v0.3.9

What's Changed

• feat: v2.0 Platform — Vault, MCP Auth, 7 Adapters, Webhook Log by @mishrasanjeev in #122
• chore: bump SDK, adapters, mcp-auth, Python SDK versions by @mishrasanjeev in #124
• feat: v2.1 enterprise scale — observability, event streaming, budgets, IaC by @mishrasanjeev in #125
• chore: bump @grantex/sdk 0.1.9, grantex (py) 0.1.9, @grantex/destinations 0.1.0 by @mishrasanjeev in #127
• fix: resolve all open security alerts by @mishrasanjeev in #128
• fix: mask API key in CLI config show output by @mishrasanjeev in #129
• fix: eliminate API key data flow in CLI config show by @mishrasanjeev in #130
• feat: v2.2 ecosystem — policy engines, A2A bridge, managed cloud by @mishrasanjeev in #131
• chore: bump @grantex/sdk 0.2.0, grantex (py) 0.2.0 by @mishrasanjeev in #132
• chore: add twitterposts.md by @mishrasanjeev in #133
• feat: v2.2 standards, blog, portal usage dashboard, playground fix by @mishrasanjeev in #134
• fix: cascade delete dependent rows when deleting an agent by @mishrasanjeev in #135
• fix: usage history query + portal bundle update by @mishrasanjeev in #136
• fix: add GET /v1/budget/allocations endpoint by @mishrasanjeev in #137
• chore: clean up IETF draft-01 for submission by @mishrasanjeev in #138
• fix: point docs links to docs.grantex.dev by @mishrasanjeev in #139
• fix: resolve 4 CodeQL code scanning alerts by @mishrasanjeev in #140
• fix: correct ratelimit-reset conformance test by @mishrasanjeev in #141
• feat: SEO landing pages and technical SEO improvements by @mishrasanjeev in #142
• feat: add IndexNow key for search engine indexing by @mishrasanjeev in #143
• feat: SEO backlinks, comparison pages, and package metadata by @mishrasanjeev in #144
• feat: zero-signup playground with built-in demo key by @mishrasanjeev in #147
• fix: e2e test failures and portal signup email verification by @mishrasanjeev in #150
• chore: run e2e tests daily by @mishrasanjeev in #152
• test: achieve ~100% code coverage across SDK and auth-service by @mishrasanjeev in #153
• feat: FIDO2/WebAuthn + DID infrastructure (Phases 1 & 3) by @mishrasanjeev in #154
• feat: W3C Verifiable Credentials, SD-JWT selective disclosure, and trust infrastructure by @mishrasanjeev in #155
• docs: complete documentation coverage for all features by @mishrasanjeev in #156
• chore: bump all package versions for v2.3 release by @mishrasanjeev in #157
• chore: sync Go SDK v0.1.3 with 6 new resource services by @mishrasanjeev in #158
• fix: sync package-lock.json with missing dependencies by @mishrasanjeev in #160
• chore: overhaul README for star conversion by @mishrasanjeev in #162
• content: State of AI Agent Security 2026 report by @mishrasanjeev in #163
• chore: auto-update sitemap dates + weekly SEO pings by @mishrasanjeev in #164
• chore: add daily mention monitoring workflow by @mishrasanjeev in #165
• fix: add issues:write permission to monitor-mentions workflow by @mishrasanjeev in #166
• feat: MPP agent identity and delegation for agentic commerce by @mishrasanjeev in #168
• docs: MPP Agent Identity — landing page, README, and Mintlify docs by @mishrasanjeev in #170
• fix: align MPP payment flow section on landing page by @mishrasanjeev in #171
• fix: serve MPP demo at /mpp-demo/ and left-align CTA buttons by @mishrasanjeev in #172
• fix: improve MPP demo UX and remove hackathon references by @mishrasanjeev in #173
• feat: complete all MPP TODOs — auto-refresh and DNS TXT verification by @mishrasanjeev in #174
• chore: add MPP to CI pipeline and create E2E production test workflow by @mishrasanjeev in #175
• fix: install sdk-ts before mpp build in E2E workflow by @mishrasanjeev in #176
• fix: reuse existing agent in E2E workflow to avoid plan limit by @mishrasanjeev in #177
• chore: MPP SEO — sitemap, meta tags, JSON-LD, and /for/mpp landing page by @mishrasanjeev in #178
• chore: visual MPP workflow on landing page and README by @mishrasanjeev in #179
• fix: resolve Google Search Console indexing issues by @mishrasanjeev in #180
• content: add MPP Agent Identity blog post by @mishrasanjeev in #181
• fix: replace ASCII flow diagrams with copy-friendly markdown tables by @mishrasanjeev in #182
• feat: add @grantex/x402 — agent spend authorization for x402 payment flows by @mishrasanjeev in #183
• test: comprehensive coverage for x402 and mpp untested code paths by @mishrasanjeev in #184
• fix: resolve MPP test typecheck errors in CI by @mishrasanjeev in #185
• feat: bump free tier to 200 agents and increase all plan limits by @mishrasanjeev in #186
• feat: add llms.txt and expand package keywords for SEO by @mishrasanjeev in #187
• chore: bump all package versions for keyword publish by @mishrasanjeev in #188
• chore(deps): bump picomatch from 4.0.3 to 4.0.4 in /apps/portal by @dependabot[bot] in #193
• chore(deps-dev): bump picomatch from 4.0.3 to 4.0.4 in /packages/destinations by @dependabot[bot] in #192
• chore(deps): bump fastify from 5.7.4 to 5.8.3 in /packages/mcp-auth by @dependabot[bot] in #191
• chore(deps): bump fastify from 5.7.4 to 5.8.3 in /apps/auth-service by @dependabot[bot] in #190
