Skip to content

feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext - #2343

Merged
felixweinberger merged 1 commit into
v2-2026-07-28from
fweinberger/auth-0-surface
Jun 24, 2026
Merged

feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext#2343
felixweinberger merged 1 commit into
v2-2026-07-28from
fweinberger/auth-0-surface

Conversation

@felixweinberger

@felixweinbergerfelixweinberger commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

d57c32e46

Surface delta for the 2026-07-28 authorization requirements. Extracts the inline auth() options object as the exported AuthOptions type and adds two fields: iss (the RFC 9207 callback parameter) and skipIssuerMetadataValidation (the RFC 8414 §3.3 opt-out). OAuthClientProvider.clientInformation() and .saveClientInformation() accept an optional OAuthClientInformationContext carrying the resolved authorization-server issuer so providers can key persisted credentials per AS. OAuthClientMetadataSchema gains application_type?: 'native' | 'web'; AuthorizationServerMetadata gains authorization_response_iss_parameter_supported?: boolean.

Motivation and Context

This is the additive-only surface PR for the M13.1 auth bundle (SEP-2468 / SEP-2352 / SEP-2350 / SEP-837 / SEP-2207 — see docs/2026-06-19-m13-auth-bundle-prd.md). It introduces every public-API field and type the behavior PRs depend on so that each subsequent PR carries only behavior, and so that existing OAuthClientProvider implementers (Claude Code is the named consumer) can be reviewed against the final shape once.

No spec MUST is implemented in this PR — all new fields are inert.

How Has This Been Tested?

pnpm typecheck:all, pnpm lint:all, pnpm --filter @modelcontextprotocol/client test. The barrelClean test confirms the new exports do not pull Node-only modules into the runtime-neutral entry. No behavior tests change.

Breaking Changes

None. All new fields are optional; existing OAuthClientProvider implementations and auth() call sites compile unchanged.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

First PR in a 7-PR stack. The five behavior PRs that follow wire each field up; the closeout PR consolidates migration.md and the client guide. Reviewing the surface in isolation makes the additive-optional invariant (PRD §Implementation Decisions, "Surface delta") auditable independently of behavior.

@felixweinberger
felixweinberger requested a review from a team as a code ownerJune 23, 2026 13:18
@changeset-bot

changeset-botBot commented Jun 23, 2026•
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: be75471

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/clientMinor
@modelcontextprotocol/coreMinor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new

pkg-pr-newBot commented Jun 23, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2343

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2343

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2343

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2343

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2343

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2343

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2343

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2343

commit: be75471

claude[bot]
claudeBot reviewed Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Comment thread.changeset/auth-surface-delta.md Outdated
@felixweinberger
felixweinbergerforce-pushed the fweinberger/auth-0-surface branch from 0fdbe45 to f6fb29cCompareJune 23, 2026 19:03
claude[bot]
claudeBot reviewed Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/authErrors.ts
Comment threaddocs/migration.md
@felixweinberger
felixweinbergerforce-pushed the fweinberger/auth-0-surface branch from f6fb29c to d1ffd2fCompareJune 23, 2026 21:20
claude[bot]
claudeBot reviewed Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts Outdated
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinbergerforce-pushed the fweinberger/auth-0-surface branch 2 times, most recently from ec501fa to 874ca25CompareJune 23, 2026 23:05
claude[bot]
claudeBot reviewed Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
claude[bot]
claudeBot reviewed Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
feat(client,core): auth surface delta — AuthOptions, issuer ctx/stamp…
be75471
…, authErrors module
Surface delta for the 2026-07-28 authorization requirements. All additive;
existing OAuthClientProvider implementers compile unchanged. The new fields
are inert until the behavior changes that follow wire them up.
- Extract the inline auth() options object as exported AuthOptions and add
iss (RFC 9207 callback parameter) and skipIssuerMetadataValidation
(RFC 8414 §3.3 opt-out). JSDoc is non-assertive — validation lands in
the follow-up commit.
- OAuthClientProvider.clientInformation/saveClientInformation/tokens/
saveTokens accept an optional OAuthClientInformationContext carrying the
resolved authorization-server issuer so providers can key persisted
credentials per AS.
- OAuthTokens and OAuthClientInformation gain an optional issuer stamp
field (core/shared/auth.ts) — the slot the SDK writes before persistence
so stored credentials are bound to the AS that issued them.
- New packages/client/src/client/authErrors.ts with the OAuthClientFlowError
base class; the flow-specific error classes from later commits land here.
Claude-Session: https://claude.ai/code/session_01XBib5gRe8AMPPJhySCz3EJ
@felixweinberger
felixweinbergerforce-pushed the fweinberger/auth-0-surface branch from 874ca25 to be75471CompareJune 24, 2026 10:06
@felixweinberger
felixweinberger merged commit ffa96a6 into v2-2026-07-28Jun 24, 2026
16 checks passed
@felixweinberger
felixweinberger deleted the fweinberger/auth-0-surface branch June 24, 2026 10:44
felixweinberger added a commit that referenced this pull request Jun 24, 2026
@felixweinberger
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation …
9df72ef
…and OAuthClientInformationContext (#2343)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext by felixweinberger · Pull Request #2343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext - #2343
Merged
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Jun 24, 2026
Merged
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext#2343
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 23, 2026

