@open-charging-cloud/wwcp-poi 0.1.1 → 0.3.0

package/CHANGELOG.md

@@ -2,6 +2,388 @@
 
 ## Unreleased
 
+
+## 0.3.0 (prepared; not yet published)
+
+WWCP_POI3 as the measure: a roaming network is read as WWCP_POI3 reads it and refused in its words, change sets apply
+what WWCP_POI3 applies (the entities a party embeds, element changes, preconditions, no lastChange going back),
+histories require the signature roles WWCP_POI requires and take a checkpoint with the signatures that verify, and EV
+Taler phase 2 checks the steps and the settlement of a session. Each of them is probed against WWCP_POI3, what differs
+named below, and the vectors of WWCPPOIConformanceTests `215023a` hold, none deviating. See [Migration](#migration)
+before upgrading: versions, change sets and signatures 0.2.0 took are refused, and the types of three properties change.
+
+- A roaming network is read as WWCP_POI3 reads it (`RoamingNetwork.TryParse` and the TryParse of every entity) and
+  refused in its words and its order: JSON types, mandatory properties, values, identifications, names of enumerations,
+  currencies, URLs, timestamps, texts in languages, data licenses, and what the constructor of each entity refuses of
+  what it read (`src/network/reading.ts`, `poiJSON.ts`, `poiValues.ts`). Every kind of entity it reads: the roaming
+  network and its operator; charging station operators with their pools, stations, EVSEs, connectors, energy meters,
+  templates, groups, tariffs, tariff templates, groups and offers, brands and parking spaces; manufacturers of charging
+  stations and energy meters with their models, transparency software manufacturers with their releases, conformity
+  assessment bodies, e-mobility providers, grid operators with their grid connection points, parking operators.
+- The references the constructor of the roaming network checks, and the identifications it keeps unique among them,
+  interleaved in its order (`references.ts`): manufacturers, models, hardware revisions and firmware versions, releases,
+  certificates, grid connection points, charging stations, parking spaces and maintainers the network does not have, a
+  station or an energy meter contradicting its model, a key of two parties. After the last change of a change set, bare,
+  in the order of `RoamingNetwork.ChangeSets.cs`, a reference the version before resolves named as one the change set
+  withdrew. They replace the separate checks of identifications, versions, certificates, EV Taler and keys of parties.
+- 1268 versions probed against WWCP_POI3 at 89d2e02 are taken and refused alike, in the same words, but for nine agreed:
+  five identifications of the roaming network and its operator given as numbers, which keep the words of this library
+  for WWCP_POI3 to take, and four messages of the CBOR and COSE libraries.
+- Values WWCP_POI3 writes otherwise than given are refused in the words of its written form (`writtenForm.ts`): a
+  number, a boolean or a text given as another JSON type it reads it of (`"0.390"` as 0.390, `"TRUE"` as true, 5 as
+  `"5"`), coordinates of texts and booleans, durations in seconds in whole ticks of 100 ns without trailing zeros (1.50
+  as 1.5), the width and height of an image; opening times as Styx writes them, `24/7` always, hours `HH:mm`, periods
+  UTC, empty lists and free texts left out; NUTS codes in upper case, a list written otherwise compared element by
+  element with the one WWCP_POI3 writes; addresses with their countries by their alpha-3 codes, their street, postal
+  code and time zone trimmed, their other texts as given and left out where empty, their languages in lower case,
+  nothing else. A country is read as `Country.TryParse` of Styx reads it, of its 251 countries (`countries.ts`): by its
+  alpha-2 or alpha-3 code in any case, its numeric code, its calling code or one of its names, and refused where it
+  names none. Of 164 more versions probed against WWCP_POI3 at 89d2e02, 163 are taken and refused alike, in the same
+  words; the one left gives a number with an exponent, which the probe writes otherwise before WWCP_POI3 reads it.
+- Two charging tariff offers of an operator must not overlap (`offers.ts`, `OverlappingOffers` of WWCP_POI3, SPECIFICATION.md
+  9.4): covering one EVSE, for some of the same sessions (ad hoc, or contracts of a provider both name, or one names
+  none), at some of the same times within their `notBefore` and `notAfter`, both inclusive, and their opening times in the
+  time zone of the EVSE's charging pool, with what its templates give it, else UTC; local times as `TimeZoneInfo`
+  converts them, one a change to daylight saving time skips the first after it, one it gives twice the one of standard
+  time; exceptional closings
+  close, exceptional openings open. Refused in its words, at the first EVSE in the ordinal order, as the constructor of
+  the operator refuses it, also after a change set. After a change set also two offers of an e-mobility provider the
+  change set changed that overlap and did not in the version before (`NewProviderOfferOverlap`); by the changes of
+  others they may. Of 64 versions probed against WWCP_POI3 at d1c41ca, all are taken and refused alike, in the same
+  words, also those of time zones a charging pool may not name.
