From 03646b225775763f9cdd5efe2ff24623e6314dbd Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 11:41:16 +0000 Subject: [PATCH] Release --- .changeset/add-graph-entity-follow.md | 5 ----- .changeset/permission-sets-crud.md | 15 --------------- CHANGELOG.md | 18 ++++++++++++++++++ package-lock.json | 4 ++-- package.json | 2 +- 5 files changed, 21 insertions(+), 23 deletions(-) delete mode 100644 .changeset/add-graph-entity-follow.md delete mode 100644 .changeset/permission-sets-crud.md diff --git a/.changeset/add-graph-entity-follow.md b/.changeset/add-graph-entity-follow.md deleted file mode 100644 index 0b531610..00000000 --- a/.changeset/add-graph-entity-follow.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@hypercerts-org/lexicon": minor ---- - -Add `app.certified.graph.entityFollow`, a follow record for non-account entities. `subject` is an open union currently offering only `app.certified.defs#recordSubject` (a record referenced by AT-URI without a CID, so the follow survives updates to the referenced record); account follows remain in `app.certified.graph.follow`. The new collection is also added to the `app.certified.authWrite` permission set so it is grantable alongside the other Certified records. diff --git a/.changeset/permission-sets-crud.md b/.changeset/permission-sets-crud.md deleted file mode 100644 index 82c89962..00000000 --- a/.changeset/permission-sets-crud.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"@hypercerts-org/lexicon": minor ---- - -Add three permission-set lexicons — `org.hypercerts.authWrite`, `org.hyperboards.authWrite`, and `app.certified.authWrite` — each granting create/update/delete over every record collection in its namespace. - -A [permission set](https://atproto.com/specs/permission#permission-sets) lets any AT Protocol app request a whole bundle of `repo:` scopes with a single `include:` OAuth scope, instead of enumerating each collection by hand. The user's PDS resolves and expands the set during the OAuth grant; the same published set can also be consumed by services (e.g. the Certified group service) when expanding API-key scopes. - -There are **three** sets rather than one because the spec requires it: a permission set "is limited to expressing permissions that reference resources under the same NSID namespace as the set itself" and "can not address 'sibling groups' or 'parents'". `org.hypercerts`, `org.hyperboards`, and `app.certified` are separate namespace authorities, so they cannot be combined in a single set — an app needing more than one requests each `include:` scope. - -Permission sets are published as-is (they are the source of truth for what gets published to AT Protocol) but have no TypeScript shape — `lex gen-api` cannot generate code for `permission-set` defs. They are therefore excluded from the codegen globs (`gen-api`/`gen-md`/`gen-ts`) and from `generated/exports.ts`, while still shipping as raw lexicon JSON. - -Collection lists are enumerated explicitly because the spec forbids wildcards inside a permission set; they must be kept in sync as record types are added. See `docs/design/permission-sets.md`. - -The generated `SCHEMAS.md` reference now renders permission-set entries (title, detail, and the resource/collections/actions each set grants) instead of leaving them as empty sections. diff --git a/CHANGELOG.md b/CHANGELOG.md index 4a811731..3bab237c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,23 @@ # @hypercerts-org/lexicon +## 1.2.0 + +### Minor Changes + +- [#236](https://github.com/hypercerts-org/hypercerts-lexicon/pull/236) [`5439b36`](https://github.com/hypercerts-org/hypercerts-lexicon/commit/5439b36338e971bfe388b68b28618993066ff0f9) Thanks [@Ashex](https://github.com/Ashex)! - Add `app.certified.graph.entityFollow`, a follow record for non-account entities. `subject` is an open union currently offering only `app.certified.defs#recordSubject` (a record referenced by AT-URI without a CID, so the follow survives updates to the referenced record); account follows remain in `app.certified.graph.follow`. The new collection is also added to the `app.certified.authWrite` permission set so it is grantable alongside the other Certified records. + +- [#222](https://github.com/hypercerts-org/hypercerts-lexicon/pull/222) [`fa1c29a`](https://github.com/hypercerts-org/hypercerts-lexicon/commit/fa1c29afedf93661d733f12b0ab1eff2a5ba417e) Thanks [@aspiers](https://github.com/aspiers)! - Add three permission-set lexicons — `org.hypercerts.authWrite`, `org.hyperboards.authWrite`, and `app.certified.authWrite` — each granting create/update/delete over every record collection in its namespace. + + A [permission set](https://atproto.com/specs/permission#permission-sets) lets any AT Protocol app request a whole bundle of `repo:` scopes with a single `include:` OAuth scope, instead of enumerating each collection by hand. The user's PDS resolves and expands the set during the OAuth grant; the same published set can also be consumed by services (e.g. the Certified group service) when expanding API-key scopes. + + There are **three** sets rather than one because the spec requires it: a permission set "is limited to expressing permissions that reference resources under the same NSID namespace as the set itself" and "can not address 'sibling groups' or 'parents'". `org.hypercerts`, `org.hyperboards`, and `app.certified` are separate namespace authorities, so they cannot be combined in a single set — an app needing more than one requests each `include:` scope. + + Permission sets are published as-is (they are the source of truth for what gets published to AT Protocol) but have no TypeScript shape — `lex gen-api` cannot generate code for `permission-set` defs. They are therefore excluded from the codegen globs (`gen-api`/`gen-md`/`gen-ts`) and from `generated/exports.ts`, while still shipping as raw lexicon JSON. + + Collection lists are enumerated explicitly because the spec forbids wildcards inside a permission set; they must be kept in sync as record types are added. See `docs/design/permission-sets.md`. + + The generated `SCHEMAS.md` reference now renders permission-set entries (title, detail, and the resource/collections/actions each set grants) instead of leaving them as empty sections. + ## 1.1.0 ### Minor Changes diff --git a/package-lock.json b/package-lock.json index ee7ff5db..306fc856 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@hypercerts-org/lexicon", - "version": "1.1.0", + "version": "1.2.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@hypercerts-org/lexicon", - "version": "1.1.0", + "version": "1.2.0", "license": "MIT", "dependencies": { "@atproto/lexicon": "^0.6.0", diff --git a/package.json b/package.json index e8e9bf7f..715fa896 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@hypercerts-org/lexicon", - "version": "1.1.0", + "version": "1.2.0", "description": "ATProto lexicon definitions and TypeScript types for the Hypercerts protocol", "type": "module", "main": "./dist/index.cjs",