• chore(deps): bump fastify from 5.7.4 to 5.8.3 in /packages/gateway by @dependabot[bot] in #189
• chore(deps): bump next from 15.5.12 to 15.5.14 in /examples/nextjs-starter by @dependabot[bot] in #169
• chore(deps): bump hono from 4.12.3 to 4.12.7 in /packages/mcp by @dependabot[bot] in #159
• chore(deps): bump express-rate-limit from 8.2.1 to 8.3.0 in /packages/mcp by @dependabot[bot] in #149
• chore(deps): bump @hono/node-server from 1.19.9 to 1.19.10 in /packages/mcp by @dependabot[bot] in #146
• Add comprehensive manual QA test plan by @mishrasanjeev in #200
• chore(deps-dev): bump picomatch from 4.0.3 to 4.0.4 by @dependabot[bot] in #196
• chore(deps-dev): bump picomatch from 4.0.3 to 4.0.4 in /packages/mcp-auth by @dependabot[bot] in #197
• chore(deps): bump yaml from 2.8.2 to 2.8.3 in /packages/gateway by @dependabot[bot] in #198
• chore(deps-dev): bump picomatch from 4.0.3 to 4.0.4 in /packages/a2a by @dependabot[bot] in #199
• feat(cli): add missing commands, --json flag, and full API coverage by @mishrasanjeev in #202
• feat(cli): complete SDK parity — vault, webauthn, credentials, passports, SCIM writes by @mishrasanjeev in #203
• docs: update all surfaces with complete CLI coverage by @mishrasanjeev in #204
• chore(deps): bump path-to-regexp from 0.1.12 to 0.1.13 in /apps/mpp-demo-service by @dependabot[bot] in #201
• feat(content): blog posts, compliance matrix, landing page sections from CTO deck by @mishrasanjeev in #205
• fix(landing): replace alternatives table with responsive card grid by @mishrasanjeev in #206
• fix(landing): restore alternatives table without horizontal scroll by @mishrasanjeev in #207
• docs: update README, llms.txt, QA plan for new content by @mishrasanjeev in #208
• fix(security): resolve all 30 CodeQL code scanning alerts by @mishrasanjeev in #209
• fix(deps): bump path-to-regexp to 8.4.0 in packages/mcp by @mishrasanjeev in #210
• fix(security): resolve remaining 6 CodeQL alerts by @mishrasanjeev in #211
• fix(deps): bump fast-xml-parser to >=5.5.6 in packages/destinations by @mishrasanjeev in #212
• fix(security): resolve 7 CodeQL alerts in auth-service by @mishrasanjeev in #213
• feat(sso): enterprise SSO with OIDC + SAML 2.0, multi-IdP, JIT provisioning by @mishrasanjeev in #214
• chore: bump SDK versions for enterprise SSO release by @mishrasanjeev in #215
• fix(docs): remove duplicate nav tabs in header by @mishrasanjeev in #216
• feat(anthropic): Anthropic SDK integration for scope-enforced tool use by @mishrasanjeev in #218
• fix(web): add Anthropic SDK /for/ landing page entry by @mishrasanjeev in #220
• fix(seo): add Anthropic SDK to sitemap.xml and llms.txt by @mishrasanjeev in #221
• fix(integrations): add agentDid and principalId to audit logging by @mishrasanjeev in #222
• chore: bump autogen 0.1.5, vercel-ai 0.1.5, langchain 0.1.6 by @mishrasanjeev in #223
• fix(mcp): add agentDid and principalId to audit log tool by @mishrasanjeev in #224
• docs: update audit logging options for autogen, vercel-ai, langchain by @mishrasanjeev in #226
• feat(examples): multi-agent email flow with failure handling by @mishrasanjeev in #227
• fix(security): resolve all 31 CodeQL code scanning alerts by @mishrasanjeev in #228
• test: comprehensive negative E2E test suite (58 tests) by @mishrasanjeev in #229
• test: comprehensive E2E suite + fix Python SDK bugs by @mishrasanjeev in #232
• chore: bump Python SDK to 0.2.5 by @mishrasanjeev in #233
• fix(sdk-py): update audit tests for agentDid and principalId by @mishrasanjeev in #234
• feat(examples): token expiry and refresh lifecycle by @bankyresearch in #230
• feat(gemma): offline authorization for Gemma 4 on-device agents by @mishrasanjeev in #236
• feat(mcp-auth): MCP Auth Server v2.0 GA + certification program by @mishrasanjeev in #237
• feat(dpdp): DPDP Act 2023 & EU AI Act compliance module by @mishrasanjeev in #238
• feat(registry): public trust registry with org profiles and badges by @mishrasanjeev in #239
• feat(anomaly): expand anomaly detection with custom rules and dashboard by @mishrasanjeev in #240
• feat(security): cross-feature security test suite + OWASP ZAP CI by @mishrasanjeev in #241
• feat(web): add v2.5 section to landing page + SEO/sitemap by @mishrasanjeev in #242
• docs: add cli/verify page — fixes 404 by @mishrasanjeev in #243
• chore(mcp-auth): bump version to 2.0.0 by @mishrasanjeev in #244
• feat(tests): comprehensive test coverage — portal, E2E, Python SDK by @mishrasanjeev in #245
• docs: fix 404s for Gemma, MCP Auth, Trust Registry, DPDP integration pages by @mishrasanjeev in #246
• feat(sdk): scope enforcement — enforce(), ToolManifest, 54 manifests (v0.3.0) by @mishrasanjeev in #247
• docs: scope enforcement guide, API refs, case study, and landing page by @mishrasanjeev in #248
• fix(docs): address Codex review on scope enforcement docs by @mishrasanjeev in #249
• feat(sdk): v0.3.1 — wrapTool, enforceMiddleware, permissive mode, manifest generate, portal UI by @mishrasanjeev in #250
• fix(sdk-ts): remove unused Permission import (CodeQL alert #201) by @mishrasanjeev in #251
