@ai-sdk/mcp 2.0.0-beta.6 → 2.0.0-beta.67

package/dist/index.js

@@ -1,79 +1,56 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name3 in all)
-    __defProp(target, name3, { get: all[name3], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  ElicitResultSchema: () => ElicitResultSchema,
-  ElicitationRequestSchema: () => ElicitationRequestSchema,
-  UnauthorizedError: () => UnauthorizedError,
-  auth: () => auth,
-  createMCPClient: () => createMCPClient,
-  experimental_createMCPClient: () => createMCPClient
-});
-module.exports = __toCommonJS(index_exports);
-
 // src/tool/mcp-client.ts
-var import_provider_utils3 = require("@ai-sdk/provider-utils");
+import {
+  asSchema,
+  dynamicTool,
+  jsonSchema,
+  safeParseJSON,
+  safeValidateTypes,
+  tool
+} from "@ai-sdk/provider-utils";
 
 // src/error/mcp-client-error.ts
-var import_provider = require("@ai-sdk/provider");
+import { AISDKError } from "@ai-sdk/provider";
 var name = "AI_MCPClientError";
 var marker = `vercel.ai.error.${name}`;
 var symbol = Symbol.for(marker);
 var _a, _b;
-var MCPClientError = class extends (_b = import_provider.AISDKError, _a = symbol, _b) {
+var MCPClientError = class extends (_b = AISDKError, _a = symbol, _b) {
   constructor({
     name: name3 = "MCPClientError",
     message,
     cause,
     data,
-    code
+    code,
+    statusCode,
+    url,
+    responseBody
   }) {
     super({ name: name3, message, cause });
     this[_a] = true;
     this.data = data;
     this.code = code;
+    this.statusCode = statusCode;
+    this.url = url;
+    this.responseBody = responseBody;
   }
   static isInstance(error) {
-    return import_provider.AISDKError.hasMarker(error, marker);
+    return AISDKError.hasMarker(error, marker);
   }
 };
 
 // src/tool/mcp-sse-transport.ts
-var import_provider_utils = require("@ai-sdk/provider-utils");
+import {
+  EventSourceParserStream,
+  withUserAgentSuffix,
+  getRuntimeEnvironmentUserAgent
+} from "@ai-sdk/provider-utils";
 
 // src/tool/json-rpc-message.ts
-var import_v42 = require("zod/v4");
+import { parseJSON } from "@ai-sdk/provider-utils";
+import { z as z2 } from "zod/v4";
 
 // src/tool/types.ts
-var import_v4 = require("zod/v4");
+import { z } from "zod/v4";
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,
@@ -81,356 +58,377 @@ var SUPPORTED_PROTOCOL_VERSIONS = [
   "2025-03-26",
   "2024-11-05"
 ];
-var ToolMetaSchema = import_v4.z.optional(import_v4.z.record(import_v4.z.string(), import_v4.z.unknown()));
-var ClientOrServerImplementationSchema = import_v4.z.looseObject({
-  name: import_v4.z.string(),
-  version: import_v4.z.string()
+var ToolMetaSchema = z.optional(z.record(z.string(), z.unknown()));
+var ClientOrServerImplementationSchema = z.looseObject({
+  name: z.string(),
+  version: z.string(),
+  title: z.optional(z.string())
 });
-var BaseParamsSchema = import_v4.z.looseObject({
-  _meta: import_v4.z.optional(import_v4.z.object({}).loose())
+var BaseParamsSchema = z.looseObject({
+  _meta: z.optional(z.object({}).loose())
 });
 var ResultSchema = BaseParamsSchema;
-var RequestSchema = import_v4.z.object({
-  method: import_v4.z.string(),
-  params: import_v4.z.optional(BaseParamsSchema)
+var RequestSchema = z.object({
+  method: z.string(),
+  params: z.optional(BaseParamsSchema)
 });
-var ElicitationCapabilitySchema = import_v4.z.object({
-  applyDefaults: import_v4.z.optional(import_v4.z.boolean())
+var ElicitationCapabilitySchema = z.object({
+  applyDefaults: z.optional(z.boolean())
 }).loose();
-var ServerCapabilitiesSchema = import_v4.z.looseObject({
-  experimental: import_v4.z.optional(import_v4.z.object({}).loose()),
-  logging: import_v4.z.optional(import_v4.z.object({}).loose()),
-  prompts: import_v4.z.optional(
-    import_v4.z.looseObject({
-      listChanged: import_v4.z.optional(import_v4.z.boolean())
+var ServerCapabilitiesSchema = z.looseObject({
+  experimental: z.optional(z.object({}).loose()),
+  logging: z.optional(z.object({}).loose()),
+  prompts: z.optional(
+    z.looseObject({
+      listChanged: z.optional(z.boolean())
     })
   ),
-  resources: import_v4.z.optional(
-    import_v4.z.looseObject({
-      subscribe: import_v4.z.optional(import_v4.z.boolean()),
-      listChanged: import_v4.z.optional(import_v4.z.boolean())
