@ni-c/mcp-hub 0.11.2 → 0.11.4

package/dist/subscriptions.js

@@ -1,3 +1,4 @@
+import { logSafe } from './auth/text.js';
 import { booleanEnv, nonNegativeIntegerEnv, positiveIntegerEnv } from './mcp-limits.js';
 /**
  * Carrying a child's change notifications to the client that asked for them.
@@ -71,6 +72,15 @@ export const MAX_STREAM_MS = nonNegativeIntegerEnv('MCP_SUBSCRIPTION_MAX_MS', 30
  * window would otherwise be a million map entries the hub holds for it.
  */
 const MAX_PENDING_EVENTS = 1024;
+/**
+ * Longest `resources/updated` URI the hub holds or forwards; a longer one is
+ * dropped. A URI names what to re-read — nothing legitimate comes near this.
+ * `MAX_PENDING_EVENTS` bounds how many one window holds, this how large each
+ * may be, whichever transport the child sends it over.
+ */
+export const MAX_RESOURCE_URI_BYTES = positiveIntegerEnv('MCP_SUBSCRIPTION_MAX_URI_BYTES', 8 * 1024);
+/** At most one log line a minute per registry about dropped URIs. */
+const OVERSIZED_URI_WARNING_INTERVAL_MS = 60_000;
 /** True unless an operator said otherwise, globally or for this server. */
 export function subscriptionsAllowed(config) {
     return SUBSCRIPTIONS_ENABLED && config.subscriptions !== 'off';
@@ -131,6 +141,7 @@ export class SubscriptionRegistry {
     nextId = 1;
     timer;
     closed = false;
+    lastOversizedUriWarningAt = 0;
     constructor(notifier, options = {}) {
         this.notifier = notifier;
         this.options = options;
@@ -172,6 +183,10 @@ export class SubscriptionRegistry {
     publish(event) {
         if (this.closed)
             return;
+        if (event.kind === 'resource_updated' && Buffer.byteLength(event.uri, 'utf8') > MAX_RESOURCE_URI_BYTES) {
+            this.warnOversizedUri(event.uri);
+            return;
+        }
         const debounceMs = this.options.debounceMs ?? DEBOUNCE_MS;
         if (debounceMs <= 0) {
             this.deliver(event);
@@ -236,6 +251,14 @@ export class SubscriptionRegistry {
                 return;
         }
     }
+    /** The URI is the child's own text, so it is escaped and truncated. */
+    warnOversizedUri(uri) {
+        const now = Date.now();
+        if (now - this.lastOversizedUriWarningAt < OVERSIZED_URI_WARNING_INTERVAL_MS)
+            return;
+        this.lastOversizedUriWarningAt = now;
+        console.error(`mcp-hub: dropped a resources/updated notification whose uri exceeded ${MAX_RESOURCE_URI_BYTES} bytes: ${logSafe(uri)}`);
+    }
     close() {
         this.closed = true;
         clearTimeout(this.timer);

package/dist/supervisor.js

@@ -9,6 +9,7 @@ import { DockerTransport } from './transports/docker.js';
 import { setTransportHandlers } from './transports/stream.js';
 import { DockerClient, parseSandboxDockerHost } from './sandbox/docker-client.js';
 import { UpstreamAuth, UpstreamLoginRequiredError } from './upstream/auth.js';
+import { boundedRedirectFetch } from './upstream/redirects.js';
 import { ToolCache } from './tool-cache.js';
 import { filterTools, hasToolFilter, unmatchedPatterns } from './tool-filter.js';
 import { subscriptionsAllowed } from './subscriptions.js';
@@ -44,6 +45,10 @@ function eraHasPing(client) {
 /**
  * Remote upstreams get their configured headers on EVERY request via a fetch
  * wrapper — requestInit alone does not cover the SSE stream GET.
+ *
+ * Both wrappers follow a redirect only within the configured origin, and at
+ * most three: the platform would otherwise follow a `Location` anywhere,
+ * headers and body included. See `boundedRedirectFetch`.
