From 45e93c94af53c919dff818ce04a6f3a7ee78e78d Mon Sep 17 00:00:00 2001
From: Jordan Ritter <jpr5@darkridge.com>
Date: Mon, 15 Jun 2026 08:35:01 -0700
Subject: [PATCH] =?UTF-8?q?Release=20v1.15.1=20=E2=80=94=20RFC=209728=20re?=
 =?UTF-8?q?source=5Fmetadata=20+=20RFC=206750=20conformance?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md      | 7 +++++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 src/cli.ts        | 2 +-
 4 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c554d9..776f79d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @copilotkit/pathfinder
 
+## 1.15.1
+
+### Patch Changes
+
+- **OAuth Bearer 401s emit RFC 9728 `resource_metadata` discovery hint on `WWW-Authenticate`** — wires the previously-dead `unauthorizedWithDiscovery` helper into all three `bearerMiddleware` failure paths. Discovery endpoint (`/.well-known/oauth-protected-resource`) was already live. Adds `[oauth] bearer_failure reason={empty_token|invalid_signature|expired|aud_mismatch|malformed_token} ip=<ip>` observability logs at every Bearer-401 path. Additive header change, backward compatible — spec-compliant clients ignore unknown attributes.
+- **RFC 6750 §3.1 conformance**: the `WWW-Authenticate` header now retains `error="invalid_token"` alongside `resource_metadata=` and `scope="mcp"`. Per RFC 6750 §3.1 the `error=` attribute MUST be in the header when a Bearer token is presented and invalid; the helper previously dropped it (kept only in the JSON body). Strengthened `assertDiscoveryHeader` test helper now pins this invariant on all four RFC 9728 paths (empty Bearer, invalid signature, expired, aud mismatch).
+
 ## 1.15.0
 
 ### Minor Changes
diff --git a/package-lock.json b/package-lock.json
index c12e2fb..df410c5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@copilotkit/pathfinder",
-  "version": "1.15.0",
+  "version": "1.15.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@copilotkit/pathfinder",
-      "version": "1.15.0",
+      "version": "1.15.1",
       "license": "Elastic-2.0",
       "dependencies": {
         "@discordjs/rest": "^2.6.1",
diff --git a/package.json b/package.json
index eb8f215..de01ba2 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@copilotkit/pathfinder",
-  "version": "1.15.0",
+  "version": "1.15.1",
   "description": "The knowledge server for AI agents — index docs, code, Notion, Slack, and Discord into searchable, agent-accessible knowledge via MCP. Supports OpenAI, Ollama, and local transformers.js embeddings.",
   "type": "module",
   "repository": {
diff --git a/src/cli.ts b/src/cli.ts
index 29727df..6fc5ea0 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -11,7 +11,7 @@ const program = new Command();
 program
   .name("pathfinder")
   .description("The knowledge server for AI agents")
-  .version("1.15.0");
+  .version("1.15.1");
 
 program
   .command("init")