[Client][Auth] SEP-2352: Key DCR registrations and tokens by AS issuer; reject cross-AS credential reuse

Implements SEP-2352 for the MCP Spec 2026-07-28 release.

Tracked by umbrella #338.

Spec summary

Clarifies that clients must key DCR/pre-registered credentials by AS issuer, maintain separate registration state per AS, and error on AS mismatch. CIMD client_ids remain portable. Clients MUST NOT assume cross-AS credential validity.

PHP SDK changes

• TokenStorage (#315) and DCR (#320) must be indexed by AS issuer URL, not just by MCP server URL.
• Token cache key should be (resource_server, as_issuer) tuples.
• PRM/AS metadata discovery (#317, #318) must drive the binding.
• Client must error if a stored credential's bound issuer != the issuer currently advertised by the resource.
• Server-side: minimal — server PRM metadata document in src/Server/Transport/Http/OAuth/ must continue to advertise its AS issuer unambiguously.

Related

• Umbrella #338
• Extends #315 (TokenStorage) and #320 (DCR) with per-issuer keying

TokenStorage (#315)、DCR (#320)、および #317 と #318 の PRM/AS メタデータ検出作業から始めます。src/Server/Transport/Http/OAuth/ にあるサーバーメタデータドキュメントを確認し、公開された AS issuer がクライアント認証情報とトークンストレージにどのように到達するかを追跡します。認証情報とトークンキャッシュエントリが issuer ごとにスコープされ、AS をまたいだ再利用が拒否され、CIMD クライアント ID がポータブルなままであれば完了です。