v0.1.2

Dependency-only alignment release: @pegma/rate-limit advances from 0.1.0 to 0.2.0 and @pegma/mail from 0.1.0 to 0.1.1, so the dependency tree resolves a single @pegma/storage-core@0.4.0 — previously rate-limit's transitive storage-core 0.3.0 split hosts' trees into two incompatible Store types. Identity already required a storage-core 0.4.0 Store; runtime behavior, composition contract, and public API are unchanged. See docs/RELEASE_NOTES.md.

v0.1.1

Documentation-only patch closing the operator-guidance findings from the 2026-07-28 security scan. No runtime or public API change; the packed dist/ output is identical to 0.1.0.

• claimsFor and repairUserByEmail are named as privileged operations alongside provisionVerifiedUser; none may be reachable from unauthenticated traffic or a user-supplied principalId/email (F-01).
• Email change now carries explicit host obligations: authenticate the endpoint for the named principal, and require a fresh passkey assertion before beginEmailChange. The old-address notification is a detective control that arrives only after the change commits (F-02).
• The threat model records that authenticator attestation is deliberately not verified (attestationType: "none") (F-03).
• finishAccountCreation is documented as also authenticating existing accounts, so the creation endpoint needs sign-in-grade rate limiting, session policy, and anomaly detection (F-06).

Three findings were reviewed and disputed as non-findings, with reasoning in docs/securityscan.md: plaintext deliverable addresses at rest (F-04), deterministic HMAC-derived codes (F-05), and the credential-ID timing distinction in finishPasskeyAuthentication (F-07).

v0.1.0

What's Changed

• Prepare @pegma/identity v0.1.0 by @FlyOverCoderKY in #3

Full Changelog: v0.0.0...v0.1.0