  */
 function buildRemoteTransport(config, auth) {
     const url = new URL(config.url);
@@ -59,14 +64,15 @@ function buildRemoteTransport(config, auth) {
             ? new SSEClientTransport(url, { authProvider: auth.provider(), fetch: guarded })
             : new StreamableHTTPClientTransport(url, { authProvider: auth.provider(), fetch: guarded });
     }
-    const fetchWithHeaders = (input, init) => {
+    // The headers go on inside the redirect wrapper, so every hop carries them.
+    const fetchWithHeaders = boundedRedirectFetch(url.origin, (input, init) => {
         const merged = new Headers(init?.headers);
         for (const [key, value] of Object.entries(headers)) {
             if (!merged.has(key))
                 merged.set(key, value);
         }
         return fetch(input, { ...init, headers: merged });
-    };
+    });
     if (config.transport === 'sse') {
         return new SSEClientTransport(url, { requestInit: { headers }, fetch: fetchWithHeaders });
     }
@@ -180,8 +186,16 @@ export class ManagedServer {
     restartTimer;
     pingTimer;
     stopping = false;
-    /** Failed restarts since the last real use; wake() and markUsed() reset it. */
+    /** Failed restarts since the server was last up or used; a start that
+     *  reaches 'up' and markUsed() reset it, wake() does not. */
     restartsSinceUse = 0;
+    /**
+     * When a request last revived a server that had given up. The first request
+     * after a give-up retries at once; another one within the current backoff is
+     * refused, so a caller repeating it cannot restart the server faster than its
+     * own crashes allow. Cleared by a start that reaches 'up'.
+     */
+    lastGiveUpRetryAt = 0;
     wakeWaiters = [];
     /**
      * Invalidates callbacks of an abandoned transport: sleep() and stop() tear a
@@ -190,6 +204,8 @@ export class ManagedServer {
      * kill the new child.
      */
     generation = 0;
+    /** True while client.connect() is in flight; see start(). */
+    connecting = false;
     /** The one upstream listen stream carrying this route's whole demand (modern era). */
     upstream;
     upstreamFilter;
@@ -242,6 +258,15 @@ export class ManagedServer {
         if (this.state === 'unauthorized') {
             return Promise.reject(new Error(`Server "${this.name}" needs an upstream login`));
         }
+        // A server that gave up revives on request, but no faster than its backoff.
+        // A request inside the window fails fast with the error the give-up
+        // reported, rather than queueing behind an attempt that is not coming.
+        if (this.state === 'sleeping' && this.restartsSinceUse > 0) {
+            if (Date.now() - this.lastGiveUpRetryAt < this.backoffMs) {
+                return Promise.reject(new Error(`Server "${this.name}" failed to start: ${this.lastError}`));
+            }
+            this.lastGiveUpRetryAt = Date.now();
+        }
         const timeoutMs = this.options.wakeTimeoutMs ?? WAKE_TIMEOUT_MS;
         const promise = new Promise((resolve, reject) => {
             const waiter = {
@@ -256,16 +281,20 @@ export class ManagedServer {
             waiter.timer.unref();
             this.wakeWaiters.push(waiter);
         });
-        if (this.state === 'sleeping') {
-            this.restartsSinceUse = 0;
+        if (this.state === 'sleeping' && this.restartsSinceUse === 0) {
+            // Idle sleep or a cache-hydrated boot: no crash history, wake at once.
             this.backoffMs = this.options.backoffInitialMs ?? BACKOFF_INITIAL_MS;
             void this.start();
         }
-        else if (this.state === 'down') {
-            // Someone is asking — no point in sitting out the rest of the backoff.
-            clearTimeout(this.restartTimer);
+        else if (this.state === 'sleeping') {
+            // Given up earlier: this is the one attempt the window above allows.
