connectors 0.3.2
Added
- Add a bounded, single-use OAuth2 PKCE connection flow for Claude subscriptions. Connectors keeps
the verifier and provider tokens in custody; authenticated callers receive only the provider
authorization URL, an opaque flow id, presence, and attempt-bounded lease results. - Persist refresh-capable subscription records and refresh them before expiry during serialized
lease redemption, including refresh-token rotation. Existing manually supplied credentials
remain readable for compatibility. - Expose typed start and completion operations through the hosted API, Rust client, and embedded
OpenAPI document. Credential-bearing requests and responses are bounded and non-cacheable.
Security
- Provider acquisition and token lifecycle remain wholly inside Connectors. Identity remains
provider- and service-agnostic, and neither authorization codes, PKCE verifiers, refresh tokens,
nor provider diagnostics are returned to callers or written to logs.
Full Changelog: v0.3.1...v0.3.2