# Changelog

## 2026-08-02 - 29.0.1

### Fixes

- type Development IdP persona capabilities as delegable authority (`devidp`)
  - Align the fixed persona authority contract with the exact capability type accepted by persisted user records.
- type Development IdP persona capabilities as delegable authority (devidp)
  - Aligns fixed persona authority contracts with the capability type accepted by persisted user records.

## 2026-08-02 - 29.0.0

### Breaking Changes

- make backend-service tag payload credential-free (tags)
  - Remove backendToken from the protected backend-service tag payload
  - Change ITag_BackendService payload to Record<string, never>
  - Clarify that backend tokens are only validated during registration and are not retained in connection tag state

## 2026-08-02 - 28.1.0

### Features

- add backend service connection registration request (request)
  - Adds IReq_RegisterBackendServiceConnection with a backendToken-only request and exact { registered: true } success response.
  - Exports the backend request contract and documents backend-service connection registration behavior.

## 2026-08-02 - 28.0.0

### Breaking Changes

- bind Development IdP personas to a closed platform authority profile (`devidp`)
  - Advance the Development IdP manifest to schema v3 and require the exact `platform-personas-v1` profile marker.
  - Derive ordinary-user, least-privilege moderator, and global-administrator authority only from the fixed persona name; reject caller-supplied widening fields.
  - Keep the result at schema v1 because its manifest fingerprint binds the complete authority profile and relying-party TLS inventory.
  - Align shared request contracts with `@api.global/typedrequest-interfaces` 5.1.1 for the upcoming coherent RPC stack.

## 2026-08-02 - 27.0.0

### Breaking Changes

- bind Development IdP relying-party URLs to an exact local TLS hostname inventory (`devidp`)
  - Advance only the Development IdP manifest to schema v2 and require `rpClient.tlsHostnames` as an already sorted, unique list of exact `localhost` or concrete `.localhost` names.
  - Require the declared TLS inventory to cover the hostname of `appUrl` and every redirect and post-logout URI while allowing explicit additional local surfaces such as `superadmin.localhost`.
  - Reject schema-v1 manifests rather than maintaining a parallel compatibility shape; the result stays schema v1 and namespace-derived identifiers remain unchanged.

### Fixes

- remove duplicate Development IdP changelog entry (changelog)
  - Remove redundant duplicate bullets for the Development IdP TLS hostname inventory change.

## 2026-08-01 - 26.5.0

### Features

- publish the exact local Development IdP contract (`devidp`)
  - Adds a dedicated `@idp.global/interfaces/devidp` export for strict manifest/result validation, canonical fingerprinting, fixed persona and hostname inventories, and deterministic namespace-owned identifiers.
  - Keeps runtime provisioning, persistence receipts, credentials, and authority decisions inside the idp.global app.
- add Development IdP contract subpath (devidp)
  - Expose @idp.global/interfaces/devidp with strict manifest and result validation, canonical fingerprinting, fixed inventories, and deterministic namespace-derived identifiers.
  - Add Node.js tests covering normalization, fingerprint stability, identifier derivation, and result-to-manifest binding.
  - Document the new devidp public API and package export.

## 2026-07-27 - 26.4.0

### Features

- export the canonical global-administration request inventory (request)
  - Classifies every platform-wide admin contract, including suspended-user deletion, so transports can enforce the private-surface boundary without duplicating method names.

## 2026-07-27 - 26.3.0

### Features

- preserve opaque OIDC authorization across registration (registration)
  - Add an optional transaction identifier to registration start and server-side registration-session data.
  - Return the authoritative stored transaction only after email proof and at registration completion so clients can resume the existing authenticated OIDC handoff.

## 2026-07-25 - 26.2.0

### Features

- add opaque OIDC authorization transaction inspection, completion, and denial contracts
- add opaque OIDC authorization V2 contracts (oidc-authorization)
  - Adds inspect, prepare, complete, and deny V2 typed request interfaces for OIDC authorization flows.
  - Models one-time transactionId handoff so OAuth request data can remain server-side.
  - Documents the OIDC V2 opaque browser handoff in the README and changelog.

