⚠ BREAKING CHANGES #

• rename the SDK to DAKit

Features #

• add comments and social API mutations (daf5cdf)
• add notification and feedback message APIs (ba92841)
• add profile discovery and folder APIs (2dff62a)
• add pub.flutter-io.cn topics for search discoverability (b882632)
• add topics and folder content browsing (5f28f47)
• add user relationship and lookup APIs (89350f9)
• api: add moreLikeThis to discovery repositories (0bdf150)
• api: export DeviationMapper for raw JSON mapping (0943d41)
• api: sort tag feeds by recent or popular (1209d3a)
• core,api: expose a collection cover image on CollectionSummary (05eb721)
• core,api: expose collection groups in More Like This result (243bfa0)
• map deviation tags into Artwork.tags (2dc6271)
• map is_favourited and is_multi_media into Artwork (c78cfbf)
• media: expose download denial reason and document removed fields (#4) (bf32c60)
• web: support DeviantArt web cookies for mature multi-image works (5231553)

Bug Fixes #

• api: apply receiveTimeout so hung API requests fail instead of spinning forever (0765cbb)
• api: classify invalid refresh credentials (c31414c)
• api: commit login before pending cleanup (4b1567e)
• api: decouple live OAuth from recovery storage (383651d)
• api: degrade collection groups gracefully on shape drift (bcf677e)
• api: hydrate sparse related artwork previews (4390935)
• api: invalidate rejected refresh sessions (a442d73)
• api: load artwork tags from metadata (8b81129)
• api: map download 4xx to unavailable instead of rethrowing (d1df323)
• api: mark premium/paid content image availability (2c9de59)
• api: read the correct formatted_excerpt field (bd2984b)
• api: recover from token deletion failure (cade2c7)
• api: send mature_content on all read endpoints (5c357d9)
• api: show mature gallery/folder content and map journal thumbs (b0fbfbb)
• api: skip idle authorization recovery (7ddd9e1)
• api: tag sort mode values are newest|popular not recent (da94dc5)
• api: treat empty watched feed as valid (50f9530)
• api: use browse/morelikethis/preview for More Like This (b535604)
• ci: resolve web client analyzer findings (6646ffd)
• harden related results and destructive transfer removal (7567ea6)
• make OAuth logout and cancellation race-safe (6c0ce55)
• satisfy formatter and typed task paths (244e00e)

Code Refactoring #

• rename the SDK to DAKit (a9f0837)

Added #

• WebDeviationClient: resolves a numeric deviation id through the website's _puppy/dadeviation/init endpoint (browser UA + CSRF) with a web cookie, returning every media asset for mature multi-image works (main file plus each additional page) as transferable signed-CDN MediaAssets. Requires dakit_core >=0.2.0.
• CookieProvider with StaticCookieProvider and EnvironmentCookieProvider (DAKIT_COOKIES). Diagnostics route the cookie through the existing Redactor, so cookie/set-cookie are never logged.

Fixed #

• Web request headers always send the Cookie value; the cookie never appears in diagnostic attributes.

Fixed #

• OfficialApiClient now applies the configured receiveTimeout to its Dio (previously only connectTimeout was set, and dio's default receive timeout is null). An API host that accepts the connection but never replies — e.g. a blackholed route — previously hung the request forever; it now fails with a typed, retryable timeout error.

Docs #

• Publish pub.flutter-io.cn topics (deviantart, deviantart-api, oauth, pkce, downloader, …) so the package is discoverable in pub.flutter-io.cn search.

Docs #

• Modernized the package README: pub.flutter-io.cn badges, install snippet, and documentation links.

Fixed #

• Tag sort now sends the correct browse/tags mode values (newest / popular) instead of recent, which DeviantArt ignores — so "Newest" and "Popular" previously returned identical results.

Added #

• OfficialDiscoveryRepository.tag accepts a BrowseSort (recent / popular) and sends it as the mode query parameter, so tag feeds can be ordered by newest or most popular.

Fixed #

• Treat persisted PKCE state as optional recovery support during a live OAuth flow. A temporarily unavailable platform key store can no longer prevent the browser from opening, turn cancellation into an error, or override the real callback/timeout result.
• If cold-start PKCE recovery storage is unreadable, return to a clean signed- out state so the host can offer a fresh authorization instead of exposing a secure-storage implementation error.

Fixed #

• Skip the encrypted pending-authorization store during ordinary cold starts that contain no OAuth callback. This prevents an unavailable or slow platform key store from delaying startup when there is no login to resume.

Fixed #

• Treat the saved OAuth token as the login commit point. Failure to remove an obsolete pending-PKCE Keychain item is now a cleanup warning and can no longer turn a successful token exchange into a failed login that users must repeat.