+  resources: z.optional(
+    z.looseObject({
+      subscribe: z.optional(z.boolean()),
+      listChanged: z.optional(z.boolean())
     })
   ),
-  tools: import_v4.z.optional(
-    import_v4.z.looseObject({
-      listChanged: import_v4.z.optional(import_v4.z.boolean())
+  tools: z.optional(
+    z.looseObject({
+      listChanged: z.optional(z.boolean())
     })
   ),
-  elicitation: import_v4.z.optional(ElicitationCapabilitySchema)
+  elicitation: z.optional(ElicitationCapabilitySchema)
 });
-var ClientCapabilitiesSchema = import_v4.z.object({
-  elicitation: import_v4.z.optional(ElicitationCapabilitySchema)
+var ClientCapabilitiesSchema = z.object({
+  elicitation: z.optional(ElicitationCapabilitySchema)
 }).loose();
 var InitializeResultSchema = ResultSchema.extend({
-  protocolVersion: import_v4.z.string(),
+  protocolVersion: z.string(),
   capabilities: ServerCapabilitiesSchema,
   serverInfo: ClientOrServerImplementationSchema,
-  instructions: import_v4.z.optional(import_v4.z.string())
+  instructions: z.optional(z.string())
 });
 var PaginatedResultSchema = ResultSchema.extend({
-  nextCursor: import_v4.z.optional(import_v4.z.string())
+  nextCursor: z.optional(z.string())
 });
-var ToolSchema = import_v4.z.object({
-  name: import_v4.z.string(),
+var ToolSchema = z.object({
+  name: z.string(),
   /**
    * @see https://modelcontextprotocol.io/specification/2025-11-25/server/tools#tool
    */
-  title: import_v4.z.optional(import_v4.z.string()),
-  description: import_v4.z.optional(import_v4.z.string()),
-  inputSchema: import_v4.z.object({
-    type: import_v4.z.literal("object"),
-    properties: import_v4.z.optional(import_v4.z.object({}).loose())
+  title: z.optional(z.string()),
+  description: z.optional(z.string()),
+  inputSchema: z.object({
+    type: z.literal("object"),
+    properties: z.optional(z.object({}).loose())
   }).loose(),
   /**
    * @see https://modelcontextprotocol.io/specification/2025-06-18/server/tools#output-schema
    */
-  outputSchema: import_v4.z.optional(import_v4.z.object({}).loose()),
-  annotations: import_v4.z.optional(
-    import_v4.z.object({
-      title: import_v4.z.optional(import_v4.z.string())
+  outputSchema: z.optional(z.object({}).loose()),
+  annotations: z.optional(
+    z.object({
+      title: z.optional(z.string())
     }).loose()
   ),
   _meta: ToolMetaSchema
 }).loose();
 var ListToolsResultSchema = PaginatedResultSchema.extend({
-  tools: import_v4.z.array(ToolSchema)
+  tools: z.array(ToolSchema)
 });
-var TextContentSchema = import_v4.z.object({
-  type: import_v4.z.literal("text"),
-  text: import_v4.z.string()
+var TextContentSchema = z.object({
+  type: z.literal("text"),
+  text: z.string()
 }).loose();
-var ImageContentSchema = import_v4.z.object({
-  type: import_v4.z.literal("image"),
-  data: import_v4.z.base64(),
-  mimeType: import_v4.z.string()
+var ImageContentSchema = z.object({
+  type: z.literal("image"),
+  data: z.base64(),
+  mimeType: z.string()
 }).loose();
-var ResourceSchema = import_v4.z.object({
-  uri: import_v4.z.string(),
-  name: import_v4.z.string(),
-  title: import_v4.z.optional(import_v4.z.string()),
-  description: import_v4.z.optional(import_v4.z.string()),
-  mimeType: import_v4.z.optional(import_v4.z.string()),
-  size: import_v4.z.optional(import_v4.z.number())
+var ResourceSchema = z.object({
+  uri: z.string(),
+  name: z.string(),
+  title: z.optional(z.string()),
+  description: z.optional(z.string()),
+  mimeType: z.optional(z.string()),
+  size: z.optional(z.number())
 }).loose();
 var ListResourcesResultSchema = PaginatedResultSchema.extend({
-  resources: import_v4.z.array(ResourceSchema)
+  resources: z.array(ResourceSchema)
 });
-var ResourceContentsSchema = import_v4.z.object({
+var ResourceContentsSchema = z.object({
   /**
    * The URI of this resource.
    */
-  uri: import_v4.z.string(),
+  uri: z.string(),
   /**
    * Optional display name of the resource content.
    */
-  name: import_v4.z.optional(import_v4.z.string()),
+  name: z.optional(z.string()),
   /**
    * Optional human readable title.
    */
-  title: import_v4.z.optional(import_v4.z.string()),
+  title: z.optional(z.string()),
   /**
    * The MIME type of this resource, if known.
