sm-oauthserver-plugin 0.1.4

Changed

• MCP consent is stored per client.
  • A later allow replaces the stored scopes instead of merging them.
  • offline_access follows the issued code.
  • Revoking a client deletes its unused MCP code.
• The authorizations list marks each client as mcp or oidc.
• The advertised MCP scope list comes from config. You can filter the declared member scopes, but the five fixed names always stay. An unknown name fails boot.

Upgrading

• A migration creates one consent for each live MCP grant. Running it again changes nothing.

Requires SummerCMS v0.5.2 and sm-user-plugin v0.1.16.