Copy link


Copy Markdown

Contributor
d57c32e46
Surface delta for the 2026-07-28 authorization requirements. Extracts the inline auth() options object as the exported AuthOptions type and adds two fields: iss (the RFC 9207 callback parameter) and skipIssuerMetadataValidation (the RFC 8414 §3.3 opt-out). OAuthClientProvider.clientInformation() and .saveClientInformation() accept an optional OAuthClientInformationContext carrying the resolved authorization-server issuer so providers can key persisted credentials per AS. OAuthClientMetadataSchema gains application_type?: 'native' | 'web'; AuthorizationServerMetadata gains authorization_response_iss_parameter_supported?: boolean.
Motivation and Context
This is the additive-only surface PR for the M13.1 auth bundle (SEP-2468 / SEP-2352 / SEP-2350 / SEP-837 / SEP-2207 — see docs/2026-06-19-m13-auth-bundle-prd.md). It introduces every public-API field and type the behavior PRs depend on so that each subsequent PR carries only behavior, and so that existing OAuthClientProvider implementers (Claude Code is the named consumer) can be reviewed against the final shape once.
No spec MUST is implemented in this PR — all new fields are inert.
How Has This Been Tested?
pnpm typecheck:all, pnpm lint:all, pnpm --filter @modelcontextprotocol/client test. The barrelClean test confirms the new exports do not pull Node-only modules into the runtime-neutral entry. No behavior tests change.
Breaking Changes
None. All new fields are optional; existing OAuthClientProvider implementations and auth() call sites compile unchanged.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
First PR in a 7-PR stack. The five behavior PRs that follow wire each field up; the closeout PR consolidates migration.md and the client guide. Reviewing the surface in isolation makes the additive-optional invariant (PRD §Implementation Decisions, "Surface delta") auditable independently of behavior.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 23, 2026 13:18
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: be75471
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/clientMinor
@modelcontextprotocol/coreMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2343

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2343

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2343

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2343

commit: be75471
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Comment thread.changeset/auth-surface-delta.md
Outdated

@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
0fdbe45 to
f6fb29cCompareJune 23, 2026 19:03
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/authErrors.ts
Comment threaddocs/migration.md
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
f6fb29c to
d1ffd2fCompareJune 23, 2026 21:20
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
2 times, most recently
from
ec501fa to
874ca25CompareJune 23, 2026 23:05
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
feat(client,core): auth surface delta — AuthOptions, issuer ctx/stamp…
be75471
…, authErrors module
Surface delta for the 2026-07-28 authorization requirements. All additive;
existing OAuthClientProvider implementers compile unchanged. The new fields
are inert until the behavior changes that follow wire them up.
- Extract the inline auth() options object as exported AuthOptions and add
iss (RFC 9207 callback parameter) and skipIssuerMetadataValidation
(RFC 8414 §3.3 opt-out). JSDoc is non-assertive — validation lands in
the follow-up commit.
- OAuthClientProvider.clientInformation/saveClientInformation/tokens/
saveTokens accept an optional OAuthClientInformationContext carrying the
resolved authorization-server issuer so providers can key persisted
credentials per AS.
- OAuthTokens and OAuthClientInformation gain an optional issuer stamp
field (core/shared/auth.ts) — the slot the SDK writes before persistence
so stored credentials are bound to the AS that issued them.
- New packages/client/src/client/authErrors.ts with the OAuthClientFlowError
base class; the flow-specific error classes from later commits land here.
Claude-Session: https://claude.ai/code/session_01XBib5gRe8AMPPJhySCz3EJ
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
874ca25 to
be75471CompareJune 24, 2026 10:06
@felixweinberger
felixweinberger
merged commit ffa96a6
into
v2-2026-07-28Jun 24, 2026

