@ai-sdk/mcp 1.0.81 → 1.0.82

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @ai-sdk/mcp
 
+## 1.0.82
+
+### Patch Changes
+
+- 1620182: fix(mcp): avoid duplicate legacy SSE OAuth refreshes for stale 401 responses
+
 ## 1.0.81
 
 ### Patch Changes

package/dist/index.js

@@ -1434,6 +1434,30 @@ var SseMCPTransport = class {
       (0, import_provider_utils3.getRuntimeEnvironmentUserAgent)()
     );
   }
+  /**
+   * Runs a single OAuth recovery flow for concurrent 401 responses.
+   */
+  authorizeOnce(resourceMetadataUrl, scope) {
+    if (!this.authProvider) {
+      return Promise.resolve("REDIRECT");
+    }
+    if (!this.authPromise) {
+      this.authPromise = auth(this.authProvider, {
+        serverUrl: this.url,
+        resourceMetadataUrl,
+        scope,
+        fetchFn: this.fetchFn
+      }).finally(() => {
+        this.authPromise = void 0;
+      });
+    }
+    return this.authPromise;
+  }
+  async accessTokenChanged(requestAuthorization) {
+    var _a3, _b3;
+    const accessToken = (_b3 = await ((_a3 = this.authProvider) == null ? void 0 : _a3.tokens())) == null ? void 0 : _b3.access_token;
+    return accessToken != null && requestAuthorization !== `Bearer ${accessToken}`;
+  }
   async start() {
     return new Promise((resolve, reject) => {
       if (this.connected) {
@@ -1455,12 +1479,10 @@ var SseMCPTransport = class {
             const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
             this.resourceMetadataUrl = resourceMetadataUrl;
             try {
-              const result = await auth(this.authProvider, {
-                serverUrl: this.url,
-                resourceMetadataUrl: this.resourceMetadataUrl,
-                scope,
-                fetchFn: this.fetchFn
-              });
+              const result = await this.authorizeOnce(
+                this.resourceMetadataUrl,
+                scope
+              );
               if (result !== "AUTHORIZED") {
                 const error = new UnauthorizedError();
                 (_b3 = this.onerror) == null ? void 0 : _b3.call(this, error);
@@ -1573,7 +1595,7 @@ var SseMCPTransport = class {
     const transportSignal = (_b3 = this.abortController) == null ? void 0 : _b3.signal;
     const requestSignal = (options == null ? void 0 : options.signal) == null ? transportSignal : transportSignal == null ? options.signal : AbortSignal.any([transportSignal, options.signal]);
     const attempt = async (triedAuth = false) => {
-      var _a4, _b4;
+      var _a4, _b4, _c;
       try {
         const headers = await this.commonHeaders({
           "Content-Type": "application/json"
@@ -1587,14 +1609,17 @@ var SseMCPTransport = class {
         };
         const response = await this.fetchFn(endpoint.href, init);
         if (response.status === 401 && this.authProvider && !triedAuth) {
+          if (await this.accessTokenChanged(
+            (_a4 = new Headers(headers).get("authorization")) != null ? _a4 : void 0
+          )) {
+            return attempt(true);
+          }
           const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
           this.resourceMetadataUrl = resourceMetadataUrl;
-          const result = await auth(this.authProvider, {
-            serverUrl: this.url,
-            resourceMetadataUrl: this.resourceMetadataUrl,
-            scope,
-            fetchFn: this.fetchFn
-          });
+          const result = await this.authorizeOnce(
+            this.resourceMetadataUrl,
+            scope
+          );
           if (result !== "AUTHORIZED") {
             throw new UnauthorizedError();
           }
@@ -1611,10 +1636,10 @@ var SseMCPTransport = class {
           throw error;
         }
       } catch (error) {
-        if ((_a4 = options == null ? void 0 : options.signal) == null ? void 0 : _a4.aborted) {
+        if ((_b4 = options == null ? void 0 : options.signal) == null ? void 0 : _b4.aborted) {
           throw error;
         }
-        (_b4 = this.onerror) == null ? void 0 : _b4.call(this, error);
+        (_c = this.onerror) == null ? void 0 : _c.call(this, error);
         throw error;
       }
     };