Fixed #

• Always leave the internal logout state even when Keychain/token deletion fails. A subsequent browser authorization can now save its replacement token instead of being rejected as oauth.session.changed on every attempt.

Fixed #

• OAuthSession now clears unusable local credentials after a definitive refresh rejection and emits invalidations. Hosts can leave authenticated UI immediately even when a slow refresh completed after their startup timeout.

Fixed #

• Normalize DeviantArt's non-standard invalid_request response for an invalid refresh token to oauth.refresh.invalid. Clients can now clear a revoked session instead of misclassifying it as a temporary outage and retrying authenticated endpoints indefinitely.

Added #

• DeviationMapper.collectionSummary now maps a collection's thumb / preview / cover image into CollectionSummary.coverUri.

Fixed #

• OfficialDiscoveryRepository.watched now treats the official API's empty object / null-results response for accounts that watch nobody as a valid empty feed. Contradictory pagination metadata remains a parsing failure, so real upstream schema drift is not silently swallowed.

Added #

• Added OfficialArtworkMetadataRepository.tags, backed by the official deviation/metadata endpoint, so hosts can hydrate tags omitted from compact browse responses and from deviation/{id}.

Fixed #

• OfficialDiscoveryRepository.moreLikeThis now hydrates sparse related deviations through deviation/{id} in bounded batches. This matches the current public schema, which only guarantees identifiers and deletion state in preview entries, instead of silently dropping every valid recommendation.
• If every sparse recommendation fails to hydrate, the repository surfaces the failure so hosts can present a retry state rather than an unexplained empty section.

Fixed #

• OfficialDiscoveryRepository.moreLikeThis now skips malformed, deleted, or restricted entries independently and tolerates a missing related rail. One bad recommendation can no longer discard every valid sibling in the preview; transport failures still throw so hosts can offer retry.

Changed #

• Centralized every official API endpoint path into ApiRoutes (internal), with a contract test pinning the routes, so a provider endpoint rename is a one-line edit. No behavior change.

Fixed #

• OfficialDiscoveryRepository.moreLikeThis now degrades to empty featured_in_collections / suggested_collections when their shape drifts, so a provider change to the volatile collection groups no longer drops the related artworks.

Added #

• OfficialDiscoveryRepository.moreLikeThis now also maps featured_in_collections and suggested_collections (each a collection folderid/name/owner plus its listed deviations) into MoreLikeThisResult.

Fixed #

• OfficialDiscoveryRepository.moreLikeThis now calls the real browse/morelikethis/preview endpoint (the old browse/morelikethis page endpoint no longer exists) and flattens more_from_artist + more_from_da into a de-duplicated artwork list, excluding the seed.

Added #

• OfficialDiscoveryRepository.moreLikeThis maps the official browse/morelikethis endpoint into a paged Artwork list.

Changed #

• DeviationMapper now marks the full-size content image with the same availability as the download (premium/paid content is purchaseRequired), while preview/social_preview thumbnails stay available so hosts can still render an accessible thumbnail.

Fixed #

• DeviationMapper now reads the correct formatted_excerpt field (the previous formatted_exerpt typo meant the HTML-excerpt fallback never matched, so Artwork.description only ever used the plain excerpt).

Fixed #

• OfficialMediaRepository.originalFile now maps a 4xx from the download endpoint to MediaAvailability.unavailable instead of rethrowing, so hosts show a "not downloadable" hint rather than a full-screen error. 5xx errors still bubble up for a retry.

Fixed #

• Every official read endpoint now sends mature_content: true and no longer forces with_session: false, so mature deviations appear consistently in browse, search, tags, topics, gallery/folder/collection feeds, and messages for signed-in users (the session is used for watch state too).

Added #

• Export DeviationMapper so hosts can map raw official-API deviation JSON (e.g. user/profile/posts journals) without a repository round-trip.

Fixed #

• Gallery, folder, and collection requests now send mature_content: true and stop forcing with_session: false, so folders/galleries full of mature deviations no longer render as empty for signed-in users.

Added #

• DeviationMapper maps a literature deviation's embedded thumbs images into Artwork.media, so journals with inline art render their images.

Added #

• DeviationMapper maps is_favourited and is_multi_media into Artwork.

Added #

• DeviationMapper now maps a deviation's tags into Artwork.tags.

Changed #

• OfficialMediaRepository.originalFile now populates MediaAsset.availabilityReason from the provider error_description when a download is declined, so hosts can distinguish "Deviation not downloadable" from "Free download limit reached".

Added #

• Authorization Code + PKCE OAuth flow with callback validation and token exchange, refresh, and revocation.
• Network profiles, explicit proxy support, and staged connectivity probing.
• Official DeviantArt API adapters for accounts, users, artworks, discovery, galleries, folders, media, comments, social actions, and messages.
• Private upstream DTO mapping with additive-field tolerance and typed parsing failures.