@ai-sdk/mcp 1.0.90 → 1.0.92

package/dist/index.mjs

@@ -835,8 +835,10 @@ function buildDiscoveryUrls(authorizationServerUrl) {
     type: "oidc",
     expectedIssuer: pathIssuer
   });
+  const oidcDiscoveryUrl = new URL(url.origin);
+  oidcDiscoveryUrl.pathname = `${pathname}/.well-known/openid-configuration`;
   urlsToTry.push({
-    url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),
+    url: oidcDiscoveryUrl,
     type: "oidc",
     expectedIssuer: pathIssuer
   });
@@ -857,7 +859,13 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, {
 } = {}) {
   var _a3;
   const headers = { "MCP-Protocol-Version": protocolVersion };
+  const authorizationServerOrigin = new URL(authorizationServerUrl).origin;
   const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
+  if (urlsToTry.some(({ url }) => url.origin !== authorizationServerOrigin)) {
+    throw new MCPClientOAuthError({
+      message: "OAuth discovery URL changed authorization-server origin"
+    });
+  }
   for (const { url: endpointUrl, type, expectedIssuer } of urlsToTry) {
     const response = await fetchWithCorsRetry(
       endpointUrl,
@@ -1190,8 +1198,9 @@ async function registerClient(authorizationServerUrl, {
 }
 async function auth(provider, options) {
   var _a3, _b3, _c;
+  const refreshAttempt = {};
   try {
-    return await authInternal(provider, options);
+    return await authInternal(provider, options, refreshAttempt);
   } catch (error) {
     if (error instanceof InvalidClientError || error instanceof UnauthorizedClientError) {
       if (options.authorizationCode !== void 0 || !await ((_a3 = provider.isClientInformationDynamicallyRegistered) == null ? void 0 : _a3.call(provider))) {
@@ -1199,8 +1208,10 @@ async function auth(provider, options) {
       }
       await ((_b3 = provider.invalidateCredentials) == null ? void 0 : _b3.call(provider, "all"));
       return await authInternal(provider, options);
-    } else if (error instanceof InvalidGrantError) {
-      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens"));
+    } else if (error instanceof InvalidGrantError && refreshAttempt.tokens) {
+      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens", {
+        tokens: refreshAttempt.tokens
+      }));
       return await authInternal(provider, options);
     }
     throw error;
@@ -1234,7 +1245,7 @@ async function authInternal(provider, {
   scope,
   resourceMetadataUrl,
   fetchFn
-}) {
+}, refreshAttempt) {
   var _a3, _b3, _c;
   let resourceMetadata;
   let authorizationServerUrl;
@@ -1378,10 +1389,15 @@ async function authInternal(provider, {
         currentAuthorizationServerInformation
       });
     } else {
-      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens"));
+      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens", {
+        tokens: { ...tokens }
+      }));
     }
     try {
       if (storedAuthorizationServerInformation) {
+        if (refreshAttempt) {
+          refreshAttempt.tokens = { ...tokens };
+        }
         const newTokens = await refreshAuthorization(authorizationServerUrl, {
           metadata,
           clientInformation,