v0.13.0

Full Changelog: v0.12.0...v0.13.0

v0.12.0

Full Changelog: v0.11.0...v0.12.0

v0.11.0: no second claim code

Breaking: pairingCode is removed from claim links (register().claimLink, createClaimLink(), ForbiddenError.claim). The link's own code does the job: tell the person the code with the link; the claim page shows it first (broker SPEC-002 decision 10, revised 2026-10-01). README: Breaking in 0.11.0.

v0.10.1

renewCredential() updates the stored agent name from the new credential, so a self-registered agent renamed to its agent ID (broker SPEC-002 decision 10) shows its current name in credentialStatus() and saved credentials.

v0.10.0: agent naming and the claim page

Needs a broker with SPEC-002 decision 10 (api.parafe.ai since 2026-10-01). Nothing breaks.

• Without an API key, register() needs no name or principalName. A self-registered agent's public name is its agent ID; what it sends is shown only on the claim page.
• Claim links (register().claimLink, createClaimLink(), ForbiddenError.claim) carry pairingCode: show it with the link, the claim page shows the same code.
• Self-registered agents' credentials no longer carry principal_name; older ones renew as identity_changed.

v0.9.0: operator and principal

Broker SPEC-002 (operator and principal). Breaking: register({ principalName, actsFor? }) replaces owner; actsFor: { ref } registers an agent for one of your users (you become its operator; ref is opaque, no '@'). register() and getClaimStatus() return operatorType, operatorId, principalType, principalId/principalRef; claim status renames ownerTier→principalTier, ownerEmail→principalEmail. completeHandshake() and verifyConsentLocally() return initiatorParties/targetParties; receipts carry participants.*.parties (type Parties). verifyMandate()'s agent: orgDomain→operatorDomain.

v0.8.0: P-256 by default; claim status adds registeredAt and opt-in ownerEmail

Breaking: register() and generateKeyPair() create a P-256 (ES256) key by default, the key type AP2 receipts need. Pass keyAlgorithm: 'Ed25519' for the old default; the broker accepts both. To move an existing Ed25519 agent to P-256, register a new agent.

• getClaimStatus() returns registeredAt, and ownerEmail / ownerEmailVerified only when the person who claimed the agent chose to share their email with your platform.
• README: claiming an agent for an organization; opt-in owner email; the public registry's minimal record for revoked agents; what an AP2 mandate must say when you're the merchant (merchant/payee, aud, nonce), P-256 for AP2 receipts, and fresh root-only mandates. The verifyMandate() example now passes your DID as expectedAudience.

v0.7.0: AP2 mandates (delegated, verified), AP2 receipts

AP2 v0.2 support (AP2 change request Phase 3). Needs a broker with AP2 Phase 3.

Breaking

• authorization.verified() takes the user-signed AP2 mandate ({ mandate, checkoutJwt?, checkoutHash?, checkoutMandate? }) instead of { instruction, platform, userSignature } (deprecated and already refused by the broker; userSignature now throws).
• authorization.mandateRefs is MandateRef[] ({ family, closedJwt, sdHash }) instead of string[].

New

• authorization.delegated() for AP2 open-mandate chains (human not present).
• verifyMandate() (the broker's POST /ap2/mandates/verify), including who signed the closed and first open mandate (closedBy, openedBy).
• signAp2Receipt() / recordAp2Receipt(), ap2MandateReferences().
• The A3 mandate check on acknowledgments, index entries and receipt actions: referenceVerified, mandateRef, mandateVerifiedBy, mandateIssuerSource.
• README: claim page key fingerprint format; public registry record.

v0.6.0

Action receipts (Parafé broker AP2 Phase 2, B6): signActionReceipt(), fileActionReceipt() (a duplicate returns the original acknowledgment), recordActionReceipt(), getActionReceipts(); SessionReceipt.actions is decoded. Reputation floors in ScopePolicy (B18) and ForbiddenError.reputation. recordAction() is deprecated: /interaction/record is being retired. ConflictError.body, jcs / jsonHash exported.

v0.5.0: claim links for self-registered agents

Phase 1.5: an agent registered without an API key can be claimed by the person it acts for, with no secret passing through the AI.

• RegisterResult.claimLink { url, code, expiresAt } on keyless registrations
• createClaimLink(): a new claim link for the loaded agent (replaces the pending one)
• getClaimStatus(): { claimed, identityAssurance, verificationTier, ownerTier, credentialCurrent }
• ForbiddenError.claim and .hint when a handshake or escalation is refused for identity or tier and the agent has no owner
• renewCredential(): new renewal reason identity_changed (after a claim)

Needs a broker with Phase 1.5 (api.parafe.ai since 2026-09-30). README: "Self-registered agents and claim links".