@dupecom/botcha 0.10.0 → 0.11.0

package/README.md

@@ -35,6 +35,7 @@ Use cases:
 - 📊 Per-app metrics dashboard at [botcha.ai/dashboard](https://botcha.ai/dashboard)
 - 📧 Email verification, account recovery, and secret rotation
 - 🤖 Agent-first dashboard auth (challenge-based login + device code handoff)
+- 🆔 Persistent agent identities with registry
 
 ## Install
 
@@ -237,6 +238,32 @@ async with BotchaClient(app_id="app_abc123") as client:
     response = await client.fetch("https://api.example.com/agent-only")
 ```
 
+### SDK App Lifecycle (v0.10.0+)
+
+Both SDKs now include methods for the full app lifecycle:
+
+**TypeScript:**
+
+```typescript
+const client = new BotchaClient();
+const app = await client.createApp('agent@example.com'); // auto-sets appId
+await client.verifyEmail('123456');                       // verify with email code
+await client.resendVerification();                        // resend code
+await client.recoverAccount('agent@example.com');         // recovery device code via email
+const rotated = await client.rotateSecret();              // rotate secret (auth required)
+```
+
+**Python:**
+
+```python
+async with BotchaClient() as client:
+    app = await client.create_app("agent@example.com")  # auto-sets app_id
+    await client.verify_email("123456")                  # verify with email code
+    await client.resend_verification()                   # resend code
+    await client.recover_account("agent@example.com")    # recovery device code via email
+    rotated = await client.rotate_secret()               # rotate secret (auth required)
+```
+
 ### Rate Limiting
 
 Each app gets its own rate limit bucket:
@@ -285,6 +312,50 @@ Session uses cookie-based auth (HttpOnly, Secure, SameSite=Lax, 1hr expiry).
 
 All metrics support `1h`, `24h`, `7d`, and `30d` time windows via htmx-powered buttons — no page reload required.
 
+## 🤖 Agent Registry
+
+BOTCHA now supports **persistent agent identities** — register your agent with a name, operator, and version to build a verifiable identity over time.
+
+### Why Register an Agent?
+
+- **Identity**: Get a persistent `agent_id` that survives across sessions
+- **Attribution**: Track which agent made which API calls
+- **Reputation**: Build trust over time (foundation for future reputation scoring)
+- **Accountability**: Know who's operating each agent
+
+### Registering an Agent
+
+```bash
+# Register a new agent (requires app_id)
+curl -X POST "https://botcha.ai/v1/agents/register?app_id=app_abc123" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "name": "my-assistant",
+    "operator": "Acme Corp",
+    "version": "1.0.0"
+  }'
+
+# Returns:
+{
+  "agent_id": "agent_xyz789",
+  "app_id": "app_abc123",
+  "name": "my-assistant",
+  "operator": "Acme Corp",
+  "version": "1.0.0",
+  "created_at": 1770936000000
+}
+```
+
+### Agent Endpoints
+
+| Endpoint | Description |
+|----------|-------------|
+| `POST /v1/agents/register` | Create a new agent identity (requires `app_id`) |
+| `GET /v1/agents/:id` | Get agent info by ID (public, no auth) |
+| `GET /v1/agents` | List all agents for authenticated app |
+
+> **Note:** Agent Registry is the foundation for future features like delegation chains, capability attestation, and reputation scoring. See [ROADMAP.md](./ROADMAP.md) for details.
+
 ## 🔄 SSE Streaming Flow (AI-Native)
 
 For AI agents that prefer a **conversational handshake**, BOTCHA offers **Server-Sent Events (SSE)** streaming:
@@ -362,7 +433,7 @@ BOTCHA is designed to be auto-discoverable by AI agents through multiple standar
 All responses include these headers for agent discovery:
 
 ```http
-X-Botcha-Version: 0.5.0
+X-Botcha-Version: 0.11.0
 X-Botcha-Enabled: true
 X-Botcha-Methods: hybrid-challenge,speed-challenge,reasoning-challenge,standard-challenge
 X-Botcha-Docs: https://botcha.ai/openapi.json

package/dist/lib/client/index.js

@@ -1,6 +1,6 @@
 import crypto from 'crypto';
 // SDK version - hardcoded since npm_package_version is unreliable when used as a library
-const SDK_VERSION = '0.10.0';
+const SDK_VERSION = '0.11.0';
 // Export stream client
 export { BotchaStreamClient } from './stream.js';
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dupecom/botcha",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Prove you're a bot. Humans need not apply. Reverse CAPTCHA for AI-only APIs.",
   "workspaces": [
     "packages/*"