@stigmer/server 3.18.0 → 3.19.0

package/src/domain/mcpserver/oauth/__tests__/discovery.test.ts

@@ -1,12 +1,17 @@
 /**
- * Pins RFC 8414 discovery against Go oauth/discovery.go: the well-known
- * URI lives at the URL ORIGIN (not under the server's path), S256 support
- * is mandatory when advertised, and every error message is text initiate
- * embeds in its FailedPrecondition copy — asserted verbatim.
+ * Pins authorization-server discovery: for an MCP endpoint the RFC 9728
+ * walk (the protected-resource document names the login server, which may
+ * live on another origin and carry a path) with the endpoint's origin as
+ * the last resort the retired reader used; for an author's `discovery_url`
+ * an issuer read; S256 mandatory when advertised; and every error message
+ * verbatim, because initiate embeds it in its FailedPrecondition copy and
+ * the conformance suite pins it against the first document tried.
  */
 import { describe, expect, it } from "vitest";
 
-import { buildWellKnownUrl, discoverAuthorizationServer } from "../discovery.js";
+import type { OutboundFetch } from "@stigmer/outbound/egress";
+
+import { buildWellKnownUrl, discoverAtIssuer, discoverForResource } from "../discovery.js";
 
 function jsonResponse(status: number, body: unknown): Response {
   return new Response(JSON.stringify(body), {
@@ -24,127 +29,151 @@ const VALID_METADATA = {
   code_challenge_methods_supported: ["S256"],
 };
 
+/** A fetch answering from a URL table; anything unlisted is a 404. */
+function serving(documents: Record<string, unknown>): { fetchImpl: OutboundFetch; requested: string[]; accepts: string[] } {
+  const requested: string[] = [];
+  const accepts: string[] = [];
+  const fetchImpl: OutboundFetch = async (url, init) => {
+    requested.push(String(url));
+    accepts.push((init?.headers as Record<string, string>)["Accept"] ?? "");
+    const body = documents[String(url)];
+    return body === undefined ? jsonResponse(404, {}) : jsonResponse(200, body);
+  };
+  return { fetchImpl, requested, accepts };
+}
+
 describe("buildWellKnownUrl", () => {
   it("builds at the origin, dropping the server path (Linear-style URL)", () => {
-    expect(buildWellKnownUrl("https://mcp.linear.app/mcp")).toBe(
-      "https://mcp.linear.app/.well-known/oauth-authorization-server",
-    );
+    expect(buildWellKnownUrl("https://mcp.linear.app/mcp")).toBe("https://mcp.linear.app/.well-known/oauth-authorization-server");
   });
 
   it("preserves a non-default port in the origin", () => {
-    expect(buildWellKnownUrl("http://127.0.0.1:8931/api/v2")).toBe(
-      "http://127.0.0.1:8931/.well-known/oauth-authorization-server",
-    );
+    expect(buildWellKnownUrl("http://127.0.0.1:8931/api/v2")).toBe("http://127.0.0.1:8931/.well-known/oauth-authorization-server");
   });
 
   const invalid: Array<[string, string, string]> = [
-    [
-      "a non-http(s) scheme",
-      "ftp://example.com",
-      'invalid server URL for discovery: unsupported scheme "ftp": only http and https are supported',
-    ],
+    ["a non-http(s) scheme", "ftp://example.com", 'invalid server URL for discovery: unsupported scheme "ftp": only http and https are supported'],
   ];
   it.each(invalid)("rejects %s", (_label, url, message) => {
     expect(() => buildWellKnownUrl(url)).toThrow(message);
   });
 
   it("rejects an unparseable URL with the Go prefix", () => {
-    expect(() => buildWellKnownUrl("::::")).toThrow(
-      /^invalid server URL for discovery: /,
-    );
+    expect(() => buildWellKnownUrl("::::")).toThrow(/^invalid server URL for discovery: /);
   });
 });
 
