CHANGELOG.md

1.16.0 (2026-10-15)

Features

• add hlx6 migration dual writes (#321) (ec06d64)

1.15.1 (2026-08-19)

Bug Fixes

• deps: update external fixes (#313) (ccafa3c)

1.15.0 (2026-08-07)

Features

• derive source contentUrl from DA_CONTENT env var (#312) (11e926f)

1.14.1 (2026-08-06)

Bug Fixes

• HEAD /list 500 crash when caller has no read permission (#311) (5658b63)

1.14.0 (2026-08-04)

Features

• tag MCP-initiated writes as agent in version history (#310) (ae50c1b), closes #309

1.13.6 (2026-08-04)

Bug Fixes

• deps: update adobe fixes (#239) (f7a851a)

1.13.5 (2026-08-04)

Bug Fixes

• deps: update external major (major) (#297) (427606d)

1.13.4 (2026-08-03)

Bug Fixes

• return 422 instead of 500 for non-versionable labelled version requests (#308) (dc03b91), closes #288

1.13.3 (2026-07-23)

Bug Fixes

• log R2 errors on source GET 500s (#307) (db8f824)

1.13.2 (2026-07-22)

Bug Fixes

• site write access must not implicitly grant CONFIG write (#306) (9545ea2)

1.13.1 (2026-07-20)

Bug Fixes

• reject copy/move destinations in the reserved .da-versions folder (#303) (df584e5), closes #301 #302

1.13.0 (2026-07-17)

Features

• reject a non-UUID guid before it becomes a file id (#304) (818c553)

1.12.4 (2026-07-16)

Bug Fixes

• block .da-versions access through the generic source/list/delete routes (#302) (3d74efa)

1.12.3 (2026-07-14)

Bug Fixes

• reject cross-org copy/move destinations instead of misdelivering (#301) (fd7a351)

1.12.2 (2026-07-09)

Bug Fixes

• page-scoped ACL grants also cover the page's dot asset folder (#300) (0e95a8e)

1.12.1 (2026-07-08)

Bug Fixes

• list: allow listing an ancestor folder when permission is only granted on a descendant (#299) (420f664)

1.12.0 (2026-07-07)

Features

• source: accept raw body PUT/POST for application/json (#294) (6d1363c)

1.11.2 (2026-06-30)

Bug Fixes

• deps: update external fixes (#236) (f193fbc)

1.11.1 (2026-06-17)

Bug Fixes

• derive config site from key and let site wildcards govern site config (#295) (fd355f3)

1.11.0 (2026-06-17)

Features

• add per-site /{site}/CONFIG permission for site config (#293) (f9002e9)

1.10.2 (2026-06-16)

Bug Fixes

• Error when deleting file open in another window (#259) (85217c1), closes #258

1.10.1 (2026-06-15)

Bug Fixes

• cap putObjectWithVersion retries to prevent runaway workers (#291) (fa5dad5), closes hi#concurrency

1.10.0 (2026-06-10)

Features

• trigger release (cc42df6)

1.9.3 (2026-05-29)

Bug Fixes

• version: heal ContentType for legacy octet-stream files on labelled version (#288) (bf86d40), closes #284 #284

1.9.2 (2026-05-22)

Bug Fixes

• version: log diagnostics on POST /versionsource silent 500 (#284) (f06504b)

1.9.1 (2026-05-21)

Bug Fixes

• audit: grow writeAuditEntry 412 backoff to 6 retries / ~3050 ms (#282) (bc49409), closes #277

1.9.0 (2026-05-20)

Features

• add DA_OPS_IMS_BOT_EMAIL escape hatch for bot write access (#280) (faad8c1)

1.8.2 (2026-05-12)

Bug Fixes

• audit: grow writeAuditEntry 412 backoff to exponential jitter (#277) (17aac95)

1.8.1 (2026-05-12)

Bug Fixes

• retry on R2 ETag mismatch when client sends If-Match: * (#276) (3634d98)

1.8.0 (2026-05-07)

Features

• add media route with media bus upload (#178) (060765c)

1.7.3 (2026-05-07)

Bug Fixes

• copy: return 400 instead of 500 when /copy POST body is not form-encoded (#275) (a951f0c)

1.7.2 (2026-05-05)

Bug Fixes

• handle NoSuchKey error name in copyFile catch block (#272) (939b491)
• increase writeAuditEntry 412 retries to 5 and remove dead retry loop in put.js (#274) (2aca684)
• return 400 when label is missing in POST /versionsource (#273) (36acb2b)

1.7.1 (2026-04-30)

Bug Fixes

• handle KV 414 error when IMS auth fragment leaks into org path (#270) (db2b4c8)
• treat putVersion 412 as version-already-exists, not failure (#271) (e92b916)

1.7.0 (2026-04-29)

Features

• add x-error header (#269) (9183c18)

1.6.3 (2026-04-29)