+- The time zone of a charging pool or a charging pool template is one of a region of the IANA time zone database, as
+  the database writes it, which this platform knows (`timeZones.ts`, `POITimeZones` of WWCP_POI3 `d1c41ca`,
+  SPECIFICATION.md 9.4, D17 of the conformance tests): `Europe/Berlin`, also an older name the database keeps for one,
+  `Asia/Kolkata` as `Asia/Calcutta`, or of a part of a region, `America/Argentina/Buenos_Aires`. No name of another
+  system (`W. Europe Standard Time`), none without a region (`CET`, `UTC`, `Etc/GMT-1`, `US/Eastern`), none in another
+  case (`europe/berlin`), none the platform does not know: refused in the words of WWCP_POI3 as the constructor of the
+  pool or template refuses it, trimmed, after its images, no longer taken as UTC, nor a Windows name as its IANA name.
+  The case is the one Temporal gives (Node 26); without Temporal (Node 22 and 24) Intl gives it of a name, but of an
+  older name only the name it stands for, so an older name is then taken in any case (`Asia/KOLKATA`). Of 92 versions
+  probed against WWCP_POI3 at `d1c41ca`, 90 are taken and refused alike, in the same words; the two left name
+  `America/Ciudad_Juarez` and `Antarctica/Troll`, which .NET on Windows does not find, and this library takes, as Node
+  knows them: databases of different age know different names (SPECIFICATION.md 9.4). `poi-refusals.json` of
+  WWCPPOIConformanceTests vendored again without the marker of D17: its 10 time zones are refused by their reasons.
+- A measurement public key is a key as BouncyCastle 2.7.0 makes one, as WWCP_POI3 checks it (`measurementPublicKey.ts`,
+  `MeasurementPublicKey.TryCheck`), refused in its words and those of BouncyCastle: a SubjectPublicKeyInfo of DER
+  (`ber.ts`), of RSA, also of PSS and OAEP, its modulus odd, of no prime factor up to 743, of 16384 bits at most and no
+  prime, its exponent odd (`rsa.ts`); of EC on the 84 named curves BouncyCastle knows (`curves.ts`, taken from it), a point
+  it decodes, compressed, uncompressed or hybrid, on its curve and of its order (`ecc.ts`); of Ed25519 and Ed448 a point
+  of no small order; of X25519, X448, ML-DSA, ML-KEM and SLH-DSA of their lengths; of DSA in its group. Its certificates
+  DER, as X509CertificateParser reads them, the first of the key, each one issued by the next one, its signature of
+  ECDSA, DSA, RSA of PKCS #1 v1.5 or PSS, Ed25519, Ed448 or ML-DSA verified with the key of the next one
+  (`certificates.ts`). Of 242 keys and chains of BouncyCastle and variants of them probed against WWCP_POI3 at 89d2e02,
+  237 are taken and refused alike, in the same words; taken as given, where WWCP_POI3 checks them: points on curves over
+  binary fields, explicit curve parameters, keys of Diffie-Hellman, ElGamal, GOST and DSTU. Not verified, so refused: a
+  certificate signed with GOST, SM2 or SLH-DSA.
+- Other words: decimals in messages invariant and line breaks `\n`, where WWCP_POI3 writes them in the culture of its
+  machine and `\r\n`; timestamps `DateTimeOffset` reads and the written form refuses, refused as invalid; an error of an
+  entity changed by a change set without the `Change N:` of WWCP_POI3.
+- A price statement reads its price status as WWCP_POI3 reads it (`ChargingPrices.TryParse`), in its words and order,
+  under its "Invalid price status of the price statement:": the prices of each charging tariff once, the tariff named
+  by its identification `{operatorId}*T{suffix}` (SPECIFICATION.md 2, 12.1, D16 of the conformance tests), their
+  elements, at least one, as a tariff has them, no property or JSON-LD context besides. A statement naming another text
+  is no price statement: the price evidence of a session holding one has invalid signatures, as WWCP_POI3 gives it
+  (`sessionPrice-foreign-tariff`), not valid ones of a tariff outside the references of its EVSE.
+- The nine vectors of WWCPPOIConformanceTests `fde40c9` vendored, `poi-refusals.json` of 129 vectors (a version naming a
+  charging tariff not as `{operatorId}*T{suffix}`), and `poi-verifier.json`, new here: 106 checks of the verifier
+  extensions, meter keys, historical meter evidence, session prices, trust transitions, keys of charging documents,
+  trust policy identifications, digests of key statements, offer hashes and publication receipts, against the POI
+  fixtures of ChargyWebApp at `fc513cd`, vendored as `tests/vectors/chargy-fc513cd`. Run in `tests/conformance.test.ts`
+  as WWCPPOIConformanceTests runs them against this library: a refusal after its control, by its reason; none deviates.
