v1.0.6

Changes

• Add database-managed OAuth resources with per-resource scopes, client assignments, GraphQL management operations and client resource policy queries.
• Use Light's registered concrete permissions as the default scope catalog. OAUTH_SCOPES optionally restricts the catalog; wildcard permissions are excluded.
• Enable RFC 8693 token exchange automatically. Confidential clients authenticate with their secret and explicitly select a target resource (or audience). Both source and target must be registered, enabled and assigned to the exchanging client.
• Validate source tokens against their persisted resource, including DCR/CIMD user tokens. Preserve scope narrowing, source revocation checks, source-bounded expiry and the prohibition on chained exchanges.
• Configure the maximum derived-token lifetime with OAUTH_TOKEN_EXCHANGE_TTL (default PT5M).

Upgrade notes

• Apply migrations/002_oauth_resources.sql, register trusted resources and assign them to clients before upgrading an existing OAuth installation. New installations also require migration 001. Resource policy is always enabled; the resource registry switch has been removed.
• OAUTH_TOKEN_EXCHANGE_POLICY and the TokenExchangePolicy class have been removed. Update manual provider/factory calls that passed a policy object. Use confidential-client resource assignments and scopes instead.
• Exchange requests must explicitly select one target. Assign the MCP server client both its source MCP resource and target API resource. Public DCR/CIMD clients cannot perform exchange themselves.
• Without OAUTH_SCOPES, the catalog now includes all registered concrete Light permissions. Existing resource/client/token scopes continue to constrain access.

Validation

PHPUnit: 140 tests, 773 assertions; 10 skipped.