@ractive-ch/tab-mcp 0.2.1 → 0.3.1

package/index.js

@@ -45,6 +45,7 @@ var DEFAULT_CONFIG = {
   host: "0.0.0.0",
   allowedOrigins: [],
   sites: [],
+  identity: "code",
   clientIdHosts: [],
   trustProxy: "none",
   cors: true,
@@ -112,6 +113,7 @@ function resolveConfig(input = {}) {
     }
     seen.add(site.origin);
   }
+  validateIdentity(config);
   config.clientIdHosts = config.clientIdHosts.map((h) => {
     const host = h.trim().toLowerCase();
     if (!/^[a-z0-9.-]+(:\d+)?$/.test(host)) {
@@ -194,13 +196,12 @@ function validateSite(input) {
     out.name = site["name"];
   }
   const pairing = site["pairing"];
-  if (pairing !== undefined && pairing !== "code") {
-    if (pairing === "oidc") {
-      throw new ConfigError(`pairing "oidc" (identity binding) is planned but not available yet: ${out.origin}`);
+  if (pairing !== undefined) {
+    if (pairing !== "code" && pairing !== "oidc") {
+      throw new ConfigError(`pairing must be "code" or "oidc": ${out.origin}`);
     }
-    throw new ConfigError(`pairing must be "code": ${out.origin}`);
+    out.pairing = pairing;
   }
-  out.pairing = "code";
   const limits = site["limits"];
   if (limits !== undefined) {
     if (typeof limits !== "object" || limits === null) {
@@ -224,6 +225,57 @@ function validateSite(input) {
   }
   return out;
 }
+function checkUrl(value, name, development) {
+  if (typeof value !== "string" || value === "") {
+    throw new ConfigError(`${name} is required for identity binding`);
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new ConfigError(`${name} is not a URL: ${value}`);
+  }
+  if (url.protocol !== "https:" && !(development && url.protocol === "http:")) {
+    throw new ConfigError(`${name} must be https: ${value}`);
+  }
+  if (url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "") {
+    throw new ConfigError(`${name} has no query, fragment or credentials: ${value}`);
+  }
+  return value;
+}
+function validateIdentity(config) {
+  if (config.identity !== "code" && config.identity !== "oidc") {
+    throw new ConfigError('identity must be "code" or "oidc"');
+  }
+  const used = config.sites.some((s) => (s.pairing ?? config.identity) === "oidc") || config.identity === "oidc" && config.allowedOrigins !== "*" && config.allowedOrigins.length > 0;
+  if (config.identity === "oidc" && config.allowedOrigins === "*") {
+    throw new ConfigError("TAB_MCP_IDENTITY=oidc cannot be used with TAB_MCP_ALLOWED_ORIGINS=* (one provider cannot vouch for any website's users)");
+  }
+  const oidc = config.oidc;
+  if (oidc === undefined) {
+    if (used) {
+      throw new ConfigError("identity binding (oidc) needs TAB_MCP_OIDC_ISSUER, TAB_MCP_OIDC_CLIENT_ID, TAB_MCP_TAB_ASSERTION_ISSUER and TAB_MCP_TAB_ASSERTION_JWKS_URL");
+    }
+    return;
+  }
+  const dev = config.development;
+  checkUrl(oidc.issuer, "TAB_MCP_OIDC_ISSUER", dev);
+  checkUrl(oidc.assertionJwksUrl, "TAB_MCP_TAB_ASSERTION_JWKS_URL", dev);
+  if (typeof oidc.clientId !== "string" || oidc.clientId === "") {
+    throw new ConfigError("TAB_MCP_OIDC_CLIENT_ID is required for identity binding");
+  }
+  if (oidc.clientSecret !== undefined && typeof oidc.clientSecret !== "string") {
+    throw new ConfigError("TAB_MCP_OIDC_CLIENT_SECRET must be a string");
+  }
+  if (typeof oidc.assertionIssuer !== "string" || oidc.assertionIssuer === "") {
+    throw new ConfigError("TAB_MCP_TAB_ASSERTION_ISSUER is required for identity binding");
+  }
+  const claim = oidc.subjectClaim ?? "sub";
+  if (claim !== "sub" && claim !== "oid") {
+    throw new ConfigError('TAB_MCP_OIDC_SUBJECT_CLAIM must be "sub" or "oid" (a stable identifier, never email or a user name)');
+  }
+  config.oidc = { ...oidc, subjectClaim: claim };
+}
 function defaultLimits(config) {
   return {
     maxMessageBytes: config.maxMessageBytes,
@@ -241,7 +293,7 @@ function siteFor(config, origin) {
   if (configured !== undefined) {
     const site = {
       origin: configured.origin,
-      pairing: configured.pairing ?? "code",
+      pairing: configured.pairing ?? config.identity,
       limits: { ...defaults, ...configured.limits }
     };
     if (configured.name !== undefined)
@@ -251,7 +303,7 @@ function siteFor(config, origin) {
   if (config.allowedOrigins === "*" || origin !== null && config.allowedOrigins.includes(origin)) {
     return {
       origin: config.allowedOrigins === "*" ? "*" : origin ?? "",
-      pairing: "code",
+      pairing: config.allowedOrigins === "*" ? "code" : config.identity,
       limits: defaults
     };
   }
@@ -335,6 +387,30 @@ function configFromEnv(env) {
   if (hosts !== undefined && hosts.trim() !== "") {
     out.clientIdHosts = hosts.split(",").map((h) => h.trim()).filter((h) => h !== "");
   }
+  set("identity", oneOf(env, "TAB_MCP_IDENTITY", ["code", "oidc"]));
+  const oidcVars = {
+    issuer: env["TAB_MCP_OIDC_ISSUER"],
+    clientId: env["TAB_MCP_OIDC_CLIENT_ID"],
+    clientSecret: env["TAB_MCP_OIDC_CLIENT_SECRET"],
+    subjectClaim: env["TAB_MCP_OIDC_SUBJECT_CLAIM"],
+    assertionIssuer: env["TAB_MCP_TAB_ASSERTION_ISSUER"],
+    assertionJwksUrl: env["TAB_MCP_TAB_ASSERTION_JWKS_URL"]
+  };
+  if (Object.values(oidcVars).some((v) => v !== undefined && v !== "")) {
+    const oidc = {
+      issuer: oidcVars.issuer ?? "",
+      clientId: oidcVars.clientId ?? "",
+      assertionIssuer: oidcVars.assertionIssuer ?? "",
+      assertionJwksUrl: oidcVars.assertionJwksUrl ?? ""
+    };
+    if (oidcVars.clientSecret !== undefined && oidcVars.clientSecret !== "") {
+      oidc.clientSecret = oidcVars.clientSecret;
+    }
+    if (oidcVars.subjectClaim !== undefined && oidcVars.subjectClaim !== "") {
+      oidc.subjectClaim = oidcVars.subjectClaim;
+    }
+    out.oidc = oidc;
+  }
   set("trustProxy", oneOf(env, "TAB_MCP_TRUST_PROXY", [
     "none",
     "x-real-ip",
@@ -369,6 +445,385 @@ function configFromEnv(env) {
   ]));
   return out;
 }
+// src/jwt.ts
+var JWT_ALGORITHMS = [
+  "RS256",
+  "RS384",
+  "RS512",
+  "PS256",
+  "PS384",
+  "PS512",
+  "ES256",
+  "ES384",
+  "ES512",
+  "EdDSA"
+];
+var MAX_JWT_BYTES = 8192;
+var MAX_JWKS_BYTES = 65536;
+var JWKS_TTL_MS = 10 * 60000;
+var JWKS_REFETCH_MS = 30000;
+var JWKS_GRACE_MS = 60 * 60000;
+var FETCH_TIMEOUT_MS = 5000;
+
+class JwtError extends Error {
+  name = "JwtError";
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+  }
+}
+function fromBase64Url(part) {
+  if (!/^[A-Za-z0-9_-]*$/.test(part)) {
+    throw new JwtError("malformed", "the token is not base64url");
+  }
+  return Uint8Array.fromBase64(part, { alphabet: "base64url" });
+}
+function jsonPart(part, what) {
+  let value;
+  try {
+    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(fromBase64Url(part)));
+  } catch {
+    throw new JwtError("malformed", `the token's ${what} is not JSON`);
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new JwtError("malformed", `the token's ${what} is not a JSON object`);
+  }
+  return value;
+}
+function decodeJwt(token) {
+  if (typeof token !== "string" || token.length > MAX_JWT_BYTES) {
+    throw new JwtError("too_large", "the token is too large");
