v0.62.1

v0.62.1 updates .NET for two denial-of-service advisories, lets a revoked key be enrolled again, and saves a decrypted sealed document under its real name.

What's fixed

• .NET 10.0.15. The ASP.NET Core and .NET packages move from 10.0.14 to 10.0.15 for CVE-2026-114147 (ASP.NET Core denial of service, High) and CVE-2026-118747 (.NET denial of service, Moderate).
• A revoked key can be enrolled again, for its holder or somebody else, as a new enrolment beside the revoked one, which stays in history. Before, a revoked certificate could never be enrolled again, and the refusal asked to revoke it first.
• A decrypted sealed document is written out as what it is. Dragged out, saved or opened in its application from the desktop, it takes the file name sealed with it (for example contract.pdf), a hidden name too, instead of .p7m.
• Text on the secondary colour reads in dark mode, the account avatar's initials among it, for every theme.

Before upgrading

• The enrolment registry's index changes. A migration lets one unrevoked enrolment per certificate stand beside revoked ones; existing data is unchanged.
• An Encryption Service at its ADR 0018 or later is needed for a reader whose certificate holds an EC key (a PIV card's key-management slot, a security key's P-256). An older service cannot address such a reader on a Strict tenant. This is a standing entry, repeated from v0.35.0.

Known issue

• The chart's Tube module digest is wrong. An installation that installs the Tube module (modules.install: ["TUBE"]) from this chart is refused with "does not match its pinned digest", and nothing is installed. Set modules.pins.TUBE.sha512 to bp4/R+YiCeqm130cqrUZFPFjDOX5yCWnUPxVUYXus1dwrRaryEj06av8K/H70UZJ4U5KYhkl5Yr5ncqxhZaIiw== or wait for the next release. Installations without the Tube module are not affected.

Every change since v0.62.0

• The tag workflows run as the release when dispatched on a v* tag
• .NET packages 10.0.15 (CVE-2026-114147, CVE-2026-118747)
• The manual builds on a dispatch on main, as on a push
• A decrypted sealed document is written out as what it is, not as .p7m (#2312)
• Seed the kiosk Tube demo as the owner arranged it
• Pin Tube 0.6.0 on the kiosk
• A revoked certificate is enrolled again, beside its revoked entry (#2317)
• Text on the secondary colour reads in dark mode (the account avatar)
• Runbook: dispatch an edition's tag workflows on the full tag ref

Full Changelog: v0.62.0...v0.62.1

v0.62.0

v0.62.0 shows what a sealed document is and who can open it, keeps "My keys" to your own keys, and lets macOS Contacts edit a card in place.

What's new

• Inspect seal, on the web and the desktop.
  • Inspect seal… on a sealed document shows who it is sealed to, who signed it, and its structure, at three levels of detail.
  • Each recipient is matched to an enrolled key and marked whether they are still in the declared audience. A member removed without a re-seal shows as one who can still open this version, and Re-seal is offered where you manage the audience.
  • On the desktop, Inspect a file… reads a local sealed file the same way and says which of your keys opens it.
• "My keys" lists your own keys only, an administrator's too. An administrator's view of the whole tenant moved to its own link (see Before upgrading).
• macOS Contacts edits a CardDAV card in place. Before, every edit on a Mac was saved as a new linked card, and the synced fields could not be changed.
• A field's value completes from a module's vocabulary (module ABI 2.2): a module can offer suggestions for a field while still accepting free text.
• A Sealed document in a personal space says it is sealed for its owner alone when it is added on the desktop, instead of offering an audience.
• apass whoami names the installation, the person and tenant the session acts as, the enrolled hardware keys and the stores you may read. apass ls names those stores when My Passwords is empty.

Before upgrading

• GET certificates without holder answers the caller's own certificates, for an administrator too.
  • Before, an administrator received the whole tenant's, so every client's My keys showed colleagues' keys.
  • The whole tenant's listing is GET /api/certificates/tenant, advertised on the API root as tenant-certificates to administrators only; anyone else is refused.
  • alcifra certificates list (without --holder), inspect and revoke follow the new link where it is offered. A script that read the tenant from certificates as an administrator must follow tenant-certificates.
• An Encryption Service at its ADR 0018 or later is needed for a reader whose certificate holds an EC key (a PIV card's key-management slot, a security key's P-256). An older service cannot address such a reader on a Strict tenant. This is a standing entry, repeated from v0.35.0.

