v3.6.0

Merge pull request #61 from RobotRegistryFoundation/release/3.6.0

Release rcan-ts 3.6.0

What's Changed

• assurance: recovery fields from rcan-spec #232, BE levels, working README by @craigm26 in #57
• Add the MIT LICENSE file by @craigm26 in #58
• README: the rcan.dev root node now publishes its key by @craigm26 in #59
• README: resolve example uses a registered RRN by @craigm26 in #60
• Release rcan-ts 3.6.0 by @craigm26 in #61

Full Changelog: v3.5.0...v3.6.0

v3.5.0

Add Appendix C physical-assurance types and evidence-chain verifier (#54)

Add Appendix C physical-assurance types and evidence-chain verifier

What's Changed

• docs: Plan 2 Phase 5 PR 2C — retire hardcoded RCAN versions by @craigm26 in #48
• ci: forbidden-phrase-lint workflow (Plan 2 Phase 5 PR 3C) by @craigm26 in #49
• chore(ci): bump emit-version-tuple to v3.2.3 by @craigm26 in #51
• docs(claude-md): bump CLAUDE.md version refs (Plan 9 carryover) by @craigm26 in #52
• chore: move rcan-ts to RobotRegistryFoundation + OIDC trusted publishing by @craigm26 in #53
• Add Appendix C physical-assurance types and evidence-chain verifier by @craigm26 in #54

Full Changelog: v3.4.2...v3.5.0

v3.4.2

release: 3.4.2 — voice block parsing + soft validation (rcan-spec §8.7)

What's Changed

• feat(manifest): parse + soft-validate optional voice: block (rcan-spec §8.7) by @craigm26 in #43

Full Changelog: v3.4.1...v3.4.2

v3.4.1

release: 3.4.1 — CJS require path fix + runtimes: null parity with rcan-py

• Fix: tsup config now forces CJS output to dist/index.cjs (matches package.json
  main/exports.require). Prior releases emitted dist/index.js, breaking
  require('rcan-ts') with MODULE_NOT_FOUND. ESM (import) consumers unaffected.
• Fix: normalizeAgent runtimes-guard uses != null (covers both null and
  undefined). YAML runtimes: with empty value now falls through instead of
  throwing "agent.runtimes must be an array". Matches rcan-py parity.
• Add: 1 new test for { runtimes: null } normalization. Total manifest tests 19.
• Bump: SDK_VERSION 3.4.0 → 3.4.1; package.json version 3.4.1.

Follow-ups from R3 code review closed. Parity: rcan-py 3.3.0 ⇔ rcan-spec v3.2 ⇔ rcan-ts 3.4.1.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

Full Changelog: v3.4.0...v3.4.1

v3.4.0

docs(changelog): add 3.4.0 entry — agent.runtimes[] (rcan-spec v3.2 §8.6)

Full Changelog: v3.2.0...v3.4.0

v3.2.0

release: v3.2.0 — §23-26 compliance builders + constants

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

Full Changelog: v3.1.1...v3.2.0

v3.1.1

fix(build): preserve node:crypto import prefix via variable indirection

esbuild was rewriting import("node:crypto") → import("crypto") in
dist output across all 3 crypto fallback sites (hybrid, multimodal,
transport), breaking Cloudflare Workers builds. Move the specifier
into a const cryptoModule = "node:crypto" variable so esbuild
cannot resolve it at build time. Runtime semantics unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

Full Changelog: v3.1.0...v3.1.1

v3.1.0

chore: bump to 3.1.0 — consolidation release

First npm publish since 2.1.0 (3.0.0 was never published). Adds
canonicalJson, signBody, verifyBody. Pairs with rcan-py 3.1.0 and an
RRF deploy that swaps to rcan-ts.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

Full Changelog: v2.1.0...v3.1.0

v2.1.0

release: v2.1.0 — fromManifest() ROBOT.md cross-link

Bumps SDK_VERSION + package.json to 2.1.0 so the fromManifest() export
that landed in commit f5a4d28 is installable via npm install rcan-ts.

Zero-dependency: fromManifest takes a parsed frontmatter object, so
rcan-ts stays YAML-parser-free. See CHANGELOG for the recipe with
js-yaml.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

Full Changelog: v2.0.0...v2.1.0

v2.0.0

ci(release): split release workflow — tag → GitHub Release, npm opt-in

Previous workflow required NPM_TOKEN to succeed on every tag push.
Since continuonai/rcan-ts has no NPM_TOKEN configured, tagging
v2.0.0 would have produced a red publish run + no GitHub release
(because publish depended on build-and-test and would have failed
at the publish step).

New split mirrors RobotRegistryFoundation/robot-md release.yml:

• build-and-test: always runs. Produces dist/ + .tgz artifact.
• github-release: tag push only. Downloads the artifact and
  attaches the .tgz to the GitHub release.
• npm-publish: workflow_dispatch only, gated on publish_npm=true.
  Runs npm publish with NPM_TOKEN when the maintainer is ready.

Result: a tag push today produces a green Release workflow + a
GitHub release with the packed tarball. npm publish is a separate
opt-in action once the maintainer adds NPM_TOKEN to repo secrets.

Workflow name updated from "Publish to npm" to "Release" to reflect
the broader scope.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

What's Changed

• fix: handlebars 4.7.9 override (Dependabot batch) by @craigm26 in #42

Full Changelog: v1.3.0...v2.0.0