+- `poi-refusals.json` of WWCPPOIConformanceTests `7d43d4b` vendored (`586a339` before a rebase there), of 142 vectors:
+  13 price statements whose price status is none WWCP_POI3 reads (without one; its prices not an array; the prices of a
+  tariff not an object; a property or a JSON-LD context besides, of the status or of the prices of a tariff; a tariff
+  not named `{operatorId}*T{suffix}` or named twice, also in another spelling; its elements empty, one not an object or
+  without price components), refused as both read them, in the words both give. None deviates.
+- `poi-refusals.json` of WWCPPOIConformanceTests `ed91741` vendored, of 273 vectors: 131 versions built from the tests
+  of this library and read as WWCP_POI3 reads them, 59 of reading, 18 of references, 33 of written forms, 11 of offers,
+  10 of measurement public keys, refused in the words both give. None deviates. Two of them, offers of `Europe/Berlin`,
+  WWCP_POI3 takes where .NET runs without ICU, as it then finds no IANA time zone and compares them in UTC (O5 there).
+- `@vanaheimr/cose` 0.14.0, the codec still `@vanaheimr/metrological-cbor` 0.12: a key of a party of key type RSA (3) is
+  read as Styx reads it, identified by its RFC 9679 thumbprint over n and e, and taken as WWCP_POI3 takes it; 0.12.0
+  refused it, "Invalid COSE key: The curve of a COSE key must be an integer!". POI names no signature algorithm of RSA
+  (SPECIFICATION.md 4), so such a key signs nothing this library verifies, as before.
+- `@vanaheimr/cose` 0.15.0, the codec still `@vanaheimr/metrological-cbor` 0.12. It reads and verifies the
+  countersignature of RFC 8152 and holds a key an X.509 certificate writes as `id-RSASSA-PSS` to RSASSA-PSS, as Styx
+  `7642de3d` does. This library uses neither, and reads and verifies its keys and signatures as with 0.14.0. For
+  development, Playwright 1.65.0 and Vite 8.3.6. TypeScript stays at 6.0: typescript-eslint 8.72.1 requires a version
+  below 6.1, and its typed linting needs the compiler API that TypeScript 7 does not ship.
+- `poi-refusals.json` of WWCPPOIConformanceTests `d388929` vendored, of 283 vectors: 10 versions naming a time zone of a
+  charging pool or a charging pool template that is none of a region of the IANA time zone database, refused by WWCP_POI3
+  since `d1c41ca` and taken by this library, marked as its deviation (D17 there).
+- A change set changes the entities a party embeds, as WWCP_POI3 applies them (`apply.ts`; RoamingNetwork.OfferChanges.cs,
+  ProviderChanges.cs, GridChanges.cs and ParkingChanges.cs): the charging tariff offers of charging station operators
+  and e-mobility providers, the EVSE, charging station and charging pool groups of e-mobility providers, the grid
+  connection points of grid operators, the parking garages, spaces, sensors, space templates, space groups and products
+  of parking operators and the parking spaces of charging station operators. Added to the party an `Add` names as its
+  parent, found by its identification as its type compares it, e.g. a parking product with case, the properties a change
+  set may change, in the words of WWCP_POI3; with their timestamps, but a grid connection point and a parking product,
+  which have none. Owned by the party embedding them (4.1), the offers by keys that may sign `tariffs`, the others
+  `infrastructure`; a grid connection point by its maintainer, its maintainer changed by it, its grid operator or the
+  identity keys of the roaming network operator; also after the earlier changes of the change set, which may add or
+  remove them or their party. 0.2.0 refused them as not supported. Of 107 change sets probed against WWCP_POI3 at
+  `d1c41ca` (`CreateChangeSet`), the 50 it takes lead to the same content here, and the 57 it refuses are refused here
+  too, 34 in the same words; the others in the words of the entity read again without `Change N:`, of the change as
+  WWCP_POI3 parses it, or of the written form, where WWCP_POI3 names a property of infrastructure a change set may not
+  change.
+- The `effectiveLastChanges` of a snapshot are read as WWCP_POI3 reads them (`TryTakeEffectiveFloors`,
+  POIEffectiveLastChange): absent or `null`, or an array of `{entityType, entityId, lastChange}`, a JSON-LD context only
+  its own, the timestamp in a form `DateTimeOffset` reads; refused otherwise in its words, "The effective last changes of
+  a snapshot must be a JSON array!", "Invalid effective last change '{…}' of a snapshot!". 0.2.0 took any. They are the
+  floors of the `lastChange` of effective members POI_API keeps at runtime (SPECIFICATION.md 8.8, point 3), found again
+  for what a change set changes; the effective tree takes the `lastChange` of an effective member without them (8.1),
+  as WWCP_POI3 does (`EffectiveChargingPoolsOfTheContent`), so this library reads them and keeps none.