+  }
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new JwtError("malformed", "the token is not a signed JWT");
+  }
+  const [h = "", p = "", s = ""] = parts;
+  return {
+    header: jsonPart(h, "header"),
+    payload: jsonPart(p, "payload"),
+    signingInput: new TextEncoder().encode(`${h}.${p}`),
+    signature: fromBase64Url(s)
+  };
+}
+function spec(alg) {
+  const bits = alg.slice(2);
+  const hash = `SHA-${bits}`;
+  switch (alg.slice(0, 2)) {
+    case "RS":
+      return {
+        kty: "RSA",
+        importParams: { name: "RSASSA-PKCS1-v1_5", hash },
+        verifyParams: { name: "RSASSA-PKCS1-v1_5" }
+      };
+    case "PS":
+      return {
+        kty: "RSA",
+        importParams: { name: "RSA-PSS", hash },
+        verifyParams: {
+          name: "RSA-PSS",
+          saltLength: Number(bits) / 8
+        }
+      };
+    case "ES": {
+      const crv = bits === "512" ? "P-521" : `P-${bits}`;
+      return {
+        kty: "EC",
+        crv,
+        importParams: { name: "ECDSA", namedCurve: crv },
+        verifyParams: { name: "ECDSA", hash }
+      };
+    }
+    default:
+      return {
+        kty: "OKP",
+        crv: "Ed25519",
+        importParams: { name: "Ed25519" },
+        verifyParams: { name: "Ed25519" }
+      };
+  }
+}
+function isAlgorithm(v) {
+  return JWT_ALGORITHMS.includes(v);
+}
+function keyFits(jwk, alg) {
+  const s = spec(alg);
+  if (jwk.kty !== s.kty)
+    return false;
+  if (s.crv !== undefined && jwk.crv !== s.crv)
+    return false;
+  if (jwk.use !== undefined && jwk.use !== "sig")
+    return false;
+  if (jwk.alg !== undefined && jwk.alg !== alg)
+    return false;
+  return true;
+}
+function publicJwk(jwk) {
+  const out = { kty: jwk.kty };
+  for (const k of ["n", "e", "crv", "x", "y"]) {
+    const v = jwk[k];
+    if (typeof v === "string")
+      out[k] = v;
+  }
+  return out;
+}
+async function fetchJson(url, init = {}, maxBytes = MAX_JWKS_BYTES) {
+  const res = await fetch(url, {
+    ...init,
+    redirect: "error",
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    headers: { accept: "application/json", ...init.headers ?? {} }
+  });
+  const length = Number(res.headers.get("content-length") ?? "0");
+  if (length > maxBytes)
+    throw new Error(`response too large (${url})`);
+  const chunks = [];
+  let size = 0;
+  const reader = res.body?.getReader();
+  while (reader !== undefined) {
+    const { done, value } = await reader.read();
+    if (done)
+      break;
+    size += value.byteLength;
+    if (size > maxBytes) {
+      await reader.cancel();
+      throw new Error(`response too large (${url})`);
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  const text = new TextDecoder().decode(bytes);
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw new Error(`not JSON (${url}, HTTP ${res.status})`);
+  }
+  if (!res.ok) {
+    const error = value?.["error"];
+    throw new HttpJsonError(res.status, typeof error === "string" ? error : "", url);
+  }
+  return value;
+}
+
+class HttpJsonError extends Error {
+  name = "HttpJsonError";
+  status;
+  error;
+  constructor(status, error, url) {
+    super(`HTTP ${status}${error === "" ? "" : ` ${error}`} (${url})`);
+    this.status = status;
+    this.error = error;
+  }
+}
+
+class JwksCache {
+  #url;
+  #now;
+  #keys = [];
+  #fetchedAt = 0;
+  #attemptedAt = Number.NEGATIVE_INFINITY;
+  #lastError;
+  #inflight;
+  constructor(url, options = {}) {
+    this.#url = typeof url === "string" ? () => Promise.resolve(url) : url;
+    this.#now = options.now ?? Date.now;
+  }
+  async keys(kid) {
+    if (this.#inflight !== undefined)
+      await this.#inflight.catch(() => {});
+    const now = this.#now();
+    const stale = now - this.#fetchedAt >= JWKS_TTL_MS;
+    const unknown = kid !== undefined && !this.#keys.some((k) => k.kid === kid);
+    if ((stale || unknown) && now - this.#attemptedAt >= JWKS_REFETCH_MS) {
+      try {
+        await this.#refresh();
+      } catch (error) {
+        this.#lastError = error instanceof Error ? error : new Error("JWKS");
+      }
+    }
+    if (this.#now() - this.#fetchedAt >= JWKS_TTL_MS + JWKS_GRACE_MS) {
+      throw this.#lastError ?? new Error("the JWKS could not be loaded");
+    }
+    return kid === undefined ? this.#keys : this.#keys.filter((k) => k.kid === kid);
+  }
+  #refresh() {
+    this.#inflight ??= (async () => {
+      this.#attemptedAt = this.#now();
+      try {
+        const doc = await fetchJson(await this.#url());
+        const keys = doc?.keys;
+        if (!Array.isArray(keys))
+          throw new Error("a JWKS needs keys");
+        this.#keys = keys.filter((k) => typeof k === "object" && k !== null);
+        this.#fetchedAt = this.#now();
+        this.#lastError = undefined;
+      } finally {
+        this.#inflight = undefined;
+      }
+    })();
+    return this.#inflight;
+  }
+}
+async function verifyJwt(token, source, options = {}) {
+  const jwt = decodeJwt(token);
+  const { header } = jwt;
+  const alg = header["alg"];
+  const allowed = options.algorithms ?? JWT_ALGORITHMS;
+  if (!isAlgorithm(alg) || !allowed.includes(alg)) {
+    throw new JwtError("alg", `the token's algorithm is not accepted (${String(alg).slice(0, 20)})`);
+  }
+  if (header["crit"] !== undefined) {
+    throw new JwtError("crit", "the token has critical header parameters");
+  }
+  if (options.typ !== undefined && header["typ"] !== options.typ) {
+    throw new JwtError("typ", `the token's type must be ${options.typ}`);
+  }
+  const kid = header["kid"];
+  if (kid !== undefined && typeof kid !== "string") {
+    throw new JwtError("malformed", "the token's kid is not a string");
+  }
+  let candidates;
+  try {
+    candidates = (await source.keys(kid)).filter((k) => keyFits(k, alg));
+  } catch (error) {
+    throw new JwtError("jwks_unavailable", `the signing keys could not be loaded: ${error instanceof Error ? error.message : "unknown"}`);
+  }
+  if (candidates.length === 0 || kid === undefined && candidates.length > 1) {
+    throw new JwtError("key", "no matching signing key");
+  }
+  const s = spec(alg);
+  for (const jwk of candidates) {
+    let key;
+    try {
+      key = await crypto.subtle.importKey("jwk", publicJwk(jwk), s.importParams, false, ["verify"]);
+    } catch {
+      continue;
+    }
+    const ok = await crypto.subtle.verify(s.verifyParams, key, jwt.signature, jwt.signingInput).catch(() => false);
+    if (ok)
+      return jwt;
+  }
+  throw new JwtError("signature", "the token's signature is not valid");
+}
+function numericDate(payload, name) {
+  const v = payload[name];
+  if (v === undefined)
+    return;
+  if (typeof v !== "number" || !Number.isFinite(v)) {
+    throw new JwtError("claims", `${name} must be a number`);
+  }
+  return v * 1000;
+}
+function audiences(payload) {
+  const aud = payload["aud"];
+  if (typeof aud === "string")
+    return [aud];
+  if (Array.isArray(aud) && aud.every((a) => typeof a === "string")) {
+    return aud;
+  }
+  throw new JwtError("claims", "aud is missing");
+}
+
+// src/identity.ts
