Changelog

14 October 2026BC breakCompare 0.9.0

Added

• Steam::webApi() — the base SDK’s WebApiResource, handed back the same way as players(), users(), stats(), apps() and news(), whose serverTime() returns Steam’s clock as a UTC DateTimeImmutable and never sends the key. supportedApis() sends the key when one is configured, which adds the methods it can call, and goes out without it otherwise, while a key Steam rejects raises InvalidApiKeyException, rendered as a 500 (#131).
• WebApiInterfaceFactory, WebApiMethodFactory and WebApiParameterFactory, with SteamResponse::serverInfo() and SteamResponse::supportedApiList() for the two envelopes. ->withoutDescription() drops the description as Steam does on most methods and some parameters, and ->emptyDescription() sends the '' it sends on other parameters, both read back as null (#131).
• SteamResponse::supportedApiListInvalidKey() — the 403 with an empty interface list that GetSupportedApiListRequest raises as InvalidApiKeyException, faked fluently as ->webApi()->supportedApiListInvalidKey() beside ->webApi()->serverInfo() and ->webApi()->supportedApiList() on SteamFake (#131).
• PlayerSummaryFactory::friendsOnly() — a profile Steam reports as friends-only, read back as CommunityVisibility::FriendsOnly, which drops what private() drops. It keeps commentpermission, since Steam sends that by the comment setting rather than the visibility (#128).
• steam-api.rate_limit.limits — left null it keeps the base SDK’s 100 000 a day, [] meters nothing locally, and a list of ['allow' => …, 'every' => …, 'sleep' => …] entries replaces the default with a key or without, every taking seconds or 'day', which closes at 00:00 UTC on the default’s own counter. A value it cannot take raises InvalidSteamRateLimitOptionException naming its key, such as steam-api.rate_limit.limits.1.every, rendered as a 500 (#125).
• steam-api.rate_limit.cooldown — the seconds a 429 without Retry-After holds requests back, read from STEAM_API_RATE_LIMIT_COOLDOWN and 60 when left unset (#125).
• php artisan about — a “429 Cool-down” row, marked (default) at 60 (#125).
• steam-api.http.sender — a class implementing Saloon\Contracts\Sender, read from STEAM_API_SENDER and resolved through the container each time the connector is built, so a binding of that class decides how, while leaving it unset keeps Guzzle. A value naming no such class raises InvalidSteamHttpOptionException naming the key, rendered as a 500 (#126).
• php artisan about — a “Sender” row, Guzzle (default) until one is configured, or Guzzle + Nightwatch (default) while Nightwatch is reporting (#126, #127).
• Steam requests show up in Laravel Nightwatch’s outgoing requests while laravel/nightwatch is installed and enabled and steam-api.http.sender is unset, with saloonphp/laravel-plugin or without it, since the plugin skips the base SDK’s SteamSender. The API key is stripped from every Steam URL Nightwatch records, while a sender of your own reports only once Nightwatch::guzzleMiddleware() is attached to it (#127).

Changed

• BC break fkrzski/php-steam-api-sdk ^0.9 is required, and Steam::connector()->sender() returns its SteamSender, which wraps the sender in use, so addMiddleware(), getHandlerStack() and getGuzzleClient() are gone from it. Middleware added that way, which never outlived the scoped connector anyway, moves onto a GuzzleSender bound in the container and named in steam-api.http.sender (#124, #126).
• BC break InvalidSteamRateLimitStoreException is now InvalidSteamRateLimitOptionException, covering the whole steam-api.rate_limit block, so code catching it by name has to catch the new class (#125).
• php artisan about reports every local limit in a “Requests Remaining” row, such as 99,412 of 100,000 per day, 9 of 10 per 1s (sleeps), where “Daily Requests Remaining” showed only the first, so --json output moves from daily_requests_remaining to requests_remaining (#125).

Removed

• BC break The 19 endpoint helpers that only forwarded to a resource, Steam::summaries() through Steam::appNews(), are gone from the facade, SteamManager and its contract, while Steam::newsFeed() stays. Each call moves to its resource with the same arguments and return type, so Steam::groups($id) becomes Steam::users()->groups($id) (#130).

Fixed

• The daily budget resets at 00:00 UTC instead of 24 hours after the first request of its window, and RespectsSteamRateLimit releases a job until then. The limit is now named 100000_every_utc_midnight, so a counter kept in the rate limit cache store, which outlives a deploy, restarts from zero once, as on the upgrade to 0.4.0 (#124).
• Steam::users()->summaries() maps a friends-only profile to CommunityVisibility::FriendsOnly, where one such profile among up to 100 IDs threw UnexpectedValueException and failed the whole batch (#124).