Every change since v0.61.0

• feat: a field's value completes from a module's vocabulary (ABI 2.2, #2288)
• feat: Inspect seal in the web and desktop clients (#2291, slice 1)
• fix(desktop): say a Sealed document in a personal space is sealed for its owner alone (#2293)
• feat: inspect a sealed file and try your keys on the desktop (#2291, slice 2)
• fix(dav): the home advertises its owner's privileges, so macOS Contacts edits in place (#2296)
• ci: split the e2e-2 leg into two (#2300)
• "My keys" lists the caller's own; the tenant under tenant-certificates (#2302)
• docs(readme): Inspect seal, for v0.62.0
• apass whoami, and ls says where the passwords are when My Passwords is empty
• Mutation testing runs the unit tests only (ADR 1087)

Full Changelog: v0.61.0...v0.62.0

v0.61.0

v0.61.0 lets a person revoke a lost key, keeps CI secrets sealed in the archive, and gives a copied user the very same rights.

What's new

• Revoke a key from the clients, with a reason.
  • A hardware key's holder revokes it from My keys… in the account menu, on the web and the desktop.
  • An administrator who manages users does so from the person's Keys… in Users & groups.
  • The reason (lost, stolen or compromised, replaced by a new key, the holder left the organisation, or one's own words) stays on the key.
  • The holder is notified when somebody else revoked it.
  • The dialog advises enrolling the new key first, and warns when it is the holder's only valid one.
• The CI/CD Store.
  • A new kind of sealed store keeps a pipeline's secrets and variables in the archive, sealed to its audience's hardware keys like a password store.
  • Each secret is one rotation unit: its targets, its keys (text, files kept as their bytes, and plain variables), and its values.
  • apass cicd apply sets what is missing or stale on each repository, with one PIN, and never prints a value. --dry-run reports without a key.
  • On the desktop, a CI/CD secret shows its targets and key names in the preview, and its values after one open with the key, with an editor for files and a drop zone.
• A Sealed document keeps its earlier versions when it is re-sealed after an audience change or a revoked key. Before, the history rules meant for password entries could delete them.
• Copying a user carries the source's rights and groups, in one request. A tenant administrator holding every right could not grant four of them before; that is fixed.
• A contact's or an appointment's card shows its stored text in a collapsed section, and the card fills the preview pane.
• alcifra search reindex --wait follows a rebuild to its end.
• alcifra document list, fields show/set and delete, for scripting the archive.

Before upgrading

• alcifra certificates revoke now requires --reason (lost, compromised, replaced, left, or other with --text).
  • It follows the key's new revoke transition, open to the key's holder and to an administrator who manages users.
  • A script that revoked without a reason fails until it gives one.
  • --on, which records a revocation a certification authority made at its own instant, works as before and takes no reason.
• An Encryption Service at its ADR 0018 or later is needed for a reader whose certificate holds an EC key (a PIV card's key-management slot, a security key's P-256). An older service cannot address such a reader on a Strict tenant. This is a standing entry, repeated from v0.35.0.

