@ai-sdk/mcp 1.0.70 → 1.0.72

package/dist/index.mjs

@@ -631,26 +631,41 @@ function assertAuthorizationServerInformationMatches({
     });
   }
 }
-function extractResourceMetadataUrl(response) {
-  var _a3;
+function extractWWWAuthenticateParams(response) {
+  var _a3, _b3;
   const header = (_a3 = response.headers.get("www-authenticate")) != null ? _a3 : response.headers.get("WWW-Authenticate");
   if (!header) {
-    return void 0;
+    return {};
   }
   const [type, scheme] = header.split(" ");
-  if (type.toLowerCase() !== "bearer" || !scheme) {
-    return void 0;
-  }
-  const regex = /resource_metadata="([^"]*)"/;
-  const match = header.match(regex);
-  if (!match) {
-    return void 0;
+  if (type.replace(/,$/, "").toLowerCase() !== "bearer" || !scheme) {
+    return {};
   }
+  const resourceMetadataMatch = header.match(
+    /(?:^|[,\s])resource_metadata="([^"]*)"/i
+  );
+  const scope = (_b3 = header.match(/(?:^|[,\s])scope="([^"]*)"/i)) == null ? void 0 : _b3[1];
+  let resourceMetadataUrl;
   try {
-    return new URL(match[1]);
+    resourceMetadataUrl = resourceMetadataMatch ? new URL(resourceMetadataMatch[1]) : void 0;
   } catch (e) {
-    return void 0;
   }
+  return { resourceMetadataUrl, scope };
+}
+function selectScope({
+  scope,
+  resourceMetadata,
+  clientMetadata
+}) {
+  var _a3;
+  if (scope) {
+    return scope;
+  }
+  const resourceScopes = (_a3 = resourceMetadata == null ? void 0 : resourceMetadata.scopes_supported) == null ? void 0 : _a3.join(" ");
+  if (resourceScopes) {
+    return resourceScopes;
+  }
+  return clientMetadata.scope;
 }
 function buildWellKnownPath(wellKnownPrefix, pathname = "", options = {}) {
   if (pathname.endsWith("/")) {
@@ -1279,7 +1294,11 @@ async function authInternal(provider, {
       clientInformation,
       state,
       redirectUrl: provider.redirectUrl,
-      scope: scope || provider.clientMetadata.scope,
+      scope: selectScope({
+        scope,
+        resourceMetadata,
+        clientMetadata: provider.clientMetadata
+      }),
       resource
     }
   );
@@ -1357,11 +1376,13 @@ var SseMCPTransport = class {
             redirect: this.redirectMode
           });
           if (response.status === 401 && this.authProvider && !triedAuth) {
-            this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+            const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+            this.resourceMetadataUrl = resourceMetadataUrl;
             try {
               const result = await auth(this.authProvider, {
                 serverUrl: this.url,
                 resourceMetadataUrl: this.resourceMetadataUrl,
+                scope,
                 fetchFn: this.fetchFn
               });
               if (result !== "AUTHORIZED") {
@@ -1476,7 +1497,7 @@ var SseMCPTransport = class {
     const transportSignal = (_b3 = this.abortController) == null ? void 0 : _b3.signal;
     const requestSignal = (options == null ? void 0 : options.signal) == null ? transportSignal : transportSignal == null ? options.signal : AbortSignal.any([transportSignal, options.signal]);
     const attempt = async (triedAuth = false) => {
-      var _a4, _b4, _c, _d, _e;
+      var _a4, _b4;
       try {
         const headers = await this.commonHeaders({
           "Content-Type": "application/json"
@@ -1490,38 +1511,35 @@ var SseMCPTransport = class {
         };
         const response = await this.fetchFn(endpoint.href, init);
         if (response.status === 401 && this.authProvider && !triedAuth) {
-          this.resourceMetadataUrl = extractResourceMetadataUrl(response);
-          try {
-            const result = await auth(this.authProvider, {
-              serverUrl: this.url,
-              resourceMetadataUrl: this.resourceMetadataUrl,
-              fetchFn: this.fetchFn
-            });
-            if (result !== "AUTHORIZED") {
-              const error = new UnauthorizedError();