+var TAB_ASSERTION_TYP = "tab-mcp-identity+jwt";
+var TAB_ASSERTION_MAX_LIFETIME_MS = 60000;
+var CLOCK_LEEWAY_MS = 5000;
+var MAX_SUBJECT = 255;
+var MAX_JTI = 128;
+var MAX_SEEN_JTI = 1e5;
+var MAX_JTI_PER_PERSON = 120;
+var MISMATCH_TEXT = "This AI tool is logged in as someone other than the page.";
+function identityKey(issuer, subject) {
+  return new Bun.CryptoHasher("sha256").update(`${issuer}
+${subject}`).digest().toBase64({ alphabet: "base64url", omitPadding: true });
+}
+
+class TabAssertionVerifier {
+  #oidc;
+  #keys;
+  #seen = new Map;
+  #perPerson = new Map;
+  #sweptAt = Number.NEGATIVE_INFINITY;
+  constructor(oidc, keys) {
+    this.#oidc = oidc;
+    this.#keys = keys ?? new JwksCache(oidc.assertionJwksUrl);
+  }
+  async verify(token, address, now = Date.now()) {
+    const { payload } = await verifyJwt(token, this.#keys, {
+      typ: TAB_ASSERTION_TYP
+    });
+    if (payload["iss"] !== this.#oidc.assertionIssuer) {
+      throw new JwtError("iss", "the assertion's issuer is not the configured one");
+    }
+    const aud = audiences(payload);
+    if (aud.length !== 1 || aud[0] !== address) {
+      throw new JwtError("aud", "the assertion is not for this address");
+    }
+    const exp = numericDate(payload, "exp");
+    if (exp === undefined)
+      throw new JwtError("exp", "the assertion has no exp");
+    if (exp <= now - CLOCK_LEEWAY_MS) {
+      throw new JwtError("expired", "the assertion has expired");
+    }
+    if (exp > now + TAB_ASSERTION_MAX_LIFETIME_MS + CLOCK_LEEWAY_MS) {
+      throw new JwtError("lifetime", "the assertion lives longer than 60 seconds");
+    }
+    const iat = numericDate(payload, "iat");
+    if (iat !== undefined && iat > now + CLOCK_LEEWAY_MS) {
+      throw new JwtError("iat", "the assertion was issued in the future");
+    }
+    const nbf = numericDate(payload, "nbf");
+    if (nbf !== undefined && nbf > now + CLOCK_LEEWAY_MS) {
+      throw new JwtError("nbf", "the assertion is not valid yet");
+    }
+    const sub = payload["sub"];
+    if (typeof sub !== "string" || sub === "" || sub.length > MAX_SUBJECT) {
+      throw new JwtError("sub", "the assertion needs a subject");
+    }
+    const jti = payload["jti"];
+    if (typeof jti !== "string" || jti === "" || jti.length > MAX_JTI) {
+      throw new JwtError("jti", "the assertion needs a jti");
+    }
+    this.#sweep(now);
+    const key = identityKey(this.#oidc.issuer, sub);
+    const seenKey = `${key}
+${jti}`;
+    if (this.#seen.has(seenKey)) {
+      throw new JwtError("replayed", "the assertion was already used");
+    }
+    const mine = this.#perPerson.get(key) ?? 0;
+    if (mine >= MAX_JTI_PER_PERSON || this.#seen.size >= MAX_SEEN_JTI) {
+      throw new JwtError("busy", "too many assertions at once");
+    }
+    this.#seen.set(seenKey, exp + CLOCK_LEEWAY_MS);
+    this.#perPerson.set(key, mine + 1);
+    return key;
+  }
+  #sweep(now) {
+    if (now - this.#sweptAt < 1000 && this.#seen.size < MAX_SEEN_JTI)
+      return;
+    this.#sweptAt = now;
+    for (const [seenKey, until] of this.#seen) {
+      if (until > now)
+        continue;
+      this.#seen.delete(seenKey);
+      const person = seenKey.slice(0, seenKey.indexOf(`
+`));
+      const left = (this.#perPerson.get(person) ?? 1) - 1;
+      if (left > 0)
+        this.#perPerson.set(person, left);
+      else
+        this.#perPerson.delete(person);
+    }
+  }
+}
 // src/ip.ts
 function parseIpv4(ip) {
   const parts = ip.split(".");
@@ -698,7 +1153,19 @@ function parseTabMessage(text) {
     case "pairing.start":
     case "pairing.stop":
     case "grants.revokeAll":
+    case "identity.logout":
       return { ok: true, message: { type } };
+    case "identity": {
+      const assertion = v["assertion"];
+      if (typeof assertion !== "string" || assertion === "" || assertion.length > MAX_JWT_BYTES) {
+        return bad(`identity.assertion must be a JWT of at most ${MAX_JWT_BYTES} bytes`);
+      }
+      const round = v["round"];
+      if (round !== undefined && !(Number.isSafeInteger(round) && round >= 0)) {
+        return bad("identity.round must be a non-negative integer");
+      }
+      return round === undefined ? { ok: true, message: { type, assertion } } : { ok: true, message: { type, assertion, round } };
+    }
     case "grant.revoke": {
       const grantId = v["grantId"];
       if (!isId(grantId))
@@ -724,7 +1191,7 @@ function parseTabMessage(text) {
   }
 }
 // package.json
-var version = "0.2.1";
+var version = "0.3.1";
 
 // src/exchange.ts
 var RelayErrorCode = {
@@ -735,7 +1202,8 @@ var RelayErrorCode = {
   sendFailed: -31005,
   tooLarge: -31006,
   badResponse: -31007,
-  storeUnavailable: -31008
+  storeUnavailable: -31008,
+  signedOut: -31009
 };
 var encoder = new TextEncoder;
 var NULL_BODY_STATUSES = new Set([204, 205, 304]);
@@ -1056,6 +1524,12 @@ function pageName(appName) {
 function notOpenText(appName) {
   return `The page is not open, or not in front. Ask the user to open ${pageName(appName)} and keep it in front (on a phone, in split screen), then try again.`;
 }
+function signedOutText(appName) {
+  return `The page is open, but nobody is signed in to it. Ask the user to sign in to ${pageName(appName)}, then try again.`;
+}
+function phaseText(phase, appName) {
+  return phase === "signed_out" ? signedOutText(appName) : notOpenText(appName);
+}
 function goneDuringCallText(appName) {
   return `The page closed while the tool was running, so it may or may not have finished. Ask the user to open ${pageName(appName)} and keep it in front (on a phone, in split screen), then check the result before trying again.`;
 }
@@ -1065,7 +1539,7 @@ function notOpenAnswer(body, rpcId, appName, phase, relay) {
   const id = rpcId;
   const method = body["method"];
   if (method === "tools/call") {
-    const text = phase === "gone" ? goneDuringCallText(appName) : notOpenText(appName);
+    const text = phase === "gone" ? goneDuringCallText(appName) : phaseText(phase, appName);
     return JSON.stringify({
       jsonrpc: "2.0",
       id,
@@ -1084,7 +1558,7 @@ function notOpenAnswer(body, rpcId, appName, phase, relay) {
         resultType: "complete",
         supportedVersions: [MCP_PROTOCOL_VERSION],
         capabilities: { tools: { listChanged: true } },
-        instructions: notOpenText(appName),
+        instructions: phaseText(phase, appName),
         ttlMs: 0,
         cacheScope: "private",
         _meta: {
@@ -1101,7 +1575,7 @@ function notOpenAnswer(body, rpcId, appName, phase, relay) {
     id,
     error: {
       code: phase === "gone" ? RelayErrorCode.tabGone : RelayErrorCode.pageNotOpen,
-      message: notOpenText(appName)
+      message: phaseText(phase, appName)
     }
   });
 }
@@ -1178,7 +1652,8 @@ async function issueTokenPair(store, grant, options) {
     clientName: grant.clientName,
     scopes: grant.scopes,
     grantCreatedAt: grant.grantCreatedAt,
-    issuedAt: now
+    issuedAt: now,
+    ...grant.subject === undefined ? {} : { subject: grant.subject }
   };
   const accessExpires = Math.min(now + options.accessTtlMs, options.grantEndsAt);