Every change since v0.60.2

• Pin Tube 0.5.0 on the demo
• alcifra document fields show and set (#2258)
• alcifra document list, and fields show prints empty fields
• The demo shows its own login on the sign-in page (kiosk keys, ADR 1075)
• Pin the Licensing Module 0.9.2 on the vendor installation
• alcifra document delete moves a document to the recycle bin
• The leftover references name the renamed repositories (#2028 remainder 5)
• test(web): the drag-move test proves where the documents went
• fix(chart): the kiosk overlay names the demo administrator
• docs(deploy): one installation manual source, a white-label edition's manual from it
• docs(adr): 1080, a white-label edition signs and notarizes its .dmg
• docs(deploy): a production cluster for any Kubernetes; the edition's manual leaves out k3s, Caddy and our hosts
• chore(kiosk): the Flight School overlay seeds its setup account (#1612, step 1)
• feat(search): alcifra search reindex --wait follows a rebuild that lives in the database (#1715, ADR 1081)
• feat(preview): a contact or an appointment card shows its stored text, and fills the pane (#2274, ADR 1082)
• chore(kiosk): retire the legacy Flight School seed (#1612, step 5)
• fix(kiosk): the Demo tenant binds by possession, without the anonymous guard (ADR 1061)
• fix(users): a copy carries the source's rights and groups, in one request (#2277)
• Revoke a key from the clients, with a reason (#2278)
• ci(mutation): generate the brand icons before Stryker
• docs(readme): what v0.61.0 delivers
• The CI/CD Store: CI secrets sealed in the archive, set by apass (#2269)
• fix(test): the kiosk overlay guard stands down in the public mirror
• docs(readme): the CI/CD store, for v0.61.0

Full Changelog: v0.60.2...v0.61.0

v0.60.2

v0.60.2 shows the public demo's login on its sign-in page, so a visitor who arrives from an app store, the web or the desktop client can try the demo without hunting for the password.

What's new

• A sign-in page can name a demo login. Where an installation sets DemoSignIn:Email and DemoSignIn:Password, the first sign-in step shows them in the reader's language, with a button that fills both fields. Only a demo sets these: a production installation refuses to start with them.

Also in v0.60.2

• Publishing a white-label edition copies its images' signatures in the format the signing step now writes, and takes its tools from the branch it runs on.

Every change since v0.60.1

• Pin the Licensing Module 0.9.0 on the vendor installation
• fix(edition): publish copies cosign 3's signature tag and runs the branch's tools
• Pin the Licensing Module 0.9.1 on the vendor installation
• The public demo shows its own login on the sign-in page (Mobile #275)

Full Changelog: v0.60.1...v0.60.2

v0.60.1

v0.60.1 is v0.60.0 with its desktop packages and manual. v0.60.0's packaging stopped at the macOS notarization: Apple accepted the installer, and a check in the job misread the answer. v0.60.1 fixes that check and carries everything below. If you run v0.60.0's images, upgrading changes nothing on the server.

v0.60.0 carries module ABI 2.1. A module built on ABI 2.1 loads only into this core or a later one, so upgrade an installation before installing such a module. Every module built on an earlier 2.x keeps loading.

Read this before upgrading

• alcifra and apass keep a person's session in one file. alcifra login and apass login no longer need eval "$(…)": both tools read and renew one session file. It stays valid for 15 idle minutes, every command except Tab completion renews it, and the server holds it to 12 hours at most. ALCIFRA_URL and ALCIFRA_TOKEN still override the file, so in a shell that exported them earlier, unset them (or open a new shell) to use the file. A service account's login still prints the two variables.
• A document's type can be refused while something holds it. Changing the mask of a document is refused (409 MASK_HELD_BY_REFERENCE) while either of these holds the document and would not take the new type: a folder whose references follow its admission, such as a playlist, or a reference field limited to certain types, such as a video's thumbnail. Ordinary references never hold a document.
• The Encryption Service image is published as alcifra-encryption only. The earlier image name receives no new builds. The compose files and the chart already name alcifra-encryption.
• The password tool's browser host is now com.alcifra.autofill.apass. If you set one up before, run apass browser install again with this release's apass.

What's new

• A reference field offers only what it accepts. A module's reference field may name the types it takes (ABI 2.1), and the core refuses anything else. On the desktop and the web, such a field gets a type-ahead picker with a picture of each candidate, shows the picture it holds, and takes a file directly where it accepts exactly one type, filed beside the item.
• Contacts, appointments and mails preview as cards. A contact or an appointment shows its details as a card instead of the raw file, with the pencil opening its editor. A mail shows its sender, recipients, date and attachments; the web shows its body as sanitised HTML in a sandboxed frame, and the desktop shows its text.
• A login that ran out says so. apass names an expired session, rather than claiming the store could not be read. Tab completion continues inside a folder, answering from the cached tree first.
• The release's notarization wait has a limit of its own, with one resubmission, so a slow notarization no longer ends the packaging job.
• The intray leaves nothing behind when an item is deleted mid-ingest.