-describe("discoverAuthorizationServer", () => {
-  it("parses valid metadata and sends Accept: application/json to the origin well-known URI", async () => {
-    let requestedUrl = "";
-    let accept = "";
-    const metadata = await discoverAuthorizationServer(
-      "https://mcp.example.com/mcp",
-      async (url, init) => {
-        requestedUrl = String(url);
-        accept = (init?.headers as Record<string, string>)["Accept"] ?? "";
-        return jsonResponse(200, VALID_METADATA);
-      },
-    );
-    expect(requestedUrl).toBe(
-      "https://mcp.example.com/.well-known/oauth-authorization-server",
-    );
-    expect(accept).toBe("application/json");
-    expect(metadata.authorizationEndpoint).toBe(
-      "https://auth.example.com/authorize",
-    );
+describe("discoverForResource", () => {
+  it("reaches a login server on another origin through the protected-resource document (RFC 9728)", async () => {
+    const { fetchImpl, requested } = serving({
+      "https://mcp.example.com/.well-known/oauth-protected-resource/mcp": { resource: "https://mcp.example.com/mcp", authorization_servers: ["https://auth.example.com"] },
+      "https://auth.example.com/.well-known/oauth-authorization-server": VALID_METADATA,
+    });
+    const metadata = await discoverForResource("https://mcp.example.com/mcp", fetchImpl);
+    expect(metadata.authorizationEndpoint).toBe("https://auth.example.com/authorize");
+    expect(metadata.registrationEndpoint).toBe("https://auth.example.com/register");
+    expect(requested).toEqual([
+      "https://mcp.example.com/.well-known/oauth-protected-resource/mcp",
+      "https://auth.example.com/.well-known/oauth-authorization-server",
+    ]);
+  });
+
+  it("inserts the well-known segment before an issuer's path (RFC 8414 section 3)", async () => {
+    const { fetchImpl } = serving({
+      "https://mcp.example.com/.well-known/oauth-protected-resource": { authorization_servers: ["https://auth.example.com/tenant"] },
+      "https://auth.example.com/.well-known/oauth-authorization-server/tenant": VALID_METADATA,
+    });
+    const metadata = await discoverForResource("https://mcp.example.com/", fetchImpl);
     expect(metadata.tokenEndpoint).toBe("https://auth.example.com/token");
-    expect(metadata.registrationEndpoint).toBe(
-      "https://auth.example.com/register",
-    );
+  });
+
+  it("falls back to the endpoint's origin when no protected-resource document exists, sending Accept: application/json", async () => {
+    const { fetchImpl, requested, accepts } = serving({
+      "https://mcp.example.com/.well-known/oauth-authorization-server": VALID_METADATA,
+    });
+    const metadata = await discoverForResource("https://mcp.example.com/mcp", fetchImpl);
     expect(metadata.scopesSupported).toEqual(["read", "write"]);
+    expect(requested).toEqual([
+      "https://mcp.example.com/.well-known/oauth-protected-resource/mcp",
+      "https://mcp.example.com/.well-known/oauth-protected-resource",
+      "https://mcp.example.com/.well-known/oauth-authorization-server",
+    ]);
+    expect(new Set(accepts)).toEqual(new Set(["application/json"]));
   });
 
-  it("refuses a non-200 with the MCP Authorization hint (Go copy, verbatim)", async () => {
-    await expect(
-      discoverAuthorizationServer("https://mcp.example.com/mcp", async () =>
-        jsonResponse(404, {}),
-      ),
-    ).rejects.toThrow(
+  it("refuses a non-200 naming the origin's RFC 8414 document with the MCP Authorization hint (Go copy, verbatim)", async () => {
+    const fetchImpl: OutboundFetch = async () => jsonResponse(404, {});
+    await expect(discoverForResource("https://mcp.example.com/mcp", fetchImpl)).rejects.toThrow(
       "authorization server discovery failed: https://mcp.example.com/.well-known/oauth-authorization-server returned HTTP 404 (expected 200). " +
         "This MCP server may not support the MCP Authorization specification",
     );
   });
 