16 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/auth-0-surface

branch
June 24, 2026 10:44
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation …
9df72ef
…and OAuthClientInformationContext (#2343)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext by felixweinberger · Pull Request #2343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext - #2343
Merged
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Jun 24, 2026
Merged
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext#2343
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 23, 2026

Copy link


Copy Markdown

Contributor
d57c32e46
Surface delta for the 2026-07-28 authorization requirements. Extracts the inline auth() options object as the exported AuthOptions type and adds two fields: iss (the RFC 9207 callback parameter) and skipIssuerMetadataValidation (the RFC 8414 §3.3 opt-out). OAuthClientProvider.clientInformation() and .saveClientInformation() accept an optional OAuthClientInformationContext carrying the resolved authorization-server issuer so providers can key persisted credentials per AS. OAuthClientMetadataSchema gains application_type?: 'native' | 'web'; AuthorizationServerMetadata gains authorization_response_iss_parameter_supported?: boolean.
Motivation and Context
This is the additive-only surface PR for the M13.1 auth bundle (SEP-2468 / SEP-2352 / SEP-2350 / SEP-837 / SEP-2207 — see docs/2026-06-19-m13-auth-bundle-prd.md). It introduces every public-API field and type the behavior PRs depend on so that each subsequent PR carries only behavior, and so that existing OAuthClientProvider implementers (Claude Code is the named consumer) can be reviewed against the final shape once.
No spec MUST is implemented in this PR — all new fields are inert.
How Has This Been Tested?
pnpm typecheck:all, pnpm lint:all, pnpm --filter @modelcontextprotocol/client test. The barrelClean test confirms the new exports do not pull Node-only modules into the runtime-neutral entry. No behavior tests change.
Breaking Changes
None. All new fields are optional; existing OAuthClientProvider implementations and auth() call sites compile unchanged.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
First PR in a 7-PR stack. The five behavior PRs that follow wire each field up; the closeout PR consolidates migration.md and the client guide. Reviewing the surface in isolation makes the additive-optional invariant (PRD §Implementation Decisions, "Surface delta") auditable independently of behavior.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 23, 2026 13:18
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: be75471
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/clientMinor
@modelcontextprotocol/coreMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2343

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2343

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2343

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2343

commit: be75471
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Comment thread.changeset/auth-surface-delta.md
Outdated

@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
0fdbe45 to
f6fb29cCompareJune 23, 2026 19:03
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/authErrors.ts
Comment threaddocs/migration.md
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
f6fb29c to
d1ffd2fCompareJune 23, 2026 21:20
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
2 times, most recently
from
ec501fa to
874ca25CompareJune 23, 2026 23:05
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
feat(client,core): auth surface delta — AuthOptions, issuer ctx/stamp…
be75471
…, authErrors module
Surface delta for the 2026-07-28 authorization requirements. All additive;
existing OAuthClientProvider implementers compile unchanged. The new fields
are inert until the behavior changes that follow wire them up.
- Extract the inline auth() options object as exported AuthOptions and add
iss (RFC 9207 callback parameter) and skipIssuerMetadataValidation
(RFC 8414 §3.3 opt-out). JSDoc is non-assertive — validation lands in
the follow-up commit.
- OAuthClientProvider.clientInformation/saveClientInformation/tokens/
saveTokens accept an optional OAuthClientInformationContext carrying the
resolved authorization-server issuer so providers can key persisted
credentials per AS.
- OAuthTokens and OAuthClientInformation gain an optional issuer stamp
field (core/shared/auth.ts) — the slot the SDK writes before persistence
so stored credentials are bound to the AS that issued them.
- New packages/client/src/client/authErrors.ts with the OAuthClientFlowError
base class; the flow-specific error classes from later commits land here.
Claude-Session: https://claude.ai/code/session_01XBib5gRe8AMPPJhySCz3EJ
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
874ca25 to
be75471CompareJune 24, 2026 10:06
@felixweinberger
felixweinberger
merged commit ffa96a6
into
v2-2026-07-28Jun 24, 2026