-              (_a4 = this.onerror) == null ? void 0 : _a4.call(this, error);
-              return;
-            }
-          } catch (error) {
-            (_b4 = this.onerror) == null ? void 0 : _b4.call(this, error);
-            return;
+          const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          this.resourceMetadataUrl = resourceMetadataUrl;
+          const result = await auth(this.authProvider, {
+            serverUrl: this.url,
+            resourceMetadataUrl: this.resourceMetadataUrl,
+            scope,
+            fetchFn: this.fetchFn
+          });
+          if (result !== "AUTHORIZED") {
+            throw new UnauthorizedError();
           }
           return attempt(true);
         }
         if (!response.ok) {
           const text = await response.text().catch(() => null);
           const error = new MCPClientError({
-            message: `MCP SSE Transport Error: POSTing to endpoint (HTTP ${response.status}): ${text}`
+            message: `MCP SSE Transport Error: POSTing to endpoint (HTTP ${response.status}): ${text}`,
+            statusCode: response.status,
+            url: endpoint.href,
+            responseBody: text != null ? text : void 0
           });
-          (_c = this.onerror) == null ? void 0 : _c.call(this, error);
-          return;
+          throw error;
         }
       } catch (error) {
-        if ((_d = options == null ? void 0 : options.signal) == null ? void 0 : _d.aborted) {
+        if ((_a4 = options == null ? void 0 : options.signal) == null ? void 0 : _a4.aborted) {
           throw error;
         }
-        (_e = this.onerror) == null ? void 0 : _e.call(this, error);
-        return;
+        (_b4 = this.onerror) == null ? void 0 : _b4.call(this, error);
+        throw error;
       }
     };
     await attempt();
@@ -1586,7 +1604,7 @@ var HttpMCPTransport = class {
   /**
    * Runs a single OAuth recovery flow for concurrent 401 responses.
    */
-  authorizeOnce(resourceMetadataUrl) {
+  authorizeOnce(resourceMetadataUrl, scope) {
     if (!this.authProvider) {
       return Promise.resolve("REDIRECT");
     }
@@ -1594,6 +1612,7 @@ var HttpMCPTransport = class {
       this.authPromise = auth(this.authProvider, {
         serverUrl: this.url,
         resourceMetadataUrl,
+        scope,
         fetchFn: this.fetchFn
       }).finally(() => {
         this.authPromise = void 0;
@@ -1655,9 +1674,13 @@ var HttpMCPTransport = class {
           this.sessionId = sessionId;
         }
         if (response.status === 401 && this.authProvider && !triedAuth) {
-          this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+          const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          this.resourceMetadataUrl = resourceMetadataUrl;
           try {
-            const result = await this.authorizeOnce(this.resourceMetadataUrl);
+            const result = await this.authorizeOnce(
+              this.resourceMetadataUrl,
+              scope
+            );
             if (result !== "AUTHORIZED") {
               const error2 = new UnauthorizedError();
               throw error2;
@@ -1828,9 +1851,13 @@ var HttpMCPTransport = class {
         this.sessionId = sessionId;
       }
       if (response.status === 401 && this.authProvider && !triedAuth) {
-        this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+        const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+        this.resourceMetadataUrl = resourceMetadataUrl;
         try {
-          const result = await this.authorizeOnce(this.resourceMetadataUrl);
+          const result = await this.authorizeOnce(
+            this.resourceMetadataUrl,
+            scope
+          );
           if (result !== "AUTHORIZED") {
             const error = new UnauthorizedError();
             (_b3 = this.onerror) == null ? void 0 : _b3.call(this, error);