+  it("wraps a network failure with the discovery-request prefix", async () => {
+    const fetchImpl: OutboundFetch = async () => {
+      throw new Error("connect ECONNREFUSED");
+    };
+    await expect(discoverForResource("https://mcp.example.com/mcp", fetchImpl)).rejects.toThrow(/^discovery request to .* failed: connect ECONNREFUSED$/);
+  });
+
+  it("screens the URL before dialling", async () => {
+    const fetchImpl: OutboundFetch = async () => jsonResponse(200, VALID_METADATA);
+    await expect(discoverForResource("ftp://example.com", fetchImpl)).rejects.toThrow(
+      'invalid server URL for discovery: unsupported scheme "ftp": only http and https are supported',
+    );
+  });
+});
+
+describe("discoverAtIssuer", () => {
+  it("reads an author's discovery_url as an issuer, RFC 8414 at its origin first", async () => {
+    const { fetchImpl, requested } = serving({
+      "https://auth.example.com/.well-known/oauth-authorization-server": VALID_METADATA,
+    });
+    const metadata = await discoverAtIssuer("https://auth.example.com", fetchImpl);
+    expect(metadata.authorizationEndpoint).toBe("https://auth.example.com/authorize");
+    expect(requested).toEqual(["https://auth.example.com/.well-known/oauth-authorization-server"]);
+  });
+
+  it("falls back to OpenID's document", async () => {
+    const { fetchImpl, requested } = serving({
+      "https://auth.example.com/.well-known/openid-configuration": VALID_METADATA,
+    });
+    await discoverAtIssuer("https://auth.example.com", fetchImpl);
+    expect(requested).toEqual([
+      "https://auth.example.com/.well-known/oauth-authorization-server",
+      "https://auth.example.com/.well-known/openid-configuration",
+    ]);
+  });
+
+  it("refuses a non-200 naming the first document tried with its status (the conformance suite's pin)", async () => {
+    const fetchImpl: OutboundFetch = async () => jsonResponse(503, { error: "metadata unavailable" });
+    await expect(discoverAtIssuer("http://127.0.0.1:8931", fetchImpl)).rejects.toThrow(
+      "authorization server discovery failed: http://127.0.0.1:8931/.well-known/oauth-authorization-server returned HTTP 503 (expected 200). " +
+        "This MCP server may not support the MCP Authorization specification",
+    );
+  });
+
   const missingEndpoint: Array<[string, Record<string, unknown>, string]> = [
-    [
-      "authorization_endpoint",
-      { ...VALID_METADATA, authorization_endpoint: undefined },
-      "is missing authorization_endpoint",
-    ],
-    [
-      "token_endpoint",
-      { ...VALID_METADATA, token_endpoint: undefined },
-      "is missing token_endpoint",
-    ],
+    ["authorization_endpoint", { ...VALID_METADATA, authorization_endpoint: undefined }, "is missing authorization_endpoint"],
+    ["token_endpoint", { ...VALID_METADATA, token_endpoint: undefined }, "is missing token_endpoint"],
   ];
-  it.each(missingEndpoint)(
-    "refuses metadata without %s",
-    async (_label, body, fragment) => {
-      await expect(
-        discoverAuthorizationServer("https://mcp.example.com/mcp", async () =>
-          jsonResponse(200, body),
-        ),
-      ).rejects.toThrow(fragment);
-    },
-  );
+  it.each(missingEndpoint)("refuses metadata without %s, naming the document (Go copy)", async (_label, body, fragment) => {
+    const fetchImpl: OutboundFetch = async () => jsonResponse(200, body);
+    await expect(discoverAtIssuer("https://auth.example.com", fetchImpl)).rejects.toThrow(
+      `authorization server at https://auth.example.com/.well-known/oauth-authorization-server ${fragment}`,
+    );
+  });
 
