v0.2.1

@particle-academy/prism-browser 0.2.1 — security fix

No breaking changes.

SECURITY: BrowserPolicy promises to refuse a private address even when
the host is allow-listed, but this port's check knew only ::1 for IPv6
and nothing outside the classic IPv4 private ranges. It admitted
100.100.100.200 (Alibaba Cloud's metadata endpoint, in CGNAT), the NAT64
and 6to4 spellings of 169.254.169.254, unique-local and link-local IPv6,
IPv4-mapped loopback, and benchmarking, documentation, multicast, Teredo
and site-local ranges. If you allow-list IP literals, upgrade.

• The check is now the explicit list core's guarded media fetch uses,
  identical in every language.
• NAT64 and 6to4 addresses are judged by the IPv4 address they embed, so
  a DNS64 network's public addresses still navigate.

v0.2.0

v0.2.0 - Node 22 is the floor

Breaking changes: the declared Node floor moves from 20 to 22. Node 20
reached end of life on 2026-04-30, and engines >=20 told consumers that running
there was sanctioned. Be exact about what this does: npm checks engines and
emits EBADENGINE, but it is a WARNING and the install still proceeds. It is a
refusal only where you set engine-strict=true; pnpm refuses by default. No
source changed, so the code would most likely still run on Node 20 -- what
changed is that it is no longer claimed to.

Tested on Node 22, 24 and 26, on Linux and Windows.

This release adds a README. The package has been on npm with no README
at all, so its page showed nothing you could read before installing it.

Every TypeScript example in it is typechecked against the package's own source
rather than written from reading it. That caught four wrong examples before
release -- an interface method that does not exist, a required field left out,
a wrong argument shape, and a missing import. One claim was not just wrong but
backwards, describing a protection the code does not provide; it now states the
actual limit instead.

v0.1.0

v0.1.0 - guarded browsing for the TypeScript port

@particle-academy/prism-browser drives a headless browser for an agent.

THE URL POLICY IS THE PRODUCT. The cloud metadata endpoint is refused even when
it has been explicitly allow-listed, because an SSRF guard that a configuration
mistake can switch off is not a guard. The engine is injected, so the surface
runs with no network.

CONFORMANCE. All 12 rows of the URL-policy corpus agree across PHP, TypeScript
and Python. That took closing G-21, and it closed in the direction worth
recording: the REFERENCE took the ports' implementation, not the other way round.

This is the first published version, and 0.1.0 is meant literally: a focused,
working slice rather than a 1.0 in disguise.

It is published from CI through npm trusted publishing, with a provenance
attestation you can verify. The 0.0.0 that claimed this name was hand-published
and carries none, which is exactly why it was burned rather than used.