    */
-  mimeType: import_v4.z.optional(import_v4.z.string())
+  mimeType: z.optional(z.string())
 }).loose();
 var TextResourceContentsSchema = ResourceContentsSchema.extend({
-  text: import_v4.z.string()
+  text: z.string()
 });
 var BlobResourceContentsSchema = ResourceContentsSchema.extend({
-  blob: import_v4.z.base64()
+  blob: z.base64()
 });
-var EmbeddedResourceSchema = import_v4.z.object({
-  type: import_v4.z.literal("resource"),
-  resource: import_v4.z.union([TextResourceContentsSchema, BlobResourceContentsSchema])
+var EmbeddedResourceSchema = z.object({
+  type: z.literal("resource"),
+  resource: z.union([TextResourceContentsSchema, BlobResourceContentsSchema])
+}).loose();
+var ResourceLinkContentSchema = z.object({
+  type: z.literal("resource_link"),
+  uri: z.string(),
+  name: z.string(),
+  description: z.optional(z.string()),
+  mimeType: z.optional(z.string())
 }).loose();
 var CallToolResultSchema = ResultSchema.extend({
-  content: import_v4.z.array(
-    import_v4.z.union([TextContentSchema, ImageContentSchema, EmbeddedResourceSchema])
+  content: z.array(
+    z.union([
+      TextContentSchema,
+      ImageContentSchema,
+      EmbeddedResourceSchema,
+      ResourceLinkContentSchema
+    ])
   ),
   /**
    * @see https://modelcontextprotocol.io/specification/2025-06-18/server/tools#structured-content
    */
-  structuredContent: import_v4.z.optional(import_v4.z.unknown()),
-  isError: import_v4.z.boolean().default(false).optional()
+  structuredContent: z.optional(z.unknown()),
+  isError: z.boolean().default(false).optional()
 }).or(
   ResultSchema.extend({
-    toolResult: import_v4.z.unknown()
+    toolResult: z.unknown()
   })
 );
-var ResourceTemplateSchema = import_v4.z.object({
-  uriTemplate: import_v4.z.string(),
-  name: import_v4.z.string(),
-  title: import_v4.z.optional(import_v4.z.string()),
-  description: import_v4.z.optional(import_v4.z.string()),
-  mimeType: import_v4.z.optional(import_v4.z.string())
+var ResourceTemplateSchema = z.object({
+  uriTemplate: z.string(),
+  name: z.string(),
+  title: z.optional(z.string()),
+  description: z.optional(z.string()),
+  mimeType: z.optional(z.string())
 }).loose();
 var ListResourceTemplatesResultSchema = ResultSchema.extend({
-  resourceTemplates: import_v4.z.array(ResourceTemplateSchema)
+  resourceTemplates: z.array(ResourceTemplateSchema)
 });
 var ReadResourceResultSchema = ResultSchema.extend({
-  contents: import_v4.z.array(
-    import_v4.z.union([TextResourceContentsSchema, BlobResourceContentsSchema])
+  contents: z.array(
+    z.union([TextResourceContentsSchema, BlobResourceContentsSchema])
   )
 });
-var PromptArgumentSchema = import_v4.z.object({
-  name: import_v4.z.string(),
-  description: import_v4.z.optional(import_v4.z.string()),
-  required: import_v4.z.optional(import_v4.z.boolean())
+var PromptArgumentSchema = z.object({
+  name: z.string(),
+  description: z.optional(z.string()),
+  required: z.optional(z.boolean())
 }).loose();
-var PromptSchema = import_v4.z.object({
-  name: import_v4.z.string(),
-  title: import_v4.z.optional(import_v4.z.string()),
-  description: import_v4.z.optional(import_v4.z.string()),
-  arguments: import_v4.z.optional(import_v4.z.array(PromptArgumentSchema))
+var PromptSchema = z.object({
+  name: z.string(),
+  title: z.optional(z.string()),
+  description: z.optional(z.string()),
+  arguments: z.optional(z.array(PromptArgumentSchema))
 }).loose();
 var ListPromptsResultSchema = PaginatedResultSchema.extend({
-  prompts: import_v4.z.array(PromptSchema)
+  prompts: z.array(PromptSchema)
 });
-var PromptMessageSchema = import_v4.z.object({
-  role: import_v4.z.union([import_v4.z.literal("user"), import_v4.z.literal("assistant")]),
-  content: import_v4.z.union([
+var PromptMessageSchema = z.object({
+  role: z.union([z.literal("user"), z.literal("assistant")]),
+  content: z.union([
     TextContentSchema,
     ImageContentSchema,
-    EmbeddedResourceSchema
+    EmbeddedResourceSchema,
+    ResourceLinkContentSchema
   ])
 }).loose();
 var GetPromptResultSchema = ResultSchema.extend({
-  description: import_v4.z.optional(import_v4.z.string()),
-  messages: import_v4.z.array(PromptMessageSchema)
+  description: z.optional(z.string()),
+  messages: z.array(PromptMessageSchema)
 });
 var ElicitationRequestParamsSchema = BaseParamsSchema.extend({
-  message: import_v4.z.string(),
-  requestedSchema: import_v4.z.unknown()
+  message: z.string(),
+  requestedSchema: z.unknown()
 });
 var ElicitationRequestSchema = RequestSchema.extend({
-  method: import_v4.z.literal("elicitation/create"),
+  method: z.literal("elicitation/create"),
   params: ElicitationRequestParamsSchema
 });
 var ElicitResultSchema = ResultSchema.extend({
-  action: import_v4.z.union([
-    import_v4.z.literal("accept"),
-    import_v4.z.literal("decline"),
-    import_v4.z.literal("cancel")
+  action: z.union([
+    z.literal("accept"),
+    z.literal("decline"),
+    z.literal("cancel")
   ]),
-  content: import_v4.z.optional(import_v4.z.record(import_v4.z.string(), import_v4.z.unknown()))
