@ai-sdk/mcp 1.0.90 → 1.0.91

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @ai-sdk/mcp
 
+## 1.0.91
+
+### Patch Changes
+
+- 5267a7a: Preserve stored OAuth credentials when an authorization-code exchange returns `invalid_grant`, without retrying the rejected code.
+
+  Add optional token context to `OAuthClientProvider.invalidateCredentials` so providers sharing storage can atomically delete only the rejected token generation and preserve tokens saved by a concurrent refresh.
+
 ## 1.0.90
 
 ### Patch Changes

package/dist/index.d.mts

@@ -184,8 +184,15 @@ interface OAuthClientProvider {
      * If implemented, provides a way for the client to invalidate (e.g. delete) the specified
      * credentials, in the case where the server has indicated that they are no longer valid.
      * This avoids requiring the user to intervene manually.
+     *
+     * For token invalidation, context identifies the token generation being invalidated
+     * when available. Providers sharing storage must atomically compare and delete
+     * that generation so a concurrent refresh's tokens are preserved. Omitting or
+     * ignoring context retains unconditional invalidation.
      */
-    invalidateCredentials?(scope: 'all' | 'client' | 'tokens' | 'verifier'): void | Promise<void>;
+    invalidateCredentials?(scope: 'all' | 'client' | 'tokens' | 'verifier', context?: {
+        tokens: OAuthTokens;
+    }): void | Promise<void>;
     get redirectUrl(): string | URL;
     get clientMetadata(): OAuthClientMetadata;
     clientInformation(): OAuthClientInformation | undefined | Promise<OAuthClientInformation | undefined>;

package/dist/index.d.ts

@@ -184,8 +184,15 @@ interface OAuthClientProvider {
      * If implemented, provides a way for the client to invalidate (e.g. delete) the specified
      * credentials, in the case where the server has indicated that they are no longer valid.
      * This avoids requiring the user to intervene manually.
+     *
+     * For token invalidation, context identifies the token generation being invalidated
+     * when available. Providers sharing storage must atomically compare and delete
+     * that generation so a concurrent refresh's tokens are preserved. Omitting or
+     * ignoring context retains unconditional invalidation.
      */
-    invalidateCredentials?(scope: 'all' | 'client' | 'tokens' | 'verifier'): void | Promise<void>;
+    invalidateCredentials?(scope: 'all' | 'client' | 'tokens' | 'verifier', context?: {
+        tokens: OAuthTokens;
+    }): void | Promise<void>;
     get redirectUrl(): string | URL;
     get clientMetadata(): OAuthClientMetadata;
     clientInformation(): OAuthClientInformation | undefined | Promise<OAuthClientInformation | undefined>;

package/dist/index.js

@@ -1215,8 +1215,9 @@ async function registerClient(authorizationServerUrl, {
 }
 async function auth(provider, options) {
   var _a3, _b3, _c;
+  const refreshAttempt = {};
   try {
-    return await authInternal(provider, options);
+    return await authInternal(provider, options, refreshAttempt);
   } catch (error) {
     if (error instanceof InvalidClientError || error instanceof UnauthorizedClientError) {
       if (options.authorizationCode !== void 0 || !await ((_a3 = provider.isClientInformationDynamicallyRegistered) == null ? void 0 : _a3.call(provider))) {
@@ -1224,8 +1225,10 @@ async function auth(provider, options) {
       }
       await ((_b3 = provider.invalidateCredentials) == null ? void 0 : _b3.call(provider, "all"));
       return await authInternal(provider, options);
-    } else if (error instanceof InvalidGrantError) {
-      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens"));
+    } else if (error instanceof InvalidGrantError && refreshAttempt.tokens) {
+      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens", {
+        tokens: refreshAttempt.tokens
+      }));
       return await authInternal(provider, options);
     }
     throw error;
@@ -1259,7 +1262,7 @@ async function authInternal(provider, {
   scope,
   resourceMetadataUrl,
   fetchFn
-}) {
+}, refreshAttempt) {
   var _a3, _b3, _c;
   let resourceMetadata;
   let authorizationServerUrl;
@@ -1403,10 +1406,15 @@ async function authInternal(provider, {
         currentAuthorizationServerInformation
       });
     } else {
-      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens"));
+      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens", {
+        tokens: { ...tokens }
+      }));
     }
     try {
       if (storedAuthorizationServerInformation) {
+        if (refreshAttempt) {
+          refreshAttempt.tokens = { ...tokens };
+        }
         const newTokens = await refreshAuthorization(authorizationServerUrl, {
           metadata,
           clientInformation,