Release v1.2.0

CHANGELOG.md

@@ -1,5 +1,23 @@
 # @hypercerts-org/lexicon
 
+## 1.2.0
+
+### Minor Changes
+
+- [#236](https://github.com/hypercerts-org/hypercerts-lexicon/pull/236) [`5439b36`](https://github.com/hypercerts-org/hypercerts-lexicon/commit/5439b36338e971bfe388b68b28618993066ff0f9) Thanks [@Ashex](https://github.com/Ashex)! - Add `app.certified.graph.entityFollow`, a follow record for non-account entities. `subject` is an open union currently offering only `app.certified.defs#recordSubject` (a record referenced by AT-URI without a CID, so the follow survives updates to the referenced record); account follows remain in `app.certified.graph.follow`. The new collection is also added to the `app.certified.authWrite` permission set so it is grantable alongside the other Certified records.
+
+- [#222](https://github.com/hypercerts-org/hypercerts-lexicon/pull/222) [`fa1c29a`](https://github.com/hypercerts-org/hypercerts-lexicon/commit/fa1c29afedf93661d733f12b0ab1eff2a5ba417e) Thanks [@aspiers](https://github.com/aspiers)! - Add three permission-set lexicons — `org.hypercerts.authWrite`, `org.hyperboards.authWrite`, and `app.certified.authWrite` — each granting create/update/delete over every record collection in its namespace.
+
+  A [permission set](https://atproto.com/specs/permission#permission-sets) lets any AT Protocol app request a whole bundle of `repo:` scopes with a single `include:<nsid>` OAuth scope, instead of enumerating each collection by hand. The user's PDS resolves and expands the set during the OAuth grant; the same published set can also be consumed by services (e.g. the Certified group service) when expanding API-key scopes.
+
+  There are **three** sets rather than one because the spec requires it: a permission set "is limited to expressing permissions that reference resources under the same NSID namespace as the set itself" and "can not address 'sibling groups' or 'parents'". `org.hypercerts`, `org.hyperboards`, and `app.certified` are separate namespace authorities, so they cannot be combined in a single set — an app needing more than one requests each `include:` scope.
+
+  Permission sets are published as-is (they are the source of truth for what gets published to AT Protocol) but have no TypeScript shape — `lex gen-api` cannot generate code for `permission-set` defs. They are therefore excluded from the codegen globs (`gen-api`/`gen-md`/`gen-ts`) and from `generated/exports.ts`, while still shipping as raw lexicon JSON.
+
+  Collection lists are enumerated explicitly because the spec forbids wildcards inside a permission set; they must be kept in sync as record types are added. See `docs/design/permission-sets.md`.
+
+  The generated `SCHEMAS.md` reference now renders permission-set entries (title, detail, and the resource/collections/actions each set grants) instead of leaving them as empty sections.
+
 ## 1.1.0
 
 ### Minor Changes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypercerts-org/lexicon",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "ATProto lexicon definitions and TypeScript types for the Hypercerts protocol",
   "type": "module",
   "main": "./dist/index.cjs",