+  content: z.optional(z.record(z.string(), z.unknown()))
 });
 
 // src/tool/json-rpc-message.ts
 var JSONRPC_VERSION = "2.0";
-var JSONRPCRequestSchema = import_v42.z.object({
-  jsonrpc: import_v42.z.literal(JSONRPC_VERSION),
-  id: import_v42.z.union([import_v42.z.string(), import_v42.z.number().int()])
+var JSONRPCRequestSchema = z2.object({
+  jsonrpc: z2.literal(JSONRPC_VERSION),
+  id: z2.union([z2.string(), z2.number().int()])
 }).merge(RequestSchema).strict();
-var JSONRPCResponseSchema = import_v42.z.object({
-  jsonrpc: import_v42.z.literal(JSONRPC_VERSION),
-  id: import_v42.z.union([import_v42.z.string(), import_v42.z.number().int()]),
+var JSONRPCResponseSchema = z2.object({
+  jsonrpc: z2.literal(JSONRPC_VERSION),
+  id: z2.union([z2.string(), z2.number().int()]),
   result: ResultSchema
 }).strict();
-var JSONRPCErrorSchema = import_v42.z.object({
-  jsonrpc: import_v42.z.literal(JSONRPC_VERSION),
-  id: import_v42.z.union([import_v42.z.string(), import_v42.z.number().int()]),
-  error: import_v42.z.object({
-    code: import_v42.z.number().int(),
-    message: import_v42.z.string(),
-    data: import_v42.z.optional(import_v42.z.unknown())
+var JSONRPCErrorSchema = z2.object({
+  jsonrpc: z2.literal(JSONRPC_VERSION),
+  id: z2.union([z2.string(), z2.number().int()]),
+  error: z2.object({
+    code: z2.number().int(),
+    message: z2.string(),
+    data: z2.optional(z2.unknown())
   })
 }).strict();
-var JSONRPCNotificationSchema = import_v42.z.object({
-  jsonrpc: import_v42.z.literal(JSONRPC_VERSION)
+var JSONRPCNotificationSchema = z2.object({
+  jsonrpc: z2.literal(JSONRPC_VERSION)
 }).merge(
-  import_v42.z.object({
-    method: import_v42.z.string(),
-    params: import_v42.z.optional(BaseParamsSchema)
+  z2.object({
+    method: z2.string(),
+    params: z2.optional(BaseParamsSchema)
   })
 ).strict();
-var JSONRPCMessageSchema = import_v42.z.union([
+var JSONRPCMessageSchema = z2.union([
   JSONRPCRequestSchema,
   JSONRPCNotificationSchema,
   JSONRPCResponseSchema,
   JSONRPCErrorSchema
 ]);
+async function parseJSONRPCMessage(text) {
+  return JSONRPCMessageSchema.parse(await parseJSON({ text }));
+}
 
 // src/version.ts
 var VERSION = typeof __PACKAGE_VERSION__ !== "undefined" ? __PACKAGE_VERSION__ : "0.0.0-test";
 
 // src/tool/oauth.ts
-var import_pkce_challenge = __toESM(require("pkce-challenge"));
+import pkceChallenge from "pkce-challenge";
 
 // src/tool/oauth-types.ts
-var import_v43 = require("zod/v4");
-var OAuthTokensSchema = import_v43.z.object({
-  access_token: import_v43.z.string(),
-  id_token: import_v43.z.string().optional(),
-  // Optional for OAuth 2.1, but necessary in OpenID Connect
-  token_type: import_v43.z.string(),
-  expires_in: import_v43.z.number().optional(),
-  scope: import_v43.z.string().optional(),
-  refresh_token: import_v43.z.string().optional()
-}).strip();
-var SafeUrlSchema = import_v43.z.string().url().superRefine((val, ctx) => {
+import { z as z3 } from "zod/v4";
+var SafeUrlSchema = z3.string().url().superRefine((val, ctx) => {
   if (!URL.canParse(val)) {
     ctx.addIssue({
-      code: import_v43.z.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       message: "URL must be parseable",
       fatal: true
     });
-    return import_v43.z.NEVER;
+    return z3.NEVER;
   }
 }).refine(
   (url) => {
-    const u = new URL(url);
-    return u.protocol !== "javascript:" && u.protocol !== "data:" && u.protocol !== "vbscript:";
+    const parsedUrl = new URL(url);
+    return parsedUrl.protocol !== "javascript:" && parsedUrl.protocol !== "data:" && parsedUrl.protocol !== "vbscript:";
   },
   { message: "URL cannot use javascript:, data:, or vbscript: scheme" }
 );
-var OAuthProtectedResourceMetadataSchema = import_v43.z.object({
-  resource: import_v43.z.string().url(),
-  authorization_servers: import_v43.z.array(SafeUrlSchema).optional(),
-  jwks_uri: import_v43.z.string().url().optional(),
-  scopes_supported: import_v43.z.array(import_v43.z.string()).optional(),
-  bearer_methods_supported: import_v43.z.array(import_v43.z.string()).optional(),
-  resource_signing_alg_values_supported: import_v43.z.array(import_v43.z.string()).optional(),
-  resource_name: import_v43.z.string().optional(),
-  resource_documentation: import_v43.z.string().optional(),
-  resource_policy_uri: import_v43.z.string().url().optional(),
-  resource_tos_uri: import_v43.z.string().url().optional(),
-  tls_client_certificate_bound_access_tokens: import_v43.z.boolean().optional(),
-  authorization_details_types_supported: import_v43.z.array(import_v43.z.string()).optional(),
-  dpop_signing_alg_values_supported: import_v43.z.array(import_v43.z.string()).optional(),
-  dpop_bound_access_tokens_required: import_v43.z.boolean().optional()
+var OAuthTokensSchema = z3.object({
+  access_token: z3.string(),
+  id_token: z3.string().optional(),
+  // Optional for OAuth 2.1, but necessary in OpenID Connect
+  token_type: z3.string(),
+  expires_in: z3.number().optional(),
+  scope: z3.string().optional(),
+  refresh_token: z3.string().optional(),
+  authorization_server: SafeUrlSchema.optional(),
