Version`; verify advertised successful-response protocols. These changes are not in the immutable published 0.2.0 tarball.
+- Add the stable-major compatibility policy, at least 12 calendar months of predecessor support and 180 days of public notice, with a pinned published-old-SDK/current-server regression gate. Current 0.x still rejects obsolete protocols. See [support policy](../../docs/sdk-versioning-and-support.md).
+
+## 0.2.0 — 2026-10-16
+
+- Breaking: server Funnel starts and decisions use `customer: { type: "id" | "externalUserId", value }`; optional `customerData` is creation-only and requires an external user reference. Remove start-body `customerToken` and decision `customerId`; no legacy compatibility. Customer-credential starts name no Customer.
+- Export `createFunnelCampaignClient` from `/server` for explicit campaign decisions and starts with durable suppression. Validate returned Funnel and Customer identity before accepting a Run.
+- Use `X-Indiana-Web-View` and `X-Indiana-Telemetry-Subject` response headers. Include current renderer, native shell and Paywall recovery/lifecycle fixes.
+- Route native receipt recovery through independent `subscriptions/native/restore`, including read-only recovery. This package release does not certify or publish Apple/Google store integrations; real store acceptance remains deferred.
+
+## 0.1.0 — 2026-10-16
+
+- Web Beta with current Indiana factories, Customer two-table identity, current Funnel runtime, Feature generation, Offering hierarchy and independent Paywall sessions. No legacy API or data compatibility.
+- Converge current request/response contracts and regenerate native shell assets. Include canonical Stripe payment setup, subscription administration and License client contracts. Server availability is documented in README; unfinished billing authorization, batch/conflict, Reward Product and native execution remain outside accepted scope.
+- Keep one npm package with browser, server, popup, OpenRouter and native-shell entries. Swift/Kotlin store acceptance and publication are deferred.
+
+- Move Local/Remote evaluation policy to each Funnel. New Funnels default to Local; Owner/Admin manage it in Funnel settings. API keys only authenticate and authorize calls; one key can call different modes. Remove `remoteEval`: `configuration()` reads the Funnel mode and the server enforces rule downloads and API decisions.
+- Add `configuration()` with public Funnel topology and versioned resource references. Remote payloads omit rules and commercial parameters; Local payloads include pure evaluation configuration.
+- Keep business actions server-authoritative. Existing Funnels migrate explicitly to Remote; one API key can call both Local and Remote Funnels.
+
+## 0.0.1 — 2026-10-13
+
+- First organizational Beta under `@tinkerlandai/longplay-sdk`, replacing personal-package imports. Publish with the `beta` tag and pin `0.0.1` when installing.
+- Include browser, server, popup, OpenRouter and native-shell ESM entries. Private contracts remain bundled into the SDK.
+- Add browser/server `createFeatureClient` with scoped cached configuration and synchronous GrowthBook evaluation. Generic decisions return immutable `value` JSON with live validity `state`; trusted inputs use `attributes`.
+- Replace customer `metadata` / `tags` inputs with `attributes`, `removeAttributes` and incremental `tagChanges`. No obsolete-format compatibility reader is included.
+- Refine Funnel decision recovery and host resume/close behavior. Include current subscription, native-receipt and prepaid Feature quantity contracts, with the matching generated native host.
+- Include GrowthBook MIT attribution and synchronize installation examples and downloadable archives.
+
+Upgrade imports and the matching server/database deployment together. This npm release does not deploy Grow or publish the separate Swift/Kotlin packages. Installed-artifact and offline checks do not certify real payments, native stores or deployed behavior. Browser validation was explicitly omitted at the user's request.