+            // The backoff and the give-up count carry on from where the crashes
+            // left them instead of starting over.
             void this.start();
         }
+        // 'down': a restart is already scheduled by the backoff. The caller waits
+        // for it; cancelling the timer to start now would let requests set the
+        // pace of a crash loop.
         // 'starting': the in-flight start resolves the waiter.
         return promise;
     }
@@ -353,13 +382,24 @@ export class ManagedServer {
             inputRequired: { autoFulfill: false }
         });
         setTransportHandlers(transport, { onclose: () => this.onExit(this.exitReason(), generation) });
+        // While the opening exchange runs, a close of the transport is not
+        // reported by onclose: the SDK closes the transport *before* connect()
+        // rejects, so the generic "connection closed" used to win the race and the
+        // rejection — which names the cause, and may carry a verdict no restart
+        // can fix — was thrown away by onExit's state guard. A refused redirect,
+        // a TLS failure or an unauthorized upstream all read as "connection
+        // closed" in the log. connect() always rejects once its transport is
+        // gone, so the catch below is the one place that reports this exit.
+        this.connecting = true;
         try {
             await client.connect(transport);
         }
         catch (error) {
+            this.connecting = false;
             this.onExit(`failed to start: ${error.message}`, generation, classifyAuthFailure(error));
             return;
         }
+        this.connecting = false;
         if (generation !== this.generation) {
             // sleep()/stop() ran while we were connecting; it already set the final
             // state, so this child is surplus and only needs to go away again.
@@ -374,6 +414,9 @@ export class ManagedServer {
         // The start itself opens a full idle window, so a pre-warmed server is not
         // swept away just before the tool call it was warmed for.
         this.lastUsedAt = this.startedAt;
+        // Coming up is what clears the crash history — being asked for does not.
+        this.restartsSinceUse = 0;
+        this.lastGiveUpRetryAt = 0;
         // The child's declared identity, on its way into a file LOG_FILE mirrors
         // and fail2ban reads: escaped and bounded like any other stranger's text.
         console.log(`[${this.name}] up (${logSafe(this.serverInfo?.name ?? 'unknown', 100)} ${logSafe(this.serverInfo?.version ?? '', 40)})`.trim());
@@ -615,6 +658,10 @@ export class ManagedServer {
         // left behind must not touch the current child.
         if (generation !== this.generation)
             return;
+        // A close during the opening exchange is reported by start()'s catch, with
+        // the reason connect() gives — see the note there.
+        if (this.connecting && reason === this.exitReason())
+            return;
         // A failed start reports twice: transport.onclose fires and start()'s catch
         // calls us as well. Without this guard the second call would overwrite
         // restartTimer without clearing it, so two children would be spawned and
@@ -648,6 +695,9 @@ export class ManagedServer {
             // forever. Give up until the next wake, which starts fresh.
             console.error(`[${this.name}] down (${logSafe(reason, 500)}), giving up until next use after ${this.restartsSinceUse - 1} failed restarts`);
             this.state = 'sleeping';
+            // lastGiveUpRetryAt stays as it is: zero after a first give-up, so the
+            // next request retries at once; the time of that retry when the retry
+            // is what failed, so the one after it waits for the backoff.
             this.rejectWakeWaiters(new Error(`Server "${this.name}" failed to start: ${reason}`));
             return;
         }

package/dist/transports/docker.js

@@ -1,3 +1,5 @@
+import { StringDecoder } from 'node:string_decoder';
+import { logSafe } from '../auth/text.js';
 import { buildCreateRequest, containerName } from '../sandbox/container-spec.js';
 import { StreamTransport, setTransportHandlers } from './stream.js';
 /** Guards against a corrupt header turning into a multi-gigabyte allocation. */
@@ -15,7 +17,16 @@ const STDERR = 2;
 export class DockerFrameDecoder {
     onFrame;
     onError;
-    buffer = Buffer.alloc(0);
+    /**
+     * The bytes of the frame in progress, as the chunks they arrived in, joined
+     * once the whole frame is here. One growing buffer would copy itself on every
+     * chunk — quadratic in the frame size, on the hub's event loop, for a size
+     * the peer chooses.