   it("refuses a server that advertises methods without S256 (Go %v list rendering)", async () => {
-    await expect(
-      discoverAuthorizationServer("https://mcp.example.com/mcp", async () =>
-        jsonResponse(200, {
-          ...VALID_METADATA,
-          code_challenge_methods_supported: ["plain"],
-        }),
-      ),
-    ).rejects.toThrow(
+    const fetchImpl: OutboundFetch = async () => jsonResponse(200, { ...VALID_METADATA, code_challenge_methods_supported: ["plain"] });
+    await expect(discoverAtIssuer("https://auth.example.com", fetchImpl)).rejects.toThrow(
       "does not support S256 PKCE (supports: [plain]). S256 is required by the MCP Authorization specification",
     );
   });
 
   it("accepts a server that advertises NO methods (list absent = unconstrained)", async () => {
-    const metadata = await discoverAuthorizationServer(
-      "https://mcp.example.com/mcp",
-      async () =>
-        jsonResponse(200, {
-          ...VALID_METADATA,
-          code_challenge_methods_supported: undefined,
-        }),
-    );
+    const fetchImpl: OutboundFetch = async () => jsonResponse(200, { ...VALID_METADATA, code_challenge_methods_supported: undefined });
+    const metadata = await discoverAtIssuer("https://auth.example.com", fetchImpl);
     expect(metadata.codeChallengeMethodsSupported).toEqual([]);
   });
-
-  it("wraps a network failure with the discovery-request prefix", async () => {
-    await expect(
-      discoverAuthorizationServer("https://mcp.example.com/mcp", async () => {
-        throw new Error("connect ECONNREFUSED");
-      }),
-    ).rejects.toThrow(/^discovery request to .* failed: connect ECONNREFUSED$/);
-  });
 });

package/src/domain/mcpserver/oauth/__tests__/token-refresh.test.ts

@@ -287,7 +287,9 @@ describe("refreshTokenIfExpired", () => {
 
   it("expired with no refresh token: throws the re-auth error", async () => {
     await expect(
-      refreshTokenIfExpired(grant(nowSeconds() - 10), "", "", "", silentLogger),
+      refreshTokenIfExpired(grant(nowSeconds() - 10), "", "", "", silentLogger, () => {
+        throw new Error("token endpoint must not be reached");
+      }),
     ).rejects.toThrow(
       "access token for resource 'mcps_1' has expired and no refresh token is available. " +
         "Please re-authenticate via OAuth Connect",

package/src/domain/mcpserver/oauth/dcr.ts

@@ -6,6 +6,7 @@
  * "never ciphertext-of-empty" rule meaningful (oss#394).
  * Proven by mcpserver-oauth.conformance.test.ts (CONFORMANCE_TARGET=local).
  */
+import type { OutboundFetch } from "@stigmer/outbound/egress";
 import { truncateBody } from "./truncate-body.js";
 
 /** Dynamic Client Registration response per RFC 7591 (Go DCRResponse). */
@@ -29,7 +30,7 @@ export async function registerClient(
   registrationEndpoint: string,
   redirectUri: string,
   clientName: string,
-  fetchImpl: typeof fetch = fetch,
+  fetchImpl: OutboundFetch,
 ): Promise<DcrResponse> {
   const requestBody = JSON.stringify({
     redirect_uris: [redirectUri],

