v0.2.0 — WorkOS, Hono, WebhookSink, A2A adapter (experimental)

Five-feature minor release.

Added

• workos(client_id, audience, domain?) profile (Python + TypeScript) — third big-vendor profile after Entra and Auth0. WorkOS AuthKit OAuth OBO. JWKS URL pattern records the WorkOS quirk that JWKS lives under /sso/jwks/<client_id> even for AuthKit / User Management tokens.

• A2AAgentCardAdapter (Python + TypeScript, experimental) — first non-OAuth-family adapter. Verifies signed Agent Cards per the A2A v1.0 protocol. principal ← provider.organization, agent ← card.name, scopes ← skills[].id. Marked experimental because A2A v1.0's .proto omits explicit canonicalisation rules; current implementation uses deterministic JSON serialisation that matches most A2A implementations but is not formally RFC 8785 (JCS) compliant.

• @deeplethe/demarche/hono — Hono middleware (verifyMiddleware, requireScope, DemarcheEnv type) for TypeScript. Matches the Python demarche.fastapi.DemarcheAuth semantics. Hono is an optional peer-dependency.

• WebhookSink (Python + TypeScript) — production audit sink that POSTs each event to an HTTPS URL. HTTPS-only at construction. Delivery failures do not propagate; opt in via callback. Custom headers supported for Bearer / HMAC.

Changed

• npm publishing migrated to OIDC trusted publisher. Bootstrap token deleted from GitHub Secrets. Future publishes auto-generate provenance attestations and require no long-lived secrets, matching the PyPI publishing posture.

Tests

Package	Tests
Python (demarche)	123 (was 91)
TypeScript (@deeplethe/demarche)	103 (was 64)
Combined	226 (was 155)

Installation

pip install demarche==0.2.0
npm install @deeplethe/demarche@0.2.0

Full changelog at CHANGELOG.md.

v0.1.0 — TypeScript at parity + OpenID Connect Discovery

First feature release. Brings the TypeScript SDK to feature parity with Python, and adds OpenID Connect Discovery for one-line adapter setup against any standards-compliant OIDC issuer.

Python additions

• JWKSKeyProvider.from_issuer(...) — fetches {issuer}/.well-known/openid-configuration (RFC 8414) and constructs a configured JWKSKeyProvider from the discovered jwks_uri.
• OAuthOBOAdapter.from_issuer(...) — one-liner adapter setup for any OIDC-discoverable issuer (Keycloak, Cognito, Okta, custom OIDC servers).

TypeScript: full SDK at parity

• Verifier, IssuerAdapter, AuditEvent / AuditSink / LoggingSink, exception hierarchy.
• OAuthOBOAdapter (using jose for JWT primitives), StaticKeyProvider, JWKSKeyProvider with HTTPS enforcement, TTL cache, key rotation, rate-limited refresh, and OIDC Discovery via JWKSKeyProvider.fromIssuer.
• entraAgentId() and auth0AiAgents() profile factories.

Infrastructure

• TypeScript CI job (Node 20 + 22 matrix); 8 total CI jobs across Python 3.10–3.13 on Linux, Python 3.12 on Windows, FastAPI example end-to-end, and TypeScript on Node 20 + 22.
• publish-npm.yml workflow with dual-mode auth (token for first publish, OIDC trusted publisher after).

Tests

Package	Tests
Python (demarche)	91
TypeScript (@deeplethe/demarche)	64
Combined	155

Installation

pip install demarche==0.1.0
npm install @deeplethe/demarche@0.1.0

Full changelog at CHANGELOG.md.