Module auth 

Endpoint authentication — the interactive and workload credential providers and the token cache they share.

Static headers (mcp::auth) and the AAuth request-signer (aauth) supply the static and aauth providers. This module owns the rest: the Kind::Cred-backed cache, the OAuth 2.1 / OIDC [oauth2] flows (device grant, browser + PKCE, refresh, discovery) behind agentd login, and the AWS SigV4 / IAM Identity Center providers. Everything but the cache is gated on the oauth cargo feature, so a build without it carries no interactive-login code at all.

Modules

cache

The endpoint-credential cache: access + refresh tokens with their expiry, keyed by a hash of the login target (e.g. mcp:github, intelligence).

Functions

canonical_target

Canonicalize a login/logout target: mcp:<name> on a server that references a service-catalog entry becomes service:<entry>, the key the daemon’s connect path actually reads. Every server pointing at that entry shares one credential, so a login must land where all of them look and a logout must revoke it for all of them at once. Deliberately outside the oauth feature gate, so logout still resolves in a build without interactive login.