package/src/domain/mcpserver/oauth/discovery.ts

@@ -1,16 +1,49 @@
 /**
- * RFC 8414 authorization-server discovery — ports
- * pkg/domain/mcpserver/oauth/discovery.go. The well-known URI lives at the
- * URL ORIGIN (scheme + host), not under the server's path — a Linear-style
- * MCP URL like https://mcp.linear.app/mcp discovers at
- * https://mcp.linear.app/.well-known/oauth-authorization-server.
- * Proven by mcpserver-oauth.conformance.test.ts (CONFORMANCE_TARGET=local).
+ * Authorization-server discovery for the DCR arm of Sign in: finding the
+ * login server that protects an MCP endpoint, and validating what it says.
+ *
+ * Two entry points, because the spec gives Sign in two kinds of URL:
+ *
+ *   - `discoverForResource(mcpUrl)`: the MCP endpoint itself (`http.url`).
+ *     Its login server is found by the RFC 9728 walk in
+ *     `@stigmer/outbound/mcp-oauth`: the protected-resource document at the
+ *     endpoint (path-suffixed, then bare) names `authorization_servers`;
+ *     each issuer's metadata is read by RFC 8414 with the issuer's path
+ *     inserted, then at its origin, then OpenID's document. When no
+ *     protected-resource document exists the endpoint's origin is the one
+ *     issuer to try, which is exactly what this module did before the walk
+ *     (a Linear-style https://mcp.linear.app/mcp read
+ *     https://mcp.linear.app/.well-known/oauth-authorization-server), so
+ *     no server that signed in before signs in less now. Of the 41
+ *     OAuth-protected servers the catalogue audit resolved, 21 keep their
+ *     login server on another origin; only the walk reaches them.
+ *   - `discoverAtIssuer(issuerUrl)`: the author's `auth.discovery_url`, an
+ *     override naming the login server. It is read as an issuer: RFC 8414
+ *     with its path, then its origin, then OpenID's.
+ *
+ * Both return the same `AuthServerMetadata` (the Go AuthServerMetadata's
+ * parsed camelCase view) and hold the login server to the same rules:
+ * both endpoints present, and S256 offered when methods are listed. The
+ * error copy is contract: initiate embeds it in its FailedPrecondition, the
+ * conformance suite pins it, and the failure names the FIRST document the
+ * walk tried (for a bare issuer, the RFC 8414 document at its origin, the
+ * one the retired reader named) with its status or its network error.
+ * Proven by __tests__/discovery.test.ts and
+ * mcpserver-oauth.conformance.test.ts (CONFORMANCE_TARGET=local).
  */
+import type { OutboundFetch } from "@stigmer/outbound/egress";
+import {
+  authorizationServerMetadataUrls,
+  readAuthorizationServerMetadata,
+  resolveAuthorizationServers,
+  type AuthorizationServerMetadata,
+  type MetadataAttempt,
+} from "@stigmer/outbound/mcp-oauth";
 
 /**
- * OAuth 2.0 Authorization Server Metadata discovered via RFC 8414
- * (Go AuthServerMetadata). Field names keep the RFC's snake_case on the
- * wire; this interface is the parsed camelCase view.
+ * OAuth 2.0 Authorization Server Metadata (Go AuthServerMetadata). Field
+ * names keep the RFC's snake_case on the wire; this interface is the parsed
+ * camelCase view.
  */
 export interface AuthServerMetadata {
   issuer: string;
@@ -21,117 +54,115 @@ export interface AuthServerMetadata {
   codeChallengeMethodsSupported: string[];
 }
 
-/** Go's discoveryHTTPClient 10s timeout — a named constant per guidelines. */
+/** Go's discoveryHTTPClient 10s timeout — a named constant per guidelines; per document read. */
 export const DISCOVERY_REQUEST_TIMEOUT_MS = 10_000;
 