Also in v0.60.1

• The packaging job reads the notarization by its final answer, so an accepted installer is no longer taken for a wait that ran out.

Every change since v0.59.1

• docs(tube): ADR 0012, a playlist is a folder of references under a channel (#2214)
• A reference field names the masks it accepts: the core's half (#2214)
• fix(apass): an expired session says so, instead of blaming the store
• ABI 2.1: a field seed names the masks a reference field accepts (#2214)
• fix(apass): completion goes on inside a folder and never falls back to local files
• Rename the password tool's project, types and browser host to Pass and apass (ADR 1070)
• The manual's card checks name the desktop client CLIENT, not SA
• fix(release): a notarization wait has its own 20-minute limit and one resubmission
• fix(apass): Tab completion answers from the cached tree before asking the installation
• fix(release): the tag mirror skips releases before v0.2, and an edition is tagged without a local tag
• The command-line tools share one session file (ADR 1071)
• fix(manual): the macOS path names the brand's own app bundle (#2229)
• test(web): the New dialog test reads the notice that names its case
• A contact or an appointment previews as its own card, on the desktop and the web (#2215, ADR 1072)
• A mail previews as its own card, on the desktop and the web (#2215, ADR 1073)
• fix(intray): a marker written after its item was deleted is taken back (#2221)
• A reference field naming the masks it accepts is picked, on the desktop and the web (#2214)
• Public README for v0.60.0: preview cards and the reference picker
• A mask change is refused while a holder would not take it (#2214)
• fix(release): notarization decides by the submission's final status

Dependencies

• build(deps): bump the github-actions group across 1 directory with 4 updates

Full Changelog: v0.59.1...v0.60.1

v0.60.0

The desktop packages and the manual for this release come with v0.60.1. v0.60.0's images, chart and command-line tools are complete, but its packaging job stopped at the macOS notarization: Apple accepted the installer, and a check in the job misread the answer. v0.60.1 carries the fix and every package.

v0.60.0 carries module ABI 2.1. A module built on ABI 2.1 loads only into this core or a later one, so upgrade an installation before installing such a module. Every module built on an earlier 2.x keeps loading.

Read this before upgrading

• alcifra and apass keep a person's session in one file. alcifra login and apass login no longer need eval "$(…)": both tools read and renew one session file. It stays valid for 15 idle minutes, every command except Tab completion renews it, and the server holds it to 12 hours at most. ALCIFRA_URL and ALCIFRA_TOKEN still override the file, so in a shell that exported them earlier, unset them (or open a new shell) to use the file. A service account's login still prints the two variables.
• A document's type can be refused while something holds it. Changing the mask of a document is refused (409 MASK_HELD_BY_REFERENCE) while either of these holds the document and would not take the new type: a folder whose references follow its admission, such as a playlist, or a reference field limited to certain types, such as a video's thumbnail. Ordinary references never hold a document.
• The Encryption Service image is published as alcifra-encryption only. The earlier image name receives no new builds. The compose files and the chart already name alcifra-encryption.
• The password tool's browser host is now com.alcifra.autofill.apass. If you set one up before, run apass browser install again with this release's apass.

What's new

• A reference field offers only what it accepts. A module's reference field may name the types it takes (ABI 2.1), and the core refuses anything else. On the desktop and the web, such a field gets a type-ahead picker with a picture of each candidate, shows the picture it holds, and takes a file directly where it accepts exactly one type, filed beside the item.
• Contacts, appointments and mails preview as cards. A contact or an appointment shows its details as a card instead of the raw file, with the pencil opening its editor. A mail shows its sender, recipients, date and attachments; the web shows its body as sanitised HTML in a sandboxed frame, and the desktop shows its text.
• A login that ran out says so. apass names an expired session, rather than claiming the store could not be read. Tab completion continues inside a folder, answering from the cached tree first.
• The release's notarization wait has a limit of its own, with one resubmission, so a slow notarization no longer ends the packaging job.
• The intray leaves nothing behind when an item is deleted mid-ingest.