   const refreshStored = await store.put({
@@ -1569,6 +2044,348 @@ ${body}
 </html>`;
 }
 
+// src/oauth/oidc.ts
+var FLOW_TTL_MS = 10 * 60000;
+var MAX_FLOWS = 1e4;
+var METADATA_TTL_MS = 60 * 60000;
+var MAX_TOKEN_RESPONSE_BYTES = 65536;
+
+class OidcError extends Error {
+  name = "OidcError";
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+  }
+}
+function random2(bytes) {
+  return crypto.getRandomValues(new Uint8Array(bytes)).toBase64({ alphabet: "base64url", omitPadding: true });
+}
+function s256(verifier) {
+  return new Bun.CryptoHasher("sha256").update(verifier).digest().toBase64({ alphabet: "base64url", omitPadding: true });
+}
+function str(v) {
+  return typeof v === "string" && v !== "" ? v : undefined;
+}
+function originOf(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return;
+  }
+}
+
+class ProviderDiscovery {
+  #issuer;
+  #development;
+  #metadata;
+  #fetchedAt = 0;
+  #inflight;
+  constructor(issuer, development) {
+    this.#issuer = issuer;
+    this.#development = development;
+  }
+  get cached() {
+    return this.#metadata;
+  }
+  async get() {
+    if (this.#metadata !== undefined && Date.now() - this.#fetchedAt < METADATA_TTL_MS) {
+      return this.#metadata;
+    }
+    this.#inflight ??= this.#load().finally(() => {
+      this.#inflight = undefined;
+    });
+    return this.#inflight;
+  }
+  async#load() {
+    const url = `${this.#issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`;
+    const doc = await fetchJson(url);
+    if (typeof doc !== "object" || doc === null) {
+      throw new OidcError("discovery", "the provider's metadata is not an object");
+    }
+    if (doc["issuer"] !== this.#issuer) {
+      throw new OidcError("discovery_issuer", "the provider's metadata names another issuer");
+    }
+    const endpoint = (name) => {
+      const v = str(doc[name]);
+      const ok = v !== undefined && (v.startsWith("https://") || this.#development && v.startsWith("http://"));
+      if (!ok) {
+        throw new OidcError("discovery", `the provider's metadata lacks ${name}`);
+      }
+      return v;
+    };
+    const methods = doc["token_endpoint_auth_methods_supported"];
+    const tokenAuth = Array.isArray(methods) && !methods.includes("client_secret_basic") && methods.includes("client_secret_post") ? "client_secret_post" : "client_secret_basic";
+    const metadata = {
+      issuer: this.#issuer,
+      authorizationEndpoint: endpoint("authorization_endpoint"),
+      tokenEndpoint: endpoint("token_endpoint"),
+      jwksUri: endpoint("jwks_uri"),
+      tokenAuth
+    };
+    this.#metadata = metadata;
+    this.#fetchedAt = Date.now();
+    return metadata;
+  }
+}
+
+class OidcPairing {
+  kind = "oidc";
+  #config;
+  #publicUrl;
+  #logger;
+  #discovery;
+  #jwks;
+  #flows = new Map;
+  #mismatched = new Set;
+  constructor(options) {
+    this.#config = options.config;
+    this.#publicUrl = options.publicUrl;
+    this.#logger = options.logger;
+    this.#discovery = new ProviderDiscovery(options.config.issuer, options.development);
+    this.#jwks = new JwksCache(async () => (await this.#discovery.get()).jwksUri);
+  }
+  get #providerHost() {
+    try {
+      return new URL(this.#config.issuer).host;
+    } catch {
+      return this.#config.issuer;
+    }
+  }
+  get callbackUrl() {
+    return `${this.#publicUrl()}/authorize/callback`;
+  }
+  async prepare() {
+    await this.#discovery.get();
+  }
+  formTargets() {
+    const out = new Set;
+    const issuer = originOf(this.#config.issuer);
+    if (issuer !== undefined)
+      out.add(issuer);
+    const auth = this.#discovery.cached?.authorizationEndpoint;
+    const origin = auth === undefined ? undefined : originOf(auth);
+    if (origin !== undefined)
+      out.add(origin);
+    return [...out];
+  }
+  render(target) {
+    const host = escapeHtml(this.#providerHost);
+    if (target.identity === undefined) {
+      return `<p class="help">Nobody is signed in to the page. Sign in there first, then click Connect.</p>`;
+    }
+    return `<p>When you click Connect, sign in at <strong>${host}</strong> with the account you use in the page. No code is needed.</p>`;
+  }
+  async check(target, _form, _admit, context) {
+    if (!target.pairingOpen) {
+      return {
+        ok: false,
+        message: "The page is not connecting right now. In the page, open \u201CConnect your AI app\u201D, then click Connect here again.",
+        reason: "inactive"
+      };
+    }
+    if (target.identity === undefined) {
+      return {
+        ok: false,
+        message: "Nobody is signed in to the page. Sign in there first, then click Connect here again.",
+        reason: "signed_out"
+      };
+    }
+    if (context === undefined) {
+      return { ok: false, message: "Something went wrong.", reason: "context" };
+    }
+    let metadata;
+    try {
+      metadata = await this.#discovery.get();
+    } catch (error) {
+      return this.#unavailable(error);
+    }
+    this.#sweep();
+    if (this.#flows.size >= MAX_FLOWS) {
+      return {
+        ok: false,
+        message: "Too many sign-ins are open right now. Wait a few minutes and try again.",
+        reason: "busy"
+      };
+    }
+    const state = random2(24);
+    const nonce = random2(24);
+    const verifier = random2(32);
+    this.#flows.set(state, {
+      requestId: context.requestId,
+      browserId: context.browserId,
+      nonce,
+      verifier,
+      expiresAt: Date.now() + FLOW_TTL_MS
+    });
+    const url = new URL(metadata.authorizationEndpoint);
+    const params = {
+      response_type: "code",
+      client_id: this.#config.clientId,
+      redirect_uri: this.callbackUrl,
+      scope: "openid",
+      state,
+      nonce,
+      code_challenge: s256(verifier),
+      code_challenge_method: "S256"
+    };
+    if (this.#mismatched.has(context.requestId))
+      params["prompt"] = "login";
+    for (const [k, v] of Object.entries(params))
+      url.searchParams.set(k, v);
+    return { ok: "redirect", location: url.href };
+  }
+  async callback(params, browserId, targetFor) {
+    this.#sweep();
+    const state = params.get("state") ?? "";
+    const flow = this.#flows.get(state);
+    if (flow === undefined || flow.expiresAt <= Date.now()) {
+      return {
+        result: {
+          ok: false,
+          message: "This sign-in has expired or was already used. Start again from your AI app.",
+          reason: "unknown_state"
+        }
+      };
+    }
+    this.#flows.delete(state);
+    const requestId = flow.requestId;
+    const fail = (reason, message) => ({
+      requestId,
+      result: { ok: false, message, reason }
+    });
+    if (flow.browserId !== browserId) {
+      return fail("browser", "This sign-in was started in another browser. Start again from your AI app.");
+    }
+    const iss = params.get("iss");
+    if (iss !== null && iss !== this.#config.issuer) {
+      return fail("iss", "The sign-in came back from an unexpected provider.");
+    }
+    const error = params.get("error");
+    if (error !== null) {
