fix: delegate issuer context and discovery state through the EMA wrapper

Copilot review (#2287): `EmaTransportOAuthProvider` forwarded
`clientInformation` / `saveClientInformation` without the SDK's `ctx`, and
implemented neither `discoveryState` nor `saveDiscoveryState`. Since the wrapper
does expose `clientMetadataUrl`, an EMA connection can still take SDK `auth()`'s
URL-based-client-ID branch — and the inner provider then saw
`issuer === undefined` with no discovery state to read back, so the CIMD write
was recorded as DCR.

Forward `ctx` on both, and delegate the two discovery-state methods to the inner
provider. Both were pre-existing SEP-2352 gaps in their own right: dropping the
issuer put every EMA read and write on the unkeyed slot, and the missing
discovery state meant the SDK re-discovered on every call and warned that it
could not run its callback-leg authorization-server binding check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Lmj6X2epWpPE7ScdSKQmtA
Signed-off-by: cliffhall <cliff@futurescale.com>

core/auth/ema/transportProvider.ts

@@ -1,7 +1,9 @@
 import type { OAuthClientProvider } from "@modelcontextprotocol/client";
 import type {
+  OAuthClientInformationContext,
   OAuthClientInformationMixed,
   OAuthClientMetadata,
+  OAuthDiscoveryState,
   OAuthTokens,
 } from "@modelcontextprotocol/client";
 import type { BaseOAuthClientProvider } from "../providers.js";
@@ -50,17 +52,40 @@ export class EmaTransportOAuthProvider implements OAuthClientProvider {
     return this.inner.state();
   }
 
-  clientInformation():
+  // SEP-2352: `ctx` carries the authorization-server `issuer` the SDK resolved,
+  // and the inner provider keys registrations by it. Dropping it here made every
+  // EMA read and write land on the unkeyed slot — and, since #2242, left
+  // `resolveSdkRegistrationKind` with no issuer to check, so a CIMD registration
+  // made over an EMA connection was recorded as DCR (Copilot).
+  clientInformation(
+    ctx?: OAuthClientInformationContext,
+  ):
     | OAuthClientInformationMixed
     | undefined
     | Promise<OAuthClientInformationMixed | undefined> {
-    return this.inner.clientInformation();
+    return this.inner.clientInformation(ctx);
   }
 
   saveClientInformation(
     clientInformation: OAuthClientInformationMixed,
+    ctx?: OAuthClientInformationContext,
   ): void | Promise<void> {
-    return this.inner.saveClientInformation(clientInformation);
+    return this.inner.saveClientInformation(clientInformation, ctx);
+  }
+
+  // Without these the SDK persists no discovery state for an EMA connection, so
+  // it re-discovers on every call, cannot perform its SEP-2352 callback-leg
+  // authorization-server binding check (it warns as much), and — since #2242 —
+  // leaves the registration-kind resolver nothing to read back.
+  saveDiscoveryState(state: OAuthDiscoveryState): void | Promise<void> {
+    return this.inner.saveDiscoveryState(state);
+  }
+
+  discoveryState():
+    | OAuthDiscoveryState
+    | undefined
+    | Promise<OAuthDiscoveryState | undefined> {
+    return this.inner.discoveryState();
   }
 
   async tokens(): Promise<OAuthTokens | undefined> {