## 2026-07-23 - 26.1.0

### Features

- add optional refresh token to registration completion response (registration)
  - Expose an optional refreshToken on registration completion responses when a session can be issued directly.
  - Document that clients should fall back to normal sign-in when no refresh token is returned.

## 2026-07-22 - 26.0.0

### Breaking Changes

- add email code verification contracts (auth)
  - Require codeHash and codeAttemptsRemaining on email action tokens and registration sessions
  - Add typed requests for login and registration email code verification

## 2026-07-18 - 25.2.1

### Fixes

- include administrator recovery events in activity DTO union (activity-dto)
  - Add administrator recovery DTO variants using the administrator_recovery target and null facts.
  - Add a type-level guard so every activity action remains represented in TActivityEventDto.
- update pnpm to 11.14.0 (package-manager)
  - Updates the packageManager field from pnpm@11.11.0 to pnpm@11.14.0.

## 2026-07-18 - 25.2.0

### Features

- add administrator recovery activity types (activity)
  - Added administrator recovery requested, activated, and completed activity actions.
  - Added administrator_recovery as an activity target type.

## 2026-07-18 - 25.1.0

### Features

- add administrator recovery state and request contracts (admin-recovery)
  - Add persisted and public DTO administrator recovery state types.
  - Expose administratorRecovery on user data and global admin DTOs.
  - Add typed admin requests for requesting and approving replacement-passkey recovery operations.

## 2026-07-18 - 25.0.0

### Breaking Changes

- add break-glass access contracts (break-glass)
  - Adds break-glass activity event and target types for request, activation, use, and review flows
  - Adds eligible global capabilities, user data state, public DTO state, and admin request contracts for request, approval, and review
  - Adds required breakGlassAccess to IGlobalUserAdminDto

## 2026-07-18 - 24.0.0

### Breaking Changes

- introduce capability-based authorization contracts (authorization)
  - Export global and tenant capability catalogs with delegable subsets.
  - Add direct global capability assignment request contract using user revision and operation id.
  - Require explicit capability lists on customer-defined organization role contracts.
  - Expose user global capability assignments and add global_capabilities_changed activity event.

## 2026-07-18 - 23.0.0

### Breaking Changes

- require two-step OIDC signing-key rotation approvals (admin)
  - Require operationId for rotateOidcSigningKey requests and return rotation status metadata.
  - Add approveOidcSigningKeyRotation request contract with expected active key validation.
  - Expose completion-only rotation results such as approvedAt, resultingActiveKid, and retiringKids.

## 2026-07-18 - 22.0.0

### Breaking Changes

- require encrypted delivery envelopes for confidential app secrets (admin)
  - Require confidential global app creation and credential regeneration to provide an operationId and RSA-OAEP-256 public key.
  - Replace plaintext clientSecret responses with durable encrypted secretDelivery envelopes.
  - Add acknowledgeAppSecretDelivery request to close pending deliveries after ciphertext verification.

## 2026-07-18 - 21.0.0

### Breaking Changes

- require jwt in authenticated setNewPassword requests (request/login)
  - Model setNewPassword as mutually exclusive authenticated password-change and recovery-token reset request variants.
  - Authenticated password changes now require both jwt and oldPassword; recovery-token resets continue to use tokenArg.

## 2026-07-18 - 20.0.1

### Fixes

- include global administrator grant and removal events in activity DTO union (activity-dto)
  - Add global_admin_granted and global_admin_removed activity events with account targets.
  - Align the browser-safe activity event DTO union with the published activity action contract.

## 2026-07-18 - next

### Breaking Changes

- require operation-bound encrypted delivery for confidential OIDC client secrets
  - Confidential global-App creation and client-secret rotation now require a caller-stable operation ID plus a canonical RSA-OAEP-256 delivery public key.
  - Responses return a durable encrypted delivery envelope instead of plaintext secret material.
  - Add an explicit acknowledgement request that irreversibly closes delivery after the caller verifies the ciphertext hash.
- require an authenticated password change to carry the caller's JWT in
  addition to the current password; recovery-token password resets remain a
  separate mutually exclusive request shape

### Fixes

- include global-administrator grant/removal events in the closed browser-safe
  activity-event DTO union, matching the published activity action contract

## 2026-07-18 - 20.0.0

### Breaking Changes

- expose user revision in global admin DTOs (dto)
  - Add required revision to IGlobalUserAdminDto for compare-and-set administration.
  - Document revision as the review token for global admin directory and mutation responses.