Bug Fixes

• buffer current.body to ArrayBuffer before putVersion to survive SDK retries (#268) (47562f1)
• guard against null body in notifyCollab to prevent move partial_failure (#267) (b21c4eb)

1.6.2 (2026-04-29)

Bug Fixes

• consumed body on retry (#264) (fffb056)
• reject expired IMS tokens by comparing expiry in milliseconds (#265) (09e44e9)

1.6.1 (2026-04-29)

Bug Fixes

• log errors on move failures so they appear in Cloudflare Logs (#266) (84ac28f)

1.6.0 (2026-04-28)

Features

• no legacy versions support (#263) (0d5455c)

1.5.0 (2026-04-27)

Features

• all orgs write to audit.txt (#262) (8dc7659)

1.4.0 (2026-04-23)

Features

• add a retry to compensate R2 transient failure (#257) (eb25f6d)

1.3.1 (2026-04-03)

Bug Fixes

• normalize charset=utf-8 for text content types and support raw-body HTML PUTs (#256) (29b4f4b)

1.3.0 (2026-04-02)

Features

• restructure versions (#253) (f583359)

1.2.0 (2026-03-31)

Features

• improve error handling (#255) (3fc681c)

1.1.7 (2026-03-12)

Bug Fixes

• versionsource: surface version creation failures and fix streaming warning (#250) (4ee0dbe)

1.1.6 (2026-02-25)

Bug Fixes

• auth: make user identifier comparison case-insensitive (#246) (aac2136)

1.1.5 (2026-02-18)

Bug Fixes

• allow logout again (#245) (3653979), closes #232

1.1.4 (2026-02-18)

Bug Fixes

• api docs by clarifying file extension requirements in API paths (#242) (7164ffe), closes #129

1.1.4 (2026-02-10)

Bug Fixes

• api docs by clarifying file extension requirements in API paths (#242) (7164ffe), closes #129

1.1.3 (2026-01-28)

Bug Fixes

• do not lose permissions if read and write on config (#240) (ac0971e)

1.1.2 (2026-01-15)

Bug Fixes

• deps: update external fixes (#218) (1bfca22)

1.1.1 (2026-01-15)

Bug Fixes

• deps: update dependency @adobe/helix-shared-process-queue to v3.1.5 (#230) (f4b7861)

1.1.0 (2026-01-13)

Bug Fixes

• no exception if no destination provided (#231) (df0939f)
• repair release (#234) (104409e)

Features

• add special IMS org with full access (#233) (8e35211)

1.1.0 (2026-01-13)

Bug Fixes

• no exception if no destination provided (#231) (df0939f)

Features

• add special IMS org with full access (#233) (8e35211)

1.0.6 (2026-01-07)

Bug Fixes

• no exception if no destination provided (#231) (df0939f)

1.0.5 (2025-12-18)

Bug Fixes

• fix prod worker name (#227) (73b05c7)

1.0.4 (2025-12-18)

Bug Fixes

• GH-221 - Disable anonymous access (#225) (df98f3e), closes #221 #221 #221

1.0.3 (2025-12-17)

Bug Fixes

• stalled response (#226) (d32fa3e)

1.0.2 (2025-12-15)

Bug Fixes

• exception when no path (#223) (cb97c95)

1.0.1 (2025-12-10)

Bug Fixes

• capture failing version requests (#220) (729c8f5)

1.0.0 (2025-12-04)

Bug Fixes

• add IMS offline token validation (#109) (ba7f961)
• add more tests for getObject (#148) (7055d3c)
• add semantic release (#213) (86b608d)
• build (51c6255)
• consistently use 'syncadmin' (no intercaps) (#198) (3197624)
• CopySource needs to be encoded (#210) (1ab3fc8)
• do not respond a 404 on error (#184) (b1d10c8)
• error when copying a file that exists (#185) (7215387)
• get handler returns undefined (#168) (aa55ce5)
• last modified header for source (#145) (edf1de1)
• non-https links in docs (#190) (661db82)
• only invalidate collab for html documents (#167) (71e6a1c), closes #166
• persist creds (d5dfed1)
• pin s3 client version due to problems with DOMParser (#201) (1f93628)
• preserve content type when copying (#182) (4e83525)
• put/post to source responds with hlx.page / hlx.live (#209) (0415ef4)
• trigger release (3c35bb4)
• versioning timestamp for version and document itself (#144) (a384662)
• versionsource: "delegate" permission check to api (#179) (04b17f2)
• when catching exceptions don't rely on $metadata being set (#170) (5e121f0), closes #169

Features

• add a restore point if body is empty (#173) (65cbf32)
• add HTTP conditional request support (If-Match, If-None-Match) (#187) (190afd8)
• do not create a version for binaries (#211) (92ea28a)
• handle bad requests (#204) (5ae63c5)
• handle bad requests (#214) (be0dc49), closes #204 #212
• no version for binaries (dd98406)
• preserve content type in versions (#177) (5182cd5)
• return last modified for source based on timestamp (#142) (2b3454b)
• send shared secret to collab (#202) (6636423)

