feat(client): add DPoP (RFC 9449) sender-constrained token support

[gbshankar]

Summary

Implements the client half of DPoP (RFC 9449) sender-constrained tokens per SEP-1932, a draft OAuth extension for MCP. This is the SDK-side work backing conformance#394 (merged), which added the auth/dpop and auth/dpop-nonce client scenarios that no SDK currently passes.

• DpopSession (new client/dpop.ts): non-extractable keypair generation, RFC 9449 §4 proof building (fresh jti per proof, query/fragment-stripped htu, ath when presenting a token), and per-origin nonce tracking for both the AS and RS nonce challenges (§8/§9).
• Two additive, optional hooks — no breaking change for existing hosts:
  • AuthProvider.authorizeRequest?() / consumeChallenge?() — let a transport delegate per-request header construction and nonce-challenge handling instead of hard-coding Bearer.
  • OAuthClientProvider.dpop?() — a host returns a DpopSession to opt in; adaptOAuthProvider then presents Authorization: DPoP <token> + a signed DPoP proof instead of Bearer, everywhere.
• Wired into the token endpoint (auth.ts: proof on the token request, retry-once on AS 400 use_dpop_nonce) and both transports (streamableHttp.ts, sse.ts: proof per request, retry-once on RS 401 use_dpop_nonce).
• Standalone withDpop() middleware for hosts that build their own fetch pipeline instead of using OAuthClientProvider.
• Conformance harness: registers auth/dpop / auth/dpop-nonce against the pinned referee (test/conformance/src/helpers/dpopClient.ts, everythingClient.ts) and removes both from expected-failures.yaml.

Bug fix found while verifying against the real referee

withOAuth (and the conformance harness's withOAuthRetry, same shape) only checked for a nonce challenge before the credential re-authorization retry, never after it. auth/dpop-nonce's actual sequence is: request with no token → 401 (no nonce yet) → re-authorize, get a token → request again → 401 again, this time use_dpop_nonce — which the old linear code never re-checked. Restructured both into a bounded while-loop (nonce retry and credential retry, each spent at most once, tried in whichever order the server presents them) — see middleware.ts and the conformance harness's withOAuthRetry.ts. Covered by a new regression test shaped exactly like the scenario.

Verification

• 57 new unit tests (packages/client/test/client/{dpop,auth.dpop,streamableHttp.dpop,sse.dpop,middleware.dpop}.test.ts), full client suite: 855/855 passing.
• Typecheck/lint clean (pnpm --filter @modelcontextprotocol/client typecheck).
• Against the real pinned @modelcontextprotocol/conformance referee: auth/dpop 12/12, auth/dpop-nonce 14/14 (including sep-1932-client-rs-nonce), full --suite all regression-clean.

Activation

Fully opt-in: DPoP only activates when a host supplies a DpopSession via OAuthClientProvider.dpop(). Hosts that don't implement it keep the exact prior Bearer-only behavior.

Stack

This is part of a 3-PR DPoP rollout (mirroring the client/server split in the conformance repo's own #394/#395):

1. → this PR ← — client-side DPoP (SEP-1932, conformance#394)
2. Server-side DPoP proof validation (SEP-1932, conformance#395) — independent of this PR, no shared files
3. Server-side conformance fixture for Race condition between transport start and server connection #2, stacked on it

PR 2 and 3 links will be added here once opened. Not order-dependent with #2 — either can merge first.

[changeset-bot]

🦋 Changeset detected

Latest commit: 9991200

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages

Name	Type
@modelcontextprotocol/client	Minor
@modelcontextprotocol/core	Minor
@modelcontextprotocol/server	Minor
@modelcontextprotocol/server-legacy	Minor
@modelcontextprotocol/codemod	Minor
@modelcontextprotocol/core-internal	Patch
@modelcontextprotocol/express	Major
@modelcontextprotocol/fastify	Major
@modelcontextprotocol/hono	Major
@modelcontextprotocol/node	Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2629

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2629

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2629

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2629

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2629

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2629

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2629

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2629

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2629

commit: 9991200