fix(http): serve path-aware OAuth AS metadata for /mcp (#39)

MCP SDK discovery tries /.well-known/oauth-authorization-server/mcp and
/mcp/.well-known/openid-configuration when the resource URL has a path.
Those 404ed while the root documents were 200.

Author: johnleider

src/transports/http.spec.ts

@@ -164,6 +164,17 @@ describe('http oauth gate', () => {
     expect(body.authorization_endpoint).toBe('https://api.vuetifyjs.com/oauth/authorize')
   })
 
+  it('serves path-aware AS metadata for /mcp', async () => {
+    const origin = originUrl(server)
+    const a = await fetch(`${origin}/.well-known/oauth-authorization-server/mcp`)
+    const b = await fetch(`${origin}/mcp/.well-known/openid-configuration`)
+
+    expect(a.status).toBe(200)
+    expect(b.status).toBe(200)
+    expect((await a.json()).authorization_endpoint).toBe('https://api.vuetifyjs.com/oauth/authorize')
+    expect((await b.json()).authorization_endpoint).toBe('https://api.vuetifyjs.com/oauth/authorize')
+  })
+
   it('advertises RFC9728 resource with /mcp', async () => {
     const prev = process.env.MCP_SERVER_URL
     delete process.env.MCP_SERVER_URL

src/transports/http.ts

@@ -140,8 +140,10 @@ function handleOauthRoutes (req: IncomingMessage, res: ServerResponse): boolean
   // RFC 8414 — Authorization Server Metadata (proxy to API)
   // Some MCP SDK versions fetch this from the resource server directly
   if (
-    req.url === '/.well-known/oauth-authorization-server'
-    || req.url === '/.well-known/openid-configuration'
+    req.url.startsWith('/.well-known/oauth-authorization-server')
+    || req.url.startsWith('/.well-known/openid-configuration')
+    || req.url.startsWith('/mcp/.well-known/oauth-authorization-server')
+    || req.url.startsWith('/mcp/.well-known/openid-configuration')
   ) {
     const apiUrl = getApiUrl()
     sendJson(res, {