v1.1.0 - durable-authority candidate, admin-user-repository folded in

v1.1.0 - durable-authority candidate released, admin-user-repository folded in (RU11, RV15, TIN-3692)

Minor release, additive for 1.0.0 consumers: no 1.0.0 export is removed or renamed. Full notes: CHANGELOG.md.

• ./sveltekit/server: a rune-free server entry that imports in plain Node.
• ./storage durable coordinators: FileBootstrapCoordinator, FileTotpEnrollmentCoordinator, FileTotpRetirementCoordinator, FileActionStepUpStore. The classes, their prototypes and their instances are frozen. They accept only a genuine TOTPService; there is no injectable verifier (RS6).
• beforeComplete deny-only gate: it replaces the candidate's delegating totp wrapper. Migration: pass the TOTPService itself as totp and the write-activation check as beforeComplete: (operation) => requireAuthorityWriteActivation(operation).
• ./admin-user-repository (RV15): the archived admin-user-repository module, including the federationEnabled opt-in. Public reads copy the explicit 17-field PUBLIC_ADMIN_USER_FIELDS allowlist (tinyland.dev f7e32942). The default filePermissions is now 0o600. Consumers drop the tummycrypt_tinyland_admin_user_repository bazel_dep in favor of this subpath.
• Bounded sessions, explicit-grant own-scope permissions, and fail-closed file adapter durability. See the CHANGELOG.

Delivery is the Bzlmod registry entry tummycrypt_tinyland_auth@1.1.0 only. Nothing is published to npm or GitHub Packages (RU6/RU8).

v1.0.0 - production TOTP bypass removed, test admission gated

v1.0.0 - production TOTP bypass removed, test admission gated (RS5, RS6, TIN-5766)

Breaking release. Migration guide: docs/migration-1.0.md.

• Removed (RS6): TOTPServiceConfig.devMode / testCode and the fixed-code shortcut in verifyToken / verifyTokenWithStep; TOTPConfig.devMode; the mTLS development auto-pass and MTLSOptions.isDevelopment; AuthConfig.isDevelopment; BootstrapServiceConfig.verifyTOTP / generateTOTPSecret. Legacy keys passed at runtime are ignored and never accept a fixed code.
• Test harness behind a hard gate (RS5): src/testing (including createTestAdmissionIssuer) is excluded from the production build, //:pkg and the npm tarball, is not exported, throws on load unless NODE_ENV === 'test', and reads no caller-supplied environment.
• Production-exclusion proof: pnpm check:production-artifact and Bazel //:production_artifact_test check the packed tarball and a production Vite bundle of every public entry.
• Fixes: cookie Secure defaults to true unless NODE_ENV is development or test; generateSecurePassword works in plain Node ESM; base32ByteLength no longer uses a backtracking regex.

0.7.1 is not yanked: its TOTP bypass fires only when a caller sets testCode, and no known consumer does. Its mTLS development auto-pass and the bootstrap verifyTOTP option are fixed only in 1.0.0; consumers should move to 1.0.0.

See CHANGELOG.md for the full list.

Full changelog: v0.7.1...v1.0.0

v0.7.1 - shared Bazel TypeScript compatibility

v0.7.1 - shared Bazel TypeScript compatibility (TIN-2647, TIN-2783)

• Restore the non-root Bazel module's shared aspect_rules_ts request to the coordinated first-party TypeScript 5.9.3 toolchain.
• Retain direct package typechecking with TypeScript 6.0.3, so both compatibility surfaces remain exercised.
• Supersede v0.7.0, whose TypeScript 6.0.3 extension request conflicts in mixed first-party Bzlmod graphs. The registry marks 0.7.0 yanked as part of the 0.7.1 promotion.

Full changelog: v0.7.0...v0.7.1

v0.7.0 - invitation authority consolidation and otplib v13

v0.7.0 - invitation authority consolidation and otplib v13 (TIN-2780)

Breaking change

• Remove the ungated local InvitationService and createInvitationService exports. Consumers must use @tummycrypt/tinyland-invitation >=0.2.5, whose fail-closed role authority and claim-first acceptance path are canonical.

Compatibility and release hardening

• Migrate TOTP compatibility to otplib v13 while preserving replay-protection window and time-step semantics.
• Refresh bcryptjs, TypeScript, and Node type tooling.
• Align the Bazel TypeScript toolchain and add release-metadata parity checks across package, module, Bazel rule, changelog, and tag versions.

Full changelog: v0.6.0...v0.7.0

v0.6.0 — replay-resistant TOTP verification (TIN-2667)

v0.6.0 — replay-resistant TOTP verification (TIN-2667)

Additive minor release carrying #20 and #21.

Minor changes

• TOTP replay protection (#20). TOTPService.verifyTokenWithStep() is a new, replay-resistant verification surface: it derives the absolute time-step a submitted code was minted for and rejects any step <= a caller-supplied lastUsedStep, so a valid code can no longer be reused inside its +/-window validity window (~90s at window=1). It returns the consumed step for callers to persist. EncryptedTOTPSecret gains an optional lastUsedTotpStep field to hold that marker.
• Legacy surface unchanged: the boolean verifyToken() stays as-is (stateless, opt-in migration path).