## 2026-07-18 - next

### Breaking Changes

- expose the exact current User revision in every global-user administration
  DTO so callers can satisfy the mandatory compare-and-set contract

## 2026-07-18 - 19.0.0

### Breaking Changes

- require a caller-stable operation id and exact reviewed User revision for
  every global-administrator grant/removal request
- require idempotency and revision guards for global admin changes (admin)
  - Add operationId to setGlobalAdmin requests for durable retry reconciliation
  - Add expectedUserRevision to enforce compare-and-set behavior for reviewed user state
  - Update documentation and type assertions for the stricter global admin contract

## 2026-07-18 - 18.0.0

### Breaking Changes

- add the controlled global-administrator lifecycle request and its closed
  grant/removal audit actions
- add controlled global administrator lifecycle contract (global-admin)
  - Add setGlobalAdmin typed request for granting or removing platform-wide administrator authority.
  - Add global_admin_granted and global_admin_removed activity actions for audit events.
  - Document MFA, distinct actor/target, compare-and-set, and last-active-admin requirements.

## 2026-07-18 - 17.0.0

### Breaking Changes

- require closed primary/MFA authentication evidence on every persisted login session so privileged freshness decisions cannot be inferred from refresh activity or mutable credential telemetry
- require authentication evidence on persisted login sessions (loginsession)
  - Add closed primary and MFA authentication evidence types for login sessions.
  - Require every persisted login session to include server-derived authentication evidence.
  - Document that refresh operations must not advance authentication timestamps.

## 2026-07-18 - 16.0.0

### Breaking Changes

- require lifecycle revision on SCIM token records (data)
  - Adds a required numeric revision field to IScimTokenRecord for exact no-upsert persistence.
  - Updates type assertions to verify SCIM token revisions are required.

## 2026-07-18 - 15.1.0

### Features

- expose the optional SCIM `meta.version` HTTP entity tag
- expose optional SCIM meta.version entity tag (scim)
  - Add optional version field to IScimMeta for SCIM HTTP entity tags.
  - Cover IScimMeta.version with a compile-time type assertion.

## 2026-07-17 - 15.0.0

### Breaking Changes

- restrict billing plan communications to an empty tuple (billingplan)
  - Change IBillingPlan.data.communications from Array<any> to [] to prevent persisted communication payloads until a typed record is introduced.
  - Add a type-level assertion covering the closed communications shape.

## 2026-07-17 - 14.0.0

### Breaking Changes

- represent ordinary nullable SmartData persistence values explicitly as
  `null`, including app role mappings, rotated refresh-token hashes,
  organization billing and role-definition data, and optional user profile,
  credential, administrator, and external-identity state
- expose nullable organization billing-plan state in the organization DTO while
  keeping absence-sensitive invitation, deletion-state, sparse-index, and
  lifecycle contracts unchanged
- require current login-session ownership and timestamps plus user creation
  timestamps, remove transient plaintext password and legacy embedded SCIM state
  from persisted users, and give registration its own minimal input contract

## 2026-07-16 - 13.1.0

### Features

- add `data.ILoginSession.data.transferTargetHash` so an outstanding transfer token, its expiry, and its canonical authorized target binding can be persisted and cleared atomically without storing a raw target URL
- document and test that `IReq_ExchangeRefreshTokenAndTransferToken` requires `transferTarget` for both transfer-token issue and consume requests

