v0.13.0

Added

• ProblemTypes.CAPABILITY_REVOKED
  (https://wallet.storage/spec#capability-revoked, 404) and
  ProblemTypes.CAPABILITY_EXPIRED
  (https://wallet.storage/spec#capability-expired, 404): typed denial reasons
  for a capability invocation refused because a capability in its chain is
  revoked, or because the invoked capability or one in its chain has expired.
  The status stays the merged not-found 404; only type changes. A server
  emits them only after the request signature and the chain's delegation proofs
  verified, so they reach the holder of the affected chain and never a prober.
  Every other verification failure keeps not-found.

v0.12.0

Added

• ProblemTypes.CAPABILITY_ALREADY_REVOKED
  (https://wallet.storage/spec#capability-already-revoked, 400): a revocation
  submission whose capability, or a capability in its chain, is already revoked.
  Emitted only after the submission is authorized, so it is not a
  revocation-state oracle. A malformed submission or a chain that fails to
  verify keeps invalid-request-body, so a blind resubmission can tell "already
  done" from "refused".

v0.11.0

Added

• ChangeDocument carries the Resource's current content etag and /meta
metaEtag, the quoted validators exactly as the server emits them, so a
  replica can send If-Match from feed state without a read per Resource.
  version / metaVersion remain for ordering only; an ETag is opaque and is
  not reconstructed from them.
• ProblemTypes.ENCRYPTION_HISTORY_LOG_GOVERNED
  (https://wallet.storage/spec#encryption-history-log-governed, 409): a direct
  encryption write on a Collection whose descriptor is governed by its
  .../meta/log history log; the served member is derived from the log head, so
  the Description path is read-only for it.

v0.10.0

Changed

• BREAKING: CollectionDescription.indexes moved to
  CollectionDescription.plaintext.indexes (no compatibility alias).
  plaintext is the counterpart of encryption: at most one is present (by
  presence; a server rejects both with invalid-request-body) and it stays
  updatable for the Collection's life. The CollectionIndexDeclaration entry
  shape is unchanged.
• ChangesPage doc: only a null checkpoint means the caller has caught up; a
  page shorter than limit does not, since a server may reduce limit.

v0.9.1

Changed

• Update to latest @interop/data-integrity-core@8.7.1.

v0.9.0

Changed

• BREAKING: Renamed the resource-log format identifier constant
  WAS_RESOURCE_LOG_METHOD (was-resource-log:0.1) to RESOURCE_LOG_METHOD
  (resource-log:0.1). Both the export name and the identifier value change:
  the log format is transport-agnostic and is not tied to the WAS storage API.

v0.8.0

Added

• CollectionMetadata: the Collection-level wire type for the reserved meta
  segment of a Collection (createdAt, updatedAt, createdBy, epoch,
  custom). Mirrors ResourceMetadata minus contentType / size, which
  describe a stored representation a Collection does not have.
• RESERVED_RESOURCE_IDS: added meta. Collection Metadata occupies the
  {resource_id} position, so a Resource named meta would shadow it.

v0.7.0

Added

• CollectionEncryption: the optional hmac member -- the Collection's
  blinded-index HMAC key (id, type, and recipients, the key wrapped to
  each recipient in the same JWE recipients entry shape as the epoch
  secrets). Installed at provisioning or never, and never rotated.

v0.6.0

Added

• Add the optional generator and generatorOrigin properties to
  CollectionDescription (spec "Collection Data Model"): the DID of the
  application the Collection was provisioned for and the Web origin it was
  bound to at provisioning time. Both are controller-asserted -- client-
  supplied, updatable (so a wallet can backfill existing Collections), and
  never server-verified -- in contrast to the server-observed, read-only
  createdBy, which under delegated provisioning names the invoker rather
  than the application.

v0.5.0

Changed

• BREAKING: CollectionEncryption: the epochsMac member and the
  CollectionEncryptionEpochsMac interface are removed -- the epoch-
  configuration MAC is retired stack-wide (with @interop/was-client@0.32.0).
  On a log-governed descriptor its coverage was a strict subset of chain
  verification, and its classic gaps (whole-configuration replay, fresh
  fabrication under a newly minted secret) were gaps with or without it.
  Greenfield: no tolerance for MAC-bearing descriptors, no strip migration.