• feat(web): update landing page scope enforcement for v0.3.1 by @mishrasanjeev in #252
• fix(sdk): add manifests export subpath + scope enforcement README sections by @mishrasanjeev in #253
• fix(sdk-ts): correct enforceMode in README (Codex PR #253) by @mishrasanjeev in #254
• chore: bump SDK 0.3.2, CLI 0.2.2 — includes manifests export fix by @mishrasanjeev in #255
• fix: close all 17 spec gaps — SDK, CLI, portal, tests, landing page by @mishrasanjeev in #256
• fix: CodeQL unused variable + mypy yaml type ignore by @mishrasanjeev in #257
• fix(cli): eliminate TOCTOU file-system race (CodeQL #202) by @mishrasanjeev in #258
• chore: bump SDK 0.3.3, CLI 0.2.3 by @mishrasanjeev in #259
• docs: reframe scope enforcement as bring-your-own-manifest by @mishrasanjeev in #260
• fix(docs): correct manifest counts — 53 connectors, 339 tools by @mishrasanjeev in #261
• fix: address critical review findings across all SDKs by @mishrasanjeev in #262
• fix: remaining review findings — API docs, tests, SDK parity by @mishrasanjeev in #263
• chore: bump SDK 0.3.4, mcp-auth 2.0.1 by @mishrasanjeev in #264
• fix: low-priority review items — 233 new tests, docs, version constraints by @mishrasanjeev in #265
• fix: enterprise hardening — security, resilience, observability, API quality by @mishrasanjeev in #266
• fix: landing page content + SEO audit — 15 pre-rendered pages, examples expanded, GA4 coverage by @mishrasanjeev in #267
• chore: bump SDK 0.3.5 by @mishrasanjeev in #268
• chore(deps): bump vite from 7.3.1 to 7.3.2 by @dependabot[bot] in #270
• chore(deps-dev): bump vite from 7.3.1 to 7.3.2 in /packages/a2a by @dependabot[bot] in #271
• chore(deps-dev): bump vite from 7.3.1 to 7.3.2 in /packages/mcp-auth by @dependabot[bot] in #269
• [codex] Harden grant verification and session flows by @mishrasanjeev in #275
• chore(deps): bump next from 15.5.14 to 15.5.15 in /examples/nextjs-starter by @dependabot[bot] in #274
• chore(deps-dev): bump langsmith from 0.5.7 to 0.5.18 in /packages/langchain by @dependabot[bot] in #272
• chore(ci): bump GitHub Actions to Node.js 24-compatible versions by @mishrasanjeev in #276
• fix(ci): make ZAP baseline scan actually scan the auth service by @mishrasanjeev in #277
• ci: ignore ZAP rule 90005 (Sec-Fetch-Dest missing) by @mishrasanjeev in #279
• fix(sdk-py): grants.verify server-claims parity + post-ship docs + ship-verification skill by @mishrasanjeev in #280
• fix: remediate expert-review findings (events, sdk-py issuer, doc drift) by @mishrasanjeev in #281
• chore(release): sdk-ts 0.3.8, sdk-py 0.3.9 (security hardening) by @mishrasanjeev in #282
• fix(go-sdk): align endpoint paths with auth-service contract by @mishrasanjeev in #283
• fix(auth): tie grant lifecycle to active checks, refresh, and budget by @mishrasanjeev in #284
• fix(auth): Codex follow-ups + remaining expert-review findings (#5–#8) by @mishrasanjeev in #285
• docs: scope custom-domains messaging on landing page + SDK docs by @mishrasanjeev in #286
• fix(auth): enable CORS for the developer dashboard by @mishrasanjeev in #287
• fix(portal): repair MCP dashboard — match server response shape by @mishrasanjeev in #288
• test(portal): fix 17 pre-existing test failures by @mishrasanjeev in #289
• fix(e2e): pass explicit issuer for offline token verification by @mishrasanjeev in #296
• fix(hosting): route all client-reachable paths from grantex.dev to Cloud Run; split config by @mishrasanjeev in #299
• test(e2e): add live-mode consent flow test via grantex.dev by @mishrasanjeev in #301
• test(e2e): bump testTimeout to 120s; fix cross-feature retry-storm timeout by @mishrasanjeev in #302
• fix(authorize): re-key per-route rate limit on developer.id (Option A) by @mishrasanjeev in #303
• fix(auth-service): bump global IP rate limit 100→500/min by @mishrasanjeev in #304
• chore(ci): remove daily scheduled E2E tests against prod Cloud Run by @mishrasanjeev in #305
• chore(ci): restore e2e.yml with workflow_dispatch only (no schedule) by @mishrasanjeev in #306
• chore(deps): bump fastify from 5.8.3 to 5.8.5 in /packages/mcp-auth by @dependabot[bot] in #290
• chore(deps): bump fastify from 5.8.3 to 5.8.5 in /apps/auth-service by @dependabot[bot] in #291
• chore(deps-dev): bump langsmith from 0.5.18 to 0.5.20 in /packages/langchain by @dependabot[bot] in #292
• chore(deps): bump hono from 4.12.12 to 4.12.14 in /packages/mcp by @dependabot[bot] in #293
• chore(deps): bump protobufjs from 7.5.4 to 7.5.5 in /apps/auth-service by @dependabot[bot] in #295
• chore(deps): bump fastify from 5.8.4 to 5.8.5 in /packages/gateway by @dependabot[bot] in #297
• chore(deps-dev): bump fast-xml-parser from 5.5.9 to 5.7.1 in /packages/destinations by @dependabot[bot] in #307
• chore(deps+tests): bump postcss to 8.5.10 and remove unused import by @mishrasanjeev in #309
• [codex] Harden auth service for production by @mishrasanjeev in #312
• feat(commerce): add Grantex Commerce V1 Milestone 1 foundations by @mishrasanjeev in #314
• feat(commerce): add Grantex Commerce V1 Milestone 2 passports and consent by @mishrasanjeev in #315
