v0.6.0

Breaking Changes

• Well-known endpoint renamed from aauth-issuer.json to aauth-person.json (aligns with AAuth protocol spec distinction between Person Server and Access Server)
• Removed pseudonym and identity requirement levels from AAuth-Requirement header (moved to HTTP Signature Keys spec)

New Features

• AAuth-Capabilities header — agents declare protocol capabilities (interaction, clarification, payment) via capabilities option on createAAuthFetch/createSignedFetch
• AAuth-Mission header — agents signal mission context via mission option on createAAuthFetch/createSignedFetch; server-side parseMissionHeader() feeds directly into createResourceToken
• AAuth-Access header (two-party mode) — createAAuthFetch automatically caches opaque access tokens from AAuth-Access response headers and sends them as Authorization: Bearer on subsequent requests; server-side buildAAuthAccessHeader() for setting the header

Other

• Fixed spec link in README (DickHardt/draft-hardt-aauth → DickHardt/AAuth)
• Fixed JWT type names in README (agent+jwt → aa-agent+jwt, etc.)
• Updated mcp-agent and mcp-server READMEs with current API documentation
• Added Protocol Support section noting call chaining and AS federation are not yet implemented

v0.5.2

Fix publish: skip hardware-keys build in main publish job

v0.5.1

Fix provenance: add repository URL to hardware-keys

v0.5.0

What's new

• Fix skills: require AI agents to run discover before giving guidance
• Narrow README code blocks for npm rendering
• Remove agent-auth keyword
• Hardware keys CI with platform-specific native builds
• Provenance-signed publishing from GitHub Actions

v0.4.9

• Fix skills: require AI agents to run discover first
• Narrow README code blocks
• Remove agent-auth keyword
• Use NPM_TOKEN for CI publishing with provenance

v0.4.8

Pin npm@10

v0.4.7

Match packages-js publish pattern: registry-url + npm@latest

v0.4.6

Fix OIDC publishing: clear _authToken to enable OIDC fallback

v0.4.5

• Fix OIDC publishing: remove registry-url from setup-node
• Fix skills: require AI agents to run discover first
• Narrow README code blocks
• Remove agent-auth keyword

v0.4.4

Fix npm upgrade: pin to npm@10