Fix OAuth token refresh for servers with root-based discovery (fixes #3)

[kingsleyzhong]

Problem

The discoverTokenEndpoint() function in oauth-utils.ts only tries path-based OAuth discovery URLs:

• https://example.com/mcp/.well-known/oauth-authorization-server
• https://example.com/mcp/.well-known/openid-configuration

However, some servers like Notion host their OAuth metadata at the root:

• https://mcp.notion.com/.well-known/oauth-authorization-server

This causes token refresh to fail for these servers, even though initial login works (because the MCP SDK's discoverAuthorizationServerMetadata() tries both path-based and root-based discovery).

Solution

Add root-based fallback URLs to discoverTokenEndpoint(), matching the behavior of the MCP SDK:

const serverUrlObj = new URL(serverUrl);
const base = \`\${serverUrlObj.protocol}//\${serverUrlObj.host}\`;
if (serverUrl !== base && serverUrl !== \`\${base}/\`) {
  discoveryUrls.push(
    \`\${base}/.well-known/oauth-authorization-server\`,
    \`\${base}/.well-known/openid-configuration\`,
  );
}

Testing

• All unit tests pass (335/335)
• Manual verification: discoverTokenEndpoint('https://mcp.notion.com/mcp') now correctly returns https://mcp.notion.com/token

Fixes #3

[jancurn]

Great catch, thanks for the fix - I was unable to revert the changes to package-lock.json, so I recreated the changes in c69008a