+     */
+    pending = [];
+    pendingBytes = 0;
+    /** The header of the frame in progress, once eight bytes have arrived. */
+    header;
     failed = false;
     constructor(onFrame, onError) {
         this.onFrame = onFrame;
@@ -24,25 +35,44 @@ export class DockerFrameDecoder {
     push(chunk) {
         if (this.failed)
             return;
-        this.buffer = this.buffer.length === 0 ? chunk : Buffer.concat([this.buffer, chunk]);
+        if (chunk.length === 0)
+            return;
+        this.pending.push(chunk);
+        this.pendingBytes += chunk.length;
         for (;;) {
-            if (this.buffer.length < 8)
-                return;
-            const size = this.buffer.readUInt32BE(4);
-            if (size > MAX_FRAME_BYTES) {
-                this.failed = true;
-                this.onError(new Error(`docker frame of ${size} bytes exceeds the ${MAX_FRAME_BYTES} byte limit`));
-                this.buffer = Buffer.alloc(0);
-                return;
+            if (this.header === undefined) {
+                if (this.pendingBytes < 8)
+                    return;
+                // Joining here is cheap: the pending pieces hold at most a header's
+                // worth of bytes plus whatever one chunk brought with it.
+                const joined = this.join();
+                const size = joined.readUInt32BE(4);
+                if (size > MAX_FRAME_BYTES) {
+                    this.failed = true;
+                    this.onError(new Error(`docker frame of ${size} bytes exceeds the ${MAX_FRAME_BYTES} byte limit`));
+                    this.pending = [];
+                    this.pendingBytes = 0;
+                    return;
+                }
+                this.header = { stream: joined[0], size };
+                this.replace(joined.subarray(8));
             }
-            if (this.buffer.length < 8 + size)
+            if (this.pendingBytes < this.header.size)
                 return;
-            const stream = this.buffer[0];
-            const payload = this.buffer.subarray(8, 8 + size);
-            this.buffer = this.buffer.subarray(8 + size);
-            this.onFrame(stream, payload);
+            const joined = this.join();
+            const { stream, size } = this.header;
+            this.header = undefined;
+            this.replace(joined.subarray(size));
+            this.onFrame(stream, joined.subarray(0, size));
         }
     }
+    join() {
+        return this.pending.length === 1 ? this.pending[0] : Buffer.concat(this.pending);
+    }
+    replace(rest) {
+        this.pending = rest.length > 0 ? [rest] : [];
+        this.pendingBytes = rest.length;
+    }
 }
 /**
  * An MCP server running in its own container, spoken to over the Docker API.
@@ -68,6 +98,9 @@ export class DockerTransport {
     stream;
     closing = false;
     stderrTail = '';
+    // A frame boundary can split a multi-byte UTF-8 character; the decoder
+    // carries the partial bytes into the next frame.
+    stderrDecoder = new StringDecoder('utf8');
     constructor(server, config, client, writeStderr = line => process.stderr.write(line)) {
         this.server = server;
         this.config = config;
@@ -134,6 +167,12 @@ export class DockerTransport {
         this.closing = true;
         await this.inner?.close();
         this.stream?.destroy();
+        // A last line without a newline, or a character cut off by the exit, would
+        // otherwise go down with the container — and it is often the reason.
+        const rest = this.stderrTail + this.stderrDecoder.end();
+        this.stderrTail = '';
+        if (rest)
+            this.writeStderr(`[${this.server}] ${logSafe(rest, Infinity)}\n`);
         await this.client.removeContainer(containerName(this.server)).catch(() => { });
     }
     async ensureImage() {
@@ -149,15 +188,20 @@ export class DockerTransport {
      * to the process's stderr rather than through console: stdio children use
      * `stderr: 'inherit'` and bypass console too, which is what keeps LOG_FILE
      * (read by fail2ban) free of server chatter.