16 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/auth-0-surface

branch
June 24, 2026 10:44
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation …
9df72ef
…and OAuthClientInformationContext (#2343)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext by felixweinberger · Pull Request #2343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext - #2343
Merged
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Jun 24, 2026
Merged
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext#2343
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 23, 2026

Copy link


Copy Markdown

Contributor
d57c32e46
Surface delta for the 2026-07-28 authorization requirements. Extracts the inline auth() options object as the exported AuthOptions type and adds two fields: iss (the RFC 9207 callback parameter) and skipIssuerMetadataValidation (the RFC 8414 §3.3 opt-out). OAuthClientProvider.clientInformation() and .saveClientInformation() accept an optional OAuthClientInformationContext carrying the resolved authorization-server issuer so providers can key persisted credentials per AS. OAuthClientMetadataSchema gains application_type?: 'native' | 'web'; AuthorizationServerMetadata gains authorization_response_iss_parameter_supported?: boolean.
Motivation and Context
This is the additive-only surface PR for the M13.1 auth bundle (SEP-2468 / SEP-2352 / SEP-2350 / SEP-837 / SEP-2207 — see docs/2026-06-19-m13-auth-bundle-prd.md). It introduces every public-API field and type the behavior PRs depend on so that each subsequent PR carries only behavior, and so that existing OAuthClientProvider implementers (Claude Code is the named consumer) can be reviewed against the final shape once.
No spec MUST is implemented in this PR — all new fields are inert.
How Has This Been Tested?
pnpm typecheck:all, pnpm lint:all, pnpm --filter @modelcontextprotocol/client test. The barrelClean test confirms the new exports do not pull Node-only modules into the runtime-neutral entry. No behavior tests change.
Breaking Changes
None. All new fields are optional; existing OAuthClientProvider implementations and auth() call sites compile unchanged.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
First PR in a 7-PR stack. The five behavior PRs that follow wire each field up; the closeout PR consolidates migration.md and the client guide. Reviewing the surface in isolation makes the additive-optional invariant (PRD §Implementation Decisions, "Surface delta") auditable independently of behavior.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 23, 2026 13:18
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: be75471
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/clientMinor
@modelcontextprotocol/coreMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2343

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2343

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2343

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2343

commit: be75471
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Comment thread.changeset/auth-surface-delta.md
Outdated

@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
0fdbe45 to
f6fb29cCompareJune 23, 2026 19:03
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/authErrors.ts
Comment threaddocs/migration.md
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
f6fb29c to
d1ffd2fCompareJune 23, 2026 21:20
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
2 times, most recently
from
ec501fa to
874ca25CompareJune 23, 2026 23:05
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
feat(client,core): auth surface delta — AuthOptions, issuer ctx/stamp…
be75471
…, authErrors module
Surface delta for the 2026-07-28 authorization requirements. All additive;
existing OAuthClientProvider implementers compile unchanged. The new fields
are inert until the behavior changes that follow wire them up.
- Extract the inline auth() options object as exported AuthOptions and add
iss (RFC 9207 callback parameter) and skipIssuerMetadataValidation
(RFC 8414 §3.3 opt-out). JSDoc is non-assertive — validation lands in
the follow-up commit.
- OAuthClientProvider.clientInformation/saveClientInformation/tokens/
saveTokens accept an optional OAuthClientInformationContext carrying the
resolved authorization-server issuer so providers can key persisted
credentials per AS.
- OAuthTokens and OAuthClientInformation gain an optional issuer stamp
field (core/shared/auth.ts) — the slot the SDK writes before persistence
so stored credentials are bound to the AS that issued them.
- New packages/client/src/client/authErrors.ts with the OAuthClientFlowError
base class; the flow-specific error classes from later commits land here.
Claude-Session: https://claude.ai/code/session_01XBib5gRe8AMPPJhySCz3EJ
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
874ca25 to
be75471CompareJune 24, 2026 10:06
@felixweinberger
felixweinberger
merged commit ffa96a6
into
v2-2026-07-28Jun 24, 2026