+  token_endpoint: SafeUrlSchema.optional()
+}).strip();
+var OAuthProtectedResourceMetadataSchema = z3.object({
+  resource: z3.string().url(),
+  authorization_servers: z3.array(SafeUrlSchema).optional(),
+  jwks_uri: z3.string().url().optional(),
+  scopes_supported: z3.array(z3.string()).optional(),
+  bearer_methods_supported: z3.array(z3.string()).optional(),
+  resource_signing_alg_values_supported: z3.array(z3.string()).optional(),
+  resource_name: z3.string().optional(),
+  resource_documentation: z3.string().optional(),
+  resource_policy_uri: z3.string().url().optional(),
+  resource_tos_uri: z3.string().url().optional(),
+  tls_client_certificate_bound_access_tokens: z3.boolean().optional(),
+  authorization_details_types_supported: z3.array(z3.string()).optional(),
+  dpop_signing_alg_values_supported: z3.array(z3.string()).optional(),
+  dpop_bound_access_tokens_required: z3.boolean().optional()
 }).passthrough();
-var OAuthMetadataSchema = import_v43.z.object({
-  issuer: import_v43.z.string(),
+var OAuthMetadataSchema = z3.object({
+  issuer: z3.string(),
   authorization_endpoint: SafeUrlSchema,
   token_endpoint: SafeUrlSchema,
   registration_endpoint: SafeUrlSchema.optional(),
-  scopes_supported: import_v43.z.array(import_v43.z.string()).optional(),
-  response_types_supported: import_v43.z.array(import_v43.z.string()),
-  grant_types_supported: import_v43.z.array(import_v43.z.string()).optional(),
-  code_challenge_methods_supported: import_v43.z.array(import_v43.z.string()),
-  token_endpoint_auth_methods_supported: import_v43.z.array(import_v43.z.string()).optional(),
-  token_endpoint_auth_signing_alg_values_supported: import_v43.z.array(import_v43.z.string()).optional()
+  scopes_supported: z3.array(z3.string()).optional(),
+  response_types_supported: z3.array(z3.string()),
+  grant_types_supported: z3.array(z3.string()).optional(),
+  code_challenge_methods_supported: z3.array(z3.string()),
+  token_endpoint_auth_methods_supported: z3.array(z3.string()).optional(),
+  token_endpoint_auth_signing_alg_values_supported: z3.array(z3.string()).optional()
 }).passthrough();
-var OpenIdProviderMetadataSchema = import_v43.z.object({
-  issuer: import_v43.z.string(),
+var OpenIdProviderMetadataSchema = z3.object({
+  issuer: z3.string(),
   authorization_endpoint: SafeUrlSchema,
   token_endpoint: SafeUrlSchema,
   userinfo_endpoint: SafeUrlSchema.optional(),
   jwks_uri: SafeUrlSchema,
   registration_endpoint: SafeUrlSchema.optional(),
-  scopes_supported: import_v43.z.array(import_v43.z.string()).optional(),
-  response_types_supported: import_v43.z.array(import_v43.z.string()),
-  grant_types_supported: import_v43.z.array(import_v43.z.string()).optional(),
-  subject_types_supported: import_v43.z.array(import_v43.z.string()),
-  id_token_signing_alg_values_supported: import_v43.z.array(import_v43.z.string()),
-  claims_supported: import_v43.z.array(import_v43.z.string()).optional(),
-  token_endpoint_auth_methods_supported: import_v43.z.array(import_v43.z.string()).optional()
+  scopes_supported: z3.array(z3.string()).optional(),
+  response_types_supported: z3.array(z3.string()),
+  grant_types_supported: z3.array(z3.string()).optional(),
+  subject_types_supported: z3.array(z3.string()),
+  id_token_signing_alg_values_supported: z3.array(z3.string()),
+  claims_supported: z3.array(z3.string()).optional(),
+  token_endpoint_auth_methods_supported: z3.array(z3.string()).optional()
 }).passthrough();
 var OpenIdProviderDiscoveryMetadataSchema = OpenIdProviderMetadataSchema.merge(
   OAuthMetadataSchema.pick({
     code_challenge_methods_supported: true
   })
 );
-var OAuthClientInformationSchema = import_v43.z.object({
-  client_id: import_v43.z.string(),
-  client_secret: import_v43.z.string().optional(),
-  client_id_issued_at: import_v43.z.number().optional(),
-  client_secret_expires_at: import_v43.z.number().optional()
+var OAuthClientInformationSchema = z3.object({
+  client_id: z3.string(),
+  client_secret: z3.string().optional(),
+  client_id_issued_at: z3.number().optional(),
+  client_secret_expires_at: z3.number().optional(),
+  authorization_server: SafeUrlSchema.optional(),
+  token_endpoint: SafeUrlSchema.optional()
 }).strip();
-var OAuthClientMetadataSchema = import_v43.z.object({
-  redirect_uris: import_v43.z.array(SafeUrlSchema),
-  token_endpoint_auth_method: import_v43.z.string().optional(),
-  grant_types: import_v43.z.array(import_v43.z.string()).optional(),
-  response_types: import_v43.z.array(import_v43.z.string()).optional(),
-  client_name: import_v43.z.string().optional(),
+var OAuthClientMetadataSchema = z3.object({
+  redirect_uris: z3.array(SafeUrlSchema),
+  token_endpoint_auth_method: z3.string().optional(),
+  grant_types: z3.array(z3.string()).optional(),
+  response_types: z3.array(z3.string()).optional(),
+  client_name: z3.string().optional(),
   client_uri: SafeUrlSchema.optional(),
   logo_uri: SafeUrlSchema.optional(),
-  scope: import_v43.z.string().optional(),
-  contacts: import_v43.z.array(import_v43.z.string()).optional(),