+- The preconditions of a change set hold, as WWCP_POI3 checks them (`preconditions.ts`; RoamingNetwork.Preconditions.cs,
+  SPECIFICATION.md 4): each names the ETag an entity still has in the version the change set is applied to, after its
+  `beforeETags` and before its changes, over the entity as the roaming network embeds it, with everything it embeds, its
+  canonical JSON or its deterministic CBOR, in the hash algorithm it names. The entity is found by its type and
+  identification as its type compares it, e.g. `DEGEFP1` as `DE*GEF*P1`, among the entities a change set addresses on
+  their own (`Flatten`), not a model, which is unique within its manufacturer only, as in WWCP_POI3. Refused otherwise in
+  its words, "The change set does not fit this version of the roaming network: Precondition 0: the ChargingPool
+  'DE*GEF*P1' changed, it no longer has the ETag json:sha256:hex:…!", and a precondition not read as it reads one in a
+  change set, "Invalid precondition 1!". 0.2.0 refused change sets with preconditions as not supported. Of 79 change sets
+  with preconditions probed against WWCP_POI3 at `d1c41ca`, ETags of 40 entities of every kind among them, all are taken
+  and refused alike, 70 in the same words, the others refused when read, where the probe reads a precondition on its own.
+- A change set changes elements, as WWCP_POI3 applies them (`elements.ts`, `apply.ts`; POIElements.cs and
+  RoamingNetwork.ElementChanges.cs): `AddElement`, `RemoveElement`, `ReplaceElement`, `UpdateElementProperty` and
+  `RemoveElementProperty` address an element of a property of an entity by their element path, e.g.
+  `chargingConnectors['1'].format`, an element of an array by its identification, as the type of the identifications of
+  the property compares them, e.g. `EVSEIds` without case, any other ordinally; an added element where the ordinal order
+  puts it, in `templateIds` at the end; an array left without elements removed. Each amounts to the `UpdateProperty` or
+  `RemoveProperty` of the property its path starts with, checked and owned as that change (4.1), its old value compared
+  with the element, or the property of the element, it addresses; keys and tree hash algorithms are changed as a whole
+  only. Element changes WWCP_POI3 does not make are refused when the change set is read: an element change without an
+  element path, another change with one, a new value of JSON `null`, of each kind of change what it does not take, e.g.
+  an `AddElement` with an old value, a segment of a path without a property name or with an empty identification.
+  0.2.0 refused element changes as not supported. The properties of charging pools, stations, EVSEs, tariffs, groups and
+  templates a change set may change are those of WWCP_POI3 (RoamingNetwork.InfrastructureChanges.cs), refused otherwise
+  in its words, e.g. "the property 'chargingStations' of a charging pool can not be changed!", and an infrastructure
+  entity is named as WWCP_POI3 names it, e.g. "the charging tariff 'DE*GEF*T_AC'". Of 108 element changes probed against
+  WWCP_POI3 at `d1c41ca` (`CreateChangeSet`), the 47 it takes lead to the same content here, and the 61 it refuses are
+  refused here too, 31 in the same words; the others in the words of the entity read again without `Change N:`, of an
+  old value without the value found, or of a change as this library reads it. Of the 107 change sets of embedded
+  entities probed before, 93 are now in the same words.
+- The elements of the prices of a charging tariff in a price statement are written as a charging tariff holds them
+  (SPECIFICATION.md 12.1, WWCP_POI3 `5a72313`, D18 of the conformance tests), as a version holds the elements of a tariff:
+  an element, a price component or restrictions naming a property their type does not define, a number given as a text,
+  the days of the week out of their order, the JSON-LD context of an embedded object are refused before the signature,
+  "'elements[0].restrictions.maxStateOfCharge' of the prices of the charging tariff 'DE*GEF*T_DC' is not written as a
+  charging tariff holds it: the content leaves it out!" under "Invalid price status of the price statement: ". A reader
+  not knowing a restriction would else price a session where its signer did not. The written form knows the
+  restrictions of an element now (`startTime` to `reservation`, as ChargingTariffRestrictions writes them): a version
+  naming another one, e.g. `maxStateOfCharge`, is refused, which 0.2.0 took. The price evidence of a session whose
+  statement names a restriction of OCPI, e.g. `max_kwh`, has invalid signatures now (`sessionPrice-conditional-price`).
+  `poi-refusals.json` and `poi-verifier.json` of WWCPPOIConformanceTests `c540c7f` vendored, 290 vectors, 7 of them new;
+  none deviates.
+- `poi-histories.json` of WWCPPOIConformanceTests `bc4e5a0` vendored: the 13 replays this library left to WWCP_POI3
+  (`notApplicable`) hold here as well and are replayed: the references a version holds, e.g. `station-*`, `meter-*`,
+  `withdrawn-while-named-*`, checked since `813e1d7`, and the changes of the groups of a provider and of grid connection
+  points, applied since `1946013`, each refused in the words of its reason. `tests/conformance.test.ts` 760.
+- `poi-histories.json` of WWCPPOIConformanceTests `70deea0` vendored: 14 replays of the entities a party embeds, as
+  `1946013` applies them, in `history-parties`: offers of an operator, signed for `tariffs`, not overlapping; an offer
+  and groups of a provider, signed by the provider, not by the operator of the same prefix; a grid connection point
+  handed on and named in one change set, by its new maintainer (csharp-review 9); parking data of a parking operator
+  and the parking space of a charging station operator, each signed by its own party. `tests/conformance.test.ts` 774.
