v0.2.2

What's Changed

• v0.2.2: README links that work on PyPI; docs menu in sections by @Marceltov in #12

Full Changelog: v0.2.1...v0.2.2

v0.2.1

What's Changed

• TypeScript package: OAuth for MCP servers with a form or OIDC login by @Marceltov in #3
• ADR 0004: apps with a web UI sign in with Better Auth; this library stays the form-login OAuth server by @Marceltov in #4
• Docs: restructure, drop the web-app example, own design and diagrams by @Marceltov in #8
• Python only: remove the TypeScript package; roadmap as a timeline by @Marceltov in #9

Full Changelog: v0.2.0...v0.2.1

v0.2.0

v0.2.0

• check_login may take a second argument, a LoginClient (client_id, client_name, redirect_uri).
  One-argument callbacks keep working.
• LoginField(hint=..., group=...): a sentence above the input, and collapsed sections for
  alternative logins.
• Codes and tokens are bound to the requested resource (RFC 8707). A token bound to another
  resource, or to an old base URL, is refused and doesn't refresh.
• The code redirect carries iss; the metadata advertises it (RFC 9207).
• The login page shows the redirect's real host, never userinfo.
• BearerPrefixMiddleware(app, schemes=("Token",)) rewrites further schemes to Bearer.

Stored logins from v0.1 keep working; tokens issued by v0.1 carry no resource and are accepted.