What
The OAuth flow now carries the authorization server issuer from the callback into the token exchange and into stored credentials.
Details
- both the local callback listener and the manual callback-URL path read the
issquery parameter and pass it into the token exchange - the local callback server resolves
{ code, iss }instead of just a code - stored and served client information and the token response carry an
issuerfield, and the token provider returns{ ...a, issuer: n?.issuer }on both the refresh and the silent-exchange paths _flowDiscoveryStatecaches the discovered authorization-server metadata on the provider instance- revoke calls a cleanup helper before reporting
mcp_oauth_revoke - new device-code error sets were added, including
authorization_pending
Evidence
authorization_pending, _flowDiscoveryState
Strings lifted out of the shipped bundle, so the claim above can be checked against them.