[Connor Peet (connor4312)]

Supersedes #439.

Summary

Adds an optional, extensible target to AuthenticateParams so a client can say which consumer a pushed token is for:

export const enum AuthenticateTargetKind { McpServer = 'mcpServer' } // @nonexhaustive
export interface McpServerAuthenticateTarget {
  kind: AuthenticateTargetKind.McpServer;
  session: URI;            // session whose customizations contain the MCP server
  customizationId: string; // McpServerCustomization.id
}
export type AuthenticateTarget = McpServerAuthenticateTarget;

When target is present, the host MUST apply the token only to that MCP server in that session, never to sibling servers, other sessions, or agent-level resources, even when they share resource and scopes. If the session or customization is unknown, or the customization is not an MCP server, the host rejects with InvalidParams. An empty token revokes only for that target. Without target, resource/scope matching is unchanged, and older hosts ignore the field, so no capability or version bump is needed.

Why

Two MCP servers can share one protected resource while using different OAuth clients or accounts (microsoft/vscode#342147: two Slack workspaces behind https://mcp.slack.com). Today authenticate carries only resource, scopes, and token, so the host applies the first token to every pending challenge for that resource, and one workspace's server ends up with the other's credential.

#439 proposed a bare serverName. That isn't unique across sessions or manifests, and authenticate is a root-channel command. The session URI plus customization ID identifies the server exactly, and the client only echoes host-published values: McpServerAuthRequiredState lives on the customization, and ToolCallAuthRequiredState.contributor.customizationId names it.

kind is @nonexhaustive, so host-owned authentication (#404) can add variants rather than new fields.

Validation

• npm run generate: passed.
• npm test: 567/568 passed. The one failure is scripts/no-redaction-marker.test.ts, which only flags files under the git-ignored local docs/.vitepress/cache, no tracked files.
• Rust cargo test -p ahp-types: passed.
• Go go build ./... && go test ./ahptypes/...: passed.
• Swift swift build: passed.
• Kotlin ./gradlew test in eclipse-temurin:17-jdk via podman: passed.
• .NET: not run (toolchain not installed locally).