CODEOWNERS auth paths do not resolve on main, so the auth team is never auto-requested

[conorbronsdon]

What

On main, none of the five auth paths in .github/CODEOWNERS resolve to anything. The * catch-all still matches, so reviews are still requested and nothing looks broken. But @modelcontextprotocol/typescript-sdk-auth is no longer auto-requested on auth changes.

v1.x has a byte-identical CODEOWNERS where all five patterns resolve. The file just wasn't revisited when main became a monorepo; its last two commits are #781 and #803, both from July 2025.

Evidence

Matches against the full main tree (1427 entries, no src/ at root):

Pattern	main	v1.x
/src/server/auth/	0	17
/src/client/auth*	0	2
/src/shared/auth*	0	2
/src/examples/client/simpleOAuthClient.ts	0	1
/src/examples/server/demoInMemoryOAuthProvider.ts	0	1

A dangling pattern would matter less if code-owner review were advisory, but the org ruleset on the default branch sets require_code_owner_review: true. So the catch-all is carrying every auth review.

Where auth code lives now

Roughly, if it's useful:

• packages/core/src/auth.ts — SafeUrlSchema, OAuthProtectedResourceMetadataSchema (RFC 9728)
• packages/core-internal/src/auth/errors.ts, src/shared/auth.ts, src/shared/authUtils.ts
• packages/client/src/client/auth.ts, authErrors.ts, authExtensions.ts, authSeam.ts
• packages/server/src/server/middleware/bearerAuth.ts, oauthMetadata.ts
• packages/middleware/express/src/auth/ — bearerAuth.ts, metadataRouter.ts, types.ts
• packages/server-legacy/src/auth/ — 15 files (handlers, middleware, proxyProvider.ts)
• Examples: examples/oauth/, examples/oauth-client-credentials/, examples/bearer-auth/, examples/bearer-auth-web/, examples/shared/src/auth*.ts, examples/cli-client/host/auth.ts

One thing to flag: demoInMemoryOAuthProvider no longer has a source file on main. Only examples/shared/test/demoInMemoryOAuthProvider.test.ts remains, so a new pattern shouldn't point at the old source path.

Questions before anyone writes a patch

I'd rather ask than guess at the mapping:

1. Is the auth team still active? If it was folded into the main team during the v2 work, the right fix is deleting the block, not remapping it.
2. Should packages/server-legacy/src/auth/ get the same ownership as the current server, or is legacy deliberately out of scope?
3. Should the test/ trees be owned alongside their packages?

Happy to open the PR once you tell me which shape you want. This is main-only; v1.x is fine as-is.

---

AI disclosure, per the org AI_POLICY: I researched and drafted this issue with Claude Code. The path counts, the branch comparison against v1.x, and the auth-file inventory were generated by tooling and checked against the GitHub API rather than by hand.