- chore: release v0.6.3
- Per-client OAuth scope restrictions (#34)
- Document the current auth system (authentication.md + README) (#32)
- Restore uniform refresh-token reuse detection under client binding (#33)
- Bind refresh tokens to their issuing client (#29)
- Close the async refresh-token rotation race (#31)
- Resource-bound tokens, issuer, scope catalog and PKCE method policy (#27)