Every change since v0.59.1

• docs(tube): ADR 0012, a playlist is a folder of references under a channel (#2214)
• A reference field names the masks it accepts: the core's half (#2214)
• fix(apass): an expired session says so, instead of blaming the store
• ABI 2.1: a field seed names the masks a reference field accepts (#2214)
• fix(apass): completion goes on inside a folder and never falls back to local files
• Rename the password tool's project, types and browser host to Pass and apass (ADR 1070)
• The manual's card checks name the desktop client CLIENT, not SA
• fix(release): a notarization wait has its own 20-minute limit and one resubmission
• fix(apass): Tab completion answers from the cached tree before asking the installation
• fix(release): the tag mirror skips releases before v0.2, and an edition is tagged without a local tag
• The command-line tools share one session file (ADR 1071)
• fix(manual): the macOS path names the brand's own app bundle (#2229)
• test(web): the New dialog test reads the notice that names its case
• A contact or an appointment previews as its own card, on the desktop and the web (#2215, ADR 1072)
• A mail previews as its own card, on the desktop and the web (#2215, ADR 1073)
• fix(intray): a marker written after its item was deleted is taken back (#2221)
• A reference field naming the masks it accepts is picked, on the desktop and the web (#2214)
• Public README for v0.60.0: preview cards and the reference picker
• A mask change is refused while a holder would not take it (#2214)

Dependencies

• build(deps): bump the github-actions group across 1 directory with 4 updates

Full Changelog: v0.59.1...main

v0.59.1

v0.59.1 replaces v0.59.0 for installing. v0.59.0's images and tools are fine, but its release page has no desktop packages and no manual: a step of the packaging job failed on the macOS runner. v0.59.1 carries everything below and has them. If you run v0.59.0's images, upgrading changes only the small item under Also in v0.59.1.

Read this before upgrading

• The administrator's personal-spaces listing is gone. GET /api/admin/personal-repositories, and the rel that reached it, are no longer served: the desktop and the web show every user's personal space as a reference inside the new Users folder under Administration (below), and take one over from there. A script that read the listing reads the Users folder instead.

What's new

• Administration and Users are real folders. Every tenant's standard repository holds an Administration folder with a Users folder inside, held by the core: neither can be renamed, moved or deleted, and the Users folder lists each user's personal space as a reference. An administrator opens a personal space from there, with Take over where they may; mail clients and WebDAV never see the two.
• New ▸ a kind with required fields asks for its form. Where a folder admits a kind whose mask requires a field (an aircraft's registration, say), the New dialog shows the mask's whole form with the required fields marked, on the desktop and the web, and creates the item with its values in one step. A field left empty is named in the refusal, in your language.
• The Tube tab adds a video to a channel. Every writable channel row carries a +: pick a file, and it is filed into the channel as a Video and published, on the desktop and the web. A channel that admits only videos types what is filed into it, so an upload needs no mask chosen by hand.
• A weekly probe of the public video host. The core asks the demo's video host once a week what a PeerTube client asks first — its version, a video's details, the file door's redirect and a range — and keeps the public weekly client check from being switched off for inactivity. A failure opens an issue.
• The manual attached to a release names its release. The PDF on the release page says which version it describes.
• A kiosk reset carries on past a seed that did not land, and the release runbook names an edition's delivery registry before its first tag.

Also in v0.59.1

• A folder's list of what it admits now names each kind's required fields, so the New menu decides without a request whether a name is enough.
• The packaging job installs its typesetter correctly on macOS, and a failed download can no longer hang it.

