web/CHANGELOG.md

<!-- SPDX-License-Identifier: MPL-2.0 -->

# Changelog

## v0.1.0-preview.16 — 2026-09-03

- Add bounded organization-member and direct user-role listings for
  application-owned access administration pages. Direct listings deliberately
  exclude team and narrower resource grants rather than flattening distinct
  authority into one apparent role.
- Add atomic direct-role replacement with exact expected-binding checks,
  transactional access audit, active-member validation, and final active
  direct-owner protection. SQLite serializes competing replacements so stale
  administration fails with a stable conflict instead of partially applying.
- Record the Gamertan administration dogfood boundary: applications authorize
  the route and fresh passkey assertion, while Foundations owns the reusable
  storage transaction and invariants.

## v0.1.0-preview.15 — 2026-09-03

- Permit applications to opt into an exact non-default HTTPS WebAuthn origin
  port for `localhost` and reserved `.test` relying-party IDs. The configured
  origin remains exact, production origins remain portless by default, and
  malformed, default, non-canonical, zero, or out-of-range ports fail closed.
- Record the Gamertan local-Caddy dogfood pressure that required this explicit
  development boundary without weakening cross-origin ceremony rejection.

## v0.1.0-preview.14 — 2026-09-03

- Reject header-only, truncated, and structurally invalid PDF uploads in the
  bounded media preparer. Accepted attachments now require a supported PDF
  version, terminal EOF marker, numeric in-range `startxref`, and either a
  traditional xref/trailer or xref-stream object at the declared offset.
- Keep PDF handling storage-neutral and non-rendering: applications still own
  authorization, reference tracking, attachment disposition, and lifecycle.

## v0.1.0-preview.13 — 2026-09-03

- Complete the password-plus-recovery-code flow with a short-lived restricted
  grant bound into a replacement-passkey ceremony. Completion atomically
  consumes the grant, stores the verified passkey, replaces every recovery
  code, revokes any intervening sessions and ceremonies, and records both
  audits without issuing a normal session.
- Keep failed completion retryable until grant expiry: a duplicate credential
  or other transaction failure rolls back grant consumption and recovery-code
  replacement, while a mismatched WebAuthn binding consumes only the affected
  ceremony.

## v0.1.0-preview.12 — 2026-09-03

- Add a root-local bootstrap transaction that creates the first passkey-only
  application owner, non-personal organization, active membership, direct
  owner binding, one-time enrollment digest, and secret-free audit records
  atomically.
- Fail closed and roll back the entire bootstrap when the application has not
  seeded the configured owner role. The raw enrollment token is returned only
  after commit and never enters repository state or audit records.

## v0.1.0-preview.11 — 2026-09-03

- Add expected-user completion for authenticated self-service passkey
  enrollment. A mismatched ceremony is consumed and fails before credential
  persistence, closing an authorization seam found while dogfooding Gamertan's
  account security page.

## v0.1.0-preview.10 — 2026-09-03

- Add atomic public-account registration with required canonical email,
  password authentication, printable recovery codes, a personal organization,
  direct owner access, and an optional initial passkey. Pending registrations
  cannot authenticate, and abandoned drafts expire without reserving identity
  fields indefinitely.
- Add password verification without session issuance plus operation-bound
  WebAuthn completion hooks, allowing applications to require fresh passkeys
  for sensitive actions without imposing passkeys on ordinary customer use.
- Add digest-only recovery-code persistence and short-lived, single-use
  recovery grants that consume a code and revoke existing sessions atomically.
- Add bounded raster/PDF media preparation and a hardened content-addressed
  local filesystem adapter with atomic writes, private modes, and symlink
  rejection.
- Add explicit SQLite open-without-migration and schema-requirement APIs while
  preserving the historical migrating `Open` behavior for existing adopters.
- Record application dogfood findings and the independent future commerce
  module boundary.

## v0.1.0-preview.9 — 2026-09-03

- Add a documented root package and executable composition example so the
  module landing page presents its purpose, package-selection guidance,
  security model, and `net/http` integration rather than only a directory
  index.
- Add the repository's default MPL-2.0 licence at the conventional root path
  so Go package tooling can identify the library licence while preserving the
  existing file-level exceptions for starters and operational machinery.
- Rework the public README around progressive adoption, explicit design
  promises, package selection, assurance gates, and canonical project links.