+- `poi-verifier.json` of WWCPPOIConformanceTests `aef4b38` vendored, with the price evidence of sessions it makes itself
+  (`tests/vectors/chargy/POIPrices`): the cases of `POIPrices` of ChargyWebApp `fc513cd`, every signature
+  deterministic. 23 `sessionPrice-*` vectors check the same as before on them; `-foreign-tariff` and
+  `-conditional-price` stay on the fixtures. Two new ones are taken: `-tariff-of-another-evse`, a genuine price of a
+  tariff of the pattern `{operatorId}*T{suffix}` the EVSE does not name, of which none applies, and
+  `-conditional-element`, an element restricted by `maxEnergy`, whose price is selected without a rate.
+  `tests/conformance.test.ts` 776.
+- Transparency software releases and certificates are identified under their owners, as WWCP_POI3 `045e180` checks it
+  (SPECIFICATION.md 4.1, POI3-ISSUES.md S36, `ForeignTransparencySoftware`, `ForeignConformityCertificate`,
+  `IsIdentifiedUnder`): the `@id` of a release is the `@id` of its manufacturer, a colon and a name without one
+  (`GraphDefined:chargy-1.5.0`), of a certificate the `@id` of the body issuing it alike (`PTB:2026-0042`), the prefix
+  compared without case, both trimmed as read. A version holding one identified otherwise is refused before releases or
+  certificates given twice, in its words: "The transparency software release 'chargy-1.5.0' of the manufacturer
+  'GraphDefined' is not identified as one of it: by 'GraphDefined:' and a name without a colon!"; so is a change set
+  leading to one, after the unknown parking spaces and before the releases given twice. References name them as before.
+  Of 38 versions and change sets probed against WWCP_POI3 at `045e180`, all are taken and refused alike, in the same
+  words. `tests/releaseIdentifications.test.ts`.
+- The test vectors of a new run of the C# examples, `tests/vectors/csharp-045e180` in place of `csharp-33447ac`: WWCP_POI
+  `045e180`, examples A1 to A15, MakeProofs at `2026-11-05T19:46:00.000Z` (`tests/at.ts`). Releases and certificates
+  under their owners (`GraphDefined:chargy-1.5.0`, `PTB:2026-0017`, `PTB:2026-0042`); example A15 names the EV Taler
+  merchant of DE*GEF, so the head of epoch 2 is revision 11, while `QA.json` stays revision 8, as example A14 left it.
+  With them `poi-history.json` (100 vectors), `poi-refusals.json` (296, 6 of them of S36), `poi-histories.json` (75
+  replays, 8 of them of S36, the histories naming releases and certificates under their owners) and `poi-qidigital.json`
+  of WWCPPOIConformanceTests `2d0780f`. The tests on QA hold the values of the new run; those WWCP_POI3 calculated of
+  changed versions (element and embedded changes, preconditions, EV Taler) are calculated again by WWCP_POI3 at
+  `045e180`, and this library takes the very same versions. `tests/conformance.test.ts` 794.
+- Required signature roles, as WWCP_POI `12e993a` checks them (POI3-ISSUES.md S24): `requiredSignatureRoles` of a history,
+  the roles a commit must be signed in, refused before it is applied where it has no signature in one ("The commit '…'
+  is not signed in the role '…'!"), and once its signatures are verified where none of them is by a key the version it
+  leads to lets sign in that role ("… by a key that may sign in it!", `keyMaySignIn`): in the role of the roaming
+  network operator a signing key certified for it, in the role of a charging station operator a signing key of the
+  operator its signer names; leaders and witnesses are the verifier's. So also the commit of a snapshot.
+  `requiredCheckpointSignatureRoles`, the roles a checkpoint must be signed in ("The checkpoint '…' is not signed in the
+  role '…'!"). A signed commit without a verifier is refused before it is applied, as WWCP_POI does. Signatures of one
+  key in one role, e.g. the twin of an ECDSA signature (S11), are kept as given, each verified, and counted once by the
+  holder or witness they are of, as WWCP_POI `f7b8643` reads them too (SPECIFICATION.md 5.4): it kept the first alone
+  since `12e993a`, so a forged signature behind a genuine one of its key went unchecked. `tests/signatureRoles.test.ts`.
+- A checkpoint is taken with the signatures that verify here, as WWCP_POI `399b7c8` takes it (POI3-ISSUES.md S39,
+  SPECIFICATION.md 10.2): `verifyCheckpoint` of a history returns those of its signatures that verify, and the history
+  keeps the first of each key and role of them; one that does not verify, invalid or by a key not trusted here, is left
+  out, not refused, so that nobody blocks a checkpoint by adding a signature, and a witness trusted elsewhere and not here
+  keeps none from it. The roles a checkpoint must be signed in are counted among them: before, a role of a signature
+  `verifyCheckpointSignatures` passed over counted ("The checkpoint '…' is not signed in the role '…' by a signature that
+  verifies here!", and why the first one was left out). `takeCheckpoint` and a snapshot of a checkpoint hold it with
+  those only (`Checkpoint.withSignaturesOnly`). `verifyCheckpointSignatures` returns them as `verified`. The type of
+  `verifyCheckpoint` is now `(checkpoint) => readonly RoleSignature[] | undefined`: `undefined`, every signature verifies,
+  as before; a callback of a block without `return` is typed `void` and is no longer one.