+     *
+     * The container is untrusted, so each line is escaped like any other text
+     * from a child: an ESC or a bare CR would otherwise reach the terminal of
+     * whoever watches `docker logs -f`. No length cap from logSafe — the 64 KiB
+     * tail flush below already bounds a line.
      */
     logStderr(payload) {
-        this.stderrTail += payload.toString('utf8');
+        this.stderrTail += this.stderrDecoder.write(payload);
         const lines = this.stderrTail.split('\n');
         this.stderrTail = lines.pop() ?? '';
         for (const line of lines)
-            this.writeStderr(`[${this.server}] ${line}\n`);
+            this.writeStderr(`[${this.server}] ${logSafe(line, Infinity)}\n`);
         if (this.stderrTail.length > 64 * 1024) {
-            this.writeStderr(`[${this.server}] ${this.stderrTail}\n`);
+            this.writeStderr(`[${this.server}] ${logSafe(this.stderrTail, Infinity)}\n`);
             this.stderrTail = '';
         }
     }

package/dist/transports/stream.js

@@ -18,7 +18,17 @@ export class StreamTransport {
     onclose;
     onerror;
     onmessage;
-    buffer = Buffer.alloc(0);
+    /**
+     * Bytes received since the last newline, as the chunks they arrived in.
+     *
+     * A list rather than one growing buffer: appending a chunk to a buffer copies
+     * the whole buffer, so a peer that sends a long line in small pieces makes
+     * the hub copy quadratically — ten megabytes in 4 KiB chunks cost a second
+     * of the event loop, on every restart the peer cared to provoke. The pieces
+     * are joined once, when a newline arrives, which is linear.
+     */
+    pending = [];
+    pendingBytes = 0;
     started = false;
     closed = false;
     reportedClose = false;
@@ -55,25 +65,40 @@ export class StreamTransport {
      * own codec still does the parsing; only the policy is local.
      */
     receive(chunk) {
-        if (this.buffer.length + chunk.length > STDIO_DEFAULT_MAX_BUFFER_SIZE) {
+        if (this.pendingBytes + chunk.length > STDIO_DEFAULT_MAX_BUFFER_SIZE) {
             // A peer that keeps sending without ever writing a newline. This runs
             // inside a 'data' handler, so a throw here would reach
             // process.on('uncaughtException') and take the entire hub down — every
             // other server with it — because one sandboxed server misbehaved. The
             // stream is desynchronised anyway: report it, end this connection, let
             // the supervisor restart it.
-            this.buffer = Buffer.alloc(0);
+            this.pending = [];
+            this.pendingBytes = 0;
             this.onerror?.(new Error(`ReadBuffer exceeded maximum size of ${STDIO_DEFAULT_MAX_BUFFER_SIZE} bytes`));
             void this.close();
             return;
         }
-        this.buffer = this.buffer.length === 0 ? chunk : Buffer.concat([this.buffer, chunk]);
+        // Only the new chunk can hold the newline that completes a line; the
+        // pending pieces were already searched when they arrived.