9 October 2026BC breakCompare 0.8.0

Added

• Steam::news() — the base SDK’s NewsResource, handed back the same way as players(), users(), stats() and apps(). Steam serves its one endpoint anonymously, so it needs no STEAM_API_KEY (#105).
• Steam::appNews() — wraps GetNewsForAppRequest and returns AppNews, an app’s posts newest first, whose total counts every post the filter matches rather than the page. An app ID Steam does not know and some apps it does, such as Spacewar, both raise AppNewsUnavailableException, because Steam answers the two alike (#105).
• AppNewsFactory and NewsItemFactory, with SteamResponse::appNews() for the appnews envelope. ->total() keeps Steam’s count apart from the items listed, so a test can fake page one of many, and ->withoutAuthor() sends the '' Steam sends for a post without a byline, which the DTO reads back as null (#105).
• SteamResponse::appNewsUnavailable() — the 403 with an empty JSON object that GetNewsForAppRequest raises as AppNewsUnavailableException, faked fluently as ->news()->appNewsUnavailable() beside ->news()->appNews() on SteamFake (#105).
• Steam::newsFeed() — an app’s news as a LazyCollection of NewsItem, one GetNewsForAppRequest per page of perPage (20), skipping by ID the items each inclusive enddate repeats, so ->take(30) stops sending once it has enough. It ends on a page holding all that remains or bringing nothing new, which cuts it short when perPage or more items share one second, and a perPage below 2 raises InvalidArgumentException (#109).
• SteamResponse::newsFeed() — a whole feed of NewsItemFactory items, answering each GetNewsForAppRequest with the page Steam would send for its count and enddate, faked fluently as ->news()->newsFeed() on SteamFake. feeds, tags and maxlength are not applied (#109).
• Events\SteamRequestSending and Events\SteamResponseReceived, dispatched for every attempt with the Steam method, the key-free query and the attempt, the second adding status and duration in seconds, and Events\SteamRequestFailed, dispatched once per failed call with the exception the caller gets. Listeners sit on the dispatcher, so they outlive the scoped connector and Event::fake() sees them under Steam::fake(), but that exception does not serialize, so a SteamRequestFailed listener cannot be queued (#107).
• steam-api.logging — off by default, channel (STEAM_API_LOG_CHANNEL) logs every failed Steam call there as a warning with the exception’s class and code in context, and responses (STEAM_API_LOG_RESPONSES) adds every response at debug with its query, Steam IDs included, in context. Both run as listeners on the traffic events, so Event::fake() silences them, while a channel logging.channels does not define or a responses that is not a boolean raises InvalidSteamLoggingOptionException, a 500 like InvalidSteamRateLimitStoreException (#108).
• php artisan about — a “Logging” row reading disabled, the channel name, with (+ responses) once responses are logged too, or INVALID for a rejected option (#108).

Changed

• BC break fkrzski/php-steam-api-sdk ^0.8 is required, and every message built from a Steam response opens with the Steam method, rendered bodies included, so an unknown app’s 404 reads GetNumberOfCurrentPlayers: No Steam app found for app ID 1. A client matching on message has to match the new text, while the 429, 500 and 503 bodies stay as they were (#104).
• BC break Steam::send() and Steam::pool() raise the failure Steam reports in a 200 payload inside the call, so Steam::send(new GetOwnedGamesRequest(...)) for a private profile throws there rather than on ->dto(), and a pool rejects where it used to fulfil. The helpers and the resources throw what they did before (#104).
• BC break getPrevious() is null on SteamConnectionException and on a SteamApiException raised from a 4xx or 5xx, so a report() callback walking the chain for Saloon’s exception finds nothing. Read the status from getCode() and the payload from response instead (#104).
• BC break ProfileNotPublicException::forSteamId(), ProfileNotPublicException::forPrivateOrMissing() and SteamUserNotFoundException::forVanity() require the Saloon Response, so code building them by hand has to pass one (#104).
• AppNewsUnavailableException renders as a 404 rather than a blanket 500, and not as the 403 Steam answered with, since the client asked for nothing forbidden. It joins the client-facing group under steam-api.exceptions.render, so an application rendering it itself is unaffected (#106).

Fixed

• Steam::connector()->debug() and SteamConnectionException mask the API key as key=***, and Steam::pool() counts a 4xx or 5xx against the daily budget and raises a 429 as SteamRateLimitException, the same as a helper call (#104).
• Steam::fake() types a callable response as taking the PendingRequest Saloon passes it, so a closure reading the request no longer fails static analysis (#109).