+- A signature of a commit or checkpoint is read as WWCP_POI3 reads it (`RoamingNetworkCommitSignature.TryParse`): its role,
+  time, algorithm, key and value trimmed, its signer as given, and what it signs is what was read; refused when its role,
+  signer, algorithm, key or value is empty or whitespace alone (`String.IsNullOrWhiteSpace`), and so is a signature of a
+  change set whose algorithm, key or value is ("The … of a signature of … must not be empty!"). Before, this library took
+  them, and a role padded with whitespace was not the role.
+- Required signature roles probed against WWCP_POI3 at `12e993a`, `f7b8643` and `399b7c8` (`CheckSignatures` of a
+  snapshot, `TryAppend`, `TryAddCheckpoint`), on QA of epoch 2: 1879 cases of roles required of a snapshot, a commit and
+  a checkpoint, signed in every role, by keys of the roaming network operator, of DE*GEF and of nobody, by signers named
+  in every form, with and without a verifier; a second signature of one key in one role, the same, forged or signed
+  later; checkpoints verified by a rule leaving signatures out, forged ones before genuine ones among them; signatures
+  read with texts empty, padded and of other types. At `399b7c8` all are taken and refused alike, the checkpoints held with
+  the same signatures, the roles in the same words, signatures read refused in the words of this library. Stricter than
+  WWCP_POI3 there, which took them: a signer given as a number, an `@context` or another property in a signature of a
+  commit or checkpoint, and in the commit of a snapshot an algorithm its epoch does not name. WWCP_POI `b43ff1a` refuses
+  them too (POI3-ISSUES.md S40), and `7c6f91c` refuses a signature read in the words of this library, a snapshot naming
+  why its commit is refused: probed again at `7c6f91c`, all 1879 alike, word for word.
+- `poi-refusals.json` and `poi-histories.json` of WWCPPOIConformanceTests `215023a` vendored, 806 vectors there, 13 of
+  them new: 8 refusals of a signature of the genesis commit or of checkpoint 1 not in its one form (another property,
+  `@context`, a signer as a number, a role of whitespace, a signedAt without milliseconds); a replay starting from the
+  snapshot of the genesis of epoch 3, its commit signed with Ed448, which the epoch does not name; 4 snapshots of
+  checkpoint 0 anchored with a signature that does not verify or a witness the trust anchor does not know (taken, S39), a
+  key of one holder signing twice (refused) and with the other holder too (taken). None deviates.
+- What a proof gives of a child array, as WWCP_POI `d35c780` tells it (S29): `givesCompletely`, whether an entity as a proof
+  gives it has a child array completely, as an array or none, or pruned or partially; `sizeOf`, how many children it has,
+  also where the proof gives only some or none of them. A size or index beyond what this platform holds, and an object as
+  the identification of the roaming network, were refused already.
+- No lastChange goes back, as WWCP_POI `12e993a` stamps a change set (SPECIFICATION.md 4, "Timestamps", POI3-ISSUES.md
+  S5): with its createdAt, or the lastChange of the roaming network of the version it is applied to, where that is later,
+  as the lastChange of the network, of what it changes, adds and embeds, and as the created of what it adds without one.
+  Its keys are still checked at its createdAt; nobody is refused for it, only the ETags after it differ (`stampOf`). The
+  after ETags of the element and embedded change sets and of the preconditions of the tests, created before QA, are
+  those WWCP_POI3 at `12e993a` calculated for the very same changes (67 change sets, all alike). `poi-histories.json` of
+  WWCPPOIConformanceTests `249d667` vendored: the three rebased change sets of `history-parties`, created at 08:06:30 on a
+  head of 08:07:00, are stamped 08:07:00. `tests/lastChange.test.ts`: every change set of both epochs of QA, created
+  before its version, stamped with its lastChange.