• fix(commerce): harden M2 agent assertion validation by @mishrasanjeev in #316
• chore(deps): bump ip-address and express-rate-limit in /examples/x402-weather-api by @dependabot[bot] in #317
• chore(deps): bump hono from 4.12.14 to 4.12.18 in /packages/mcp by @dependabot[bot] in #318
• chore(deps-dev): bump fast-xml-builder from 1.1.5 to 1.2.0 in /packages/destinations by @dependabot[bot] in #319
• chore(deps): bump fast-uri from 3.1.0 to 3.1.2 in /packages/gateway by @dependabot[bot] in #320
• chore(deps): bump fast-uri from 3.1.0 to 3.1.2 in /packages/mcp-auth by @dependabot[bot] in #322
• chore(deps): bump fast-uri from 3.1.0 to 3.1.2 in /packages/mcp by @dependabot[bot] in #323
• chore(deps): bump fast-uri from 3.1.0 to 3.1.2 in /apps/auth-service by @dependabot[bot] in #321
• chore(deps): bump next from 15.5.15 to 15.5.18 in /examples/nextjs-starter by @dependabot[bot] in #325
• chore(deps): bump @protobufjs/utf8 from 1.1.0 to 1.1.1 in /apps/auth-service by @dependabot[bot] in #327
• chore(deps): bump protobufjs from 7.5.5 to 7.5.8 in /apps/auth-service by @dependabot[bot] in #328
• chore(deps): bump @opentelemetry/exporter-prometheus, @opentelemetry/auto-instrumentations-node and @opentelemetry/sdk-node in /apps/auth-service by @dependabot[bot] in #324
• feat(commerce): add V1 internal sandbox control plane by @mishrasanjeev in #326
• fix(security): pin outbound DNS resolutions by @mishrasanjeev in #329
• fix(commerce): align mock payment intent checkout state by @mishrasanjeev in #331
• docs(commerce): plan hosted staging environment by @mishrasanjeev in #332
• docs(commerce): define staging seed data setup by @mishrasanjeev in #333
• docs(commerce): define hosted staging e2e harness by @mishrasanjeev in #334
• docs(commerce): record V1 contract completeness gaps by @mishrasanjeev in #335
• feat(commerce): add merchant and agent update APIs by @mishrasanjeev in #336
• feat(commerce): add catalog list patch and bulk ingest by @mishrasanjeev in #337
• feat(commerce): add merchant webhook source APIs by @mishrasanjeev in #339
• feat(commerce): add merchant control plane portal views by @mishrasanjeev in #340
• feat(commerce): add webhook replay and merchant reenable controls by @mishrasanjeev in #341
• fix(commerce): qualify webhook replay payload hash by @mishrasanjeev in #343
• docs(commerce): prepare option a smoke setup by @mishrasanjeev in #342
• docs(commerce): record option a smoke evidence by @mishrasanjeev in #344
• fix(commerce): clean up security alerts by @mishrasanjeev in #345
• fix(commerce): use static payment log entries by @mishrasanjeev in #346
• docs(commerce): add repeatable option a smoke workflow by @mishrasanjeev in #347
• docs(commerce): add AgenticOrg fixture bridge by @mishrasanjeev in #349
• feat(commerce): add guarded option a smoke runner by @mishrasanjeev in #350
• docs(commerce): record c2d fixture smoke evidence by @mishrasanjeev in #351
• docs(commerce): record c2e smoke evidence by @mishrasanjeev in #352
• docs(commerce): record c2f smoke evidence by @mishrasanjeev in #353
• docs(commerce): record c2g smoke evidence by @mishrasanjeev in #354
• docs(commerce): assess production discovery readiness by @mishrasanjeev in #355
• docs(commerce): expand agentic commerce education by @mishrasanjeev in #356
• docs(commerce): propose read-only production discovery path by @mishrasanjeev in #357
• fix(commerce): add read-only discovery gate by @mishrasanjeev in #358
• docs(commerce): plan read-only discovery rollout by @mishrasanjeev in #359
• docs(commerce): prepare named merchant discovery approval by @mishrasanjeev in #360
• docs(commerce): list merchant approval artifacts by @mishrasanjeev in #362
• docs(commerce): add merchant approval intake by @mishrasanjeev in #363
• docs(commerce): prepare merchant artifact collection by @mishrasanjeev in #364
• Add Strands Agents SDK integration by @diptb in #366
• chore(deps): bump ws from 8.19.0 to 8.20.1 in /apps/auth-service by @dependabot[bot] in #368
• chore(deps): bump uuid and @langchain/core in /packages/langchain by @dependabot[bot] in #367
• chore(deps-dev): bump @tootallnate/once from 2.0.0 to 2.0.1 in /packages/destinations by @dependabot[bot] in #365
• [codex] docs(commerce): record c2b smoke evidence by @mishrasanjeev in #348
• fix(portal): ErrorBoundary 'Go to Dashboard' uses /dashboard/ with trailing slash by @twok020101 in #372
• fix(consent-bundles): align list endpoint with project envelope convention by @twok020101 in #370
• chore(deps): bump qs and express in /packages/x402 by @dependabot[bot] in #374
• chore(deps): bump qs and express in /packages/express by @dependabot[bot] in #373
• chore(deps): bump qs from 6.15.0 to 6.15.2 in /packages/mcp by @dependabot[bot] in #375
• fix: close enterprise readiness P0 blockers by @mishrasanjeev in #376
• test: align production e2e with hardened P0 posture by @mishrasanjeev in #433
• chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #377
• chore(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #378