## v0.1.0-preview.8 — 2026-08-28

- Preserve `http.Hijacker` through the request-evidence middleware so audited,
  authenticated WebSocket and other HTTP upgrade handlers can operate without
  bypassing request logging. Successful upgrades are recorded as HTTP 101;
  upgraded-protocol bytes remain outside HTTP body-byte accounting.

- Add revisioned active/archived lifecycles for organizations and teams,
  invitation listing and revocation, membership suspension/removal, team-member
  removal, and transactional organization-visible audit events.
- Make archived organizations and teams ineffective during authorization and
  preserve the final active direct owner during membership changes.
- Allow invitations to carry one bounded direct role and reviewed team
  memberships, applied atomically with single-use acceptance.
- Add an atomic password-to-passkey migration ceremony that stores the first
  passkey, retires the password credential, revokes all sessions, and records
  the migration audit event in one transaction.

## v0.1.0-preview.6 — 2026-08-24

- Add an explicit mode-`0640` JSONL option for applications that authorize one
  narrowly scoped collector group, while keeping private mode `0600` as the
  default and rejecting permissive modes.
- Document the setgid-directory ownership boundary for Observatory-style
  collection without granting the collector broader application access.
- Make vendored dependency and public-snapshot verification portable across
  the maintained Linux gate and native macOS development environments.
- Keep Previews 1–5 immutable; applications select Preview 6 explicitly when
  adopting collector-readable request evidence.

## v0.1.0-preview.5 — 2026-08-21

- Add storage-neutral passkey registration, discoverable login, and
  operation-bound fresh assertions without adding self-registration, password
  fallback, TOTP, email recovery, or application-owned routes.
- Require exact HTTPS relying-party origins, user verification, discoverable
  credentials, no attestation conveyance, and an initial ES256-only algorithm
  policy.
- Add transactional SQLite credential, ceremony, enrollment, recovery, and
  last-credential protections with atomic single-use consumption.
- Add a neutral session-issuance boundary for independently verified
  credentials while retaining existing password behavior.
- Pin WebAuthn protocol verification to `github.com/go-webauthn/webauthn`
  `v0.17.1` and record its source identity, module checksums, licence, and
  transitive security boundary.
- Add self-service passkey enrollment and removal primitives with fresh
  assertion, session revocation, and last-credential protection.
- Keep Previews 1–4 immutable; applications select Preview 5 explicitly when
  adopting the passkey boundary.

## v0.1.0-preview.4 — 2026-08-18

- Add an explicit local-administrator password recovery operation without
  adding a public recovery endpoint or network protocol.
- Atomically install a one-time Argon2id credential, restore mandatory password
  rotation, revoke every session, and append a secret-free audit event.
- Prove transaction rollback when the audit event cannot commit and document
  private mode-`0600` delivery as application-owned policy.
- Keep Previews 1–3 immutable; applications select Preview 4 explicitly when
  adopting administrative recovery.

## v0.1.0-preview.3 — 2026-08-18

- Add cryptographically generated temporary credentials and an explicit
  password-change-required account state.
- Replace credentials, clear the requirement, and revoke all existing sessions
  in one repository transaction after verifying the current password.
- Migrate existing SQLite users with the new requirement disabled; applications
  continue to own first-login routing, private credential delivery, and audit
  policy.
- Keep Preview 1 and Preview 2 immutable; applications select Preview 3
  explicitly when adopting forced bootstrap rotation.

## v0.1.0-preview.2 — 2026-08-17

- Add storage-neutral organizations, teams, projects, environments, services,
  single-use invitations, and independently scoped access roles.
- Separate platform-level authentication roles from organization data access.
- Add expiring break-glass grants with transactional organization-visible audit
  events and a no-CGO SQLite implementation.
- Keep `v0.1.0-preview.1` immutable; applications adopt these additive packages
  by explicitly selecting Preview 2.

## v0.1.0-preview.1 — 2026-08-16

- Establish independent request metadata, logging, browser security, abuse,
  authentication, SQLite, and analytics package boundaries.
- Add a minimal 0BSD `net/http` starter.
- Fail closed when unsafe requests lack same-origin evidence or authentication
  middleware is constructed with invalid cookie/service configuration.
- Bound untrusted request-record byte and duration fields before aggregation.
- Support Linux as the maintained release platform; native Windows is not a
  release gate or compatibility promise.

No compatibility promise is made before a stable release.