## 2026-07-16 - 13.0.0

### Breaking Changes

- remove persisted plaintext `refreshToken` fields from `data.IJwt` and `data.ILoginSession`; login-session persistence exposes hashed refresh-token state only
- remove the compatibility-only `data.IAppLegacy` shape and replace the transfer exchange request's `appData` field with `transferTarget: data.ITransferTarget`, containing only `appUrl`
- replace `IReq_GetPublicKeyForValidation` and `IReq_PushPublicKeyForValidation` with plural `IReq_GetPublicKeysForValidation` and `IReq_PushPublicKeysForValidation` contracts using the `getPublicKeysForValidation` and `pushPublicKeysForValidation` methods
- remove the singular top-level `publicKeyPem` payload from validation-key requests and responses; callers receive and push only the complete `publicKeys` keyset

## 2026-07-16 - 12.0.0

### Breaking Changes

- remove the public `data.IActivityLog` persistence shape, including raw user and target identifiers, caller-authored descriptions, IP addresses, user agents, and generic metadata
- replace `dto.IActivityEventDto` with the flat discriminated `dto.TActivityEventDto` union; activity responses now expose only finite actions, timestamps, outcomes, optional fixed reason codes, fixed target types, and allowlisted action-specific facts

### Maintenance

- update Node.js type definitions to 26.1.1

## 2026-07-11 - 11.0.0

### Breaking Changes

- remove the unsafe `loginWithApiToken` request contract; a future machine-credential API will use explicit scoped credentials rather than exchanging a long-lived token for a full user JWT
- remove `client_credentials` from OIDC app contracts because the token endpoint has no service-principal, audience, or machine-authorization implementation
- clarify that `confirmEmail` is visual confirmation only and passwordless account deletion fails closed until fresh-auth step-up is available
- define JWT blocklist pushes as complete persisted snapshots that replace consumer-local state rather than incremental append events

### Maintenance

- update Node.js type definitions to the newest supply-chain-mature 26.1.0 release

## 2026-07-10 - 10.0.0

### Breaking Changes

- revise OIDC, JWT, and organization contracts (contracts)
  - Require expanded public OIDC app configuration, including client type, post-logout redirect URIs, grant types, token lifetimes, and safe secret metadata.
  - Remove persisted OIDC secret and token storage records from public contracts while exposing JWT verification key sets for rotation.
  - Add organization status and suspension contracts plus expanded activity outcome metadata.

## 2026-07-10 - 9.3.0

### Features

- add SSO domain verification contracts (sso)
  - Define SSO domain verification status, DNS TXT challenge, and globally unique domain claim interfaces.
  - Expose optional domainVerifications on SSO connection DTOs.
  - Add verifySsoDomain typed request contract and sso_domain_verified activity type.
  - Update pnpm workspace package manager and build approval configuration.

## 2026-07-08 - 9.2.0

### Features

- add account deletion and org export contracts (governance)
  - IReq_DeleteAccount: self-service deletion with re-authentication (password, or confirmEmail for passwordless accounts), 7-day grace window before purge; org ownership blocks deletion
  - IReq_DeleteSuspendedUser: immediate admin purge of suspended accounts
  - IReq_ExportOrgData: owner-only cursor-paged export streaming redacted DTOs (TOrgExportRecord union)
  - IUser gains optional deletion {requestedAt, purgeAt}; TActivityAction gains account_deletion_requested/account_deletion_cancelled/account_purged

## 2026-07-08 - 9.1.0

### Features

- add cursor-paged user activity export contract (audit)
  - IReq_ExportUserActivity: opaque-cursor pagination with since/until filters for SOC2 evidence export and data portability

## 2026-07-08 - 9.0.0

### Breaking Changes

- remove legacy contracts (cleanup)
  - Removed IReq_SuspendUser — superseded by IReq_SetUserSuspension (suspend/unsuspend, returns the updated user)
  - Removed IReq_MobileVerificationForRegistration and the SMS fields/status on IRegistrationSession — the platform no longer provides an SMS sending service; registration completes after email validation

## 2026-07-08 - 8.0.1

- feat(admin): add global admin directory, user suspension, and profile update contracts
  - IReq_GetGlobalUsers: paged, searchable platform user directory (admin only)
  - IReq_SetUserSuspension: suspend/unsuspend a user; suspension revokes sessions and JWTs
  - IReq_GetGlobalOrgStats: platform org directory with member counts (admin only)
  - IReq_UpdateProfile: self-service name/username/mobile update (email deliberately excluded)
  - new IGlobalUserAdminDto; IUser gains optional createdAt; TActivityAction gains user_unsuspended
  - deprecated: IReq_SuspendUser (use IReq_SetUserSuspension), IReq_MobileVerificationForRegistration (platform SMS service removed)

