[dzucconi]

Summary

Claude Code sign-in was rejected because its published identity URL was missing from the server’s list. Accept valid client metadata documents without adding each app individually, including documents that omit an app name.

- Published identities require a per-app entry
+ Published identities are validated from the app’s HTTPS metadata document

• Show the identity’s publishing domain on the consent screen.
• Return a supported authentication method when an app requests a different method during registration.
• Enable published identities through yarn deploy. Local development uses dynamic registration, with discovery and request handling controlled by the same setting.

Evidence

• Before: Claude Code’s published identity was rejected as an unknown client.
  After: Regression tests complete authorization and token exchange for Claude Code and an unlisted app using mocked metadata and Are.na responses.
• Disabled-setting tests verify that discovery reports no support and authorization/token requests do not fetch metadata, even on an HTTPS origin.
• Typecheck, 166 tests, 8 review-policy checks, formatting, and diff checks pass.
• Live app sign-in after deployment remains to be verified.

Merge Danger

Door: Two-way; revert the commits to restore the previous behavior.

Blast Radius: Authentication

Changes app registration, published-identity discovery, and consent text. Deploy through yarn deploy to enable published identities; local development requires apps that support dynamic registration.