+        if (chunk.indexOf('\n') === -1) {
+            this.pending.push(chunk);
+            this.pendingBytes += chunk.length;
+            return;
+        }
+        let buffer = this.pending.length === 0 ? chunk : Buffer.concat([...this.pending, chunk]);
+        this.pending = [];
+        this.pendingBytes = 0;
         for (;;) {
-            const newline = this.buffer.indexOf('\n');
-            if (newline === -1)
+            const newline = buffer.indexOf('\n');
+            if (newline === -1) {
+                if (buffer.length > 0) {
+                    this.pending.push(buffer);
+                    this.pendingBytes = buffer.length;
+                }
                 return;
-            const line = this.buffer.toString('utf8', 0, newline).replace(/\r$/, '');
-            this.buffer = this.buffer.subarray(newline + 1);
+            }
+            const line = buffer.toString('utf8', 0, newline).replace(/\r$/, '');
+            buffer = buffer.subarray(newline + 1);
             let message;
             try {
                 message = deserializeMessage(line);
@@ -108,7 +133,8 @@ export class StreamTransport {
             return;
         this.reportedClose = true;
         this.closed = true;
-        this.buffer = Buffer.alloc(0);
+        this.pending = [];
+        this.pendingBytes = 0;
         this.onclose?.();
     }
 }

package/dist/upstream/auth.js

@@ -4,7 +4,8 @@ import net from 'node:net';
 import { isPrivateAddress, resolvePublicAddress } from '../auth/address.js';
 import { boundedResponse, guardedRequest } from '../auth/pinned-fetch.js';
 import { logSafe } from '../auth/text.js';
-import { UpstreamAuthProvider, callbackUrl, credentialFingerprint, hubClientMetadata } from './provider.js';
+import { UpstreamAuthProvider, callbackUrl, credentialFingerprint, hubClientMetadata, wellFormedOrUndefined } from './provider.js';
+import { boundedRedirectFetch } from './redirects.js';
 /**
  * Everything the hub needs to authenticate itself to one upstream MCP server.
  *
@@ -69,10 +70,18 @@ export class UpstreamAuth {
     get record() {
         return this.store.getUpstreamCredentials(this.identity.serverName, this.fingerprint);
     }
-    /** The full pair including the refresh token: this class is the only thing
-     *  allowed to spend it, which is why the provider withholds it. */
+    /**
+     * The full pair including the refresh token: this class is the only thing
+     * allowed to spend it, which is why the provider withholds it.
+     *
+     * A stored record may predate `saveTokens()`'s validation, or have been
+     * written by another process — `wellFormedOrUndefined` treats a malformed
+     * one as though nothing were stored, so it can never reach `send()`'s
+     * `headers.set()` below and throw with the token embedded in its own
+     * message.
+     */
     tokens() {
-        return this.record?.tokens;
+        return wellFormedOrUndefined(this.record?.tokens);
     }
     /** The public key the upstream needs, but only when we sign assertions. */
     async publicJwkIfNeeded() {
@@ -228,7 +237,15 @@ export class UpstreamAuth {
         const resource = discovery.resourceMetadata?.resource ? new URL(discovery.resourceMetadata.resource) : undefined;
         if (this.identity.oauth.grant === 'client_credentials') {
             const tokens = await this.fetchClientCredentialsTokens(discovery, clientInformation, resource);
-            this.provider().saveTokens(tokens);
+            try {
+                this.provider().saveTokens(tokens);
+            }
+            catch (error) {
+                // Same failure class as a refused refresh below: a human has to act,
+                // and restarting on a timer would only ask the same broken
+                // authorization server the same question forever.
+                throw new UpstreamLoginRequiredError(this.identity.serverName, error.message);
+            }
             return;
         }
         const refreshToken = this.tokens()?.refresh_token;
@@ -380,6 +397,9 @@ export class UpstreamAuth {
      */
     createFetch() {
         const upstreamOrigin = new URL(this.identity.serverUrl).origin;
+        // Data-plane redirects stay within the upstream's origin, three at most;
+        // the control plane refuses them outright in asFetch.
+        const dataPlane = boundedRedirectFetch(upstreamOrigin);
         return async (input, init) => {
             const url = new URL(input instanceof Request ? input.url : String(input));
             const isControlPlane = url.origin !== upstreamOrigin || url.pathname.startsWith('/.well-known/');
@@ -394,7 +414,7 @@ export class UpstreamAuth {
                     if (!headers.has(key))
                         headers.set(key, value);
                 }
-                return { response: await fetch(url, { ...init, headers }), token };
+                return { response: await dataPlane(url, { ...init, headers }), token };
             };
             const first = await send();
             if (first.response.status !== 401)

package/dist/upstream/provider.js

@@ -78,6 +78,57 @@ export function hubClientMetadata(identity, publicJwk) {
 }
 /** RFC 7523 §2.2: assertions are single-use and short-lived. */
 const ASSERTION_LIFETIME_S = 300;
+/**
+ * The shape every token from an upstream has to fit before the hub stores it:
+ * printable ASCII without whitespace, at most 16 KiB.