+/** The login server protecting an MCP endpoint, by the RFC 9728 walk with the origin as the last resort. */
+export async function discoverForResource(mcpUrl: string, fetchImpl: OutboundFetch): Promise<AuthServerMetadata> {
+  const resource = parseDiscoveryUrl(mcpUrl);
+  const deps = { fetchImpl, timeoutMs: DISCOVERY_REQUEST_TIMEOUT_MS };
+  const resolved = await resolveAuthorizationServers(resource.href, undefined, deps);
+  const issuers = resolved.issuers.length > 0 ? resolved.issuers : [resource.origin];
+  return readIssuers(issuers, deps);
+}
+
+/** The login server an author named in `auth.discovery_url`, read as an issuer. */
+export async function discoverAtIssuer(issuerUrl: string, fetchImpl: OutboundFetch): Promise<AuthServerMetadata> {
+  const issuer = parseDiscoveryUrl(issuerUrl);
+  return readIssuers([issuer.href], { fetchImpl, timeoutMs: DISCOVERY_REQUEST_TIMEOUT_MS });
+}
+
 /**
- * Fetches the OAuth Authorization Server Metadata from the MCP server's
- * .well-known endpoint per RFC 8414 (Go DiscoverAuthorizationServer).
- * Throws with Go's message text on non-200, unparseable metadata, missing
- * endpoints, or an S256-less server — initiate embeds these messages in
- * its FailedPrecondition copy, so the text is contract.
+ * The document the retired reader named, kept so a failure names a URL the
+ * suites and the operators already know: RFC 8414 at the issuer's origin.
+ * Exported for the tests that pin the shape.
  */
-export async function discoverAuthorizationServer(
-  serverUrl: string,
-  fetchImpl: typeof fetch = fetch,
-): Promise<AuthServerMetadata> {
-  const wellKnownUrl = buildWellKnownUrl(serverUrl);
+export function buildWellKnownUrl(serverUrl: string): string {
+  const parsed = parseDiscoveryUrl(serverUrl);
+  return `${parsed.origin}/.well-known/oauth-authorization-server`;
+}
 
-  let response: Response;
-  try {
-    response = await fetchImpl(wellKnownUrl, {
-      method: "GET",
-      headers: { Accept: "application/json" },
-      signal: AbortSignal.timeout(DISCOVERY_REQUEST_TIMEOUT_MS),
-    });
-  } catch (error) {
-    throw new Error(
-      `discovery request to ${wellKnownUrl} failed: ${error instanceof Error ? error.message : String(error)}`,
-    );
+async function readIssuers(issuers: readonly string[], deps: { fetchImpl: OutboundFetch; timeoutMs: number }): Promise<AuthServerMetadata> {
+  const attempts: MetadataAttempt[] = [];
+  for (const issuer of issuers) {
+    const read = await readAuthorizationServerMetadata(issuer, deps);
+    attempts.push(...read.attempts);
+    if (read.kind === "found") {
+      const metadata = toAuthServerMetadata(read.metadata);
+      validateMetadata(metadata, read.metadata.metadataUrl);
+      return metadata;
+    }
   }
+  throw discoveryFailure(issuers, attempts);
+}
 
-  if (response.status !== 200) {
-    // Drain the body so the connection can be reused; the status alone
-    // classifies the failure.
-    await response.text();
-    throw new Error(
-      `authorization server discovery failed: ${wellKnownUrl} returned HTTP ${response.status} (expected 200). ` +
-        "This MCP server may not support the MCP Authorization specification",
-    );
+function toAuthServerMetadata(m: AuthorizationServerMetadata): AuthServerMetadata {
+  return {
+    issuer: m.issuer,
+    authorizationEndpoint: m.authorizationEndpoint,
+    tokenEndpoint: m.tokenEndpoint,
+    registrationEndpoint: m.registrationEndpoint,
+    scopesSupported: [...m.scopesSupported],
+    codeChallengeMethodsSupported: [...m.codeChallengeMethodsSupported],
+  };
+}
+
+/**
+ * The failure names the first document tried for the first issuer: for a
+ * bare issuer that is RFC 8414 at its origin, the URL the retired reader
+ * named, so the pinned copy reads as it always did.
+ */
+function discoveryFailure(issuers: readonly string[], attempts: readonly MetadataAttempt[]): Error {
+  const firstIssuer = issuers[0] ?? "";
+  const named = firstDocumentFor(firstIssuer);
+  const attempt = attempts.find((a) => a.url === named) ?? attempts[0];
+  if (attempt?.error !== undefined) {
+    return new Error(`discovery request to ${attempt.url} failed: ${attempt.error}`);
   }
+  if (attempt?.missing !== undefined) {
+    return new Error(`authorization server at ${attempt.url} is missing ${attempt.missing}`);
+  }
+  const status = attempt?.status ?? 0;
+  return new Error(
+    `authorization server discovery failed: ${named} returned HTTP ${status} (expected 200). ` +
+      "This MCP server may not support the MCP Authorization specification",
+  );
+}
 