+  scope: z3.string().optional(),
+  contacts: z3.array(z3.string()).optional(),
   tos_uri: SafeUrlSchema.optional(),
-  policy_uri: import_v43.z.string().optional(),
+  policy_uri: z3.string().optional(),
   jwks_uri: SafeUrlSchema.optional(),
-  jwks: import_v43.z.any().optional(),
-  software_id: import_v43.z.string().optional(),
-  software_version: import_v43.z.string().optional(),
-  software_statement: import_v43.z.string().optional()
+  jwks: z3.any().optional(),
+  software_id: z3.string().optional(),
+  software_version: z3.string().optional(),
+  software_statement: z3.string().optional()
 }).strip();
-var OAuthErrorResponseSchema = import_v43.z.object({
-  error: import_v43.z.string(),
-  error_description: import_v43.z.string().optional(),
-  error_uri: import_v43.z.string().optional()
+var OAuthErrorResponseSchema = z3.object({
+  error: z3.string(),
+  error_description: z3.string().optional(),
+  error_uri: z3.string().optional()
 });
 var OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(
   OAuthClientInformationSchema
 );
 
 // src/error/oauth-error.ts
-var import_provider2 = require("@ai-sdk/provider");
+import { AISDKError as AISDKError2 } from "@ai-sdk/provider";
 var name2 = "AI_MCPClientOAuthError";
 var marker2 = `vercel.ai.error.${name2}`;
 var symbol2 = Symbol.for(marker2);
 var _a2, _b2;
-var MCPClientOAuthError = class extends (_b2 = import_provider2.AISDKError, _a2 = symbol2, _b2) {
+var MCPClientOAuthError = class extends (_b2 = AISDKError2, _a2 = symbol2, _b2) {
   constructor({
     name: name3 = "MCPClientOAuthError",
     message,
@@ -440,7 +438,7 @@ var MCPClientOAuthError = class extends (_b2 = import_provider2.AISDKError, _a2
     this[_a2] = true;
   }
   static isInstance(error) {
-    return import_provider2.AISDKError.hasMarker(error, marker2);
+    return AISDKError2.hasMarker(error, marker2);
   }
 };
 var ServerError = class extends MCPClientOAuthError {
@@ -468,6 +466,13 @@ function resourceUrlFromServerUrl(url) {
   resourceURL.hash = "";
   return resourceURL;
 }
+function resourceUrlStripSlash(resource) {
+  const href = resource.href;
+  if (resource.pathname === "/" && href.endsWith("/")) {
+    return href.slice(0, -1);
+  }
+  return href;
+}
 function checkResourceAllowed({
   requestedResource,
   configuredResource
@@ -486,12 +491,113 @@ function checkResourceAllowed({
 }
 
 // src/tool/oauth.ts
+import { parseJSON as parseJSON2 } from "@ai-sdk/provider-utils";
 var UnauthorizedError = class extends Error {
   constructor(message = "Unauthorized") {
     super(message);
     this.name = "UnauthorizedError";
   }
 };
+function normalizeUrl(url) {
+  return new URL(url).href;
+}
+function createAuthorizationServerInformation(authorizationServerUrl, metadata) {
+  return {
+    authorizationServerUrl: normalizeUrl(authorizationServerUrl),
+    tokenEndpoint: normalizeUrl(
+      (metadata == null ? void 0 : metadata.token_endpoint) ? new URL(metadata.token_endpoint) : new URL("/token", authorizationServerUrl)
+    )
+  };
+}
+function addAuthorizationServerInformationToTokens(tokens, authorizationServerInformation) {
+  return {
+    ...tokens,
+    authorization_server: authorizationServerInformation.authorizationServerUrl,
+    token_endpoint: authorizationServerInformation.tokenEndpoint
+  };
+}
+function addAuthorizationServerInformationToClientInformation(clientInformation, authorizationServerInformation) {
+  return {
+    ...clientInformation,
+    authorization_server: authorizationServerInformation.authorizationServerUrl,
+    token_endpoint: authorizationServerInformation.tokenEndpoint
+  };
+}
+function getAuthorizationServerInformationFromCredentials(credentials) {
+  if (!(credentials == null ? void 0 : credentials.authorization_server) || !credentials.token_endpoint) {
+    return void 0;
+  }
+  return {
+    authorizationServerUrl: normalizeUrl(credentials.authorization_server),
+    tokenEndpoint: normalizeUrl(credentials.token_endpoint)
+  };
+}
+async function getStoredAuthorizationServerInformation({
+  provider,
+  clientInformation,
+  tokens
+}) {
+  var _a3;
+  const tokenAuthorizationServerInformation = getAuthorizationServerInformationFromCredentials(tokens);
+  if (tokenAuthorizationServerInformation) {
+    return tokenAuthorizationServerInformation;
+  }
+  const providerAuthorizationServerInformation = await ((_a3 = provider.authorizationServerInformation) == null ? void 0 : _a3.call(provider));
+  if (providerAuthorizationServerInformation) {
+    return {
+      authorizationServerUrl: normalizeUrl(
+        providerAuthorizationServerInformation.authorizationServerUrl
+      ),
+      tokenEndpoint: normalizeUrl(
+        providerAuthorizationServerInformation.tokenEndpoint
+      )
+    };
+  }
+  return getAuthorizationServerInformationFromCredentials(clientInformation);
+}
+async function saveAuthorizationServerInformation({
+  provider,
+  clientInformation,
+  authorizationServerInformation
+}) {
+  if (provider.saveAuthorizationServerInformation) {
+    await provider.saveAuthorizationServerInformation(
+      authorizationServerInformation
