v0.16.0

Added

• pwa (new subpath): install support for an app. pwaManifest for app/manifest.ts (standalone, scoped to the origin, colored like the page, 192, 512 and maskable icons), pwaViewport (theme color, color scheme, zoom left on), pwaMetadata (appleWebApp for the iOS home screen), serviceWorkerResponse for app/sw.js/route.ts and ServiceWorkerRegister. The service worker caches only Next's hashed build files and answers a page that can't load with an offline page in the app's colors; API, auth and HTML responses are never cached.

Changed

• The optional @haruhimemoe/ui peer range is >=0.14.0 <0.25.0 (it stopped at 0.18).

v0.15.1

Fixed

• auth-react: AccountMenu's "Sign in" link is 44px tall on a touchscreen (it was 20px).
• i18n/next-intl: createI18nMiddleware's app step gets next-intl's response and may be async; when it answers with its own Response, next-intl's Set-Cookie is copied on so the locale rewrite cookie survives.

v0.15.0

i18n: next-kit/i18n locale helpers and optional next-intl adapter at next-kit/i18n/next-intl; seo hreflang alternates. See CHANGELOG.md.

v0.14.0

Account export/delete fan-out (next-kit/account) and inbox (next-kit/inbox). See CHANGELOG.md.

v0.13.0

API key scopes and Discord account linking. See CHANGELOG.md.

v0.12.2

Fixed

• check's next-kit migrate-identity now skips users without a numeric osuId (system accounts) entirely: they're never grouped with other users, never inserted into identity, and never get an idMap entry, so references pointing at them are left untouched instead of being rewritten to nowhere. MigrateReport gains usersSkipped; the CLI's summary line reports it alongside usersSeen/usersWritten.

Changed

• auth's old SessionReader type (the better-auth instance shape used by getOsuUser/getSessionUser/requireSession/requireAdmin) is renamed to OsuAuthInstance, so SessionReader can mean one thing: createSessionReader's own instance type (session-reader.ts), which the barrel used to export only as SessionReaderInstance to dodge this exact collision. session.ts keeps a SessionReader alias of OsuAuthInstance for source compatibility, and session-reader.ts keeps a SessionReaderInstance alias of SessionReader (the barrel exports both — bb/packs/pools/haruhime.moe all import SessionReaderInstance, none import the old SessionReader, so this is a non-breaking patch for every real consumer).

v0.12.1

Changed

• check's next-kit migrate-identity is idempotent now that the hub is live and identity holds real users who signed in there directly: a source group's osuId matching an existing identity user merges into it (that user's _id and fields win outright, only its own missing fields get filled from the source) instead of refusing on a non-empty identity. Accounts dedupe by providerId+accountId and API keys by hash against identity's own existing rows too, so a second --execute run inserts nothing new. MigrateReport gains usersMerged. --drop-old is unchanged: still its own run, still refusing while identity is empty.

v0.12.0

Added

• Identity core (breaking for every app — see below): mongo's createMongo gains identityDbName/getIdentityDb() so the hub reads an identity database on the same client, buildIdentityIndexes builds its four indexes, auth's createOsuAuth gains cookieDomain/trustedOrigins for the hub (every better-auth cookie, including OAuth state and PKCE, on the parent domain) and a 30-day session with a 1-day updateAge, createSessionReader reads a satellite's session with zero database writes (raw cookie verification, no betterAuth() instance) and pings the hub to refresh a session past updateAge, getSessionUser/requireSession/requireAdmin read either source and refuse a banned user, server's safeAbsoluteNext is the hub's exact-hostname allowlist for a satellite's absolute next (it returns the normalized URL), hubSignInUrl builds a satellite's link to the hub's sign-in page through the same allowlist, and check's next-kit migrate-identity merges bb/packs/pools users into identity by osuId (dry run by default).

Changed

• Breaking. mongo's onConnect now takes one { db, identityDb?, client } argument instead of (db, client).
• Breaking. The identity user gains locale, notificationPrefs, bannedAt, banReason, limits, discordId and discordUsername (auth's IDENTITY_USER_FIELDS, merged into every createOsuAuth instance's additionalFields, single-DB apps included). OsuSessionUser and OsuSession gain bannedAt. packs' system field does not move with this release: it stays a plain field on packs' own user collection for now. Once packs cuts over to the shared identity database (after the migration script runs), system must move to an app-side profile collection keyed by userId, because the identity user row is shared with bb and pools and has no room for one app's own flag. Do that move in the same deploy that switches packs to createSessionReader, not before.

v0.11.1

Fixed

• HARUHIME_ORG's email is haruhime@haruhime.moe and its Discord link is https://haruhime.moe/discord.

v0.11.0

Added

• legalMarkdownTransform(site) in legal: a mdxToMarkdown transforms entry that turns each self-closing legal block tag (<LegalContact />, <DataWeKeep />, <Processors />, <YourRights />, <DmcaNotice />, <NoWarranty />, <Changes /> and <Changes date="YYYY-MM-DD" />) into Markdown carrying the same words as its React block. Without it, an app that drops the legal blocks straight into its content/legal/*.mdx loses that text from its .md mirrors and llms-full.txt, since mdxToMarkdown strips unknown capitalized JSX. The seven blocks' sentences and list items now live in a new legal/copy.ts, shared by blocks.tsx and legalMarkdownTransform so the two outputs can't drift apart; blocks.tsx's rendered output is unchanged.