Runtime-owned explicit authentication single-flight

[ethan-huo]

Objective

Move credential usability and explicit Authentication Flow coordination behind the MCP Runtime, with one single-flight per Credential Identity.

Scope

• Ordinary Calls perform a read-only credential usability check and return reauth-required when unusable.
• Only explicit refreshServers may refresh tokens, open a browser, or join an interactive flow.
• Share one refresh/interactive promise per Credential Identity.
• Track each refresh caller as an independent waiter.
• Cancel the flow and close callback resources when the final waiter disconnects.
• Persist one successful credential rotation before releasing waiters.
• Preserve the current OAuth callback unref() mitigation until lifecycle tests prove cleanup.
• Remove the cross-process token-cache lock only after Runtime sole-writer and single-flight coverage replaces it.

Non-goals

• Automatic auth from ordinary Calls.
• Real OAuth providers.
• Credential material in Runtime protocol frames.

TDD acceptance

• Start with failing credential-coordinator tests using local metadata, token, and callback fixtures.
• An ordinary Call never hits an auth/token endpoint and returns reauth-required.
• Five concurrent explicit refresh CLI callers cause one token refresh or interactive flow.
• One waiter disconnect does not cancel while another remains.
• Final waiter disconnect closes callback resources and settles the flow.
• Success, rejection, timeout, and cancellation leave no referenced callback server or timer.

Verification

• Focused credential/auth tests.
• Concurrent process-level refresh regression.
• Full test suite, typecheck, formatter check, and git diff --check.

[ethan-huo]

Implemented Runtime-owned explicit authentication single-flight with local-only evidence:

• Added one in-memory Authentication Flow per Credential Identity.
• Each refresh caller is an independent waiter; one disconnect does not affect remaining waiters, while the final disconnect aborts the shared flow.
• The coordinator returns waiter outcomes rather than writing frames, so a multi-identity refresh still emits exactly one terminal frame at the Runtime boundary.
• Existing-token refresh and discovered interactive authentication both persist through the Runtime stores before waiters are released.
• OAuth AbortSignal now reaches metadata lookup, dynamic registration, callback waiting, code exchange, and token refresh; callback unref() remains in place.
• Ordinary Calls remain read-only and return reauth-required.

Local evidence:

• five concurrent Runtime refresh callers -> one local token request and one credential rotation
• one waiter disconnect preserves the flow; final waiter disconnect closes the injected callback resource
• success, synchronous rejection, timeout, and cancellation leave zero active flows

Validation:

• focused auth/runtime/OAuth suites: 11 pass, 0 fail
• full bun run check: 119 pass, 0 fail; typecheck and formatting pass
• prototype format check and git diff --check: pass

The legacy cross-process token lock remains until dependent CLI cutover Issue #22 proves Runtime sole-writer behavior. No real OAuth or remote MCP was accessed.