-  let raw: {
-    issuer?: string;
-    authorization_endpoint?: string;
-    token_endpoint?: string;
-    registration_endpoint?: string;
-    scopes_supported?: string[];
-    code_challenge_methods_supported?: string[];
-  };
+function firstDocumentFor(issuer: string): string {
   try {
-    raw = (await response.json()) as typeof raw;
-  } catch (error) {
-    throw new Error(
-      `failed to parse authorization server metadata: ${error instanceof Error ? error.message : String(error)}`,
-    );
+    return authorizationServerMetadataUrls(new URL(issuer))[0] ?? issuer;
+  } catch {
+    return issuer;
   }
-
-  const metadata: AuthServerMetadata = {
-    issuer: raw.issuer ?? "",
-    authorizationEndpoint: raw.authorization_endpoint ?? "",
-    tokenEndpoint: raw.token_endpoint ?? "",
-    registrationEndpoint: raw.registration_endpoint ?? "",
-    scopesSupported: raw.scopes_supported ?? [],
-    codeChallengeMethodsSupported: raw.code_challenge_methods_supported ?? [],
-  };
-
-  validateMetadata(metadata, wellKnownUrl);
-  return metadata;
 }
 
-/**
- * Constructs the .well-known URL from the MCP server URL (Go
- * buildWellKnownURL). Per RFC 8414, the well-known URI is at the origin.
- */
-export function buildWellKnownUrl(serverUrl: string): string {
+/** Parse and screen a discovery URL; the copy is the Go buildWellKnownURL's, embedded by initiate. */
+function parseDiscoveryUrl(serverUrl: string): URL {
   let parsed: URL;
   try {
     parsed = new URL(serverUrl);
   } catch (error) {
-    throw new Error(
-      `invalid server URL for discovery: ${error instanceof Error ? error.message : String(error)}`,
-    );
+    throw new Error(`invalid server URL for discovery: ${error instanceof Error ? error.message : String(error)}`);
   }
-
   const scheme = parsed.protocol.replace(/:$/, "");
   if (scheme !== "http" && scheme !== "https") {
-    throw new Error(
-      `invalid server URL for discovery: unsupported scheme "${scheme}": only http and https are supported`,
-    );
+    throw new Error(`invalid server URL for discovery: unsupported scheme "${scheme}": only http and https are supported`);
   }
   if (parsed.host === "") {
     throw new Error("invalid server URL for discovery: server URL has no host");
   }
-
-  const origin = `${scheme}://${parsed.host}`;
-  return `${origin.replace(/\/+$/, "")}/.well-known/oauth-authorization-server`;
+  return parsed;
 }
 
 function validateMetadata(m: AuthServerMetadata, sourceUrl: string): void {
   if (m.authorizationEndpoint === "") {
-    throw new Error(
-      `authorization server at ${sourceUrl} is missing authorization_endpoint`,
-    );
+    throw new Error(`authorization server at ${sourceUrl} is missing authorization_endpoint`);
   }
   if (m.tokenEndpoint === "") {
-    throw new Error(
-      `authorization server at ${sourceUrl} is missing token_endpoint`,
-    );
+    throw new Error(`authorization server at ${sourceUrl} is missing token_endpoint`);
   }
-  if (
-    m.codeChallengeMethodsSupported.length > 0 &&
-    !m.codeChallengeMethodsSupported.includes("S256")
-  ) {
+  if (m.codeChallengeMethodsSupported.length > 0 && !m.codeChallengeMethodsSupported.includes("S256")) {
     // Go renders the supported list with %v — space-separated in
     // brackets; matched exactly because initiate forwards this text.
     throw new Error(