+      this.#logger.info("oidc.provider_error", { error: error.slice(0, 64) });
+      return fail(`provider_${error.slice(0, 32)}`, `The sign-in at ${this.#providerHost} did not finish. Click Connect to try again.`);
+    }
+    const code = params.get("code");
+    if (code === null || code === "") {
+      return fail("no_code", "The provider sent no sign-in result. Click Connect to try again.");
+    }
+    let subject;
+    try {
+      subject = await this.#signIn(code, flow);
+    } catch (e) {
+      const reason = e instanceof OidcError || e instanceof JwtError ? e.reason : "exchange";
+      this.#logger.warn("oidc.sign_in_failed", {
+        reason,
+        message: e instanceof Error ? e.message.slice(0, 200) : "unknown"
+      });
+      return fail(reason, `The sign-in at ${this.#providerHost} could not be checked. Click Connect to try again.`);
+    }
+    const target = targetFor(requestId);
+    if (target === undefined) {
+      return fail("page_closed", "The page is not open any more. Open it and try again.");
+    }
+    if (target.identity === undefined) {
+      return fail("signed_out", "Nobody is signed in to the page any more. Sign in there first, then click Connect here again.");
+    }
+    const key = identityKey(this.#config.issuer, subject);
+    if (key !== target.identity) {
+      this.#mismatched.add(requestId);
+      if (this.#mismatched.size > MAX_FLOWS) {
+        const oldest = this.#mismatched.values().next().value;
+        if (oldest !== undefined)
+          this.#mismatched.delete(oldest);
+      }
+      return fail("mismatch", `${MISMATCH_TEXT} Click Connect to sign in with the page's account, or Cancel.`);
+    }
+    this.#mismatched.delete(requestId);
+    return { requestId, result: { ok: true, subject: key } };
+  }
+  async#signIn(code, flow) {
+    const metadata = await this.#discovery.get();
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: this.callbackUrl,
+      code_verifier: flow.verifier
+    });
+    const headers = {
+      "content-type": "application/x-www-form-urlencoded"
+    };
+    const secret = this.#config.clientSecret;
+    if (secret !== undefined && metadata.tokenAuth === "client_secret_basic") {
+      const enc = (v) => encodeURIComponent(v).replace(/%20/g, "+");
+      headers["authorization"] = `Basic ${btoa(`${enc(this.#config.clientId)}:${enc(secret)}`)}`;
+    } else {
+      body.set("client_id", this.#config.clientId);
+      if (secret !== undefined)
+        body.set("client_secret", secret);
+    }
+    let response;
+    try {
+      response = await fetchJson(metadata.tokenEndpoint, { method: "POST", headers, body }, MAX_TOKEN_RESPONSE_BYTES);
+    } catch (e) {
+      if (e instanceof HttpJsonError) {
+        throw new OidcError(`token_${e.error || e.status}`, e.message);
+      }
+      throw e;
+    }
+    const idToken = str(response?.["id_token"]);
+    if (idToken === undefined) {
+      throw new OidcError("no_id_token", "the token response has no id_token");
+    }
+    const { payload } = await verifyJwt(idToken, this.#jwks);
+    const now = Date.now();
+    if (payload["iss"] !== metadata.issuer) {
+      throw new OidcError("id_token_iss", "the ID token's issuer is wrong");
+    }
+    const aud = audiences(payload);
+    if (!aud.includes(this.#config.clientId)) {
+      throw new OidcError("id_token_aud", "the ID token is not for this relay");
+    }
+    const azp = payload["azp"];
+    if ((aud.length > 1 || azp !== undefined) && azp !== this.#config.clientId) {
+      throw new OidcError("id_token_azp", "the ID token's azp is not this relay");
+    }
+    const exp = numericDate(payload, "exp");
+    if (exp === undefined || exp <= now - CLOCK_LEEWAY_MS) {
+      throw new OidcError("id_token_exp", "the ID token has expired");
+    }
+    const iat = numericDate(payload, "iat");
+    if (iat === undefined || iat > now + CLOCK_LEEWAY_MS) {
+      throw new OidcError("id_token_iat", "the ID token's iat is missing or in the future");
+    }
+    if (payload["nonce"] !== flow.nonce) {
+      throw new OidcError("id_token_nonce", "the ID token's nonce does not match");
+    }
+    const claim = this.#config.subjectClaim ?? "sub";
+    const subject = payload[claim];
+    if (typeof subject !== "string" || subject === "" || subject.length > 255) {
+      throw new OidcError("id_token_subject", `the ID token has no ${claim}`);
+    }
+    return subject;
+  }
+  #unavailable(error) {
+    this.#logger.warn("oidc.discovery_failed", {
+      reason: error instanceof OidcError ? error.reason : "fetch",
+      message: error instanceof Error ? error.message.slice(0, 200) : "unknown"
+    });
+    return {
+      ok: false,
+      message: `The sign-in provider ${this.#providerHost} cannot be reached right now. Try again in a minute.`,
+      reason: "provider_unavailable"
+    };
+  }
+  #sweep() {
+    const now = Date.now();
+    for (const [state, flow] of this.#flows) {
+      if (flow.expiresAt > now)
+        break;
+      this.#flows.delete(state);
+    }
+  }
+}
+
 // src/oauth/pairing.ts
 import { timingSafeEqual } from "crypto";
 var PAIRING_CODE_TTL_MS = 120000;
@@ -1720,7 +2537,7 @@ function constantTimeEqual(a, b) {
   const y = Buffer.from(b);
   return x.length === y.length && timingSafeEqual2(x, y);
 }
-function s256(verifier) {
+function s2562(verifier) {
   return new Bun.CryptoHasher("sha256").update(verifier).digest().toBase64({ alphabet: "base64url", omitPadding: true });
 }
 var VERIFIER = /^[A-Za-z0-9\-._~]{43,128}$/;
@@ -1735,7 +2552,7 @@ function single(params, names) {
   }
   return out;
 }
-function random2(bytes) {
+function random3(bytes) {
   return crypto.getRandomValues(new Uint8Array(bytes)).toBase64({ alphabet: "base64url", omitPadding: true });
 }
 function formTarget(redirectUri) {
@@ -1764,7 +2581,7 @@ class AuthorizationServer {
   #codes = new Map;
   #authCodeTtlMs;
   #methods;
-  #csrfSecret = random2(32);
+  #csrfSecret = random3(32);
   #viewsPerIp = new RateLimiter({
     capacity: 30,
     refillPerSecond: 0.5
@@ -1785,7 +2602,19 @@ class AuthorizationServer {
   constructor(host, testMode) {
     this.#host = host;
     this.#authCodeTtlMs = testMode?.authCodeTtlMs ?? AUTH_CODE_TTL_MS;
-    this.#methods = testMode?.pairingMethods ?? PAIRING_METHODS;
+    const oidc = host.config.oidc;
+    this.#methods = {
+      ...PAIRING_METHODS,
+      ...oidc === undefined ? {} : {
+        oidc: new OidcPairing({
+          config: oidc,
+          publicUrl: () => host.publicUrl(),
+          logger: host.logger,
+          development: host.config.development
+        })
+      },
+      ...testMode?.pairingMethods
+    };
     this.#cimd = new ClientMetadataFetcher({
       allowedHosts: host.config.clientIdHosts,
       logger: host.logger,
@@ -1996,12 +2825,23 @@ class AuthorizationServer {
     if (this.#host.session(addressId) === undefined) {
       return this.#offlinePage(client, `/authorize${new URL(req.url).search}`, this.#errorUrl(redirectUri, state, "access_denied", "the user cancelled the connection"));
     }
+    const method = this.#methods[this.#host.session(addressId)?.site.pairing ?? "code"];
