# Changelog ## [0.2.1] - 2026-08-13 ### Changed - 0.2.1 (plan 021): device-code OAuth flow consolidated onto the shared core pollDeviceCodeToken (bounded reads, fail-closed token shape, [REDACTED] redaction; authorization-code/refresh exchange bounded via readBoundedResponseJson); upload manager reads bounded and retains cleanup ids until their DELETE succeeds (no remote-file leak on failed cleanup). ## [0.1.0] - 2026-08-09 ### Changed - Released with exact 0.1.0 graph. ## [0.0.28] - 2026-08-08 ### Changed - Released with exact 0.0.28 graph. ## [0.0.27] - 2026-08-07 ### Changed - Released with exact 0.0.27 graph. ## [0.0.26] - 2026-08-06 ### Changed - Released with exact 0.0.26 graph. ## [0.0.25] - 2026-08-06 ### Changed - Released with exact 0.0.25 graph. ## [0.0.24] - 2026-08-04 ### Added - Durable `AgentEventSource` (memory + PostgreSQL LISTEN/NOTIFY), recoverable `ToolEffectStore`, and AG-UI MCP/MCP Apps/A2A fronting for Phase 7. ### Changed - Publishable graph remains **47** manifests at **0.0.24**; peers and lockfile move together. See [migration guide](../../docs/migration.md) for the 0.0.23 → 0.0.24 notes. ## [0.0.23] - 2026-08-03 ### Changed - Released with exact 0.0.23 graph. ## [0.0.22] - 2026-07-31 ### Changed - Released with exact 0.0.22 graph. ## [0.0.21] - 2026-07-31 ### Changed - Released with exact 0.0.21 graph. ## [0.0.20] - 2026-07-31 ### Changed - Released with exact 0.0.20 graph. ## [0.0.19] - 2026-07-30 ### Changed - Released with exact 0.0.19 graph. ## [0.0.18] - 2026-07-30 ### Changed - Released with exact 0.0.18 graph. ## [0.0.17] - 2026-07-29 ### Changed - HTTP errors now carry numeric `code` and parsed `Retry-After` (`retryAfterMs`), so 429/5xx classify as transient and the core retry policy honors provider backpressure. Base-URL stripping now handles repeated trailing slashes. - Released with exact 0.0.17 graph. ## [0.0.16] - 2026-07-26 ### Changed - Released with exact 0.0.16 graph. ## [0.0.15] - 2026-07-26 ### Added - Provider-hosted Responses tool-call attribution, bounded self-continuation, and OpenAI Realtime sessions with header authentication, ownership/session binding, and finite audio/byte/time caps. ## [0.0.14] - 2026-07-26 ### Changed - Released with exact 0.0.14 graph. ## [0.0.13] - 2026-07-24 ### Changed - Released with exact 0.0.13 graph. ## [0.0.12] - 2026-07-22 ### Changed - Released with exact 0.0.12 graph. ### Changed - Clarified that host-invoked Codex OAuth is Prism's only first-party subscription OAuth flow in 0.0.12. ## [0.0.11] - 2026-07-22 ### Changed - Released with exact 0.0.11 graph. ## [0.0.10] - 2026-07-21 ### Changed - Released with exact 0.0.10 graph. ## [0.0.96] - 2026-07-21 ### Changed - Released with exact 0.0.96 graph. ## [0.0.9] - 2026-07-21 - Released with the exact 0.0.9 first-party package graph. ### Fixed - Malformed streamed tool-call arguments yield recoverable tool calls via `toolCallFromArgumentsText` instead of throwing `ProviderTransportError` / terminal stream errors. ## [0.0.8] - 2026-07-20 - Released with the exact 0.0.8 first-party package graph. ## [0.0.7] - 2026-07-19 - Released with the exact 0.0.7 first-party package graph. All notable changes to @arnilo/prism-provider-openai will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [0.0.6] - 2026-07-19 ### Added - Caller-gated `listOpenAIModels()` / `mapOpenAIModel()` / `defineOpenAIModel()` against official `GET /models`. - `createOpenAIProviderPackage({ models?, codexModels? })` catalog overrides. ### Fixed - Responses input serialization: assistant history uses `output_text`; `function_call` items are top-level with `call_id`. - SSE tool streaming accepts official string `delta` on `response.function_call_arguments.delta`. - First-class `reasoning` merge from model + per-turn `compat.reasoning`. ## [0.0.5] - 2026-07-16 - Pinned the required `@arnilo/prism` peer and package metadata to 0.0.5; runtime behavior is unchanged. ## [0.0.4] - 2026-07-14 ### Added - Responses API multimodal mapping for `audio` / `file` / `document` with bounded file upload cache and cleanup. ### Changed - Responses and Codex routes use shared bounded transport/media primitives, protected authorization headers, structured-output mapping, and OAuth abort polling. - Inline OpenAI `file_data` now uses `data:;base64,...` so MIME identity is preserved under provider conformance canaries. ## [0.0.2] - 2026-07-05 ### Added - Added `LICENSE` (MIT) and `CHANGELOG.md`. - Added npm package metadata: `license`, `repository`, `bugs`, `homepage`, `keywords`, and `sideEffects`. ### Changed - `files` whitelist now explicitly excludes `dist/__tests__/` and `dist/**/*.map` from published tarballs. - Made `prism` a required peer dependency; it is no longer optional. ## [0.0.1] - 2026-06-22 ### Added - Initial release of @arnilo/prism-provider-openai.