Reverts

• Revert "feat: handle bad requests (#204)" (#212) (306fcb5)
• Revert "Fine grained access control (#108)" (#118) (68918ca)
• Revert "fix: last modified header for source (#145)" (#147) (20b1a61)
• Revert "fix: versioning timestamp for version and document itself (#144)" (#146) (f626da7)
• Revert "Revert "fix: last modified header for source"" (#149) (767629c), closes #145 #147

1.0.0 (2025-12-04)

Bug Fixes

• add IMS offline token validation (#109) (ba7f961)
• add more tests for getObject (#148) (7055d3c)
• add semantic release (#213) (86b608d)
• build (51c6255)
• consistently use 'syncadmin' (no intercaps) (#198) (3197624)
• CopySource needs to be encoded (#210) (1ab3fc8)
• do not respond a 404 on error (#184) (b1d10c8)
• error when copying a file that exists (#185) (7215387)
• get handler returns undefined (#168) (aa55ce5)
• last modified header for source (#145) (edf1de1)
• non-https links in docs (#190) (661db82)
• only invalidate collab for html documents (#167) (71e6a1c), closes #166
• persist creds (d5dfed1)
• pin s3 client version due to problems with DOMParser (#201) (1f93628)
• preserve content type when copying (#182) (4e83525)
• put/post to source responds with hlx.page / hlx.live (#209) (0415ef4)
• versioning timestamp for version and document itself (#144) (a384662)
• versionsource: "delegate" permission check to api (#179) (04b17f2)
• when catching exceptions don't rely on $metadata being set (#170) (5e121f0), closes #169

Features

• add a restore point if body is empty (#173) (65cbf32)
• add HTTP conditional request support (If-Match, If-None-Match) (#187) (190afd8)
• do not create a version for binaries (#211) (92ea28a)
• handle bad requests (#204) (5ae63c5)
• handle bad requests (#214) (be0dc49), closes #204 #212
• no version for binaries (dd98406)
• preserve content type in versions (#177) (5182cd5)
• return last modified for source based on timestamp (#142) (2b3454b)
• send shared secret to collab (#202) (6636423)

Reverts

• Revert "feat: handle bad requests (#204)" (#212) (306fcb5)
• Revert "Fine grained access control (#108)" (#118) (68918ca)
• Revert "fix: last modified header for source (#145)" (#147) (20b1a61)
• Revert "fix: versioning timestamp for version and document itself (#144)" (#146) (f626da7)
• Revert "Revert "fix: last modified header for source"" (#149) (767629c), closes #145 #147

1.0.0 (2025-12-04)

Bug Fixes

• add IMS offline token validation (#109) (ba7f961)
• add more tests for getObject (#148) (7055d3c)
• add semantic release (#213) (86b608d)
• build (51c6255)
• consistently use 'syncadmin' (no intercaps) (#198) (3197624)
• CopySource needs to be encoded (#210) (1ab3fc8)
• do not respond a 404 on error (#184) (b1d10c8)
• error when copying a file that exists (#185) (7215387)
• get handler returns undefined (#168) (aa55ce5)
• last modified header for source (#145) (edf1de1)
• non-https links in docs (#190) (661db82)
• only invalidate collab for html documents (#167) (71e6a1c), closes #166
• persist creds (d5dfed1)
• pin s3 client version due to problems with DOMParser (#201) (1f93628)
• preserve content type when copying (#182) (4e83525)
• put/post to source responds with hlx.page / hlx.live (#209) (0415ef4)
• versioning timestamp for version and document itself (#144) (a384662)
• versionsource: "delegate" permission check to api (#179) (04b17f2)
• when catching exceptions don't rely on $metadata being set (#170) (5e121f0), closes #169

Features

• add a restore point if body is empty (#173) (65cbf32)
• add HTTP conditional request support (If-Match, If-None-Match) (#187) (190afd8)
• do not create a version for binaries (#211) (92ea28a)
• handle bad requests (#204) (5ae63c5)
• handle bad requests (#214) (be0dc49), closes #204 #212
• no version for binaries (dd98406)
• preserve content type in versions (#177) (5182cd5)
• return last modified for source based on timestamp (#142) (2b3454b)
• send shared secret to collab (#202) (6636423)

Reverts

• Revert "feat: handle bad requests (#204)" (#212) (306fcb5)
• Revert "Fine grained access control (#108)" (#118) (68918ca)
• Revert "fix: last modified header for source (#145)" (#147) (20b1a61)
• Revert "fix: versioning timestamp for version and document itself (#144)" (#146) (f626da7)
• Revert "Revert "fix: last modified header for source"" (#149) (767629c), closes #145 #147