6 October 2026BC breakCompare 0.7.0

Added

• Steam::apps() — the base SDK’s AppsResource, handed back the same way as players(), users() and stats(). Steam serves every ISteamApps endpoint anonymously, so none of them needs STEAM_API_KEY (#86).
• Steam::upToDateCheck() — wraps UpToDateCheckRequest and returns AppVersionCheck, telling a game server whether its version is current. An app ID Steam does not know and an app running no versioned servers both raise AppVersionUnavailableException, because Steam answers the two alike (#86).
• Steam::serversAtAddress() — wraps GetServersAtAddressRequest and returns list<GameServer>, the game servers at an IP address. An address Steam rejects raises InvalidServerAddressException (#86).
• AppVersionCheckFactory and GameServerFactory, with SteamResponse::upToDateCheck() and SteamResponse::serversAtAddress() for their response envelopes. ->withoutSpectatorPort() sends the 0 Steam sends for a server without SourceTV, which the DTO reads back as null (#86).
• SteamResponse::appVersionUnavailable(), SteamResponse::invalidServerAddress() and SteamResponse::serversAtAddressRefused() — the three failures the new endpoints answer with 200 and success: false. The last is the per-IP refusal the base SDK raises as the root SteamApiException, so nothing but the builder names it (#86).
• Steam::sdrConfig() — wraps GetSdrConfigRequest and returns SdrConfig, the Steam Datagram Relay points of presence a game connects through, keyed by code. An app ID Steam does not know raises AppNotFoundException on the first attempt, however many tries steam-api.http.retry.tries allows (#89).
• SdrConfigFactory, SdrPointOfPresenceFactory and SdrRelayFactory, with SteamResponse::sdrConfig() for the top-level payload. A point of presence carries its code into the key of pops rather than the payload, ->latitude() and ->longitude() write geo in Valve’s [longitude, latitude] order, and ->withoutRelays() drops the key the way Steam does (#89).
• SteamResponse::sdrConfigAppNotFound() — the 500 carrying Failed to get appinfo that GetSdrConfigRequest raises as AppNotFoundException, a third unknown-app shape beside appNotFound() and schemaAppNotFound() (#89).
• steam-api.http — connect_timeout and request_timeout in seconds, and retry.tries, retry.interval in milliseconds and retry.exponential_backoff, each read from its own STEAM_API_* variable and handed to the base SDK’s SteamConfig when the connector is built. Left unset they keep Saloon’s 10 and 30 seconds and a single attempt, while a value that is not a number or is out of range raises InvalidSteamHttpOptionException naming the key — a misconfiguration, so it renders as a 500 whatever steam-api.exceptions.render says (#87).
• php artisan about — “Timeouts” and “Retries” rows reporting what the connector is built with, marked (default) until the steam-api.http block changes them. A rejected value reads INVALID in its own row, and the daily budget UNKNOWN whenever any row does, since the connector cannot be built (#87).
• Steam::fake() drops the pause between attempts but keeps the tries, so a faked 5xx is retried at once and Steam::assertSentCount() still counts every attempt. Saloon pauses with a bare usleep(), which Sleep::fake() cannot reach (#87).
• Queue\Middleware\RespectsSteamRateLimit — job middleware for a job’s own middleware(), releasing it for what is left of the window when the daily budget is already spent, before the job runs, or when a request inside it raises SteamRateLimitException; without an API key only a 429 from Steam holds it back. A release counts as an attempt, so a job waiting out a daily window wants retryUntil() rather than a small $tries (#88).
• steam-api.rate_limit.store — the cache store the rate limit counter is kept in, read from STEAM_API_RATE_LIMIT_STORE, so a cache:clear of the default store no longer resets the daily budget while Steam’s own count carries on. Left unset it stays the default store, and a name cache.stores does not define raises InvalidSteamRateLimitStoreException, a 500 like InvalidSteamHttpOptionException (#96).
• SteamResponse::connectionFailed() — a request that never reaches Steam, retried like a real outage and raised as SteamConnectionException once the tries are spent. Saloon throws it before recording a response, so Steam::recorded() and the assertSent family never see the attempt (#90).
• Steam::fake()->users()->summaries(...) and the rest of the four resources’ endpoints on the returned SteamFake, each registering its SteamResponse builder under the request class it sends and handing the mock back, so a chain moves resource by resource and still ends on something the assertions read. A second call to the same endpoint replaces the first (#91).
• Named failures beside each endpoint — ->users()->friendsNotPublic(), ->stats()->schemaAppNotFound() and the rest — each faking what Steam answers that endpoint with, so the test gets the exception the base SDK raises for it. ->invalidApiKey() and ->connectionFailed() on SteamFake answer every request without a response of its own (#91).

Changed

• BC break fkrzski/php-steam-api-sdk ^0.7 is required, and a transport failure surfaces as its SteamConnectionException rather than Saloon’s FatalRequestException. Code catching the Saloon exception has to catch the SDK one instead (#85).
• php artisan about reads not metered (no API key) for the daily budget with no key configured, where it counted down from 100 000 before. Steam bills the quota to the key, so a connector built without one meters nothing (#85).
• php artisan about names the configured store in its “Rate Limit Store” row and marks the default one (default), where it always read cache.default before. A store the cache config does not define reads INVALID (#96).
• SteamConnectionException, and the root SteamApiException raised for a 5xx once the retries are spent, render as a 503 rather than a blanket 500, its body saying Service Unavailable because base 0.7.0 quotes the request URI, API key included, in the message (#90).
• AppVersionUnavailableException renders as a 404 and InvalidServerAddressException as a 422, rather than a blanket 500. Both join the 503 in the client-facing group under steam-api.exceptions.render, so an application rendering these itself is unaffected (#90).
• BC break Contracts\SteamManager::fake() returns Testing\SteamFake, a subclass of Saloon’s MockClient, so a class implementing the contract itself has to narrow its return type. The array form and every assertion on the returned mock work as before (#91).

Removed

• BC break SteamApiKeyMissingException and Http\RequiresConfiguredApiKey — the base SDK refuses a request that needs a key before it goes out, raising ApiKeyNotConfiguredException, which renders as a 500 the same way. Code catching the bridge exception has to catch the base one instead (#85).