@memoraone/mcp 0.1.54 → 0.1.55

package/dist/cli.cjs

@@ -231,7 +231,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@memoraone/mcp",
-      version: "0.1.54",
+      version: "0.1.55",
       type: "module",
       main: "dist/index.cjs",
       exports: {

package/dist/gateway.cjs

@@ -271,11 +271,17 @@ function getGatewayIssuerUrl(env2 = process.env) {
 function getGatewayResourceBaseUrl(env2 = process.env) {
   return `${getGatewayBaseUrl(env2)}${GATEWAY_MCP_PATH}`;
 }
-function getGatewayProtectedResourceMetadataUrl(env2 = process.env) {
-  return `${getGatewayBaseUrl(env2)}${GATEWAY_OAUTH_PRM_PATH}`;
+function getGatewayProtectedResourceMetadataUrl(env2 = process.env, workspaceRoot) {
+  const metadataUrl = `${getGatewayBaseUrl(env2)}${GATEWAY_OAUTH_PRM_PATH}`;
+  if (workspaceRoot === void 0) {
+    return metadataUrl;
+  }
+  const mcpUrl = buildGatewayMcpUrl(workspaceRoot, env2);
+  const queryIndex = mcpUrl.indexOf("?");
+  return queryIndex >= 0 ? `${metadataUrl}${mcpUrl.slice(queryIndex)}` : metadataUrl;
 }
-function buildGatewayMcpWwwAuthenticate(env2 = process.env) {
-  const metadataUrl = getGatewayProtectedResourceMetadataUrl(env2);
+function buildGatewayMcpWwwAuthenticate(env2 = process.env, workspaceRoot) {
+  const metadataUrl = getGatewayProtectedResourceMetadataUrl(env2, workspaceRoot);
   return `Bearer resource_metadata="${metadataUrl}"`;
 }
 function isAllowedOAuthRedirectUri(redirectUri) {
@@ -11160,9 +11166,9 @@ function opaqueId(prefix) {
 function delay(ms) {
   return new Promise((resolve46) => setTimeout(resolve46, ms));
 }
-function buildProtectedResourceMetadata(env2 = process.env) {
+function buildProtectedResourceMetadata(env2 = process.env, workspaceRoot) {
   return {
-    resource: getGatewayResourceBaseUrl(env2),
+    resource: workspaceRoot === void 0 ? getGatewayResourceBaseUrl(env2) : buildGatewayMcpUrl(workspaceRoot, env2),
     authorization_servers: [getGatewayIssuerUrl(env2)]
   };
 }
@@ -11287,11 +11293,38 @@ var GatewayOAuthSurface = class {
       return;
     }
   }
+  /**
+   * RFC 9728 PRM. Generic probes (no `ws`) advertise the bare /mcp resource.
+   * `?ws=` reuses gateway workspace identity; malformed/nonexistent fail closed.
+   */
+  async handleProtectedResourceMetadata(res, url) {
+    const wsOrError = getGatewayWsQueryParam(url);
+    if (wsOrError !== null && typeof wsOrError === "object" && wsOrError.ok === false) {
+      json(res, 404, {
+        error: "invalid_request",
+        error_description: "resource workspace is invalid"
+      });
+      return;
+    }
+    if (wsOrError === null) {
+      json(res, 200, buildProtectedResourceMetadata(this.env));
+      return;
+    }
+    const parsed2 = await parseGatewayWorkspaceRoot(wsOrError);
+    if (!parsed2.ok) {
+      json(res, 404, {
+        error: "invalid_request",
+        error_description: "resource workspace is invalid"
+      });
+      return;
+    }
+    json(res, 200, buildProtectedResourceMetadata(this.env, parsed2.workspaceRoot));
+  }
   async handleRequest(req, res, url) {
     const { pathname } = url;
     const method = req.method ?? "GET";
     if (method === "GET" && (pathname === GATEWAY_OAUTH_PRM_PATH || pathname === GATEWAY_OAUTH_PRM_ROOT_PATH)) {
-      json(res, 200, buildProtectedResourceMetadata(this.env));
+      await this.handleProtectedResourceMetadata(res, url);
       return true;
     }
     if (method === "GET" && pathname === GATEWAY_OAUTH_AS_METADATA_PATH) {
@@ -13582,8 +13615,8 @@ function sendJsonRpcHttpError(res, status, message) {
   });
   res.end(body);
 }
-function sendUnauthorizedChallenge(res, env2) {
-  const challenge = buildGatewayMcpWwwAuthenticate(env2);
+function sendUnauthorizedChallenge(res, env2, workspaceRoot) {
+  const challenge = buildGatewayMcpWwwAuthenticate(env2, workspaceRoot);
   const body = "Unauthorized";
   res.writeHead(401, {
     "www-authenticate": challenge,
@@ -13737,7 +13770,7 @@ async function handleAuthenticatedGatewayMcpRequest(req, res, auth, options = {}
   const binding = await loadGatewayHttpBinding(workspaceRoot, options);
   if (!binding) {
     await closeGatewayMcpSessionsForWorkspace(workspaceRoot);
-    sendUnauthorizedChallenge(res, env2);
+    sendUnauthorizedChallenge(res, env2, workspaceRoot);
     return;
   }
   const sessionHeader = req.headers["mcp-session-id"];
@@ -13753,7 +13786,7 @@ async function handleAuthenticatedGatewayMcpRequest(req, res, auth, options = {}
       return;
     }
     if (!await ensureBindingStillValid(existing, options)) {
-      sendUnauthorizedChallenge(res, env2);
+      sendUnauthorizedChallenge(res, env2, workspaceRoot);
       return;
     }
     if (method === "POST") {
@@ -13810,8 +13843,8 @@ function extractBearerToken(authorizationHeader) {
   const token = match[1];
   return token || null;
 }
-function sendUnauthorized(res, env2) {
-  const challenge = buildGatewayMcpWwwAuthenticate(env2);
+function sendUnauthorized(res, env2, workspaceRoot) {
+  const challenge = buildGatewayMcpWwwAuthenticate(env2, workspaceRoot);
   const body = "Unauthorized";
   res.writeHead(401, {
     "www-authenticate": challenge,
@@ -13838,7 +13871,7 @@ async function handleGatewayMcpAuthRequest(req, res, url, options = {}) {
   const canonicalUrl = buildGatewayMcpUrl(parsed2.workspaceRoot, env2);
   const token = extractBearerToken(req.headers.authorization);
   if (!token) {
-    sendUnauthorized(res, env2);
+    sendUnauthorized(res, env2, parsed2.workspaceRoot);
     return true;
   }
   const verified = await verifyGatewaySetupTicket(
@@ -13847,7 +13880,7 @@ async function handleGatewayMcpAuthRequest(req, res, url, options = {}) {
     ticketOptions
   );
   if (!verified.ok) {
-    sendUnauthorized(res, env2);
+    sendUnauthorized(res, env2, parsed2.workspaceRoot);
     return true;
   }
   await handleAuthenticatedGatewayMcpRequest(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memoraone/mcp",
-  "version": "0.1.54",
+  "version": "0.1.55",
   "type": "module",
   "main": "dist/index.cjs",
   "exports": {