16 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/auth-0-surface

branch
June 24, 2026 10:44
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation …
9df72ef
…and OAuthClientInformationContext (#2343)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext by felixweinberger · Pull Request #2343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext - #2343
Merged
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Jun 24, 2026
Merged
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext#2343
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 23, 2026

Copy link


Copy Markdown

Contributor
d57c32e46
Surface delta for the 2026-07-28 authorization requirements. Extracts the inline auth() options object as the exported AuthOptions type and adds two fields: iss (the RFC 9207 callback parameter) and skipIssuerMetadataValidation (the RFC 8414 §3.3 opt-out). OAuthClientProvider.clientInformation() and .saveClientInformation() accept an optional OAuthClientInformationContext carrying the resolved authorization-server issuer so providers can key persisted credentials per AS. OAuthClientMetadataSchema gains application_type?: 'native' | 'web'; AuthorizationServerMetadata gains authorization_response_iss_parameter_supported?: boolean.
Motivation and Context
This is the additive-only surface PR for the M13.1 auth bundle (SEP-2468 / SEP-2352 / SEP-2350 / SEP-837 / SEP-2207 — see docs/2026-06-19-m13-auth-bundle-prd.md). It introduces every public-API field and type the behavior PRs depend on so that each subsequent PR carries only behavior, and so that existing OAuthClientProvider implementers (Claude Code is the named consumer) can be reviewed against the final shape once.
No spec MUST is implemented in this PR — all new fields are inert.
How Has This Been Tested?
pnpm typecheck:all, pnpm lint:all, pnpm --filter @modelcontextprotocol/client test. The barrelClean test confirms the new exports do not pull Node-only modules into the runtime-neutral entry. No behavior tests change.
Breaking Changes
None. All new fields are optional; existing OAuthClientProvider implementations and auth() call sites compile unchanged.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
First PR in a 7-PR stack. The five behavior PRs that follow wire each field up; the closeout PR consolidates migration.md and the client guide. Reviewing the surface in isolation makes the additive-optional invariant (PRD §Implementation Decisions, "Surface delta") auditable independently of behavior.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 23, 2026 13:18
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: be75471
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/clientMinor
@modelcontextprotocol/coreMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2343

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2343

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2343

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2343

commit: be75471
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Comment thread.changeset/auth-surface-delta.md
Outdated

@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
0fdbe45 to
f6fb29cCompareJune 23, 2026 19:03
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/authErrors.ts
Comment threaddocs/migration.md
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
f6fb29c to
d1ffd2fCompareJune 23, 2026 21:20
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
2 times, most recently
from
ec501fa to
874ca25CompareJune 23, 2026 23:05
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
feat(client,core): auth surface delta — AuthOptions, issuer ctx/stamp…
be75471
…, authErrors module
Surface delta for the 2026-07-28 authorization requirements. All additive;
existing OAuthClientProvider implementers compile unchanged. The new fields
are inert until the behavior changes that follow wire them up.
- Extract the inline auth() options object as exported AuthOptions and add
iss (RFC 9207 callback parameter) and skipIssuerMetadataValidation
(RFC 8414 §3.3 opt-out). JSDoc is non-assertive — validation lands in
the follow-up commit.
- OAuthClientProvider.clientInformation/saveClientInformation/tokens/
saveTokens accept an optional OAuthClientInformationContext carrying the
resolved authorization-server issuer so providers can key persisted
credentials per AS.
- OAuthTokens and OAuthClientInformation gain an optional issuer stamp
field (core/shared/auth.ts) — the slot the SDK writes before persistence
so stored credentials are bound to the AS that issued them.
- New packages/client/src/client/authErrors.ts with the OAuthClientFlowError
base class; the flow-specific error classes from later commits land here.
Claude-Session: https://claude.ai/code/session_01XBib5gRe8AMPPJhySCz3EJ
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
874ca25 to
be75471CompareJune 24, 2026 10:06
@felixweinberger
felixweinberger
merged commit ffa96a6
into
v2-2026-07-28Jun 24, 2026