+    if (method?.prepare !== undefined) {
+      try {
+        await method.prepare();
+      } catch (error) {
+        this.#host.logger.warn("oidc.discovery_failed", {
+          message: error instanceof Error ? error.message.slice(0, 200) : "unknown"
+        });
+        return this.#errorPage(503, "The sign-in provider of this page cannot be reached right now. Wait a minute and try again.");
+      }
+    }
     this.#sweepPending();
     if (this.#pending.size >= MAX_PENDING || (this.#pendingPerIp.get(ip) ?? 0) >= MAX_PENDING_PER_IP || (this.#pendingPerAddress.get(addressId) ?? 0) >= MAX_PENDING_PER_ADDRESS) {
       return this.#errorPage(429, "Too many connection requests are open right now. Wait a few minutes and try again.");
     }
     const pending = {
-      id: random2(24),
+      id: random3(24),
       expiresAt: Date.now() + PENDING_TTL_MS,
       ip,
       client,
@@ -2098,7 +2938,25 @@ ${errorHtml}
       return this.#errorPage(500, "This page's pairing method is not available.");
     }
     const admit = () => this.#guessesPerAddressIp.take(`${pending.addressId}|${ip}`) && this.#guessesPerAddress.take(pending.addressId);
-    const result = await method.check(session, form, admit);
+    const result = await method.check(session, form, admit, {
+      requestId: pending.id,
+      browserId: browser.id
+    });
+    if (result.ok === "redirect") {
+      this.#host.logger.info("oauth.pairing_redirect", {
+        address: shortAddress(pending.addressId),
+        client: pending.client.host,
+        method: method.kind
+      });
+      return new Response(null, {
+        status: 303,
+        headers: {
+          location: result.location,
+          "cache-control": "no-store",
+          "referrer-policy": "no-referrer"
+        }
+      });
+    }
     if (!result.ok) {
       this.#host.logger.info("oauth.pairing_failed", {
         address: shortAddress(pending.addressId),
@@ -2107,20 +2965,24 @@ ${errorHtml}
       });
       return this.#pairingPage(pending, browser.id, result.message, result.reason === "rate_limited" ? 429 : 400);
     }
+    return this.#paired(pending, method.kind, result);
+  }
+  #paired(pending, kind, result) {
     this.#dropPending(pending);
-    const code = random2(32);
+    const code = random3(32);
     if (this.#codes.size >= MAX_CODES)
       this.#sweepCodes(true);
     const { id: _id, expiresAt: _expires, ip: _ip, ...request } = pending;
     this.#codes.set(hashToken(code), {
       ...request,
       expiresAt: Date.now() + this.#authCodeTtlMs,
-      used: false
+      used: false,
+      ...result.subject === undefined ? {} : { subject: result.subject }
     });
     this.#host.logger.info("oauth.paired", {
       address: shortAddress(pending.addressId),
       client: pending.client.host,
-      method: method.kind
+      method: kind
     });
     return this.#redirect(pending.redirectUri, {
       code,
@@ -2128,6 +2990,40 @@ ${errorHtml}
       iss: this.#issuer
     });
   }
+  async authorizeCallback(req, ip) {
+    if (!this.#viewsPerIp.take(ip)) {
+      return this.#errorPage(429, "Too many requests from your network. Wait a minute and try again.");
+    }
+    const method = this.#methods.oidc;
+    if (method?.callback === undefined) {
+      return new Response("Not found", { status: 404 });
+    }
+    const browser = this.#browserId(req);
+    if (browser.cookie !== undefined) {
+      return this.#errorPage(403, "The sign-in could not be checked. Your browser may block cookies for this site; start again from your AI app.");
+    }
+    this.#sweepPending();
+    const params = new URL(req.url).searchParams;
+    const { requestId, result } = await method.callback(params, browser.id, (id) => {
+      const p = this.#pending.get(id);
+      return p === undefined ? undefined : this.#host.session(p.addressId);
+    });
+    const pending = requestId === undefined ? undefined : this.#pending.get(requestId);
+    if (pending === undefined || pending.expiresAt <= Date.now()) {
+      const message = result.ok === false ? result.message : "This connection request has expired or was already used.";
+      return this.#errorPage(400, message);
+    }
+    if (result.ok === true)
+      return this.#paired(pending, method.kind, result);
+    const message = result.ok === false ? result.message : "Something went wrong.";
+    const reason = result.ok === false ? result.reason : "unexpected";
+    this.#host.logger.info("oauth.pairing_failed", {
+      address: shortAddress(pending.addressId),
+      client: pending.client.host,
+      reason
+    });
+    return this.#pairingPage(pending, browser.id, message, reason === "mismatch" ? 403 : 400);
+  }
   #addressOf(resource) {
     if (resource === undefined)
       return;
@@ -2155,7 +3051,7 @@ ${errorHtml}
         return { id: v };
       }
     }
-    const id = random2(16);
+    const id = random3(16);
     const secure = this.#issuer.startsWith("https:") ? "; Secure" : "";
     return {
       id,
@@ -2206,6 +3102,7 @@ ${cancel}
     if (method === undefined) {
       return this.#errorPage(500, "This page's pairing method is not available.");
     }
+    targets.push(...method.formTargets?.() ?? []);
     const page = session.origin === "" ? "a page that did not say where it runs" : `<span class="origin">${escapeHtml(session.origin)}</span>`;
     const target = session.appName === undefined ? `tools from ${page}` : `<strong>${escapeHtml(session.appName)}</strong> on ${page}`;
     const heading = `Connect ${client.name} from ${client.host}`;
@@ -2328,9 +3225,12 @@ ${cancel}
     if (p["resource"] !== undefined && p["resource"] !== issued.resource) {
       throw new OAuthError(400, "invalid_target", "resource does not match the authorization request");
     }
-    if (!VERIFIER.test(verifier) || !constantTimeEqual(s256(verifier), issued.codeChallenge)) {
+    if (!VERIFIER.test(verifier) || !constantTimeEqual(s2562(verifier), issued.codeChallenge)) {
       throw invalid("code_verifier does not match the code_challenge");
     }
+    if (issued.subject !== undefined && this.#host.session(issued.addressId)?.identity !== issued.subject) {
+      throw invalid("the page's user signed out or changed");
+    }
     const now = Date.now();
     const grantId = newId("g");
     issued.grantId = grantId;
@@ -2341,7 +3241,8 @@ ${cancel}
       clientId: issued.client.clientId,
       clientName: issued.client.name,
       scopes: issued.scopes,
-      grantCreatedAt: now
+      grantCreatedAt: now,
+      ...issued.subject === undefined ? {} : { subject: issued.subject }
     }, {
       accessTtlMs: config.accessTokenTtlMs,
       refreshTtlMs: config.refreshTokenTtlMs,
@@ -2416,7 +3317,8 @@ ${cancel}
       clientId: record.clientId,
       clientName: record.clientName,
       scopes: record.scopes,
-      grantCreatedAt: record.grantCreatedAt
+      grantCreatedAt: record.grantCreatedAt,
+      ...record.subject === undefined ? {} : { subject: record.subject }
     }, {
       accessTtlMs: this.#host.config.accessTokenTtlMs,
