@docstack/client 0.3.0 makes access control cryptographic. Content belongs to a scope whose content key is sealed under an attribute policy, and a session's attribute key either satisfies the formula, opening the scope, or does not, in which case the same ciphertext reads null. Denial is decryption failure, not a check, so it binds the device owner too. The JavaScript-rule policy engine is gone, and a new package, @docstack/abe, carries the primitive.

@docstack/client 0.2.0 is on npm. It adds named write transactions, makes every consumer patch chain apply as one all-or-nothing batch, lets a patch carry one-shot migration jobs, and closes a security defect in replication that 0.1.8 introduced. This post walks through what changed and what it means for an application on 0.1.x.

@docstack/react 0.1.1 is on npm. It is a one-fix release on top of 0.1.0, which was the first publish of the rewritten bindings a week earlier. This post covers the fix and, for anyone still on 0.0.9, what the 0.1 line changed.