Every change since v0.58.0

• A kiosk reset carries on past a seed that did not land
• A module's exclusive folder types what is filed into it (#2148, ADR 1065)
• Tube tab: add a video to a channel, desktop and web (#2148)
• Administration and Users as real folders held by the core (#2180, ADR 1066)
• New ▸ a kind with required fields asks for the mask's form, desktop and web (#2217, ADR 1067)
• docs(release): an edition's brand names its delivery registry before its first tag (ADR 1060)
• A weekly probe of the deployed video host (#2142)
• The manual attached to a release names its release (#2166)
• The public README says the Tube tab adds a video to a channel
• The Typst install works on the Mac
• The admits entry names the fields its mask requires (#2216)

Full Changelog: v0.58.0...v0.59.1

v0.59.0

Read this before upgrading

• The administrator's personal-spaces listing is gone. GET /api/admin/personal-repositories, and the rel that reached it, are no longer served: the desktop and the web show every user's personal space as a reference inside the new Users folder under Administration (below), and take one over from there. A script that read the listing reads the Users folder instead.

What's new

• Administration and Users are real folders. Every tenant's standard repository holds an Administration folder with a Users folder inside, held by the core: neither can be renamed, moved or deleted, and the Users folder lists each user's personal space as a reference. An administrator opens a personal space from there, with Take over where they may; mail clients and WebDAV never see the two.
• New ▸ a kind with required fields asks for its form. Where a folder admits a kind whose mask requires a field (an aircraft's registration, say), the New dialog shows the mask's whole form with the required fields marked, on the desktop and the web, and creates the item with its values in one step. A field left empty is named in the refusal, in your language.
• The Tube tab adds a video to a channel. Every writable channel row carries a +: pick a file, and it is filed into the channel as a Video and published, on the desktop and the web. A channel that admits only videos types what is filed into it, so an upload needs no mask chosen by hand.
• A weekly probe of the public video host. The core asks the demo's video host once a week what a PeerTube client asks first — its version, a video's details, the file door's redirect and a range — and keeps the public weekly client check from being switched off for inactivity. A failure opens an issue.
• The manual attached to a release names its release. The PDF on the release page says which version it describes.
• A kiosk reset carries on past a seed that did not land, and the release runbook names an edition's delivery registry before its first tag.

Every change in this release

• A kiosk reset carries on past a seed that did not land
• A module's exclusive folder types what is filed into it (#2148, ADR 1065)
• Tube tab: add a video to a channel, desktop and web (#2148)
• Administration and Users as real folders held by the core (#2180, ADR 1066)
• New ▸ a kind with required fields asks for the mask's form, desktop and web (#2217, ADR 1067)
• docs(release): an edition's brand names its delivery registry before its first tag (ADR 1060)
• A weekly probe of the deployed video host (#2142)
• The manual attached to a release names its release (#2166)

Full Changelog: v0.58.0...v0.59.0

v0.58.0

Read this before upgrading

This release has two breaks. They arrive together so that you meet them once.

The module ABI is now 2.0

The module contract is renamed to Alcifra.ModuleAbi, and its major version moves to 2. A module built for the earlier ABI is refused at startup, and the log names the reason. Its data is untouched, and it stays inactive until a current build is installed.

• Upgrade the core and its modules together. Neither an old core nor a new one can load the other's modules.
• First builds for ABI 2.0: Messenger 0.10.0, Tube 0.4.0, Encryption 0.8.0, Licensing 0.8.1 and Flight School 0.4.0. The pins in modules.env and the chart already name them.
• Licences: a module that is already active stays active. Activating one again with a licence issued for ABI 1 is refused, and needs a new licence.
• Module authors: build against Alcifra.ModuleAbi 2.0.0. The SimplArchive.ModuleAbi package no longer receives versions, and its earlier versions stay downloadable.

The names from before the rename are gone

These were announced with v0.55.0 and have now been removed:

• Sign-in: the earlier client ids (saconsole, sapass, simplarchive-desktop, simplarchive-mobile, simplarchive-mobile-autofill) and the phone's earlier redirect. Startup removes those clients and their tokens, so a session held under one ends at its next request.
• Command line: the simplarchive.cli package and the SACONSOLE_*, SA_URL and SA_TOKEN variables. Install alcifra.cli, and use ALCIFRA_URL, ALCIFRA_TOKEN and ALCIFRA_CLIENT_SECRET.
• Webhooks: the X-SimplArchive-Signature header. Receivers must read X-Alcifra-Signature.
• Mail domains: a pending claim is checked only at _alcifra-challenge. A domain already verified stays verified.
• Links and archives: simplarchive:// links no longer open. A .simplarchive archive is refused, so export it again as .alcifra.
• Phone licences: one issued under the earlier kind no longer verifies against ABI 2.0, and needs issuing again.
• Images and chart: only ghcr.io/hebelconsulting/alcifra (with -ocr and -postfix) and the alcifra chart are published from now on.

