Module flow 

The client-side decisions of the authorization flow that need no network.

Three rules from the authorization page, each a pure function so it can be tested without an authorization server: https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization#scope-selection-strategy

• Initial scope: use the scope from the WWW-Authenticate challenge; failing that, all of scopes_supported; failing that, send none.
• Step-up: re-authorize with the union of what was requested before and what the new challenge names, so earlier permissions are not lost.
• Retry limit: a few attempts, then a permanent failure.

offline_access is added only when the server lists it in its own scopes_supported, and a resource must never advertise it.

Constants

MAX_STEP_UP_ATTEMPTS

How many step-up authorizations are attempted for one operation before the failure is treated as permanent. “No more than a few times”.

OFFLINE_ACCESS

The offline_access scope, which asks for a refresh token.

Functions

initial_scope

Picks the scope for the first authorization request.

may_step_up

Whether another step-up may be attempted after attempts have been made.

step_up_scope

The scope for a step-up: everything requested before, plus the challenge.

with_offline_access

Adds offline_access to scope when the authorization server lists it.