• chore(deps): bump qs for security alerts by @mishrasanjeev in #434
• chore(deps): bump tsx from 4.21.0 to 4.22.3 in /examples/x402-weather-api by @dependabot[bot] in #436
• chore(deps): bump github.com/lestrrat-go/jwx/v2 from 2.1.3 to 2.1.6 in /packages/go-sdk by @dependabot[bot] in #432
• chore(deps-dev): bump vitest from 4.0.18 to 4.1.7 in /packages/destinations by @dependabot[bot] in #425
• chore(deps-dev): bump @aws-sdk/client-s3 from 3.1000.0 to 3.1053.0 in /packages/destinations by @dependabot[bot] in #423
• chore(deps-dev): bump @grantex/sdk from 0.3.7 to 0.3.8 in /packages/gateway by @dependabot[bot] in #418
• chore(deps): bump yaml from 2.8.3 to 2.9.0 in /packages/gateway by @dependabot[bot] in #416
• chore(deps-dev): bump vitest from 4.1.3 to 4.1.7 in /packages/adapters by @dependabot[bot] in #409
• chore(deps-dev): bump vitest from 4.1.2 to 4.1.7 in /packages/x402 by @dependabot[bot] in #403
• chore(deps): bump the minor-and-patch group across 1 directory with 8 updates by @dependabot[bot] in #395
• chore(deps-dev): bump vitest from 4.1.3 to 4.1.7 in /packages/mcp by @dependabot[bot] in #392
• chore(deps-dev): bump @vitest/coverage-v8 from 4.1.2 to 4.1.7 in /packages/sdk-ts by @dependabot[bot] in #390
• chore(deps-dev): bump vitest from 4.1.2 to 4.1.7 in /packages/cli by @dependabot[bot] in #389
• chore(deps-dev): bump vitest from 4.0.18 to 4.1.7 in /packages/mcp-auth by @dependabot[bot] in #387
• chore(deps-dev): bump vitest from 4.1.2 to 4.1.7 in /packages/sdk-ts by @dependabot[bot] in #384
• chore(deps): bump @grantex/sdk from 0.3.7 to 0.3.8 in /packages/mcp by @dependabot[bot] in #382
• [codex] Add C5I synthetic commerce merchant dataset by @mishrasanjeev in #438
• [codex] docs(commerce): record local synthetic smoke evidence by @mishrasanjeev in #439
• docs(commerce): plan real merchant readiness after synthetic smoke by @mishrasanjeev in #440
• docs(commerce): define real merchant artifact intake by @mishrasanjeev in #441
• docs(commerce): add real merchant artifact collection template by @mishrasanjeev in #442
• docs(commerce): prepare merchant artifact collection packet by @mishrasanjeev in #443
• docs(commerce): add synthetic merchant demo onboarding plan by @mishrasanjeev in #444
• docs(commerce): plan merchant self-onboarding architecture by @mishrasanjeev in #445
• docs(commerce): propose self-onboarding api data model by @mishrasanjeev in #446
• docs(commerce): propose self-onboarding schema api prototype by @mishrasanjeev in #447
• docs(commerce): specify self-onboarding ui wireframe by @mishrasanjeev in #448
• docs(commerce): plan self-onboarding local validator prototype by @mishrasanjeev in #449
• docs(commerce): plan self-onboarding review workflow by @mishrasanjeev in #450
• docs(commerce): propose self-onboarding rollout automation by @mishrasanjeev in #451
• docs(commerce): add demo home goods merchant packet by @mishrasanjeev in #453
• docs(commerce): add demo launch rehearsal by @mishrasanjeev in #454
• chore(deps-dev): bump @anthropic-ai/sdk from 0.39.0 to 0.100.1 in /packages/anthropic by @dependabot[bot] in #456
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /packages/mcp by @dependabot[bot] in #457
• chore(deps-dev): bump vitest from 4.1.3 to 4.1.7 in /packages/gateway by @dependabot[bot] in #458
• chore(deps-dev): bump typescript from 5.3.3 to 6.0.3 in /packages/gateway by @dependabot[bot] in #459
• chore(deps): bump react-router-dom from 7.15.1 to 7.16.0 in /apps/portal in the minor-and-patch group by @dependabot[bot] in #460
• chore(deps): bump jose from 5.10.0 to 6.2.3 in /packages/x402 by @dependabot[bot] in #461
• chore(deps-dev): bump ai from 5.0.141 to 6.0.193 in /packages/vercel-ai by @dependabot[bot] in #462
• chore(deps-dev): bump @types/node from 20.19.35 to 25.9.1 in /packages/mcp-auth by @dependabot[bot] in #463
• chore(deps): bump commander from 12.1.0 to 15.0.0 in /packages/cli by @dependabot[bot] in #464
• chore(deps-dev): bump @aws-sdk/client-s3 from 3.1053.0 to 3.1056.0 in /packages/destinations by @dependabot[bot] in #465
• chore(deps-dev): bump @types/node from 20.19.34 to 25.9.1 in /packages/cli by @dependabot[bot] in #466
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /packages/destinations by @dependabot[bot] in #467
• chore(deps-dev): bump @grantex/sdk from 0.3.7 to 0.3.8 in /packages/adapters by @dependabot[bot] in #468
• chore(deps-dev): bump @types/node from 20.19.39 to 25.9.1 in /packages/mcp by @dependabot[bot] in #385
• chore(deps): bump zod from 3.25.76 to 4.4.3 in /packages/mcp by @dependabot[bot] in #455
• chore(deps): bump @grantex/sdk from 0.1.9 to 0.3.8 in /packages/mcp-auth by @dependabot[bot] in #388
• chore(deps): bump jose from 5.10.0 to 6.2.3 in /packages/mcp-auth by @dependabot[bot] in #391
• chore(deps-dev): bump @types/node from 20.19.37 to 25.9.1 in /packages/x402 by @dependabot[bot] in #394
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /packages/x402 by @dependabot[bot] in #398
• chore(deps): bump @fastify/cors from 10.1.0 to 11.2.0 in /apps/auth-service by @dependabot[bot] in #399
