@spec credential_key(String.t(), String.t()) :: {String.t(), String.t()}

Returns the exact authorization-server/client identifier credential key.

Neither component is URI-normalized or case-folded. The issuer should be the value already validated by validate_issuer/2 or validate_issuer/3.

@spec registration_metadata(map(), :native | :web | String.t()) :: map()

Adds the OIDC Dynamic Client Registration application_type field.

Native desktop, mobile, CLI, and localhost clients should pass :native; remotely hosted browser applications should pass :web.

@spec select_registration(
  map(),
  keyword()
) :: {:ok, registration_selection()} | {:error, :registration_unavailable}

Selects the highest-priority registration mechanism supported by both peers.

Options are considered in MCP's required priority order:

• :pre_registered — existing authorization-server-specific client data
• :client_id_metadata_document — the client's HTTPS metadata document ID
• :dynamic_client_registration — whether deprecated DCR is enabled

@spec validate_issuer(String.t(), String.t() | nil) ::
  :ok | {:error, :issuer_mismatch | :issuer_metadata_required}

Validates a present RFC 9207 authorization-response issuer byte for byte.

When the response omits iss, use validate_issuer/3 with the authorization-server metadata so the advertised support flag can be honored. The two-argument form returns :issuer_metadata_required for an omitted issuer instead of guessing whether the parameter was required.

@spec validate_issuer(String.t(), String.t() | nil, map()) ::
  :ok | {:error, :issuer_mismatch | :missing_issuer}

Validates an RFC 9207 authorization-response issuer using authorization-server metadata.

A present iss always has to match the expected issuer exactly. A missing iss is rejected only when the server advertises authorization_response_iss_parameter_supported.