+- EV Taler, phase 2, as WWCP_POI `c2d39e5` checks it (concepts/EVTaler.md 5 and 7, `src/evTaler`): the contract terms of
+  a step of a session (`EVTalerContractTerms`: version 0, an order, an amount and a maximum fee as GNU Taler writes them,
+  the merchant, its exchanges, the times, an auto refund) and their step in `extra.wwcp` (`EVTalerStep`: the roaming
+  network, the EVSE, the session, the step after the order before, the EV Taler tariff, the price statement, what it
+  covers, from step 2 on the signed meter value at the start, an object as OCPP 2.1 sends it), checked against the proof
+  of the station: the operator's merchant and exchanges in the currency of the EV Taler tariff of the EVSE, the price
+  statement current when the session began, each step following the one before, the signed start value verified with
+  the measurement key of the meter or the station the proof gives, by a transparency software passed in; the amount of a
+  step recalculated where the session is priced by one element of the simple profile (`EVTalerRates`), as System.Decimal
+  calculates it (`NetDecimal`: 96 bits, 28 places, rounded half to even), rounded up to the minor unit. A `taler://pay`
+  URI (`EVTalerPayURI`) names the merchant of the operator. The settlement statement (`EVTalerSettlement`), signed by the
+  operator with a key that may sign `payments`, refused without both signed meter values, of the steps of the session,
+  its energy and times those of the values, its price recalculated, half away from zero. Read and verified, not signed.
+  Of 178 sessions, steps, pay URIs and settlement statements probed against WWCP_POI3 at `c2d39e5`, on station proofs it
+  made, all are taken and refused alike, in the same words. `tests/evTalerSessions.test.ts`, on the proof of example A15.
+- EV Taler: a step in minutes costs what it covers, rounded up to the cent, not a cent more, as WWCP_POI `a374855`
+  calculates it: the quantity multiplied by the price of an hour before it is divided by 60. A decimal holds no rate of a
+  minute such as 0.40 / 60 exactly, and rounding up took its last digit for a cent: 60 minutes at 0.40 EUR an hour were
+  0.41 EUR, 30 minutes 0.21 EUR. Found by the probe of this port. The 178 cases probed again against WWCP_POI3 with
+  `a374855`: all alike.
+- `hermodURL` as Hermod reads a URL: no `_` in host names, an empty port, an IPv6 address checked.
+- Reading a version takes about two to three times as long as with 0.2.0, e.g. 1.0 to 1.3 s for 3204 charging pools of
+  12816 EVSEs, each energy meter with a P-256 key of its own, where 0.2.0 took 0.4 s. A check of a version finds the
+  members of the operators in their order, their effective charging stations and energy meters and the charging stations
+  parking spaces name once (`whileChecking`); the identifications read of texts and the measurement public keys checked,
+  the last 65536 of each, are remembered for the next version too, as a history names most of them again. A key of P-256
+  takes about 20 µs, a key of RSA about as long as one exponentiation with its modulus, a certificate of ECDSA a few
+  milliseconds.
+
+
+### Migration
+
+- Versions WWCP_POI3 refuses and 0.2.0 took are refused now, in the words of WWCP_POI3; of the probed versions and the
+  test vectors, none WWCP_POI3 takes. Messages of refusals checked by their text change where 0.2.0 worded them on its
+  own, e.g. a roaming network with keys of its own.
+- A price statement whose price status 0.2.0 took and WWCP_POI3 refuses, e.g. naming the charging tariff
+  `DE*POI*FOREIGN`, is refused before its signature is looked at.
+- A charging pool or a charging pool template naming its time zone by a Windows name, an abbreviation or in another case
+  than the IANA time zone database, which 0.2.0 took, is refused: it names it as the database writes it, e.g.
+  `Europe/Berlin`.
+- `HistoryOptions.verifyCheckpoint` returns the signatures of the checkpoint that verified, `readonly RoleSignature[]`,
+  or `undefined` for all of them, e.g. `checkpoint => verifyCheckpointSignatures(checkpoint, trust, options).verified`.
+  A callback of a block without `return` no longer compiles; one that throws still refuses the checkpoint. A history,
+  `takeCheckpoint` and a snapshot of a checkpoint hold it with those signatures only, its identification the same: what
+  an app keeps of a checkpoint it took may hold fewer signatures than it was given (S39).
+- `Change.elementPath` is an array of `ElementPathSegment`, `{propertyName, elementId}`, in place of the JSON objects
+  given, and `ChangeSet.preconditions` an array of `Precondition`, `{entityType, entityId, eTag}`, both read as WWCP_POI3
+  reads them; the JSON of a change and of a change set stays in its `json`. Both types are exported, and so are
+  `MerkleTreeHead`, `PrunedTree` and `TreeNodeKind`, which the API used already.
+- A signature of a commit or checkpoint is read in its one form: its role, signedAt, algorithm, key and value trimmed,
+  and refused where one of them or its signer is empty or whitespace alone, where its signer is not a text, or where it
+  names an `@context` or another property; so is a signature of a change set whose algorithm, key or value is empty.
+  Producers write each signature in this form, as WWCP_POI `7c6f91c` reads it too.
+- A change set created before the `lastChange` of the version it is applied to is stamped with that `lastChange`, not
+  with its `createdAt` (S5): the version it leads to, and so its after ETags, differ from those 0.2.0 calculated, and a
+  producer calculates them as WWCP_POI `12e993a` does. A change set created after its version, the usual case, is stamped
+  with its `createdAt` as before.
