active-svelte/CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

This project follows Keep a Changelog and Semantic Versioning once 0.1.0 is tagged.

[Unreleased]

Added

• Release-readiness checklist in docs/before_0_1.md.
• Root documentation site under /active.
• Versioning and deprecation policy page under /active/get-started/versioning.
• Full ecosystem integration harness under /test/ecosystem.
• Server/client split for authentication, permissions and cache.
• Rate-limit port wiring for critical authentication flows.
• Runtime warnings for memory auth/cache adapters in production mode.
• OAuth PKCE regression tests for persisted verifier handling.
• Public-surface regression tests for the composed App root and its always-on/scoped artifacts.
• Permission client regression coverage for stale check, batch and what responses after actor changes.
• Bundle smoke script for the minimal createActiveApp({}) runtime budget.
• Static smoke script for generated docs/test routes and public app assets.

Changed

• MFA is excluded from the stable auth engine surface until it is implemented end-to-end.
• CSRF cookie defaults are verified as strict in auth regression tests.
• Mono-lang is documented as a type-loose null-object fallback when no schema is configured.

Security

• Added security policy and pre-0.1.0 threat-model notes.

[0.1.0] - Unreleased

Initial public stabilization target.