v0.2.0

0.2.0

Adds an optional cacheControl to put across the port and all first-class adapters (#11).

• PutOptions.cacheControl?: string — validated like content-type (printable ASCII, no surrounding whitespace, 256-byte cap, no default).
• BlobObjectInfo.cacheControl: string | undefined returned by head/get; a replacing put without one clears it.
• New exports: MAX_CACHE_CONTROL_BYTES, assertValidCacheControl.
• Conformance suite gains round-trip, absent-by-default, replace-clears, and rejection cases, verified against Azurite (Azure Blob) and LocalStack (S3, R2).

All four packages publish at 0.2.0; adapters exact-pin @pegma/storage-blobs@0.2.0. Out-of-repo BlobStore implementations must add the cacheControl field to compile against 0.2.0 — pin exact versions.

v0.1.2

Azure Blob adapter: retry container creation after a failed first attempt instead of latching the rejection for the store's lifetime.

v0.1.1

Security patch release resolving the open findings from the 2026-07-29 security scan.

Anchored the prepared release manifest across the publish job boundary. package-manifest.json previously travelled to the publish job inside the same artifact as the tarballs it describes, so a self-consistent replacement of both would have satisfied every internal check. The prepare job now records the manifest SHA-256 as a job output — crossing the boundary through run metadata rather than the artifact — and release:publish requires that digest and compares it with timingSafeEqual before the manifest is parsed. The gate is fail-closed: a missing or malformed digest aborts the publish.

Gated CI on shipped-dependency advisories. CI now runs npm audit --omit=dev --audit-level=low, so runtime dependencies are enforced clean (currently 0 advisories) and any future advisory in a shipped dependency fails the build. The remaining advisories are confined to the dev-only Azurite test chain, which has no upstream fix available, and stay tracked and non-gating.

No public API changes — @pegma/storage-blobs, @pegma/storage-azure-blob, @pegma/storage-cloudflare-r2, and @pegma/storage-s3 all move 0.1.0 → 0.1.1.

Storage Blobs v0.1.0

First supported release of the Storage Blobs family.

Packages

• @pegma/storage-blobs@0.1.0 — port, memory store, conformance suite
• @pegma/storage-azure-blob@0.1.0 — Azure Blob adapter (Azurite-proven)
• @pegma/storage-cloudflare-r2@0.1.0 — Cloudflare R2 adapter (S3-compatible)
• @pegma/storage-s3@0.1.0 — AWS S3 / S3-compatible adapter

Notes

Published only from this signed annotated tag through the trusted-publisher OIDC workflow with npm provenance. Exact versions only; no ranges.

See docs/RELEASING.md and docs/PROJECT_PLAN.md.