16 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/auth-0-surface

branch
June 24, 2026 10:44
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation …
9df72ef
…and OAuthClientInformationContext (#2343)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext by felixweinberger · Pull Request #2343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext - #2343
Merged
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Jun 24, 2026
Merged
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext#2343
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 23, 2026

Copy link


Copy Markdown

Contributor
d57c32e46
Surface delta for the 2026-07-28 authorization requirements. Extracts the inline auth() options object as the exported AuthOptions type and adds two fields: iss (the RFC 9207 callback parameter) and skipIssuerMetadataValidation (the RFC 8414 §3.3 opt-out). OAuthClientProvider.clientInformation() and .saveClientInformation() accept an optional OAuthClientInformationContext carrying the resolved authorization-server issuer so providers can key persisted credentials per AS. OAuthClientMetadataSchema gains application_type?: 'native' | 'web'; AuthorizationServerMetadata gains authorization_response_iss_parameter_supported?: boolean.
Motivation and Context
This is the additive-only surface PR for the M13.1 auth bundle (SEP-2468 / SEP-2352 / SEP-2350 / SEP-837 / SEP-2207 — see docs/2026-06-19-m13-auth-bundle-prd.md). It introduces every public-API field and type the behavior PRs depend on so that each subsequent PR carries only behavior, and so that existing OAuthClientProvider implementers (Claude Code is the named consumer) can be reviewed against the final shape once.
No spec MUST is implemented in this PR — all new fields are inert.
How Has This Been Tested?
pnpm typecheck:all, pnpm lint:all, pnpm --filter @modelcontextprotocol/client test. The barrelClean test confirms the new exports do not pull Node-only modules into the runtime-neutral entry. No behavior tests change.
Breaking Changes
None. All new fields are optional; existing OAuthClientProvider implementations and auth() call sites compile unchanged.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
First PR in a 7-PR stack. The five behavior PRs that follow wire each field up; the closeout PR consolidates migration.md and the client guide. Reviewing the surface in isolation makes the additive-optional invariant (PRD §Implementation Decisions, "Surface delta") auditable independently of behavior.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 23, 2026 13:18
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: be75471
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/clientMinor
@modelcontextprotocol/coreMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2343

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2343

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2343

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2343

commit: be75471
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Comment thread.changeset/auth-surface-delta.md
Outdated

@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
0fdbe45 to
f6fb29cCompareJune 23, 2026 19:03
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/authErrors.ts
Comment threaddocs/migration.md
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
f6fb29c to
d1ffd2fCompareJune 23, 2026 21:20
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
2 times, most recently
from
ec501fa to
874ca25CompareJune 23, 2026 23:05
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
feat(client,core): auth surface delta — AuthOptions, issuer ctx/stamp…
be75471
…, authErrors module
Surface delta for the 2026-07-28 authorization requirements. All additive;
existing OAuthClientProvider implementers compile unchanged. The new fields
are inert until the behavior changes that follow wire them up.
- Extract the inline auth() options object as exported AuthOptions and add
iss (RFC 9207 callback parameter) and skipIssuerMetadataValidation
(RFC 8414 §3.3 opt-out). JSDoc is non-assertive — validation lands in
the follow-up commit.
- OAuthClientProvider.clientInformation/saveClientInformation/tokens/
saveTokens accept an optional OAuthClientInformationContext carrying the
resolved authorization-server issuer so providers can key persisted
credentials per AS.
- OAuthTokens and OAuthClientInformation gain an optional issuer stamp
field (core/shared/auth.ts) — the slot the SDK writes before persistence
so stored credentials are bound to the AS that issued them.
- New packages/client/src/client/authErrors.ts with the OAuthClientFlowError
base class; the flow-specific error classes from later commits land here.
Claude-Session: https://claude.ai/code/session_01XBib5gRe8AMPPJhySCz3EJ
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
874ca25 to
be75471CompareJune 24, 2026 10:06
@felixweinberger
felixweinberger
merged commit ffa96a6
into
v2-2026-07-28Jun 24, 2026

16 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/auth-0-surface

branch
June 24, 2026 10:44
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation …
9df72ef
…and OAuthClientInformationContext (#2343)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext by felixweinberger · Pull Request #2343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext - #2343
Merged
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Jun 24, 2026
Merged
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext#2343
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 23, 2026