## 2026-07-08 - 8.0.0

### Breaking Changes

- add enterprise SSO and SCIM contracts (sso)
  - New data contracts: ISsoConnection (org-level SAML connection with email-domain HRD, IdP cert rollover, provisioning modes, group-role mappings), IScimTokenRecord, and shared SCIM 2.0 wire types (IScimUserResource, IScimGroupResource, IScimListResponse, IScimPatchRequest, IScimError)
  - New DTOs: ISsoConnectionDto, IScimTokenDto, ISsoSpDetailsDto
  - New request contracts: getSsoConnections, createSsoConnection, updateSsoConnection, deleteSsoConnection, getSsoSpDetails, createScimToken, getScimTokens, revokeScimToken, and public discoverSsoForEmail
  - IUser gains optional externalIdentities and scim provisioning state
  - TActivityAction extended with sso_* and scim_* actions (breaking for exhaustive consumers)

## 2026-06-24 - 7.0.0

### Breaking Changes

- rename lole reception tag to backend service (tags)
  - Renames ITag_LolePubapi to ITag_BackendService and changes the tag name from lole-reception to backend-service.
  - Documents the dto namespace in package readmes.

## 2026-06-23 - 6.0.0

### Breaking Changes

- remove obsolete user request contracts and add suspended activity type (user)
  - Removed exported IReq_GetUserData, IReq_SetUserData, and IDeleteSuspendedUser request interfaces.
  - Added user_suspended to supported activity log event types.

## 2026-06-21 - 5.0.0

### Breaking Changes

- introduce DTO-based response contracts (contracts)
  - Add exported DTO interfaces for activities, alerts, apps, billing, invitations, MFA, organizations, passport, and users.
  - Update typed request response contracts to use DTO types instead of persisted data model types.
  - Remove the internal authorization request contract and rename registration validation response data to accountData.

## 2026-06-21 - 4.0.0

### Breaking Changes

- require PKCE parameters for OIDC authorization code flow (oidc)
  - Make code_challenge and code_challenge_method mandatory on authorization requests
  - Make code_verifier mandatory on authorization code token requests

## 2026-06-21 - 3.0.0

### Breaking Changes

- require PKCE parameters and refresh token family IDs (oidc)
  - Require codeChallenge and codeChallengeMethod on OIDC authorization code data and authorization request contracts.
  - Add required familyId to refresh token data for rotation family tracking.

## 2026-06-20 - 2.0.0

### Breaking Changes

- update invitation contracts for hashed tokens and JWT acceptance (userinvitation)
  - Split public invitation data from internal persisted records and expose tokenHash only on IUserInvitationRecord
  - Replace userId with jwt in the acceptInvitation request contract
  - Bump tsdoc and Node type dev dependencies

## 2026-06-10 - 1.2.0

### Features

- add backend token to JWT blocklist request (request/jwt)
  - Added optional backendToken support for authenticated GET blocklist retrieval.
  - Documented that backendToken is omitted for PUSH requests to avoid sending the secret to clients.

## 2026-05-19 - 1.1.0

### Features

- add MFA and passkey typed request contracts (interfaces)
  - adds TOTP, backup code, MFA challenge, passkey credential, and WebAuthn challenge data contracts
  - extends login responses with MFA challenge metadata for password and magic-link flows
  - exports typed request contracts for TOTP enrollment, backup codes, passkey login, and passkey MFA step-up

## 2026-05-18 - 1.0.1

### Fixes

- add SmartConfig project metadata and update development tooling versions (build)
  - adds .smartconfig.json with npm package, repository, and release target configuration
  - bumps @git.zone build/test/documentation tooling and @types/node devDependency versions

## 1.0.0

- Initial standalone extraction of idp.global shared interfaces.