ulda-auth 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -1,6 +1,20 @@
 # Changelog
 
-## Unreleased
+## 1.1.0
+
+- Remove the fixed 63-content catalog limit; read larger catalogs in bounded ID batches.
+- Transfer large encrypted resources and atomic mutation batches in bounded frames, with a single server commit and complete Changed assembly before client publication.
+- Bound staging by bytes and deadlines; keep uncertain commits non-replayable. Require transfer-capable servers for operations beyond the ordinary wire limits.
+- Document effective server subscription, staging, queue and timeout limits, eager-loading costs and upgrade requirements.
+- Preserve public API signatures, the encrypted container format and the core dependency.
+
+## 1.0.1
+
+- Fix the release dry-run for versions already present in npm, with regression tests for dry-run safety and archive integrity.
+- Clarify GitHub Actions rehearsals, trusted publisher configuration and maintainer approval in the publishing guide.
+- SDK runtime, public API, wire protocol, cryptographic profile and dependencies are unchanged from 1.0.0.
+
+## 1.0.0
 
 - Initial public SDK package: encrypted master/content lifecycle over ULDA and Socket.IO.
 - Per-resource chains, binary transport, subscriptions, X/S queues and explicit conflict handling.

package/MANIFEST.md

@@ -76,8 +76,11 @@ The client provides registration/opening, CRUD, nested references, local snapsho
 | Application JSON per resource | 1,048,576 UTF-8 bytes |
 | JSON nesting depth | 48 |
 | Visited JSON nodes | 40,000 |
-| Content entries per master | 63 |
-| Items per protocol batch/event | 64 |
+| Content entries per master | No fixed count; catalog bytes and server budgets apply |
+| Items per ordinary protocol batch/event or transfer append | 64 |
+| Reassembled encrypted resource | 67,108,864 bytes |
+| Logical transfer / queued incoming binary budget | 134,217,728 bytes |
+| Large-resource fragment | 1,048,576 bytes |
 | Combined witness/payload bytes per message | 8,388,608 |
 | Binary attachments per Socket.IO packet | 128 |
 | Bytes per binary attachment | 1,100,000 |
@@ -87,7 +90,11 @@ The client provides registration/opening, CRUD, nested references, local snapsho
 | Content name | 1–256 UTF-16 code units |
 | Master password input | 1–1024 UTF-16 code units |
 
-Container overhead and catalog metadata consume additional space; not every theoretical maximum can necessarily be combined in one batch. Oversized Read requests can be split into smaller groups. Atomic writes are not split.
+Container overhead and catalog metadata consume additional space; not every theoretical maximum can necessarily be combined in one batch. The 40,000-node and 1 MiB JSON limits apply to application content; the private catalog uses the resource byte budget (with 4,096 bytes reserved for envelope overhead) and a byte-derived node bound. JSON depth remains bounded in both cases.
+
+The SDK reads catalog contents in groups of at most 64 IDs and reduces the group when a server explicitly rejects its size. Large ciphertext is reassembled from fragments. Large atomic writes use a staged transfer followed by one commit, never separate partial mutations. Logical transfer accounting includes 256 bytes per item. This framing requires a server implementing the [transfer extension](docs/PROTOCOL.md#large-operation-transfer). Server subscription, Router, byte and timeout budgets can reject an otherwise valid catalog or operation.
+
+Catalogs are loaded eagerly: all required content is verified before a new snapshot is published. There is no lazy loading or nested-master API. Removing the fixed entry count does not promise unlimited memory, storage or operation size.
 
 ## Environment and distribution
 
@@ -98,3 +105,7 @@ The normal ESM entry uses npm dependencies. The browser ESM bundles them and inc
 Private fields, non-extractable keys and best-effort cleanup do not isolate secrets from hostile code controlling the same page or process. [Secret lifecycle](docs/SECRET_LIFECYCLE.md) defines cleanup responsibilities.
 
 The [ULDA Library Community Source License](LICENSE.md) governs the SDK. Dependencies retain their own licenses; the core and server have separate scopes.
+
+## Capacity and compatibility
+
+See [Limits and capacity planning](docs/LIMITS.md) for SDK bounds, interacting server budgets, eager-loading costs, atomicity, timeouts and upgrades from 1.0.x.

package/README.md

@@ -4,6 +4,8 @@ A JavaScript SDK for encrypted JSON resources over Socket.IO, built on [ULDA Cor
 
 ULDA Auth encrypts application data on the client, maintains a separate ULDA chain for each resource, and synchronizes changes across connected clients. Applications work with JSON and explicit update methods.
 
+Catalogs have no fixed content-entry count limit. The SDK uses bounded read batches and, with a transfer-capable server, stages large encrypted operations for a single atomic commit. Byte, memory and server admission budgets still apply; see [large catalogs](docs/GUIDE.md#large-catalogs).
+
 ## Install
 
 ~~~sh
@@ -130,3 +132,7 @@ For repository tooling, see [development](https://github.com/ulda-io/ulda-auth/b
 [ULDA Library Community Source License 1.0](LICENSE.md), a source-available license with revenue and competitive-use conditions. Commercial licensing: [mark@shaposhnik.ch](mailto:mark@shaposhnik.ch).
 
 See the [licensing guide](docs/LICENSING.md) for a summary. Dependencies retain their own licenses.
+
+## Capacity and compatibility
+
+See [Limits and capacity planning](docs/LIMITS.md) for SDK bounds, interacting server budgets, eager-loading costs, atomicity, timeouts and upgrades from 1.0.x.

package/SECURITY.md

@@ -89,6 +89,8 @@ See [Secret lifecycle](docs/SECRET_LIFECYCLE.md) for allocation and cleanup beha
 
 The SDK bounds JSON sizes, queues, batches and binary reconstruction. See the [manifest](MANIFEST.md) for exact limits. Parser checks do not impose a total memory limit on the browser or Node process: the runtime may have allocated a frame before validation.
 
+Large-operation frames contain ciphertext and public witnesses only. Framing does not change the encrypted container or its authentication. A compatible server must bound staged bytes, expire abandoned uploads, validate every candidate before one atomic commit, and keep an accepted commit's reservations until completion. The client does not expose a partial assembled Changed event or a partially checked catalog. Temporary transfer tokens do not add replay protection or resolve a lost Commit ACK. Larger catalogs increase client memory and processing costs despite bounded network frames.
+
 SDK diagnostics contain fixed event codes, IDs, counts, sizes and timings. They omit plaintext, content names, credentials, full origins and raw packets. Server error strings are mapped to fixed local errors. IDs and access patterns can still be sensitive metadata; protect application logs accordingly.
 
 The test reporter and local secret scanner reduce accidental disclosure during development. They do not sandbox arbitrary code or prove the absence of all secrets.