feat(auth): add enterprise refresh-token and ID-JAG exchanges

[nicksteele-oai]

This PR adds the EMA/XAA token exchange flow behind auth-enterprise-managed: enterprise refresh token → ID-JAG → MCP access token. It covers the refresh-token portion of the request for support in #531.

Each authorization server has its own client authentication configuration. Clients can use a secret or a fresh JWT assertion from an application-provided signer. Public clients remain supported where explicitly allowed.

Scope

The exchange targets one MCP resource and preserves scope narrowing. The SDK checks ID-JAG structure and claim bindings. The resource authorization server verifies the signature.

Applications may supply approved server metadata and client registrations. Discovery, login, credential storage, automatic refresh, and reauth remain application responsibilities. JWT signing stays with the application. RAR and DPoP remain unsupported; nonempty authorization_details are rejected.

Testing

Local validation passed for revision dc26f27a8228:

• 211 OAuth tests with all features on Rust 1.96.
• 50 doctests passed; 10 ignored.
• Rust 1.88 minimal-feature check passed (--no-default-features --features auth-enterprise-managed).
• Formatting, strict rmcp Clippy (--all-targets --all-features), and commitlint passed.
• The MCP connection example compiles with its documented features.

Tests use mocked responses and local HTTP fixtures.

Breaking Changes

None intended and existing OAuth behavior is unchanged.

Breaking Changes

I've added a PR to extend conformance test coverage for EMA.

Conformance Test Results against rust-sdk#1234

[alexhancock]

The code for this LGTM from what I know.

I have a bit of trouble independently reproducing the conformance test results but It's likely something silly. When I run the steps you defined

TASK_RUST_DIR=/path/to/rust-sdk
TASK_CONFORMANCE_DIR=/path/to/conformance
TASK_TARGET_DIR=/Users/alexhancock/some/dir

cd "$TASK_RUST_DIR"
cargo +1.96 build -p mcp-conformance --bin conformance-client \
  --target-dir "$TASK_TARGET_DIR"

cd "$TASK_CONFORMANCE_DIR"

npm run build

node dist/index.js client \
  --command "$TASK_TARGET_DIR/debug/conformance-client" \
  --scenario auth/enterprise-managed-authorization-refresh-token

node dist/index.js client \
  --command "$TASK_TARGET_DIR/debug/conformance-client" \
  --scenario auth/enterprise-managed-authorization-refresh-token \
  --spec-version 2026-07-28 --force

node dist/index.js client \
  --command "$TASK_TARGET_DIR/debug/conformance-client" \
  --suite extensions \
  --expected-failures "$TASK_RUST_DIR/conformance/expected-failures-extensions.yaml"

I get

Stdout:
2026-09-04T01:14:59.764981Z  INFO conformance_client: Running scenario 'auth/enterprise-managed-authorization-refresh-token' against http://localhost:64726/mcp


Stderr:
Error: Unsupported conformance scenario: auth/enterprise-managed-authorization-refresh-token

Checks:
2026-09-04T01:14:59.766Z [complete-flow-mcp-access    ] FAILURE Client did not complete an MCP operation with the issued access token
2026-09-04T01:14:59.767Z [complete-flow-token-exchange] FAILURE Client did not perform token exchange
2026-09-04T01:14:59.767Z [complete-flow-jwt-bearer    ] FAILURE Client did not perform JWT bearer grant exchange

Thoughts?

Also do you want to wait for the conformance tests to merge or go ahead with the PR to the rust-sdk to get it usable more quickly? Pull out of draft when ready.

[alexhancock]

The client changes had been left out of the conformance commit. Now that they are there, I can independently reproduce the conformance checks all pass for the new scenarios.

Merging.