• chore(deps): bump ulid from 2.4.0 to 3.0.2 in /apps/auth-service by @dependabot[bot] in #402
• chore(deps): bump dotenv from 16.6.1 to 17.4.2 in /apps/auth-service by @dependabot[bot] in #404
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /apps/portal by @dependabot[bot] in #406
• chore(deps-dev): bump zod from 3.25.76 to 4.4.3 in /packages/vercel-ai by @dependabot[bot] in #407
• chore(deps-dev): bump express and @types/express in /packages/express by @dependabot[bot] in #410
• chore(deps-dev): bump @types/node from 20.19.39 to 25.9.1 in /packages/adapters by @dependabot[bot] in #411
• chore(deps-dev): bump @types/node from 20.19.39 to 25.9.1 in /packages/gateway by @dependabot[bot] in #413
• chore(deps-dev): bump @types/node from 20.19.35 to 25.9.1 in /packages/destinations by @dependabot[bot] in #414
• chore(deps-dev): bump @types/node from 20.19.35 to 25.9.1 in /packages/conformance by @dependabot[bot] in #415
• chore(deps): bump commander from 12.1.0 to 14.0.3 in /packages/conformance by @dependabot[bot] in #417
• chore(deps): bump ulid from 2.4.0 to 3.0.2 in /packages/gemma by @dependabot[bot] in #419
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /packages/gemma by @dependabot[bot] in #422
• chore(deps-dev): bump express and @types/express in /packages/mpp by @dependabot[bot] in #424
• chore(deps-dev): bump @types/node from 20.19.41 to 25.9.1 in /examples/quickstart-ts by @dependabot[bot] in #426
• chore(deps): bump express-rate-limit from 8.5.1 to 8.5.2 in /examples/x402-weather-api by @dependabot[bot] in #435
• chore(deps-dev): bump typescript from 5.3.3 to 6.0.3 in /packages/adapters by @dependabot[bot] in #412
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /packages/conformance by @dependabot[bot] in #420
• chore(deps): bump jose from 5.10.0 to 6.2.3 in /packages/gemma by @dependabot[bot] in #421
• chore(deps): bump github.com/mishrasanjeev/grantex-go from 0.1.1 to 0.1.9 in /examples/quickstart-go by @dependabot[bot] in #430
• chore(deps): bump github.com/hashicorp/terraform-plugin-framework from 1.7.0 to 1.19.0 in /packages/terraform-provider-grantex by @dependabot[bot] in #428
• chore(deps): bump github.com/hashicorp/terraform-plugin-framework-validators from 0.12.0 to 0.19.0 in /packages/terraform-provider-grantex by @dependabot[bot] in #431
• chore(deps-dev): bump vite from 6.4.2 to 8.0.14 in /apps/portal by @dependabot[bot] in #405
• chore(deps): bump react and @types/react in /apps/portal by @dependabot[bot] in #401
• chore(deps): bump stripe from 20.4.0 to 22.2.0 in /apps/auth-service by @dependabot[bot] in #400
• chore(deps): bump the minor-and-patch group across 1 directory with 6 updates by @dependabot[bot] in #396
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /examples/quickstart-ts by @dependabot[bot] in #427
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /packages/sdk-ts by @dependabot[bot] in #380
• chore(deps-dev): bump @types/node from 20.19.33 to 25.9.1 in /packages/sdk-ts by @dependabot[bot] in #393
• chore(deps): bump jose from 5.10.0 to 6.2.3 in /packages/sdk-ts by @dependabot[bot] in #386
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /packages/cli by @dependabot[bot] in #383
• [codex] Fix mentions dashboard workflow by @mishrasanjeev in #469
• [codex] feat(commerce): add seller sandbox onboarding foundation by @mishrasanjeev in #471
• [codex] feat(commerce): add category readiness checklist by @mishrasanjeev in #472
• [codex] feat(commerce): add catalog readiness preview by @mishrasanjeev in #473
• feat(commerce): add public-safe agent preview payload by @mishrasanjeev in #474
• [codex] Add C6D read-only discovery review request by @mishrasanjeev in #475
• [codex] docs(commerce): plan merchant self-serve interoperability by @mishrasanjeev in #470
• feat(commerce): add read-only discovery operator review by @mishrasanjeev in #476
• feat(commerce): add read-only discovery rollout proposal by @mishrasanjeev in #478
• feat(commerce): add AgenticOrg buyer discovery handoff by @mishrasanjeev in #479
• [codex] feat(commerce): add schemaorg jsonld preview adapter by @mishrasanjeev in #511
• [codex] feat(commerce): add ucp style capability profile preview by @mishrasanjeev in #512
• [codex] feat(commerce): add acp checkout shape preview by @mishrasanjeev in #513
• [codex] feat(commerce): add ap2 style evidence preview by @mishrasanjeev in #514
• [codex] feat(commerce): add merchant system connector foundation by @mishrasanjeev in #515
• [codex] docs(commerce): add open protocol packaging draft by @mishrasanjeev in #516
• test(commerce): add open protocol preview conformance fixtures by @mishrasanjeev in #517
• test(commerce): add open protocol preview validator scans by @mishrasanjeev in #518
• test(commerce): add preview conformance reporting by @mishrasanjeev in #519
• test(commerce): add preview conformance status page by @mishrasanjeev in #520
• test(commerce): add preview conformance ci gate by @mishrasanjeev in #521
• docs(commerce): add conformance release review runbook by @mishrasanjeev in #522
• docs(commerce): add release rehearsal status gap assessment by @mishrasanjeev in #523
