chore: import upstream snapshot with attribution

examples/stories/oauth_client_credentials/client.py

@@ -0,0 +1,46 @@
+"""HTTP-only: ``build_auth`` returns a ``ClientCredentialsOAuthProvider``; ``whoami`` round-trips client_id + scopes."""
+
+import httpx
+
+from mcp.client import Client
+from mcp.client.auth.extensions.client_credentials import ClientCredentialsOAuthProvider
+from stories._harness import Target, run_client
+
+# MCP_URL pins the resource to :8000, and the server side builds its PRM/AS metadata from
+# the same constant — run the server on 8000 or the discovery chain points at the wrong origin.
+from stories._shared.auth import MCP_URL, InMemoryTokenStorage
+
+from .server import DEMO_CLIENT_ID, DEMO_CLIENT_SECRET, DEMO_SCOPE
+
+
+def build_auth(_http: httpx.AsyncClient) -> httpx.Auth:
+    """The ``httpx.Auth`` for the ``client_credentials`` grant — five lines of provider config.
+
+    The SDK then handles 401 → RFC 9728 PRM → RFC 8414 AS-metadata discovery → token POST →
+    Bearer attachment automatically. ``Client(url)`` has no ``auth=`` passthrough yet, so the
+    harness threads this onto the transport's ``httpx.AsyncClient`` and hands ``main`` the
+    already-authed ``target``.
+    """
+    return ClientCredentialsOAuthProvider(
+        server_url=MCP_URL,
+        storage=InMemoryTokenStorage(),
+        client_id=DEMO_CLIENT_ID,
+        client_secret=DEMO_CLIENT_SECRET,
+        scopes=DEMO_SCOPE,
+    )
+
+
+async def main(target: Target, *, mode: str = "auto") -> None:
+    async with Client(target, mode=mode) as client:
+        listed = await client.list_tools()
+        assert [t.name for t in listed.tools] == ["whoami"]
+
+        result = await client.call_tool("whoami", {})
+        assert not result.is_error
+        assert result.structured_content is not None
+        assert result.structured_content["client_id"] == DEMO_CLIENT_ID, result
+        assert DEMO_SCOPE in result.structured_content["scopes"]
+
+
+if __name__ == "__main__":
+    run_client(main)