Housekeeping

• Bazel version parity (#21): npm_package version in BUILD.bazel aligned to the MODULE.bazel SSOT, with a version-parity test guard so the two can no longer drift.

Mothership adoption of 0.6.0 (the #653 native TOTP swap) is deferred to TIN-2647 step 6.

Full changelog: v0.5.0...v0.6.0

v0.5.0 — C3 federation lattice (TIN-2637/TIN-2638)

v0.5.0 — C3 federation lattice (TIN-2637 / TIN-2638)

A deliberate charter amendment: TIN-2435 closed the feature domain set at eight; R2 ratifies federation as the ninth domain (operator-ratified 2026-07-07).

Minor changes

• New feature domain: federation added to FEATURE_DOMAINS (the ratified set is now nine domains).
• New permission strings (both mapped to the federation domain in PERMISSION_FEATURE_DOMAIN):
  • admin.federation.view → moderator, admin, super_admin
  • admin.federation.deliver → moderator, admin, super_admin (R1: granted to moderator; the lattice is explicit-array, so admin holds the grant explicitly and super_admin holds it via the full-vocabulary row)
• Delivery anchor: delivery is a governance-spine capability anchored at moderator (the fedi/community moderation role). No specialist role (editor, event_manager, contributor) and no role below moderator holds it.
• New export: canDeliverFederation(role), derived from ROLE_PERMISSIONS via the SSOT helper like every other can* predicate.
• Invariants: P1 (management order) and P2 (member self-service floor) unchanged; P3 registry closure extended over the two new strings. The rbac-invariants suite exhaustively locks the federation holder set to exactly {moderator, admin, super_admin}.

Consumer wiring (pulse delivery workers etc.) is out of scope for this package (C4, separate lane).

Full changelog: v0.4.0...v0.5.0

v0.4.0 — two-axis RBAC SSOT (TIN-2435)

Minor Changes

• RBAC SSOT hardening (TIN-2435, operator-ratified 2026-07-04; precedent
  TIN-1606).

  New exports: MEMBER_SELF_SERVICE_CORE (defined as
  ROLE_PERMISSIONS.member by construction: admin.access,
  admin.content.view, admin.events.view), ROLE_CHARTER (two-axis
  role tags: governance-spine | specialist, with ROLE_HIERARCHY ranks),
  FEATURE_DOMAINS and PERMISSION_FEATURE_DOMAIN (feature-domain
  registry over the permission vocabulary), plus types FeatureDomain,
  RoleAxis, RoleCharterEntry.

  P2 data reconciliation (behavior change: view-level grants). Every
  role ranked at or above member now holds the member self-service core:

  • moderator gains admin.events.view
  • editor gains admin.events.view
  • contributor gains admin.events.view
  • event_manager gains admin.content.view

  New permission strings (behavior change: vocabulary additions so
  can* predicates derive from ROLE_PERMISSIONS instead of the
  hand-maintained role arrays — the tinyland.dev#628 anti-pattern class):

  • admin.content.publish → contributor, event_manager, editor,
    moderator, admin, super_admin (backs canCreatePublicContent)
  • admin.content.media_create → contributor, editor, admin,
    super_admin (backs canCreateVideos)
  • admin.content.delete → admin, super_admin (backs canDeletePosts,
    canDeleteVideos, canDeleteContent)
  • admin.events.delete → admin, super_admin (backs canDeleteEvents)

  Predicate derivation: every can* predicate now derives from
  ROLE_PERMISSIONS. The full role × predicate matrix is locked in
  tests/rbac-invariants.test.ts. Intentional behavior deltas (P2
  member-core flow-through; everything else is cell-identical):

  • canCreateEvents now true for moderator, editor, contributor
  • canDeleteOwnContent now true for moderator

  Invariants: deterministic, exhaustive tests for P1 (management order
  is ROLE_HIERARCHY, all 64 pairs), P2 (member self-service floor), P3
  (feature-domain registry covers the granted vocabulary exactly), plus
  pinned lattice counterexamples documenting that chain-monotonicity is
  NOT an invariant (ratified: TIN-1606, TIN-2435). Docs:
  docs/role-charter.md.

Patch Changes

• Clarify the package release authority: the TypeScript import API remains
  @tummycrypt/tinyland-auth, npmjs publication is disabled, GitHub Packages
  uses the @tinyland-inc/tinyland-auth mirror coordinate, and Bazel targets
  provide the package proof lane.

@tummycrypt/tinyland-auth v0.3.3

Patch release for SvelteKit SSR consumers using modern otplib exports.\n\n- Adds an otplib compatibility layer for legacy v12 authenticator exports and modern v13 functional exports.\n- Routes TOTP and invitation code through the compatibility helpers.\n- Validated with pnpm typecheck, tests, build, publint, Bazel build/test, and a v13-consumer smoke.

v0.3.2

Patch release for Node ESM consumers and the self-hosted Bazel publish lane. Includes the otplib CommonJS default namespace import fix from 0.3.1 and removes package-level npm provenance so npm does not reject self-hosted runner publication.

v0.3.1

Patch release for Node ESM consumers: import CommonJS otplib through its default namespace in TOTP and invitation code. Validated through pnpm typecheck/test/build/publint and Bazel package/test/typecheck lanes.