Copy link


Copy Markdown

Contributor
d57c32e46
Surface delta for the 2026-07-28 authorization requirements. Extracts the inline auth() options object as the exported AuthOptions type and adds two fields: iss (the RFC 9207 callback parameter) and skipIssuerMetadataValidation (the RFC 8414 §3.3 opt-out). OAuthClientProvider.clientInformation() and .saveClientInformation() accept an optional OAuthClientInformationContext carrying the resolved authorization-server issuer so providers can key persisted credentials per AS. OAuthClientMetadataSchema gains application_type?: 'native' | 'web'; AuthorizationServerMetadata gains authorization_response_iss_parameter_supported?: boolean.
Motivation and Context
This is the additive-only surface PR for the M13.1 auth bundle (SEP-2468 / SEP-2352 / SEP-2350 / SEP-837 / SEP-2207 — see docs/2026-06-19-m13-auth-bundle-prd.md). It introduces every public-API field and type the behavior PRs depend on so that each subsequent PR carries only behavior, and so that existing OAuthClientProvider implementers (Claude Code is the named consumer) can be reviewed against the final shape once.
No spec MUST is implemented in this PR — all new fields are inert.
How Has This Been Tested?
pnpm typecheck:all, pnpm lint:all, pnpm --filter @modelcontextprotocol/client test. The barrelClean test confirms the new exports do not pull Node-only modules into the runtime-neutral entry. No behavior tests change.
Breaking Changes
None. All new fields are optional; existing OAuthClientProvider implementations and auth() call sites compile unchanged.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
First PR in a 7-PR stack. The five behavior PRs that follow wire each field up; the closeout PR consolidates migration.md and the client guide. Reviewing the surface in isolation makes the additive-optional invariant (PRD §Implementation Decisions, "Surface delta") auditable independently of behavior.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 23, 2026 13:18
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: be75471
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/clientMinor
@modelcontextprotocol/coreMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2343

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2343

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2343

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2343

commit: be75471
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Comment thread.changeset/auth-surface-delta.md
Outdated

@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
0fdbe45 to
f6fb29cCompareJune 23, 2026 19:03
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/authErrors.ts
Comment threaddocs/migration.md
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
f6fb29c to
d1ffd2fCompareJune 23, 2026 21:20
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
2 times, most recently
from
ec501fa to
874ca25CompareJune 23, 2026 23:05
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
feat(client,core): auth surface delta — AuthOptions, issuer ctx/stamp…
be75471
…, authErrors module
Surface delta for the 2026-07-28 authorization requirements. All additive;
existing OAuthClientProvider implementers compile unchanged. The new fields
are inert until the behavior changes that follow wire them up.
- Extract the inline auth() options object as exported AuthOptions and add
iss (RFC 9207 callback parameter) and skipIssuerMetadataValidation
(RFC 8414 §3.3 opt-out). JSDoc is non-assertive — validation lands in
the follow-up commit.
- OAuthClientProvider.clientInformation/saveClientInformation/tokens/
saveTokens accept an optional OAuthClientInformationContext carrying the
resolved authorization-server issuer so providers can key persisted
credentials per AS.
- OAuthTokens and OAuthClientInformation gain an optional issuer stamp
field (core/shared/auth.ts) — the slot the SDK writes before persistence
so stored credentials are bound to the AS that issued them.
- New packages/client/src/client/authErrors.ts with the OAuthClientFlowError
base class; the flow-specific error classes from later commits land here.
Claude-Session: https://claude.ai/code/session_01XBib5gRe8AMPPJhySCz3EJ
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
874ca25 to
be75471CompareJune 24, 2026 10:06
@felixweinberger
felixweinberger
merged commit ffa96a6
into
v2-2026-07-28Jun 24, 2026

16 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/auth-0-surface

branch
June 24, 2026 10:44
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation …
9df72ef
…and OAuthClientInformationContext (#2343)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext by felixweinberger · Pull Request #2343 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext - #2343
Merged
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Jun 24, 2026
Merged
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation and OAuthClientInformationContext#2343
felixweinberger merged 1 commit into
v2-2026-07-28from 
fweinberger/auth-0-surface
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 23, 2026