+ *
+ * RFC 6749 leaves a token's format to the authorization server, but every real
+ * one issues an opaque printable string. The hub sends it back as a header
+ * value, and `Headers.set()` throws on CR or LF, quoting the value in its
+ * message. Stored anyway, such a token would break every later request to that
+ * server rather than this one, and put the value into whatever error reached a
+ * caller. Past 16 KiB a token is a payload, not an identifier.
+ */
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_PATTERN = /^[\x21-\x7e]+$/;
+function isWellFormedToken(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= MAX_TOKEN_BYTES && TOKEN_PATTERN.test(value);
+}
+/**
+ * Refuses a token pair the upstream cannot have meant, before anything reaches
+ * the state file. Neither the log line nor the thrown message carries the
+ * value: a malformed token can still be somebody's secret.
+ */
+function assertWellFormedTokens(tokens) {
+    const fields = [
+        ['access_token', tokens.access_token],
+        ['refresh_token', tokens.refresh_token]
+    ];
+    for (const [field, value] of fields) {
+        if (field === 'refresh_token' && value === undefined)
+            continue;
+        if (isWellFormedToken(value))
+            continue;
+        const length = typeof value === 'string' ? value.length : 0;
+        console.error(`mcp-hub: rejected a malformed ${field} from an upstream authorization server (${length} characters)`);
+        throw new Error(`upstream returned a malformed ${field}`);
+    }
+}
+/**
+ * A stored token pair, or undefined when it does not pass the same check. A
+ * record may predate the check or come from another process; treating it as
+ * absent means the next request refreshes or asks for a login instead of
+ * building a header that throws.
+ */
+export function wellFormedOrUndefined(tokens) {
+    if (!tokens)
+        return undefined;
+    if (!isWellFormedToken(tokens.access_token))
+        return undefined;
+    if (tokens.refresh_token !== undefined && !isWellFormedToken(tokens.refresh_token))
+        return undefined;
+    return tokens;
+}
 export class UpstreamAuthProvider {
     identity;
     store;
@@ -148,7 +199,9 @@ export class UpstreamAuthProvider {
             ...(typeof information.client_secret === 'string' ? { clientSecret: information.client_secret } : {}),
             // RFC 7592 credentials, when the upstream issued them — what `upstream
             // logout` needs to delete the registration again.
-            ...(typeof information.registration_access_token === 'string'
+            // It goes out as a bearer header later, so it has to fit the same shape
+            // as any other token; a malformed one is dropped rather than stored.
+            ...(isWellFormedToken(information.registration_access_token)
                 ? { registrationAccessToken: information.registration_access_token }
                 : {}),
             ...(typeof information.registration_client_uri === 'string'
@@ -165,7 +218,7 @@ export class UpstreamAuthProvider {
      * the whole family. Refresh belongs to UpstreamAuth, which serializes it.
      */
     tokens() {
-        const stored = this.record?.tokens;
+        const stored = wellFormedOrUndefined(this.record?.tokens);
         if (!stored)
             return undefined;
         const { refresh_token: _withheld, ...rest } = stored;
@@ -173,9 +226,10 @@ export class UpstreamAuthProvider {
     }
     /** The full pair, for the one caller that is allowed to spend it. */
     storedTokens() {
-        return this.record?.tokens;
+        return wellFormedOrUndefined(this.record?.tokens);
     }
     saveTokens(tokens) {
+        assertWellFormedTokens(tokens);
         const expiresIn = typeof tokens.expires_in === 'number' ? tokens.expires_in : undefined;
         this.patch({
             tokens: tokens,