# Changelog

All notable changes to this project are documented in this file.
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
this project uses [Semantic Versioning](https://semver.org/).

## [0.1.0] - 2026-07-04

### Added

- Initial public release.
- `TokenProvider` / `TokenVerifier` protocols as the sole auth extension point.
- `OAuth2ClientCredentialsProvider`: generic RFC 6749 client-credentials
  token acquisition with per-audience caching.
- `SharedSecretVerifier` (HS256, dev/test) and `JWKSVerifier` (RS256 via
  JWKS, works against any standard OIDC IdP) implementing `TokenVerifier`.
- `PassportAuthMiddleware`: Starlette middleware enforcing a `TokenVerifier`
  on every route except AgentCard discovery.
- `RemoteAgentClient` / `build_agent_app`: client and server SDK surfaces
  wrapping `a2a-sdk` with auth, retry, and optional OTel tracing wired in.
- `a2a_passport.testing.mock_idp`: in-process mock OAuth2 IdP for tests
  and local demos.
- Three demo agents (weather, translator, orchestrator) under `examples/`
  proving a real multi-hop A2A chain with per-hop scoped credentials.
- Conformance test suite running in-process via `httpx.ASGITransport`.
