v2.1.0

HTTP status on the protocol trace, structured CLI errors, and a
validate-the-client agent skill.

Breaking change

error events are objects (error, optional status,
error_description), not a string. Nested request.response includes
HTTP status plus the parsed body.

Highlights

• Skill workflow is “validate this client”: expected denials can pass;
  user-supplied issuer / client_id / redirect is the default path
• --redirect-uri is an alias of --redirect-url
• Help text: --callback-addr is the local bind, --audience is access-token
  aud, --prompt is OpenID Connect prompt
• Opaque or JWE access tokens are a successful token response