@zackbart/connecta 0.22.2 → 0.22.3

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to this package are documented here.
 
+## 0.22.3 — 2026-09-03
+
+This patch carries OAuth discovery across the browser redirect. It matters for
+downstream MCP servers whose authentication challenge names a protected-resource
+metadata URL outside the RFC 9728 default path, including Cloudflare Access
+Managed OAuth. Existing grants and connectors using the default path require no
+configuration or storage migration.
+
+### Fixed
+
+- **Non-default OAuth discovery survives callbacks.** The KV OAuth provider now
+  persists the SDK's discovery state in the authorization generation, restores
+  it in the callback's fresh request scope, and deletes it through discovery,
+  all-credential, and generation cleanup. A callback therefore exchanges its
+  code against the same validated authorization-server issuer that registered
+  the client instead of invalidating that client after rediscovery (#523).
+
 ## 0.22.2 — 2026-09-01
 
 This patch makes the maintained-provider release check credential-free and

package/dist/auth/downstream-oauth.d.ts

@@ -1,4 +1,4 @@
-import type { FetchLike, OAuthClientInformationContext, OAuthClientInformationMixed, OAuthClientMetadata, OAuthClientProvider, OAuthTokens } from "@modelcontextprotocol/client";
+import type { FetchLike, OAuthClientInformationContext, OAuthClientInformationMixed, OAuthClientMetadata, OAuthClientProvider, OAuthDiscoveryState, OAuthTokens } from "@modelcontextprotocol/client";
 import type { KVStorage } from "../types.js";
 type OAuthRefreshFlightOutcome = {
     status: "refreshed";
@@ -134,6 +134,8 @@ export declare class KvOAuthProvider implements OAuthClientProvider {
     get clientMetadata(): OAuthClientMetadata;
     clientInformation(ctx?: OAuthClientInformationContext): Promise<OAuthClientInformationMixed | undefined>;
     saveClientInformation(info: OAuthClientInformationMixed, ctx?: OAuthClientInformationContext): Promise<void>;
+    discoveryState(): Promise<OAuthDiscoveryState | undefined>;
+    saveDiscoveryState(state: OAuthDiscoveryState): Promise<void>;
     tokens(ctx?: OAuthClientInformationContext): Promise<OAuthTokens | undefined>;
     saveTokens(tokens: OAuthTokens, ctx?: OAuthClientInformationContext): Promise<void>;
     /**

package/dist/auth/downstream-oauth.js

@@ -24,6 +24,7 @@ const OAUTH_VALUE_KEYS = [
     "oauth:pending",
     "oauth:verifier",
     "oauth:state",
+    "oauth:discovery",
 ];
 const MAX_CLEANUP_BACKLOG = 1_000;
 function isRefreshTokenRequest(init) {
@@ -621,6 +622,12 @@ export class KvOAuthProvider {
     async saveClientInformation(info, ctx) {
         await this.writeValue("oauth:client", info, (value) => JSON.stringify(value), ctx?.issuer);
     }
+    async discoveryState() {
+        return (await this.readValue("oauth:discovery", (raw) => JSON.parse(raw)))?.value;
+    }
+    async saveDiscoveryState(state) {
+        await this.writeValue("oauth:discovery", state, (value) => JSON.stringify(value));
+    }
     async tokens(ctx) {
         const refreshGeneration = ctx ? await this.flowGeneration() : undefined;
         const successIdentity = refreshGeneration !== undefined
@@ -800,6 +807,7 @@ export class KvOAuthProvider {
                     oauthValueStorageKey("oauth:client", generation),
                     oauthValueStorageKey("oauth:tokens", generation),
                     oauthValueStorageKey("oauth:verifier", generation),
+                    oauthValueStorageKey("oauth:discovery", generation),
                 ]);
             }
             else if (scope === "client") {
@@ -811,6 +819,9 @@ export class KvOAuthProvider {
             else if (scope === "verifier") {
                 await this.storage.delete(oauthValueStorageKey("oauth:verifier", generation));
             }
+            else if (scope === "discovery") {
+                await this.storage.delete(oauthValueStorageKey("oauth:discovery", generation));
+            }
             if (endsRefresh) {
                 this.failRefreshFlight(new Error("OAuth refresh invalidated credentials before tokens were saved."));
             }

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export declare const CONNECTA_VERSION = "0.22.2";
+export declare const CONNECTA_VERSION = "0.22.3";

package/dist/version.js

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.22.2";
+export const CONNECTA_VERSION = "0.22.3";

package/documentation/upgrading.md

@@ -57,7 +57,7 @@ exist so far:
 | --- | --- | --- |
 | **pre-template** | before 0.10.2 | no `connecta init` existed; hand-written, or copied from the retired `examples/node` |
 | **A** | 0.10.2 – 0.15.1 | `.env.example`, `.gitignore`, `AGENTS.md`, `CLAUDE.md`, `README.md`, `package.json`, `src/index.ts`, `tsconfig.json` |
-| **B** | 0.16.0 – 0.22.2 | adds `.dockerignore`, `Dockerfile`, `docker-compose.yml`, and `src/file-activity.ts`; `src/index.ts` grows the four commented operator blocks; `.env.example` ships `CONNECTA_TOKEN=` empty |
+| **B** | 0.16.0 – 0.22.3 | adds `.dockerignore`, `Dockerfile`, `docker-compose.yml`, and `src/file-activity.ts`; `src/index.ts` grows the four commented operator blocks; `.env.example` ships `CONNECTA_TOKEN=` empty |
 
 Generation A is a decade in template years and identifying it precisely does
 not matter, because you are about to reconstruct it exactly rather than guess
@@ -106,7 +106,7 @@ know what to preserve, once to know what to re-verify at the end.
 ### Bump the pin and install
 
 ```sh
-npm pkg set dependencies.@zackbart/connecta=0.22.2
+npm pkg set dependencies.@zackbart/connecta=0.22.3
 npm install
 ```
 
@@ -130,7 +130,7 @@ Generate the *current* template beside the base you already made, into the same
 `$SCRATCH`:
 
 ```sh
-(cd "$SCRATCH" && npx @zackbart/connecta@0.22.2 init current)
+(cd "$SCRATCH" && npx @zackbart/connecta@0.22.3 init current)
 ```
 
 You now have a three-way merge with a real base: `$SCRATCH/base` is what this
@@ -186,7 +186,7 @@ A deployment older than 0.10.2 has no base to diff against. Do not try to
 manufacture one. Instead:
 
 1. `SCRATCH=$(mktemp -d)`, then
-   `(cd "$SCRATCH" && npx @zackbart/connecta@0.22.2 init current)` — there is no
+   `(cd "$SCRATCH" && npx @zackbart/connecta@0.22.3 init current)` — there is no
    `base` leg here, only the current template to read from.
 2. Copy `$SCRATCH/current` into the deployment file by file, **skipping
    `src/index.ts`**.
@@ -207,7 +207,7 @@ first, so cross them bottom-up: start at the oldest one still above this
 deployment's pin and work back up the page, because each boundary assumes the
 older ones are already done.
 
-### 0.21.2 → 0.22.2
+### 0.21.2 → 0.22.3
 
 Connector and user policy remain config-as-code. If `identity.connectorAccess`
 is configured, every interactive human may now manage the authentication of

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.22.2",
+  "version": "0.22.3",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of seven meta-tools.",

package/templates/node/package.json

@@ -15,7 +15,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@zackbart/connecta": "0.22.2",
+    "@zackbart/connecta": "0.22.3",
     "quickjs-emscripten": "0.32.0"
   },
   "devDependencies": {