v2026.09.30.0023

What's Changed

Sign-in no longer fetches Ministry Platform's OIDC discovery document at boot (#101), so a slow or failing MP can no longer drop the sign-in provider or stall every page's session check. This release also corrects the CommunicationType enum and prepares the repo for public use under the MIT license. Forks: if you ported selfHealingAuth from the 2026-09-28 playbook, replace it by following .claude/playbooks/port-oidc-lazy-discovery.md.

⚠️ Breaking Changes

• Node 22 or later is required (#105): package.json now sets "engines": {"node": ">=22"}, and npm run setup checks the version. Node 20 is end-of-life, and CI already ran on 22.
• CommunicationType is now 'Email' | 'SMS' (#92, thanks @jonnydcakes): 'Text' and 'Letter' are removed, because MP always rejected them with an HTTP 500. An 'SMS' communication must set TextPhoneNumberId (a dp_SMS_Numbers.SMS_Number_ID). The compiler enforces this, and createCommunication refuses any other value before it sends.

🐛 Bug Fixes

• OIDC discovery is no longer fetched at boot (#107, fixes #101): before, a failed fetch made sign-in return 404 PROVIDER_NOT_FOUND, and a hung fetch stalled every session check for about 300 s. The provider now uses explicit endpoints, so building the auth instance makes no MP call.
  • The id_token is still verified against MP's JWKS, with RS256 pinned. issuer and jwks_uri are fetched at the first sign-in callback with a 5 s timeout. They are cached on success and never cached on failure.
  • During an MP outage, only the sign-ins made during it fail; the next attempt works without a restart.
  • selfHealingAuth and requireIdTokenVerification are removed. jose is now a direct dependency.
• deps:relock now writes metadata-only lockfile changes (#107): before, a new dependency that was already hoisted never reached package-lock.json.

📚 Documentation

• Accuracy pass (#105): every claim in CLAUDE.md, README.md and the references was checked against the code. Fixes include the CLAUDE.md validation example, which passed a Contact_ID as $userId, and a query-syntax.md example that put an unsanitized ID into a $filter.
• Downstream port playbook for #101 (aa1bc64): .claude/playbooks/port-oidc-lazy-discovery.md sorts forks into four starting states and gives the full code, tests and a checklist. The 2026-09-28 playbook now points to it.

🔧 Maintenance

• Public-repo preparation (#104): adds an MIT LICENSE and package.json repository metadata. The setup placeholder host is now your-instance.ministryplatform.com, and setup no longer offers it as the default. The 2026-09-28 review record moved to docs/security/2026-09-28-auth-review.md.
• Unused dependencies removed (#106): @tailwindcss/typography, autoprefixer, @types/js-cookie, @types/react-syntax-highlighter and the Tailwind v3 tailwind.config.js. tsx moved to devDependencies. Forks that use any of these should add them back.
• CI actions bumped (#100): actions/checkout 7.0.1, actions/setup-node 7.0.0 and codecov/codecov-action 7.1.1.

Full Changelog: v2026.09.29.1945...v2026.09.30.0023