+    );
+    return true;
+  }
+  if (provider.saveClientInformation) {
+    await provider.saveClientInformation(
+      addAuthorizationServerInformationToClientInformation(
+        clientInformation,
+        authorizationServerInformation
+      )
+    );
+    return true;
+  }
+  return false;
+}
+function assertResourceMetadataUrlSameOrigin(serverUrl, resourceMetadataUrl) {
+  if (!resourceMetadataUrl) {
+    return;
+  }
+  const expectedOrigin = new URL(serverUrl).origin;
+  if (resourceMetadataUrl.origin !== expectedOrigin) {
+    throw new MCPClientOAuthError({
+      message: `OAuth protected resource metadata URL ${resourceMetadataUrl.href} must have the same origin as the MCP server URL ${expectedOrigin}`
+    });
+  }
+}
+function assertAuthorizationServerInformationMatches({
+  storedAuthorizationServerInformation,
+  currentAuthorizationServerInformation
+}) {
+  if (storedAuthorizationServerInformation.authorizationServerUrl !== currentAuthorizationServerInformation.authorizationServerUrl || storedAuthorizationServerInformation.tokenEndpoint !== currentAuthorizationServerInformation.tokenEndpoint) {
+    throw new MCPClientOAuthError({
+      message: "OAuth authorization server metadata does not match the metadata that issued the stored credentials"
+    });
+  }
+}
 function extractResourceMetadataUrl(response) {
   var _a3;
   const header = (_a3 = response.headers.get("www-authenticate")) != null ? _a3 : response.headers.get("WWW-Authenticate");
@@ -586,15 +692,18 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn =
 function buildDiscoveryUrls(authorizationServerUrl) {
   const url = typeof authorizationServerUrl === "string" ? new URL(authorizationServerUrl) : authorizationServerUrl;
   const hasPath = url.pathname !== "/";
+  const rootIssuer = url.origin;
   const urlsToTry = [];
   if (!hasPath) {
     urlsToTry.push({
       url: new URL("/.well-known/oauth-authorization-server", url.origin),
-      type: "oauth"
+      type: "oauth",
+      expectedIssuer: rootIssuer
     });
     urlsToTry.push({
       url: new URL("/.well-known/openid-configuration", url.origin),
-      type: "oidc"
+      type: "oidc",
+      expectedIssuer: rootIssuer
     });
     return urlsToTry;
   }
@@ -602,27 +711,39 @@ function buildDiscoveryUrls(authorizationServerUrl) {
   if (pathname.endsWith("/")) {
     pathname = pathname.slice(0, -1);
   }
+  const pathIssuer = `${url.origin}${pathname}`;
   urlsToTry.push({
     url: new URL(
       `/.well-known/oauth-authorization-server${pathname}`,
       url.origin
     ),
-    type: "oauth"
+    type: "oauth",
+    expectedIssuer: pathIssuer
   });
   urlsToTry.push({
     url: new URL("/.well-known/oauth-authorization-server", url.origin),
-    type: "oauth"
+    type: "oauth",
+    expectedIssuer: rootIssuer
   });
   urlsToTry.push({
     url: new URL(`/.well-known/openid-configuration${pathname}`, url.origin),
-    type: "oidc"
+    type: "oidc",
+    expectedIssuer: pathIssuer
   });
   urlsToTry.push({
     url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),
-    type: "oidc"
+    type: "oidc",
+    expectedIssuer: pathIssuer
   });
   return urlsToTry;
 }
+function assertMetadataIssuerMatches(metadata, expectedIssuer) {
+  if (metadata.issuer !== expectedIssuer) {
+    throw new MCPClientOAuthError({
+      message: `OAuth authorization server metadata issuer ${metadata.issuer} does not match expected issuer ${expectedIssuer}`
+    });
+  }
+}
 async function discoverAuthorizationServerMetadata(authorizationServerUrl, {
   fetchFn = fetch,
   protocolVersion = LATEST_PROTOCOL_VERSION
@@ -630,7 +751,7 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, {
   var _a3;
   const headers = { "MCP-Protocol-Version": protocolVersion };
   const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
-  for (const { url: endpointUrl, type } of urlsToTry) {
+  for (const { url: endpointUrl, type, expectedIssuer } of urlsToTry) {
     const response = await fetchWithCorsRetry(endpointUrl, headers, fetchFn);
     if (!response) {
       continue;
@@ -644,11 +765,14 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, {
       );
     }
     if (type === "oauth") {
-      return OAuthMetadataSchema.parse(await response.json());
+      const metadata = OAuthMetadataSchema.parse(await response.json());
+      assertMetadataIssuerMatches(metadata, expectedIssuer);
+      return metadata;
     } else {
       const metadata = OpenIdProviderDiscoveryMetadataSchema.parse(
         await response.json()
       );
+      assertMetadataIssuerMatches(metadata, expectedIssuer);
       if (!((_a3 = metadata.code_challenge_methods_supported) == null ? void 0 : _a3.includes("S256"))) {
         throw new Error(
           `Incompatible OIDC provider at ${endpointUrl}: does not support S256 code challenge method required by MCP specification`
@@ -685,7 +809,7 @@ async function startAuthorization(authorizationServerUrl, {
   } else {
     authorizationUrl = new URL("/authorize", authorizationServerUrl);
   }
-  const challenge = await (0, import_pkce_challenge.default)();