package/src/domain/mcpserver/oauth/preflight.ts

@@ -23,6 +23,7 @@
  * the authorization server at this point, and nothing is consumed until
  * the callback leg, which the probe never reaches.
  */
+import type { OutboundFetch } from "@stigmer/outbound/egress";
 import { truncateBody } from "./truncate-body.js";
 
 /**
@@ -63,7 +64,7 @@ const PREFLIGHT_BODY_READ_CAP = 4096;
  */
 export async function preflightAuthorize(
   authorizationUrl: string,
-  fetchImpl: typeof fetch = fetch,
+  fetchImpl: OutboundFetch,
 ): Promise<AuthorizeRejection | undefined> {
   // Network errors propagate to the caller, who treats them as
   // fail-open diagnostics — exactly Go's (nil, err) contract.

package/src/domain/mcpserver/oauth/refresh.ts

@@ -3,6 +3,7 @@
  * Consumed by the agentexecution EC builder's OAuth injection (#17); the
  * connect-lane refresh callers arrive with #19.
  */
+import type { OutboundFetch } from "@stigmer/outbound/egress";
 import type { OAuthGrant } from "../../../store/interface.js";
 import type { Logger } from "../../../boot/logger.js";
 import { refreshToken } from "./token.js";
@@ -40,7 +41,7 @@ export async function refreshTokenIfExpired(
   clientSecret: string,
   tokenAuthMethod: string,
   logger: Logger,
-  fetchImpl: typeof fetch = fetch,
+  fetchImpl: OutboundFetch,
 ): Promise<RefreshResult> {
   if (grant.accessTokenExpiresAt === 0) {
     // Token does not expire.

package/src/domain/mcpserver/oauth/token.ts

@@ -4,6 +4,7 @@
  * (#19). Proven by mcpserver-oauth.conformance.test.ts and the Class B
  * mcpserver-connect suite.
  */
+import type { OutboundFetch } from "@stigmer/outbound/egress";
 import { truncateBody } from "./truncate-body.js";
 
 /** Token-endpoint response (Go TokenResponse). */
@@ -40,7 +41,7 @@ export async function exchangeCode(
   clientId: string,
   clientSecret: string,
   tokenAuthMethod: string,
-  fetchImpl: typeof fetch = fetch,
+  fetchImpl: OutboundFetch,
 ): Promise<TokenResponse> {
   const params = new URLSearchParams({
     grant_type: "authorization_code",
@@ -71,7 +72,7 @@ export async function refreshToken(
   clientId: string,
   clientSecret: string,
   tokenAuthMethod: string,
-  fetchImpl: typeof fetch = fetch,
+  fetchImpl: OutboundFetch,
 ): Promise<TokenResponse> {
   const params = new URLSearchParams({
     grant_type: "refresh_token",
@@ -94,7 +95,7 @@ async function doTokenRequest(
   clientId: string,
   clientSecret: string,
   tokenAuthMethod: string,
-  fetchImpl: typeof fetch,
+  fetchImpl: OutboundFetch,
 ): Promise<TokenResponse> {
   // Exactly one credential channel per request — RFC 6749 §2.3 forbids
   // presenting the secret through more than one method. Post mode rides

package/src/domain/workflowexecution/lifecycle.ts

@@ -934,7 +934,7 @@ export async function recoverExecution(
               temporalConfig: deps.temporalConfig,
             },
             loadedExecution(ctx),
-            ctx.callerIdentity.identityId,
+            ctx.callerIdentity,
           );
         },
       },