What's new

• Bookmarks. One file per collection, in the bookmark format every browser reads. The browser extension keeps each file you can read in step as a folder of its own, merging changes bookmark by bookmark. A team shares one by putting it in a shared folder, and that folder's rights decide who gets it. Extension 0.2.0 asks for the bookmarks permission, so browsers ask to accept it again.
• Enrolling your own key under possession. On a tenant that binds certificates by possession, a member enrols a certificate by opening a challenge sealed to it, on the desktop and with alcifra. The Demo tenant now binds this way. The phone follows in its next release.
• White-label editions delivered by the Licensing module. A vendor publishes an edition with alcifra edition publish, and each customer pulls images and charts with their own credential and downloads the clients from a page behind it.
• Tube's pages are now built from components, and a module's downloads are saved under the document's name.

Fixed

• A throttled or failed answer to a session renewal, such as a 429 or a 502 during a restart, no longer signs people out or deletes a refresh token that still works.

Every change in this release

• test(realtime): a second in-process host gives the static logger back (#2162)
• fix(client): a version row carries its size
• ci: unit and integration tests run in jobs of their own
• fix(offline): an archived document advertises its mask
• ci(edition): a white-label edition's image is amd64, built on the owner's Mac
• docs(tube): ADR 0009, the pages are Razor components
• fix(edition): a white-label edition keeps its name on any server
• feat(modules): a module may claim v2 and downloads at the root
• feat(cli): alcifra edition publish, and the workflow that runs it
• fix(modules): a module's download link is saved under the document's name
• feat(chart): a chart names where a customer pulls, and every own image uses the pull secret
• feat(certificates): under possession a member enrols their own by opening a challenge
• Bookmark files a browser keeps in step (#1946)
• A renewal the server could not answer no longer ends the session
• ABI 2.0: the rename to Alcifra.ModuleAbi, with no bridge (#2136)
• Pin the first module builds for ABI 2.0 (#2136)
• Retire the names before the rename (#2028)
• Pin Licensing 0.8.1
• Test: a login whose hourly last-use write is due still succeeds
• The public README says what bookmarks do
• The runbook says a new major's pins start a clock on the kiosk

Full Changelog: v0.57.6...v0.58.0

v0.57.6

WebDAV

• Locks now hold across instances. With ConnectionStrings:Valkey set, locks live in Valkey, so a client's UNLOCK no longer depends on which instance it reaches, and a lock taken on one instance holds on the other. A single instance without Valkey keeps them in memory.
• New: 503 WEBDAV_LOCKS_UNAVAILABLE. When Valkey cannot answer, LOCK, UNLOCK and the lock check before a write are refused, so a WebDAV write stops until Valkey returns. Reads carry on.
• Faster again. A user's personal space is no longer set up on every request: once checked, that is remembered per instance for 60 seconds. A request for a hidden file that does not exist runs 8 database queries instead of 18. A typed folder deleted during those 60 seconds comes back up to a minute later.

Video on the web

• A video waits behind a play button, and nothing of it is fetched until the click. A reference field named Thumbnail on the video's mask gives it a picture, and the version resource then carries a poster link. Otherwise it shows a neutral placeholder. The desktop keeps its message for now.

Every change in this release

• fix(webdav): locks are shared through Valkey (#2176)
• test(links): the external link page's footer test follows the build's brand
• feat(preview, webdav): a video play button, and a remembered personal-space check (#2160, #2179)
• docs(release): dispatch an edition heavy tier after its push run finishes

Full Changelog: v0.57.5...v0.57.6