sm-user-plugin 0.1.17

Highlights

v0.1.15 and v0.1.16 were both released from v0.1.14 on separate lines, so each was missing the other's changes. v0.1.17 has both. Use it instead of either.

Added

• An OAuth MCP subject whose grant holds read or write also satisfies the declared scopes the catalog marks with Implies.
  • A personal token is not expanded.
  • A write grant does not imply read.

Changed

• A 403 from user.scope:<scope> includes missing_scope, and a 403 from user.permission:<code> includes missing_permission.
• go.mod now requires SummerCMS v0.5.2, the version the scope catalog needs.

Fixed

• The MCP dispatch credential carries the personal token id.