       refreshTtlMs: this.#host.config.refreshTokenTtlMs,
@@ -2552,10 +3454,13 @@ class TabSession {
   addressId;
   appName;
   codes;
+  identity;
   pending = new Map;
   #ws;
   #host;
   #state = "new";
+  #dialogOpen = false;
+  #identityChain = Promise.resolve();
   #lastRequestAt = Date.now();
   #missedPongs = 0;
   #nextRequest = 0;
@@ -2584,6 +3489,9 @@ class TabSession {
   get ready() {
     return this.#state === "ready";
   }
+  get pairingOpen() {
+    return this.site.pairing === "code" ? this.codes.active : this.#dialogOpen;
+  }
   get limits() {
     return this.site.limits;
   }
@@ -2672,9 +3580,18 @@ class TabSession {
       case "pairing.start":
         if (this.site.pairing === "code")
           this.codes.start();
+        else
+          this.#dialogOpen = true;
         return;
       case "pairing.stop":
         this.codes.stop();
+        this.#dialogOpen = false;
+        return;
+      case "identity":
+        await this.#serialIdentity(() => this.#host.bindIdentity(this, msg.assertion, msg.round));
+        return;
+      case "identity.logout":
+        await this.#serialIdentity(() => this.#host.signOut(this));
         return;
       case "grant.revoke":
         if (!await this.#host.revokeGrant(this, msg.grantId)) {
@@ -2754,6 +3671,7 @@ class TabSession {
       address: `${this.#host.publicUrl()}/a/${this.addressId}/mcp`,
       origin: this.origin,
       ...this.appName === undefined ? {} : { appName: this.appName },
+      pairing: this.site.pairing,
       expiresAt: new Date(expiresAt).toISOString(),
       limits: limitsOf(limits),
       grants
@@ -2773,6 +3691,11 @@ class TabSession {
     });
     this.#host.ready?.(this);
   }
+  #serialIdentity(run) {
+    const next = this.#identityChain.then(run);
+    this.#identityChain = next.catch(() => {});
+    return next;
+  }
   #tick() {
     if (this.#state !== "ready")
       return;
@@ -2847,6 +3770,7 @@ class TabSession {
     const wasReady = this.#state === "ready" || this.#state === "hello";
     this.#state = "ended";
     this.codes.stop();
+    this.#dialogOpen = false;
     clearTimeout(this.#helloTimer);
     clearInterval(this.#heartbeatTimer);
     clearTimeout(this.#lifetimeTimer);
@@ -2886,13 +3810,16 @@ function summarizeGrants(records, now) {
   for (const r of records) {
     if (!isLive(r, now) || grants.has(r.grantId))
       continue;
-    grants.set(r.grantId, {
+    const summary = {
       grantId: r.grantId,
       clientId: r.clientId,
       clientName: r.clientName,
       scopes: [...r.scopes],
       createdAt: r.grantCreatedAt
-    });
+    };
+    if (r.subject !== undefined)
+      summary.subject = r.subject;
+    grants.set(r.grantId, summary);
   }
   return [...grants.values()].sort((a, b) => a.createdAt - b.createdAt || a.grantId.localeCompare(b.grantId));
 }
@@ -2972,7 +3899,7 @@ class MemoryTokenStore {
 
 // src/store/sqlite.ts
 import { Database } from "bun:sqlite";
-var SCHEMA_VERSION = 2;
+var SCHEMA_VERSION = 3;
 function toRecord(row) {
   const record = {
     hash: row.hash,
@@ -2988,6 +3915,8 @@ function toRecord(row) {
   };
   if (row.used_at !== null)
     record.usedAt = row.used_at;
+  if (row.subject !== null)
+    record.subject = row.subject;
   return record;
 }
 
@@ -3023,8 +3952,13 @@ class SqliteTokenStore {
 				grant_created_at INTEGER NOT NULL,
 				issued_at INTEGER NOT NULL,
 				expires_at INTEGER NOT NULL,
-				used_at INTEGER
+				used_at INTEGER,
+				subject TEXT
 			) STRICT`);
+      const columns = this.#db.query("PRAGMA table_info(tokens)").all();
+      if (!columns.some((c) => c.name === "subject")) {
+        this.#db.run("ALTER TABLE tokens ADD COLUMN subject TEXT");
+      }
       this.#db.run("CREATE INDEX IF NOT EXISTS tokens_grant ON tokens (grant_id)");
       this.#db.run("CREATE INDEX IF NOT EXISTS tokens_address ON tokens (address_id)");
       this.#db.run("CREATE INDEX IF NOT EXISTS tokens_expires ON tokens (expires_at)");
@@ -3047,9 +3981,9 @@ class SqliteTokenStore {
   }
   #insert(r) {
     this.#db.query(`INSERT OR REPLACE INTO tokens (hash, kind, grant_id, address_id, client_id,
-				client_name, scopes, grant_created_at, issued_at, expires_at, used_at)
+				client_name, scopes, grant_created_at, issued_at, expires_at, used_at, subject)
 				VALUES ($hash, $kind, $grant_id, $address_id, $client_id, $client_name,
-				$scopes, $grant_created_at, $issued_at, $expires_at, $used_at)`).run({
+				$scopes, $grant_created_at, $issued_at, $expires_at, $used_at, $subject)`).run({
       hash: r.hash,
       kind: r.kind,
       grant_id: r.grantId,
@@ -3060,7 +3994,8 @@ class SqliteTokenStore {
       grant_created_at: r.grantCreatedAt,
       issued_at: r.issuedAt,
       expires_at: r.expiresAt,
-      used_at: r.usedAt ?? null
+      used_at: r.usedAt ?? null,
+      subject: r.subject ?? null
     });
   }
   async get(hash) {
@@ -3171,6 +4106,7 @@ function startRelay(options, hooks) {
   const appNames = new Map;
   let claudeWorkarounds = 0;
   let publicUrl = config.publicUrl ?? "";
+  const assertions = config.oidc === undefined ? undefined : new TabAssertionVerifier(config.oidc, hooks?.assertionKeys);
   const corsHeaders = config.cors ? {
     "access-control-allow-origin": "*",
     "access-control-expose-headers": "www-authenticate, mcp-protocol-version"
@@ -3218,6 +4154,105 @@ function startRelay(options, hooks) {
       for (const g of grants)
         grantRemoved(addressId, g.grantId, "revoked");
     },
+    async bindIdentity(session, assertion, round) {
+      const addressId = session.addressId;
+      if (addressId === undefined)
+        return;
+      const echo = round === undefined ? {} : { round };
+      const answer = (message) => {
+        if (!session.send(message)) {
+          logger.warn("identity.answer_dropped", {
+            address: shortAddress(addressId),
+            type: message.type
+          });
+        }
+      };
+      const refuse = (reason, message) => {
+        if (session.identity !== undefined) {
+          session.identity = undefined;
+          failPending(session, "The page's user is no longer signed in.");
+        }
+        logger.info("identity.refused", {
+          address: shortAddress(addressId),
+          reason
+        });
+        answer({ type: "error", code: "identity_refused", message, ...echo });
+      };
+      if (session.site.pairing !== "oidc" || assertions === undefined) {
+        refuse("not_oidc", "this page's site does not use identity binding");
+        return;
+      }
+      let key;
+      try {
+        key = await assertions.verify(assertion, `${publicUrl}/a/${addressId}/mcp`);
+      } catch (error) {
+        refuse(error instanceof JwtError ? error.reason : "error", `the identity assertion was refused: ${error instanceof JwtError ? error.message : "the relay could not check it"}`);
+        return;
+      }
+      if (!session.ready)
+        return;
+      const changed = session.identity !== key;
+      if (changed && session.identity !== undefined) {
+        session.identity = undefined;
+        failPending(session, "The page's user changed.");