• docs(commerce): add first connector sync adapter planning by @mishrasanjeev in #524
• test(commerce): add sandbox e2e test merchant rehearsal by @mishrasanjeev in #525
• feat(commerce): add sandbox connector dry-run foundation by @mishrasanjeev in #526
• feat(commerce): add connector dry-run review foundation by @mishrasanjeev in #527
• feat(commerce): add connector dry-run portal foundation by @mishrasanjeev in #528
• [codex] C6Sc connector dry-run portal evidence handoff by @mishrasanjeev in #529
• [codex] C6Sd connector dry-run evidence packet review by @mishrasanjeev in #530
• [codex] C6Se connector dry-run handoff remediation workflow by @mishrasanjeev in #531
• [codex] C6Sf connector dry-run remediation loop by @mishrasanjeev in #532
• feat(commerce): persist connector dry-run remediation evidence by @mishrasanjeev in #533
• [codex] C6Sh connector remediation queue timeline by @mishrasanjeev in #534
• C6Sia connector remediation operator triage controls by @mishrasanjeev in #535
• C6Sib sandbox connector remediation operator triage portal controls by @mishrasanjeev in #536
• C6Sic sandbox connector remediation triage workflow rehearsal by @mishrasanjeev in #537
• C6Sid sandbox connector remediation triage evidence reconciliation by @mishrasanjeev in #538
• C6Sie sandbox remediation follow-up closure gap assessment by @mishrasanjeev in #540
• docs(commerce): prepare IETF and NIST publication tracks by @mishrasanjeev in #539
• docs(commerce): draft agentic commerce IETF skeleton by @mishrasanjeev in #541
• docs(commerce): draft nist agentic commerce reference architecture by @mishrasanjeev in #542
• docs(commerce): add public-safe standards example corpus by @mishrasanjeev in #543
• docs(commerce): add current product gap analysis by @mishrasanjeev in #544
• docs(commerce): map agentic commerce launch readiness by @mishrasanjeev in #545
• ci: document and guard docs-only release controls by @mishrasanjeev in #546
• docs(commerce): map cross-contract parity by @mishrasanjeev in #547
• test(commerce): cover alias refusal parity by @mishrasanjeev in #548
• test(commerce): cover source freshness projection by @mishrasanjeev in #549
• C6U5 public discovery state contract by @mishrasanjeev in #550
• C6U6 Agentic Commerce consent session revocation propagation by @mishrasanjeev in #551
• feat(commerce): add order foundation by @mishrasanjeev in #552
• feat(commerce): add order handoff foundation by @mishrasanjeev in #553
• C6U9 sandbox checkout E2E foundation by @mishrasanjeev in #554
• C6U10 live provider readiness packet by @mishrasanjeev in #555
• C6U11 provider sandbox webhook reconciliation foundation by @mishrasanjeev in #556
• [codex] fix security alerts and x402 payment binding by @mishrasanjeev in #557
• chore(deps-dev): bump @types/node from 20.19.37 to 25.9.1 in /packages/gemma by @dependabot[bot] in #510
• chore(deps-dev): bump vitest from 4.1.2 to 4.1.8 in /packages/gemma by @dependabot[bot] in #509
• chore(deps-dev): bump @vitest/coverage-v8 from 4.1.7 to 4.1.8 in /packages/cli by @dependabot[bot] in #507
• chore(deps-dev): bump vitest from 4.1.7 to 4.1.8 in /packages/cli by @dependabot[bot] in #506
• chore(deps-dev): bump vitest from 4.1.7 to 4.1.8 in /packages/mcp-auth by @dependabot[bot] in #505
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /packages/mcp-auth by @dependabot[bot] in #504
• chore(deps-dev): bump @vitest/coverage-v8 from 4.1.7 to 4.1.8 in /packages/sdk-ts by @dependabot[bot] in #503
• chore(deps-dev): bump vitest from 4.1.7 to 4.1.8 in /packages/sdk-ts by @dependabot[bot] in #502
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /apps/auth-service by @dependabot[bot] in #501
• chore(deps): bump pino from 9.14.0 to 10.3.1 in /apps/auth-service by @dependabot[bot] in #500
• chore(deps-dev): bump @types/node from 20.19.33 to 25.9.1 in /apps/auth-service by @dependabot[bot] in #498
• chore(deps-dev): bump @aws-sdk/client-s3 from 3.1056.0 to 3.1062.0 in /packages/destinations by @dependabot[bot] in #496
• chore(deps): bump tailwind-merge from 2.6.1 to 3.6.0 in /apps/portal by @dependabot[bot] in #495
• chore(deps-dev): bump vitest from 4.1.7 to 4.1.8 in /packages/destinations by @dependabot[bot] in #494
• chore(deps-dev): bump vitest from 4.1.2 to 4.1.8 in /packages/conformance by @dependabot[bot] in #493
• chore(deps-dev): bump ai from 6.0.193 to 6.0.197 in /packages/vercel-ai by @dependabot[bot] in #491
• chore(deps-dev): bump @google-cloud/bigquery from 8.1.1 to 8.3.1 in /packages/destinations by @dependabot[bot] in #490
• chore(deps): bump commander from 14.0.3 to 15.0.0 in /packages/conformance by @dependabot[bot] in #488
• chore(deps-dev): bump vitest from 4.1.7 to 4.1.8 in /packages/adapters by @dependabot[bot] in #487
• chore(deps-dev): bump vitest from 4.1.7 to 4.1.8 in /packages/gateway by @dependabot[bot] in #486
• chore(deps): bump @hono/node-server from 1.19.13 to 2.0.4 in /packages/mcp by @dependabot[bot] in #485
• chore(deps): bump @noble/hashes from 2.0.1 to 2.2.0 in /packages/x402 by @dependabot[bot] in #484
