v5.8.0

Changed

• Port upstream decentralized-identity#170 and controlled-DID hook.

v5.7.0

Changed

• requestedDid is no longer part of the public ResolutionOptions; it is
  set internally by resolveDID. Ported from upstream 7533576 (PR decentralized-identity#170).

v5.6.1

Fixed

• canonicalizeStrict (and so entry hashing) no longer rejects an input that
  reaches the same object or array from two places -- one instance referenced
  twice, not two equal copies. The circular-reference check tracked every
  value ever visited rather than the current recursion path, so an ordinary
  acyclic graph -- a signed zcap whose proof carries the same @context array
  instance as the document, embedded in a log entry -- threw
  Canonicalization input contains circular references. Such an input now
  hashes as its JSON round trip does; a value that genuinely contains itself
  still throws.

v5.6.0

Added

• Resolution meta now includes versionTime (the resolved entry's timestamp)
  and ttl (the spec's cache-lifetime parameter). ttl is typed on
  DIDLogEntry.parameters, carried forward across entries like watchers,
  and reported as a number of seconds; when the log never sets it (or sets it
  to null), the spec default of 3600 is reported. Ports upstream 79d37f1
  (plus its tests 7392e53, 751d647), with the type corrected from
  upstream's string coercion to the spec's unsigned integer.

Fixed

• Resolving a deactivated DID with a historical selector (versionId,
  versionTime, or versionNumber) now returns the historical document with
  deactivated: true in the meta. Deactivation is DID-global state, so it
  previously read false at historical versions. Ports upstream 708e67f.

v5.5.1

Changed

• json-canonicalize bumped from the pinned 2.0.0 to 3.0.0 (the intact
  release after the broken 2.0.1 publish).

v5.5.0

Changed

• Ed25519 multikey decoding (decodeEd25519Multikey, the witness DID key
  check) now delegates to decodeMultikey from
  @interop/data-integrity-core/multihash instead of comparing the
  0xed 0x01 header by hand. Two deliberate tightenings follow: the key must
  now be exactly 32 bytes (previously unchecked), and a multikey must be
  base58btc (z) multibase -- u base64url is no longer accepted. The
  refusal message is now the shared codec's (Unexpected multikey codec: ...)
  rather than multiKey doesn't include ed25519 header (0xed01); the witness
  check keeps its own Witness DID key type must be Ed25519 (multicodec 0xed01): ... message.
• decodeMultikey and MultikeyCodec are re-exported from
  src/utils/multiformats.ts alongside the multihash codec.
• Bumped @interop/data-integrity-core to ^8.7.1, which is where
  decodeMultikey and MultikeyCodec ship.

Removed

• The internal isEd25519Multikey helper; it had no callers left and was not
  part of the package's export surface.

v5.4.1

Changed

• Pin json-canonicalize to exactly 2.0.0: the 2.0.1 publish is broken (its
  dist files are missing), and the pin keeps consumers resolving through this
  package from picking it up.

v5.4.0

Added

• BASE_CONTEXT is now exported from the package index.
• New additive additionalContext option on createDID/updateDID: an array
  of context entries appended after BASE_CONTEXT on create (or after the
  supplied didDocument's own @context), and after the carried-forward
  @context on update, deduplicated (strings by value, objects by JSON
  serialization). It is mutually exclusive with context, which remains the
  full-override escape hatch; passing both throws. No document bytes change:
  the result matches what context: [...BASE_CONTEXT, extra] already produced.

Changed

• Documented the context option's semantics on both interfaces: it replaces
  the document's @context wholesale, and updateDID without it preserves the
  prior entry's context, falling back to BASE_CONTEXT only when the document
  never had one.

v5.3.0

Changed

• The multihash codec (MultihashAlgorithm, createMultihash,
  decodeMultihash) now comes from @interop/data-integrity-core/multihash
  (^8.6.0) and is re-exported from src/utils/multiformats.ts; the local
  implementation is gone. Byte behavior is unchanged; varint decoding is
  stricter (overlong and oversized varints are rejected) and decoding refuses
  trailing bytes after the digest.

Removed

• DIGEST_LENGTHS is no longer exported (it had no consumers outside the
  module; the shared codec keeps it internal).