+      }
+      let revoked = 0;
+      try {
+        const grants = await store.listGrants(addressId, Date.now());
+        for (const g of grants.filter((g) => g.subject !== key)) {
+          await store.revoke({ grantId: g.grantId }, revokeOptions());
+          grantRemoved(addressId, g.grantId, "revoked");
+          revoked++;
+        }
+      } catch (error) {
+        logger.error("store.error", {
+          op: "identity",
+          message: error instanceof Error ? error.message : "unknown"
+        });
+        refuse("store_unavailable", "the relay cannot check grants right now");
+        return;
+      }
+      if (!session.ready)
+        return;
+      session.identity = key;
+      answer({ type: "identity.bound", ...echo });
+      logger.info("identity.bound", {
+        address: shortAddress(addressId),
+        changed,
+        revoked
+      });
+      host.ready(session);
+    },
+    async signOut(session) {
+      const addressId = session.addressId;
+      if (addressId === undefined)
+        return;
+      if (session.site.pairing !== "oidc") {
+        session.send({
+          type: "error",
+          code: "identity_refused",
+          message: "this page's site does not use identity binding"
+        });
+        return;
+      }
+      session.identity = undefined;
+      failPending(session, "The page's user signed out.");
+      try {
+        const grants = await store.listGrants(addressId, Date.now());
+        await store.revoke({ addressId }, revokeOptions());
+        logger.info("identity.signed_out", {
+          address: shortAddress(addressId),
+          grants: grants.length
+        });
+        for (const g of grants)
+          grantRemoved(addressId, g.grantId, "revoked");
+      } catch (error) {
+        logger.error("store.error", {
+          op: "signOut",
+          message: error instanceof Error ? error.message : "unknown"
+        });
+      }
+    },
     claimAddress(session) {
       const id = session.addressId;
       if (id === undefined)
@@ -3252,12 +4287,20 @@ function startRelay(options, hooks) {
           wake(session);
     }
   };
-  function readySession(addressId) {
+  function failPending(session, message) {
+    for (const exchange of [...session.pending.values()]) {
+      exchange.fail(401, RelayErrorCode.signedOut, message, true);
+    }
+  }
+  function readySession(addressId, usable = () => true) {
     const s = sessions.get(addressId);
-    return s?.ready === true ? s : undefined;
+    return s?.ready === true && usable(s) ? s : undefined;
+  }
+  function usableFor(subject) {
+    return (s) => subject === undefined && s.site.pairing === "code" || s.identity !== undefined;
   }
-  function waitForPage(addressId, signal, waitMs) {
-    const now = readySession(addressId);
+  function waitForPage(addressId, signal, waitMs, usable) {
+    const now = readySession(addressId, usable);
     if (now !== undefined)
       return Promise.resolve(now);
     if (waitMs === 0 || stopping !== undefined) {
@@ -3283,7 +4326,10 @@ function startRelay(options, hooks) {
         }
         resolve(result);
       };
-      const wake = (session) => done(session);
+      const wake = (session) => {
+        if (session === undefined || usable(session))
+          done(session);
+      };
       const onAbort = () => done("aborted");
       set.add(wake);
       waiters.set(addressId, set);
@@ -3441,7 +4487,7 @@ function startRelay(options, hooks) {
   }
   function checkVersion(req, body, rpcId) {
     const header = req.headers.get("mcp-protocol-version");
-    if (body["method"] === "initialize") {
+    if (body["method"] === "initialize" && !(header === MCP_PROTOCOL_VERSION && metaVersion(body) === MCP_PROTOCOL_VERSION)) {
       const params = body["params"];
       const requested = typeof params?.["protocolVersion"] === "string" ? params["protocolVersion"] : header ?? null;
       return rpcError(400, rpcId, -32022, `Unsupported protocol version: ${String(requested)}. This server supports only ${MCP_PROTOCOL_VERSION}.`, corsHeaders, { supported: [MCP_PROTOCOL_VERSION], requested });
@@ -3517,18 +4563,26 @@ function startRelay(options, hooks) {
       logDone(499, method, { outcome: "client_closed" });
       return new Response(null, { status: 499 });
     };
-    if (readySession(addressId) === undefined && waitMs > 0) {
+    const usable = usableFor(auth.subject);
+    if (readySession(addressId, usable) === undefined && waitMs > 0) {
       server.timeout(req, 0);
     }
     let retried = false;
     for (;; ) {
-      const found = await waitForPage(addressId, req.signal, waitMs);
+      const found = await waitForPage(addressId, req.signal, waitMs, usable);
       if (found === "aborted" || req.signal.aborted)
         return closed();
       if (found === undefined) {
         return pageNotOpen(body.value, rpcId, addressId, logDone, method);
       }
       const session = found;
+      if ((auth.subject !== undefined || session.site.pairing === "oidc") && session.identity !== auth.subject) {
+        logDone(401, method, { reason: "identity_mismatch" });
+        return json(401, { error: "invalid_token", error_description: MISMATCH_TEXT }, {
+          ...corsHeaders,
+          "www-authenticate": `${wwwAuthenticate(addressId, true)}, error_description="${MISMATCH_TEXT}"`
+        });
+      }
       if (Buffer.byteLength(body.text) > session.limits.maxMessageBytes) {
         logDone(413, method);
         return rpcError(413, rpcId, -32600, "Request body too large.", corsHeaders);
@@ -3584,7 +4638,9 @@ function startRelay(options, hooks) {
     }
   }
   function pageNotOpen(value, rpcId, addressId, logDone, method) {
-    const answer = notOpenAnswer(value, rpcId, appNames.get(addressId), "not_open", RELAY_INFO);
+    const open = sessions.get(addressId);
+    const phase = open?.ready === true && open.identity === undefined && open.site.pairing === "oidc" ? "signed_out" : "not_open";
+    const answer = notOpenAnswer(value, rpcId, open?.appName ?? appNames.get(addressId), phase, RELAY_INFO);
     if (answer === undefined) {
       logDone(503, method, { reason: "page_not_open" });
       return rpcError(503, rpcId, RelayErrorCode.pageNotOpen, "The page is not open.", corsHeaders);
@@ -3653,6 +4709,9 @@ function startRelay(options, hooks) {
         GET: (req, srv) => auth.authorize(req, ipOf(req, srv)),
         POST: (req, srv) => auth.authorizeSubmit(req, ipOf(req, srv))
       },
+      "/authorize/callback": {
+        GET: (req, srv) => auth.authorizeCallback(req, ipOf(req, srv))
+      },
       "/authorize.css": { GET: () => auth.stylesheet() },
       "/token": {
         POST: (req, srv) => auth.token(req, ipOf(req, srv)),
@@ -3765,6 +4824,7 @@ export {
   MemoryTokenStore,
   SUBPROTOCOL,
   SqliteTokenStore,
+  TAB_ASSERTION_TYP,
   VERSION,
   addressIdFromSecret,
   configFromEnv,
@@ -3774,5 +4834,5 @@ export {
   resolveConfig
 };
 
-//# debugId=819DDD907387E9BC64756E2164756E21
+//# debugId=00790963557D76A664756E2164756E21
 //# sourceMappingURL=index.js.map