+- A transparency software release is identified under its manufacturer, `{manufacturer}:{name}`, and a certificate
+  under the body issuing it, `{body}:{name}`, e.g. `GraphDefined:chargy-1.5.0` (S36): a version or change set
+  identifying one otherwise, which 0.2.0 took, is refused.
+- The prices of a charging tariff in a price statement are written as a tariff holds them (D18): a statement naming a
+  property their type does not define, e.g. the OCPI restriction `max_kwh`, is refused before its signature, and the
+  price evidence of a session holding one has invalid signatures. A version naming a restriction outside `startTime` to
+  `reservation`, e.g. `maxStateOfCharge`, is refused.
+- A snapshot whose `effectiveLastChanges` WWCP_POI3 does not read, which 0.2.0 took, is refused. Change sets 0.2.0
+  refused as not supported, of the entities a party embeds, with element changes or preconditions, are applied now.
+- Reading a version takes two to three times as long as with 0.2.0, about a second for 12816 EVSEs. The package is
+  larger, 3.7 MB unpacked where 0.2.0 was 2.2 MB, of it `dist/index.js` 0.9 MB and its source map 2.3 MB.
+- `@vanaheimr/cose` requires ^0.15.0 and `@vanaheimr/metrological-cbor` still ^0.12.0: keep both ranges aligned in
+  consumers that use them directly. The minimum runtime remains Node 22.18, and the package remains ESM-only. Without
+  Temporal, on Node 22 and 24, a time zone Intl names by another name is taken in any case, e.g. `Asia/KOLKATA`, which
+  it names `Asia/Calcutta`; Node 26 takes it only as the database writes it.
+
+
+## 0.2.0 (2026-11-02)
+
+Shared trust and session verification APIs, previously delivered as the unpublished 0.1.2-dev.0 development candidate.
+The experimental evidence and delegation profiles described below remain experimental in this release.
+
+- Shared association of an EVSE, its energy meter and its key, with an explicit normalization of SubjectPublicKeyInfo
+  and COSE P-256 keys and a conservative freshness of the observation; no claim of a historical association.
+- Historical meter evidence per reading, and checkpoints verified under the current local authorization.
+- Prices bound to a session, their publication and their rates checked apart.
+- A shared comparison of authenticated versions: rollback and fork constraints the caller keeps durably, historical and
+  current versions told apart, gaps filled, a change of the epoch refused unless verified.
+- The charging document keys of a CPO, an authority of their own; experimental delegation of a policy signed by two
+  quorums, historical timelines of authorities, and verified epoch continuation and profiles.
+- Experimental receipts of a public retrieval of prices, a policy of witness organizations, networks and clocks of
+  its own, restrictions of key usages and a conservative result before the signed start; no witness authorized
+  automatically, no claim of the actual start or of the consent of the customer.
+- COSE and Metrological CBOR on ^0.12.0, so that direct and transitive consumers share one codec; existing proof and
+  signature fixtures remain valid.
+- `trustPolicyId` is the SHA-256 of the canonical JSON of `{network, holders, minConsensus, urls}`, the URLs as a WHATWG
+  URL serializes them without trailing slashes, in their ordinal order, as WWCP_POI3 calculates it
+  (`TrustTransition.PolicyIdOf`); in place of their `JSON.stringify`, whose order of properties and escapes are those of
+  JavaScript, so that every implementation calculates the same. Every policy identification changes: decisions an app
+  keeps under one are made again, and transitions are signed again.
+- A commit is refused without its `json`, `cbor` and `effectiveTree` ETags (SPECIFICATION.md 8.3), as WWCP_POI3 refuses
+  it; the epoch change of `tests/vectors/trust-transitions.json` names the ETags of its versions.
+- `trustTransitions.ts` and `documentKeys.ts` with the license header and in the layout of the other sources.
+
+
+### Migration
+
+- Commits must name all three version ETags: `json`, `cbor` and `effectiveTree`. A commit accepted by 0.1.1 with
+  only an effective-tree ETag is now refused. Producers must generate the complete ETags and sign the resulting commits
+  and checkpoints again; do not edit previously signed documents or silently repair an archived original.
+- When moving from the unpublished 0.1.2-dev.0 candidate that used `JSON.stringify` for policy identity, recompute
+  `trustPolicyId` from canonical JSON. Reconfirm local decisions under the new identity and regenerate and sign affected
+  trust transitions. Retain old observations and original evidence; a changed policy identity must not erase known forks
+  or rollbacks. Candidates already using canonical JSON keep their policy identities.
+- COSE and Metrological CBOR both require ^0.12.0. Keep both dependency ranges aligned in consumers that use them directly.
+- The minimum runtime remains Node 22.18, and the package remains ESM-only. Local trust decisions, durable observation
+  storage and independently authorized witness policies remain the caller's responsibility. No production trust roots
+  or witness service are bundled.
+
+
 ## 0.1.1 (2026-10-31)
 
 `TrustContext`, for apps that import a trust anchor before they trust its keys. `TrustContext.evaluate` checks a key