Architecture Decision Records

Key design decisions with context and rationale.

ADR	Decision
001	No refresh tokens (superseded by 006)
002	Token exchange inside redirectToAuthorization() (by 006)
003	Immutable client metadata across DCR (by 006)
004	Every flow has a state; only exact, unambiguous callbacks win
005	Credential store holds opaque text; one slot per MCP server
006	The MCP SDK owns OAuth; the adapter owns browser and flow
007	One redirect URI concept; builder form; URL validation
008	Callback pages never render callback data; security headers