release: 0.4.0 — lockstep version bump for both packages

[TheBlackBit]

In plain terms

This sets both published packages to version 0.4.0. It is only the version number — no behavior, no features, no logic. Seventeen changes have been merged since the last release (0.3.1), and none of them have reached the outside world yet, because this project only publishes when someone creates a GitHub release.

Merging this does not publish anything. It just prepares the version number. Publishing happens afterwards, when a release is created on the merged commit.

What you're approving

• Three files, six lines. The two package files get 0.4.0 instead of 0.3.1, and the lock file records the same. Nothing else.
• One line matters more than the others. The storefront package depends on the gate package by version range. That range was ^0.3.1, which in this numbering scheme means "anything from 0.3.1 up to but not including 0.4.0." Left alone, a freshly published 0.4.0 storefront would reach out and download the old 0.3.0-series gate instead of its own. It is now ^0.4.0. The tool that bumps versions does not fix this line — it has to be changed by hand, so it is the one thing worth checking.
• Why 0.4.0 and not 0.3.2. Two reasons. There is genuinely new capability in this release — a one-call configuration check (credentagent.doctor()), a way to plug the gate into a host application other than the bundled storefront (defineHost()), and the ability to brand the consent pages. And there is a breaking change for a specific, small group of people (see below). A middle-number bump is how this project signals both.
• Worst case if it's wrong: the publish step fails loudly on a version conflict, or the storefront installs a mismatched gate. Both are visible immediately, and neither can move money or weaken any consent check.
• What stays safe: no source code changes, no user-facing behavior change, no security control touched, nothing deployed.

The breaking change reviewers should know about

If someone wrote their own external checker — a plug-in that does the verifying and the paying on CredentAgent's behalf — against the published 0.3.1, this release changes the contract they built to. Full migration guidance is in #161 — the DelegatedVerifier consume/settle split, and it belongs in the release notes.

The short version: that plug-in used to verify and charge in a single step. It now verifies in one step and charges in a separate one, and CredentAgent decides when the charge happens. This exists because CredentAgent's own rules can be stricter than the checker's — a checker might be satisfied by an 18-and-over proof where the shop requires 21-and-over. Under the old arrangement the card was charged before CredentAgent got to say no, so a 20-year-old's alcohol order would be charged and then refused.

Anyone using the built-in consent flows, or the bundled storefront, is unaffected.

How to test

npm ci
npm run build
npm test
npm run lint

Expect the build and lint to be clean and 594 tests across 38 files to pass.

Then confirm the version numbers agree — this is the check that matters:

node -p "const g=require('./packages/credentagent-gate/package.json'),s=require('./packages/credentagent-storefront/package.json');JSON.stringify({gate:g.version,storefront:s.version,storefrontNeedsGate:s.dependencies['@openmobilehub/credentagent-gate']})"

You should see all three reading 0.4.0:

{"gate":"0.4.0","storefront":"0.4.0","storefrontNeedsGate":"^0.4.0"}

---

For reviewers — the detail

What ships when this is released

The 17 commits between tag v0.3.1 and d1ce61c. Headlines: the delegated verify/settle split (#103), custom-effect enforcement gap fixes (#131), credentagent.doctor() (#134), defineHost() (#136), ceremony page branding (#132), the stable reader identity on the iOS/ISO-mdoc path (#133), grant spend serialization + integer-cent pricing (#135), unique dcql() credential ids (#127), the widget-missing fail-fast (#129), the honest checkout receipt (#130), and the phone-reachable Checkout button (#109).

Cut line

d1ce61c, which is main as it stands. Every open pull request (#160, #153, #151, #148, #147, #128, #94) is deliberately deferred to a later release — none is included here.

Pre-flight audit (docs/PUBLISHING.md)

Run against this branch, with exit codes checked rather than inferred from piped output:

• Clean build from a wiped dist/ in both workspaces — exit 0, zero TypeScript errors.
• npm test — exit 0, 594 passed / 38 files, including the security bypass tests.
• npm run lint — exit 0.
• exports maps resolve to emitted files: gate .; storefront ., ./server, ./redis, ./firestore.
• The storefront's runtime asset dist/ui/mcp-app.html (read from disk at request time, so its absence would be a runtime-only failure) is in the tarball — confirmed via npm pack --dry-run, 556.8 kB, covered by the "dist" entry in files.
• LICENSE (11.4 kB) and README present in both tarballs.
• No heavy or demo dependency in either package's dependencies: @upstash/redis, @hashgraph/sdk, cors, and react are all absent. @upstash/redis does appear inside dist/redis.js, which is correct and not a leak — it is an optional peer dependency behind a lazy dynamic import(), reached only when a caller actually asks for Redis-backed storage.
• @simplewebauthn/browser, resolved at runtime by the passkey flow, is a declared gate dependency.

The dependency-range edit, and a trap worth recording

npm version --workspace … bumps version fields but does not rewrite a sibling workspace dependency range, so @openmobilehub/credentagent-gate: "^0.3.1" survived the bump and was edited by hand.

While bumping, the intermediate state (workspace gate at 0.4.0, storefront still requesting ^0.3.1) made npm unable to satisfy the range from the workspace, so it installed the published 0.3.1 into a nested packages/credentagent-storefront/node_modules/. TypeScript then resolved the gate to that copy and failed with error TS2305: Module '@openmobilehub/credentagent-gate' has no exported member 'Branding' — Branding being new in this release. A plain npm install after correcting the range prunes the nested copy and restores the workspace symlink. Worth knowing because the error names a missing export and reads like a source bug, when the cause is a stale resolution.

Honesty gate

Unchanged and re-checked. trust_level stays presence-only-demo for the OpenID4VP flows: real wire cryptography (JWE/ECDH-ES, nonce binding, HPKE, ISO-mdoc parsing) and real WebAuthn on the passkey flow, but still no issuer or device-signature trust anchor, and the AP2 mandate remains dev-signed. Issuer-verified trust is the next line, not this one. No README or release copy may present a presence-only gate as a real safety control.

What happens after merge

Per docs/PUBLISHING.md, the GitHub release is the publish trigger: tag v0.4.0 on the merged commit, then publish a release, at which point .github/workflows/publish.yml publishes the gate first and the storefront second (that order is load-bearing — the storefront's semver range only resolves once the gate is on the registry). Nobody runs npm publish by hand. Once npm shows 0.4.0, the follow-up is the quickstart catch-up pull request bumping examples/quickstart to 0.4.0, whose clean install of the published packages is the real post-publish check.

Refs #161.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
credentagent-demo	Ready	Preview	Jul 29, 2026 9:36pm

[dzuluaga]

LGTM. Thanks!