@trade-it/react 0.2.0 → 1.0.0

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to `@trade-it/react` will be documented in this file.
 
+## Unreleased
+
+## 1.0.0 - 2026-10-15
+
+### Added
+
+- Portal onboarding with email OTP or social sign-in, a typed async `onAuthorization` callback, and exchange acknowledgments
+- Exact iframe-source checks and automatic closure deferred until authorization is saved
+
+### Changed
+
+- Size the desktop Connection portal around the embedded connect flow while preserving the wider Trade modal
+- Keep Connect full-screen on mobile and tall enough for the connected-account continuation state and embedded footer
+- Use a dark loading screen and animate the Trade It logo from its recognizable shape
+
 ## 0.2.0 - 2026-07-27
 
 ### Added

package/README.md

@@ -21,10 +21,45 @@ Full integration guides, examples, and API references:
 
 - [React SDK Overview](https://docs.tradeit.app/sdk)
 - [Authentication](https://docs.tradeit.app/sdk/authentication)
-- [Connect a Brokerage](https://docs.tradeit.app/sdk/connect)
+- [Portal · Connection mode](https://docs.tradeit.app/sdk/connect)
 - [Place Trades](https://docs.tradeit.app/sdk/trades)
 - [SDK Enums Reference](https://docs.tradeit.app/sdk/enums)
 
 ## Notes
 
-- Use the Trade It React skill to have your AI agent integrate Trade It: `npx skills add trade-it-inc/react-sdk-skill`
+- Use the Trade It skill to have your AI agent integrate Trade It: `npx skills add trade-it-inc/skills --skill trade-it-skill`
+
+## Trade It Portal
+
+Your backend calls `POST /api/portal`: use Basic client credentials with `oauth_options` to select Onboarding mode, or the user’s Bearer access token without `oauth_options` to select Connection mode. Pass the returned URL to `openConnect`. Your backend supplies a registered `redirect_uri` on the embedding website’s origin. Include `oauth_options.email_hint` to start with an email code, or omit it to offer Google, Apple, X, Discord, and email sign-in. Users can switch methods; social sign-in opens a popup and returns to the same portal. Trade It explains access, authenticates the user, and opens brokerage connection inside the same iframe. Your backend can optionally supply `connect_options.brokerage_code` or `connect_options.brokerage_filter` when creating the portal URL, using the same behavior as a connect session.
+
+```tsx
+const tradeIt = useTradeIt({
+  onAuthorization: async authorization => {
+    const response = await fetch('/api/tradeit/complete', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(authorization),
+    });
+    if (!response.ok) throw new Error('Could not save Trade It access');
+  },
+});
+
+tradeIt.openConnect({ launch: { mode: 'connect', url: onboardingUrl } });
+```
+
+`onAuthorization` receives `{ code, state, issuer }`; resolve it only after your authenticated backend validates the attempt and saves the OAuth tokens. Rejection is reported inside the iframe. Brokerage connection starts immediately, and automatic closure waits for the callback. Credential events do not go to the generic `onEvent` callback.
+
+See the [Onboarding mode guide](https://docs.tradeit.app/sdk/onboarding) for the server endpoints, PKCE/state validation, and account ownership rules. The same SDK method opens subsequent connections without another authorization event. Standard redirect OAuth remains available for custom sign-in experiences.
+
+## Releasing
+
+Add notes under **Unreleased** in `CHANGELOG.md` and commit your changes first. From the repository root, prepare a release with:
+
+```bash
+npm run release:minor --workspace=@trade-it/react
+```
+
+Use `release:major` or `release:patch` for other increments. The script versions the changelog, bumps the package and lockfile, then creates a commit and a package-specific tag. When releasing core too, prepare core first so React includes its updated dependency.
+
+To release both SDK packages together, use `npm run release:sdk:minor` (or `major` / `patch`) from the root. Push the commits and tags, then use the existing SDK publish workflow or `npm run publish:sdk`. Release preparation does not build, publish, or push.