v2.2.4

Fixed

• Critical: Update action on entries, terms, and globals no longer crashes with Cannot access offset of type string on string when blueprints include third-party fieldtypes (e.g., SEO Pro) — validation falls back to incoming-only fields on TypeError
• OAuth CIMD discovery: cimd_enabled config checks use (bool) cast with true default — previously silently disabled by strict comparison, env strings, and missing config keys from shallow merge
• OAuth path-suffixed discovery: Added /.well-known/oauth-authorization-server/{path} and /.well-known/oauth-protected-resource/{path} routes per RFC 8414 §3.1 — MCP clients (incl. ChatGPT) use path insertion for discovery and previously got 403

Added

• OAuth 2.1 CIMD support: Client ID Metadata Document resolution — MCP clients can present verified application identity on consent screen
• CIMD resolver with SSRF protection, JSON-LD validation, and configurable caching
• 10 update validation tests (deep nested replicator/bard/grid/group, round-trip, crashing fieldtype simulation)
• 24 discovery endpoint tests (CIMD config edge cases, path-suffixed routes, CP route changes, revocation endpoint, full ChatGPT-style client discovery flow)
• Comprehensive CIMD test suite (unit, feature, E2E)

See CHANGELOG for full details.