Copy link


Copy Markdown

Contributor
d57c32e46
Surface delta for the 2026-07-28 authorization requirements. Extracts the inline auth() options object as the exported AuthOptions type and adds two fields: iss (the RFC 9207 callback parameter) and skipIssuerMetadataValidation (the RFC 8414 §3.3 opt-out). OAuthClientProvider.clientInformation() and .saveClientInformation() accept an optional OAuthClientInformationContext carrying the resolved authorization-server issuer so providers can key persisted credentials per AS. OAuthClientMetadataSchema gains application_type?: 'native' | 'web'; AuthorizationServerMetadata gains authorization_response_iss_parameter_supported?: boolean.
Motivation and Context
This is the additive-only surface PR for the M13.1 auth bundle (SEP-2468 / SEP-2352 / SEP-2350 / SEP-837 / SEP-2207 — see docs/2026-06-19-m13-auth-bundle-prd.md). It introduces every public-API field and type the behavior PRs depend on so that each subsequent PR carries only behavior, and so that existing OAuthClientProvider implementers (Claude Code is the named consumer) can be reviewed against the final shape once.
No spec MUST is implemented in this PR — all new fields are inert.
How Has This Been Tested?
pnpm typecheck:all, pnpm lint:all, pnpm --filter @modelcontextprotocol/client test. The barrelClean test confirms the new exports do not pull Node-only modules into the runtime-neutral entry. No behavior tests change.
Breaking Changes
None. All new fields are optional; existing OAuthClientProvider implementations and auth() call sites compile unchanged.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
First PR in a 7-PR stack. The five behavior PRs that follow wire each field up; the closeout PR consolidates migration.md and the client guide. Reviewing the surface in isolation makes the additive-optional invariant (PRD §Implementation Decisions, "Surface delta") auditable independently of behavior.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 23, 2026 13:18
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: be75471
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/clientMinor
@modelcontextprotocol/coreMinor
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2343

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2343

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2343

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2343

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2343

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2343

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2343

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2343

commit: be75471
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
Comment thread.changeset/auth-surface-delta.md
Outdated

@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
0fdbe45 to
f6fb29cCompareJune 23, 2026 19:03
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/authErrors.ts
Comment threaddocs/migration.md
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
f6fb29c to
d1ffd2fCompareJune 23, 2026 21:20
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
Outdated

Comment threadpackages/client/src/client/auth.ts
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
2 times, most recently
from
ec501fa to
874ca25CompareJune 23, 2026 23:05
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/core/src/shared/auth.ts
claude[bot]
claudeBot
reviewed
Jun 23, 2026
View reviewed changes
Comment threadpackages/client/src/client/auth.ts
@felixweinberger
feat(client,core): auth surface delta — AuthOptions, issuer ctx/stamp…
be75471
…, authErrors module
Surface delta for the 2026-07-28 authorization requirements. All additive;
existing OAuthClientProvider implementers compile unchanged. The new fields
are inert until the behavior changes that follow wire them up.
- Extract the inline auth() options object as exported AuthOptions and add
iss (RFC 9207 callback parameter) and skipIssuerMetadataValidation
(RFC 8414 §3.3 opt-out). JSDoc is non-assertive — validation lands in
the follow-up commit.
- OAuthClientProvider.clientInformation/saveClientInformation/tokens/
saveTokens accept an optional OAuthClientInformationContext carrying the
resolved authorization-server issuer so providers can key persisted
credentials per AS.
- OAuthTokens and OAuthClientInformation gain an optional issuer stamp
field (core/shared/auth.ts) — the slot the SDK writes before persistence
so stored credentials are bound to the AS that issued them.
- New packages/client/src/client/authErrors.ts with the OAuthClientFlowError
base class; the flow-specific error classes from later commits land here.
Claude-Session: https://claude.ai/code/session_01XBib5gRe8AMPPJhySCz3EJ
@felixweinberger
felixweinbergerforce-pushed
the
fweinberger/auth-0-surface
branch
from
874ca25 to
be75471CompareJune 24, 2026 10:06
@felixweinberger
felixweinberger
merged commit ffa96a6
into
v2-2026-07-28Jun 24, 2026

16 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/auth-0-surface

branch
June 24, 2026 10:44
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
feat(client): name AuthOptions; add iss/skipIssuerMetadataValidation …
9df72ef
…and OAuthClientInformationContext (#2343)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger