release: @parity/truapi 0.21.0, @parity/truapi-host 0.21.0, @parity/truapi-provider 0.2.2, @parity/ios-host 0.21.0, @parity/android-host 0.21.0

CHANGELOG.md

@@ -5,12 +5,36 @@ All notable changes to the TrUAPI protocol are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 generated from [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [0.21.0] - 2026-09-24
+
+### Added
+
+- load verifiable on demand in the browser (#922)
+- host-supplied wire-debugger dial, plus a make debugger target (#604)
+- let a withdrawal reach the paired host that is serving it (#933)
+- stop a withdrawn call before it prompts, acts or reaches another party (#927)
+- pass the requesting ProductContext to permission prompts (#936)
+- stream product frames to a wire debugger behind --debugger (#656)
+
+### Changed
+
+- build smoldot's secp256k1 tables on first use in the browser (#928)
+
+### Fixed
+
+- mark the debugger private, since it is not published (#911)
+- initialize built-in personhood keys (#924)
+
 ## [0.20.0] - 2026-09-23
 
 ### Added
 
 - chat modality on the shared TrUAPI core (#840)
 
+### Changed
+
+- @parity/truapi 0.20.0, @parity/truapi-host 0.20.0, @parity/ios-host 0.20.0 (#920)
+
 ### Fixed
 
 - repair source installs and gate rustdoc (#917)

js/packages/truapi-debugger/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @parity/truapi-debugger
 
+## 0.1.8
+
+### Patch Changes
+
+- 021815d: The debugger is marked private, which is what it already was in practice: it has never been published, and
+  its README runs it from the workspace. Changesets bumped its version with every release because it depends on the
+  client, so the version it declared climbed while nothing shipped, and the registry drift check reported a published
+  version that was missing. Publishing it later is removing that one field.
+- Updated dependencies [ffdd9b4]
+- Updated dependencies [5a9f4b9]
+- Updated dependencies [cf1702f]
+  - @parity/truapi@0.21.0
+
 ## 0.1.7
 
 ### Patch Changes

js/packages/truapi-debugger/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parity/truapi-debugger",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "private": true,
   "description": "In-repo debugger consumer for TrUAPI wire frames: decodes and groups the frames the truapi-server host tap streams out",
   "license": "MIT",
@@ -34,6 +34,6 @@
     "typescript": "^6.0"
   },
   "dependencies": {
-    "@parity/truapi": "^0.20.0"
+    "@parity/truapi": "^0.21.0"
   }
 }

js/packages/truapi-host/CHANGELOG.md

@@ -1,5 +1,60 @@
 # @parity/truapi-host
 
+## 0.21.0
+
+### Minor Changes
+
+- 579f450: Load `verifiable` on demand in the browser. The core WASM is 2.64 MiB raw and 775 KiB brotli, down from 7.76
+  MiB and 5.40 MiB: `verifiable` and its 4.5 MiB of powers of tau live in a separate module, `truapi_verifiable.js` and
+  `truapi_verifiable_bg.wasm` beside the core's files in each bundle, fetched in the background once a pairing session
+  connects, or when a ring-VRF operation first runs. Bundlers that follow `new URL(…, import.meta.url)`, such as Vite,
+  emit both files, and a host serving a bundle directory as a whole needs no change; a host that copies individual files
+  out of it must copy both too.
+- db004aa: SSO request cancellation. A pairing host whose caller withdraws a request it has published sends a `Cancel`
+  naming it, when that request is still the newest one on the session; a host timeout sends nothing. The core's
+  signing-host responder reads `Cancel` while it is still serving earlier requests: a running request stops at its
+  confirmation prompt or before its next allocation step and posts no response, and one not yet started never runs.
+  `Cancel` is appended to the SSO catalog at the next index, so a peer that predates it logs the message and serves the
+  request as before.
+- 0e56d37: Take the wire debugger's dial from the embedding host instead of `localStorage`.
+
+  `createWebWorkerPairingHostRuntime` accepts a `debugger` option; a dev build may carry a default in
+  `VITE_TRUAPI_DEBUGGER_URL`. The host's own value wins, and `null` or `""` refuses the dial outright. The dial is
+  resolved once at construction and cannot be changed from the page afterwards, so whether a session is observed is a
+  property of the build and the host rather than of anything typed into a console later.
+
+  While a dial is live the host shows a small dev-only badge naming every endpoint frames are going to, suppressible
+  with `debuggerIndicator: false` for a host that renders its own. The badge belongs to the runtimes that are dialling,
+  so an embedder with one worker runtime per product surface can give a dial to some of them without the rest taking the
+  badge down.
+
+  A dial URL must be `ws://` on `localhost`, 127.0.0.0/8 or `[::1]`, the same set the native sink accepts. An
+  IPv4-mapped literal such as `ws://[::ffff:127.0.0.1]` is refused.
+
+  **Breaking for anyone enabling the debugger today:** the `truapi:debugger` `localStorage` key is no longer read, and
+  setting it has no effect. Pass the `debugger` option, or build with `VITE_TRUAPI_DEBUGGER_URL`.
+
+- 5a9f4b9: The `Permissions` host callbacks name the product that asked: `devicePermission(product, request)` and
+  `remotePermission(product, request)` take the requesting `ProductContext` first, like the other product-scoped
+  callbacks, so a host can title the prompt with the product and key any grant it keeps itself by the product. Stored
+  decisions stay keyed by `productId` alone.
+
+  The `truapi-host` CLI names the requesting product in its permission approvals.
+
+### Patch Changes
+
+- cf1702f: Initialize built-in personhood ring keys when an authorized product lists the personhood owner's keys, so
+  full and lite handles are available without prior registration on the device.
+- dadcabd: A withdrawn request stops on the host, not only at the product. A call cancelled while its confirmation
+  prompt is open stops waiting, and an answer given afterwards authorizes nothing. A withdrawn call never publishes its
+  paired-host request, never sends a broadcast, statement, notification or navigation it had not yet sent, and a
+  broadcast already sent is stopped when the node gave it an operation id. Permission prompts still finish and record
+  their answer. Every stop reaches the product as `CallError.Cancelled`.
+- Updated dependencies [ffdd9b4]
+- Updated dependencies [5a9f4b9]
+- Updated dependencies [cf1702f]
+  - @parity/truapi@0.21.0
+
 ## 0.20.0
 
 ### Patch Changes

js/packages/truapi-host/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parity/truapi-host",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "WASM-backed TrUAPI host runtime: embeds the Rust core, with web iframe and Web Worker entry points",
   "license": "MIT",
   "author": "Parity Technologies <admin@parity.io>",
@@ -86,7 +86,7 @@
   },
   "dependencies": {
     "@noble/hashes": "^2.2.0",
-    "@parity/truapi": "^0.20.0",
+    "@parity/truapi": "^0.21.0",
     "neverthrow": "^8.2.0"
   },
   "devDependencies": {

js/packages/truapi-provider/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @parity/truapi-provider
 
+## 0.2.2
+
+### Patch Changes
+
+- a8fd3a0: The browser bundle is 4.25 MiB raw and 0.94 MiB brotli, down from 5.31 MiB and 2.01 MiB. smoldot's secp256k1
+  multiplication tables are built the first time a runtime call uses a secp256k1 host function, in about 10 ms, instead
+  of shipping as 1 MiB of precomputed points.
+
 ## 0.2.1
 
 ### Patch Changes

js/packages/truapi-provider/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parity/truapi-provider",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Network provider backends for the TrUAPI ChainProvider: an embedded smoldot light client and remote WebSocket JSON-RPC nodes, compiled to WebAssembly for browser hosts",
   "license": "MIT AND Apache-2.0",
   "author": "Parity Technologies <admin@parity.io>",

js/packages/truapi/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @parity/truapi
 
+## 0.21.0
+
+### Minor Changes
+
+- ffdd9b4: `truapi-host` streams product frames to a wire debugger behind `--debugger <ws-url>` (or
+  `TRUAPI_DEBUGGER_URL`).
+
+  The commands that serve frames, `pairing-host`, `dev` and `signing-host`, resolve the switch before their frame
+  listener binds, so a non-loopback URL fails startup rather than at first dial. Each of those commands reports the
+  outcome once as a lifecycle event, naming the endpoint and the switch clap read it from, or saying the debugger is
+  off. Each accepted connection gets its own channel id, `<product-id>#<n>`, so concurrent peers under one host do not
+  share a trace key.
+
+- 5a9f4b9: The `Permissions` host callbacks name the product that asked: `devicePermission(product, request)` and
+  `remotePermission(product, request)` take the requesting `ProductContext` first, like the other product-scoped
+  callbacks, so a host can title the prompt with the product and key any grant it keeps itself by the product. Stored
+  decisions stay keyed by `productId` alone.
+
+  The `truapi-host` CLI names the requesting product in its permission approvals.
+
+### Patch Changes
+
+- cf1702f: Initialize built-in personhood ring keys when an authorized product lists the personhood owner's keys, so
+  full and lite handles are available without prior registration on the device.
+
 ## 0.20.0
 
 ### Minor Changes

js/packages/truapi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parity/truapi",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "TrUAPI TypeScript transport, SCALE codecs, and generated API client",
   "license": "MIT",
   "author": "Parity Technologies <admin@parity.io>",