v0.0.7

Fixes frequent connector re-authentication on the public (open-DCR) deployment.

Cause

Registered OAuth clients were held in an in-memory map, so any process recycle — a redeploy, scale-to-zero, or a refresh routed to a different instance — lost the registration and forced the client to re-authenticate. (Access/refresh tokens are stateless and survive; but the SDK re-validates the client on every refresh, and the lookup missed.)

Fix

New StatelessClientsStore: the client_id is now a signed blob (HMAC, same key as the tokens) encoding the registration metadata. getClient verifies the signature and reconstructs the client instead of a map lookup, and the client_secret is derived deterministically from the client_id. So any instance recognises any client with zero shared state — refresh and re-authorize survive restarts, scale-to-zero, redeploys, and multi-instance routing. Mirrors the existing stateless-token design.

Verified end-to-end against the real MCP SDK with an actual process restart: after killing the server and starting a fresh process (empty memory, same signing key), a refresh with the original credentials succeeds and tools/list returns.

Notes

• At the upgrade, clients registered under the old in-memory UUIDs re-authenticate once, then stay connected.
• Revocation remains global only (rotate MCP_OAUTH_SIGNING_KEY, which also invalidates outstanding tokens).
• No tool/API changes; tool counts unchanged.

See CHANGELOG.md.