• chore(deps): bump tsx from 4.22.3 to 4.22.4 in /examples/x402-weather-api by @dependabot[bot] in #483
• chore(deps-dev): bump express and @types/express in /packages/x402 by @dependabot[bot] in #482
• chore(deps): bump @noble/ed25519 from 2.3.0 to 3.1.0 in /packages/x402 by @dependabot[bot] in #481
• chore(deps): bump the minor-and-patch group in /apps/auth-service with 3 updates by @dependabot[bot] in #497
• chore(deps): bump the minor-and-patch group in /apps/portal with 7 updates by @dependabot[bot] in #492
• chore(deps-dev): bump vitest from 4.1.7 to 4.1.8 in /packages/mcp by @dependabot[bot] in #489
• [codex] Add C6W3 OACP artifact schema fixtures by @mishrasanjeev in #559
• [codex] Add C6W4 OACP adapter previews by @mishrasanjeev in #560
• [codex] Add C6W5 commitment boundary metadata by @mishrasanjeev in #561
• [codex] Add C6W6 prepared commitment envelopes by @mishrasanjeev in #562
• [codex] Add C6W7 response reconciliation by @mishrasanjeev in #563
• [codex] Add C6W8 eligibility packets by @mishrasanjeev in #583
• [codex] Add C6W9 dry-run verifier by @mishrasanjeev in #584
• chore(deps): bump esbuild from 0.28.0 to 0.28.1 in /examples/x402-weather-api by @dependabot[bot] in #587
• chore(deps): bump esbuild and tsx in /examples/audit-dashboard by @dependabot[bot] in #586
• chore(deps): bump esbuild and tsx in /examples/token-expiry-refresh by @dependabot[bot] in #585
• chore(deps): bump @grpc/grpc-js from 1.14.3 to 1.14.4 in /apps/auth-service by @dependabot[bot] in #558
• chore(deps): bump the minor-and-patch group across 1 directory with 7 updates by @dependabot[bot] in #588
• chore(deps): bump @fastify/rate-limit from 10.3.0 to 11.0.0 in /apps/auth-service by @dependabot[bot] in #581
• chore(deps-dev): bump ai from 6.0.197 to 6.0.202 in /packages/vercel-ai by @dependabot[bot] in #579
• chore(deps-dev): bump @types/node from 25.9.1 to 25.9.3 in /packages/mcp by @dependabot[bot] in #578
• chore(deps-dev): bump @types/react from 19.2.16 to 19.2.17 in /apps/portal in the minor-and-patch group by @dependabot[bot] in #576
• chore(deps-dev): bump @types/node from 25.9.1 to 25.9.3 in /packages/gemma by @dependabot[bot] in #575
• chore(deps-dev): bump @anthropic-ai/sdk from 0.100.1 to 0.104.1 in /packages/anthropic by @dependabot[bot] in #573
• chore(deps-dev): bump @types/node from 25.9.1 to 25.9.3 in /packages/cli by @dependabot[bot] in #572
• chore(deps): bump @fastify/rate-limit from 10.3.0 to 11.0.0 in /packages/mcp-auth by @dependabot[bot] in #571
• chore(deps-dev): bump vitest from 4.1.7 to 4.1.8 in /packages/x402 by @dependabot[bot] in #574
• chore(deps-dev): bump @types/node from 25.9.1 to 25.9.3 in /packages/mcp-auth by @dependabot[bot] in #570
• chore(deps-dev): bump @types/node from 25.9.1 to 25.9.3 in /packages/x402 by @dependabot[bot] in #577
• chore(deps-dev): bump @types/node from 25.9.1 to 25.9.3 in /packages/destinations by @dependabot[bot] in #569
• chore(deps-dev): bump @aws-sdk/client-s3 from 3.1062.0 to 3.1067.0 in /packages/destinations by @dependabot[bot] in #568
• chore(deps-dev): bump @types/node from 25.9.1 to 25.9.3 in /packages/adapters by @dependabot[bot] in #567
• chore(deps-dev): bump @types/node from 25.9.1 to 25.9.3 in /packages/sdk-ts by @dependabot[bot] in #566
• chore(deps-dev): bump @types/node from 25.9.1 to 25.9.3 in /packages/gateway by @dependabot[bot] in #565
• chore(deps-dev): bump @types/node from 25.9.1 to 25.9.3 in /packages/conformance by @dependabot[bot] in #564
• chore(deps): bump jose from 5.10.0 to 6.2.3 in /packages/cli by @dependabot[bot] in #508
• chore(deps): bump @simplewebauthn/server from 11.0.0 to 13.3.1 in /apps/auth-service by @dependabot[bot] in #499
• chore(deps): bump @simplewebauthn/types from 11.0.0 to 12.0.0 in /apps/auth-service by @dependabot[bot] in #582
• [codex] Update OACP PRD and content plan by @mishrasanjeev in #589
• docs(commerce): plan C6X1 OACP cache verifier by @mishrasanjeev in #590
• C6X2 OACP cached artifact verifier by @mishrasanjeev in #591
• C6X3 OACP cache repository compatibility by @mishrasanjeev in #592
• C6X4 durable OACP cache compatibility guard by @mishrasanjeev in #593
• C6X5 OACP cache maintenance compatibility guard by @mishrasanjeev in #594
• C6X6 OACP cache maintenance report compatibility guard by @mishrasanjeev in #595
• C6X7 operator decision compatibility guard by @mishrasanjeev in #596
• C6X8 operator decision audit compatibility by @mishrasanjeev in #597
• [codex] Add C6X9 audit export compatibility guard by @mishrasanjeev in #598
• [codex] Add C6Y1 audit review manifest compatibility by @mishrasanjeev in #599
• C6Y2 review manifest repository compatibility by @mishrasanjeev in #600
• C6Y3 review manifest summary compatibility by @mishrasanjeev in #601
• C6Y4 retention disposition compatibility guard by @mishrasanjeev in #602

New Contributors

• @dependabot[bot] made their first contribution in #193
• @bankyresearch made their first contribution in #230
• @diptb made their first contribution in #366
• @twok020101 made their first contribution in #372

Full Changelog: v0.1.7...v0.3.9