v5.2.0

Changed

• BREAKING: documentStateIsValid now takes an options object
  (documentStateIsValid(entry, { updateKeys, verifier, resolveVM })) and does
  entry-proof verification only. The witness argument and the
  skipWitnessVerification flag are gone; witness-parameter validation lives
  with the callers that own it.
• BREAKING: countVerifiedWitnessApprovals is now
  countVerifiedWitnessApprovals(witnessProofs, witness, { verifier, resolveVM, threshold?, proofVerificationCache? }); the unused log-entry argument was
  dropped. It can stop counting at threshold and memoize identical
  (versionId, proofValue) verifications across checks.
• BREAKING: The default verification-method resolver resolveVM moved out
  of utils into its own method-layer module and is now exported from the
  package root (along with a createResolveVM factory); documentStateIsValid
  and witness verification receive it via the new resolveVM resolution option
  (defaulted automatically by resolveDID/resolveDIDFromLog and the write
  operations). Repeated did:webvh verification-method resolutions are
  memoized within a single resolution; nothing is cached across resolutions,
  so key rotations are always picked up.
• BREAKING: validateWitnessParameter no-ops on an absent or empty witness
  parameter instead of throwing Witness list cannot be empty; callers no
  longer guard it.
• BREAKING: Removed the legacy witnesses/witnessThreshold entry
  parameter wire format (a v0.5 shape; this fork only supports v1.0). A log
  entry carrying the legacy shape is now rejected during resolution (fail
  closed) rather than resolving with its witness requirement silently ignored.
  Removed the WitnessParameterResolution type and
  normalizeWitnessThreshold; resolveWitnessParameter normalizes
  threshold to a number at the parse boundary, so
  DIDResolutionMeta.witness is a plain WitnessParameter.
• BREAKING: updateDID generates the parallel did:web document only when
  the new alsoKnownAsWeb: true option is passed (it also appends the
  did:web alias), instead of sniffing did:web: aliases in the document.
  When the updated document carries the parallel did:web alias but
  alsoKnownAsWeb was not passed, updateDID warns that no webDoc was
  generated, so publishers migrating from the sniffing behavior notice instead
  of silently serving a stale did:web document.
• BREAKING: Removed countWitnessApprovals (unverified-proof counter),
  createSCID (identity function), createHashHex, readLogFromDisk,
  encodeMultihashWithMultibase (alias of multibaseEncode), the
  previousLogEntryHash and latestVersionId resolution-meta fields, the
  SignDIDDocInterface type, and the METHOD_PARAMETER_KEYS constant.
• BREAKING: Public operations no longer write DID logs to ./test/logs/
  when NODE_ENV=test; src/config.ts and the test:log script were removed.
• A witness threshold failure is now signaled by a typed, exported
  WitnessThresholdError instead of an internal callback-set flag, and
  resolution no longer writes fetched witness proofs back into the caller's
  options object.
• Resolution-selector validation is centralized in the new exported
  validateResolutionSelectors, applied identically to resolveDID and the
  in-memory resolveDIDFromLog path (verificationMethod + versionTime
  remains a supported combined selector).
• A genesis entry missing scid or updateKeys, and a pre-rotation entry
  missing updateKeys, are now rejected with explicit validation errors
  instead of flowing undefined into resolution state.
• A genesis entry's witness parameter is now validated during resolution
  (threshold bounds, did:key Ed25519 witness ids, no duplicates), the same
  checks previously applied only to subsequent entries; a log whose first
  entry declares an invalid witness parameter no longer resolves.
• The write path (create/update/deactivate) and the resolver now derive
  resolution meta through one shared reducer, so both report identical values
  for the same log.
• Duplicate identifier parsing, the localhost-http exception, alias appending,
  the eddsa-jcs-2022 signing-input construction, the Ed25519 multikey decode,
  the proof-shape check, and the prerotation predicate each collapsed to a
  single shared implementation. The witness verify path now validates the
  Ed25519 multikey prefix (previously only a 34-byte length check).
• Two conflicting-selector / fragment-guard error messages changed wording:
  did:webvh identifier must not include query or fragment components is now
  Address input must not include query or fragment components, and
  version-prefix messages render the numeric version.
• newKeysAreInNextKeys resolves to void instead of true.
• UpdateDIDInterface/DeactivateDIDInterface/ResolutionOptions now declare
  all accepted options (services, address, paths, updateKeys,
  witnessProofs, ...); CreateDIDInterface declares method.
  CreateDIDResult/UpdateDIDResult share one DIDOperationResult shape.
• createDIDDoc is synchronous and returns the document directly (previously
  Promise<{ doc }>); prepareGenesisEntry/prepareUpdateEntry/
  prepareDeactivationEntry return the entry directly.

Fixed

• updateDID no longer ignores explicit capabilityDelegation /
  capabilityInvocation overrides (the other three relationship overrides
  already applied; all five now apply uniformly).

Added

• priorMeta option on updateDID/deactivateDID: opt-in trusted prior
  state that skips the full log re-resolution (previously O(n^2) signature
  verifications over a DID's lifetime); full re-resolution stays the default.
• selfVerify: false option on create/update/deactivate to skip the post-sign
  self-verification (default remains on).
• parseDidWebvhIdentifier is exported from the package root.

Performance

• Removed redundant work throughout the hot paths: single-traversal strict
  canonicalization, one cache-key serialization per deriveHash, one
  structuredClone of the resolved document per resolution (previously one
  per log entry), memoized + threshold-bounded + concurrent witness proof
  verification, and per-resolution memoization of verification-method
  resolutions.