+  const challenge = await pkceChallenge();
   const codeVerifier = challenge.code_verifier;
   const codeChallenge = challenge.code_challenge;
   authorizationUrl.searchParams.set("response_type", responseType);
@@ -706,7 +830,10 @@ async function startAuthorization(authorizationServerUrl, {
     authorizationUrl.searchParams.append("prompt", "consent");
   }
   if (resource) {
-    authorizationUrl.searchParams.set("resource", resource.href);
+    authorizationUrl.searchParams.set(
+      "resource",
+      resourceUrlStripSlash(resource)
+    );
   }
   return { authorizationUrl, codeVerifier };
 }
@@ -764,7 +891,9 @@ async function parseErrorResponse(input) {
   const statusCode = input instanceof Response ? input.status : void 0;
   const body = input instanceof Response ? await input.text() : input;
   try {
-    const result = OAuthErrorResponseSchema.parse(JSON.parse(body));
+    const result = OAuthErrorResponseSchema.parse(
+      await parseJSON2({ text: body })
+    );
     const { error, error_description, error_uri } = result;
     const errorClass = OAUTH_ERRORS[error] || ServerError;
     return new errorClass({
@@ -805,7 +934,12 @@ async function exchangeAuthorization(authorizationServerUrl, {
     redirect_uri: String(redirectUri)
   });
   if (addClientAuthentication) {
-    addClientAuthentication(headers, params, authorizationServerUrl, metadata);
+    await addClientAuthentication(
+      headers,
+      params,
+      authorizationServerUrl,
+      metadata
+    );
   } else {
     const supportedMethods = (_a3 = metadata == null ? void 0 : metadata.token_endpoint_auth_methods_supported) != null ? _a3 : [];
     const authMethod = selectClientAuthMethod(
@@ -815,7 +949,7 @@ async function exchangeAuthorization(authorizationServerUrl, {
     applyClientAuthentication(authMethod, clientInformation, headers, params);
   }
   if (resource) {
-    params.set("resource", resource.href);
+    params.set("resource", resourceUrlStripSlash(resource));
   }
   const response = await (fetchFn != null ? fetchFn : fetch)(tokenUrl, {
     method: "POST",
@@ -857,7 +991,12 @@ async function refreshAuthorization(authorizationServerUrl, {
     refresh_token: refreshToken
   });
   if (addClientAuthentication) {
-    addClientAuthentication(headers, params, authorizationServerUrl, metadata);
+    await addClientAuthentication(
+      headers,
+      params,
+      authorizationServerUrl,
+      metadata
+    );
   } else {
     const supportedMethods = (_a3 = metadata == null ? void 0 : metadata.token_endpoint_auth_methods_supported) != null ? _a3 : [];
     const authMethod = selectClientAuthMethod(
@@ -867,7 +1006,7 @@ async function refreshAuthorization(authorizationServerUrl, {
     applyClientAuthentication(authMethod, clientInformation, headers, params);
   }
   if (resource) {
-    params.set("resource", resource.href);
+    params.set("resource", resourceUrlStripSlash(resource));
   }
   const response = await (fetchFn != null ? fetchFn : fetch)(tokenUrl, {
     method: "POST",
@@ -954,8 +1093,10 @@ async function authInternal(provider, {
   resourceMetadataUrl,
   fetchFn
 }) {
+  var _a3, _b3;
   let resourceMetadata;
   let authorizationServerUrl;
+  assertResourceMetadataUrlSameOrigin(serverUrl, resourceMetadataUrl);
   try {
     resourceMetadata = await discoverOAuthProtectedResourceMetadata(
       serverUrl,
@@ -975,12 +1116,18 @@ async function authInternal(provider, {
     provider,
     resourceMetadata
   );
+  await ((_a3 = provider.validateAuthorizationServerURL) == null ? void 0 : _a3.call(
+    provider,
+    serverUrl,
+    authorizationServerUrl
+  ));
   const metadata = await discoverAuthorizationServerMetadata(
     authorizationServerUrl,
     {
       fetchFn
     }
   );
+  const currentAuthorizationServerInformation = createAuthorizationServerInformation(authorizationServerUrl, metadata);
   let clientInformation = await Promise.resolve(provider.clientInformation());
   if (!clientInformation) {
     if (authorizationCode !== void 0) {
@@ -998,8 +1145,11 @@ async function authInternal(provider, {
       clientMetadata: provider.clientMetadata,
       fetchFn
     });
-    await provider.saveClientInformation(fullInformation);
-    clientInformation = fullInformation;
+    clientInformation = addAuthorizationServerInformationToClientInformation(
+      fullInformation,
+      currentAuthorizationServerInformation
+    );
+    await provider.saveClientInformation(clientInformation);
   }
   if (authorizationCode !== void 0) {
     if (provider.storedState) {
@@ -1010,6 +1160,19 @@ async function authInternal(provider, {
         );
       }
     }
+    const storedAuthorizationServerInformation = await getStoredAuthorizationServerInformation({
+      provider,
+      clientInformation
+    });
+    if (!storedAuthorizationServerInformation) {
+      throw new MCPClientOAuthError({
+        message: "Stored OAuth authorization server metadata is required when exchanging an authorization code"
+      });
+    }
+    assertAuthorizationServerInformationMatches({
+      storedAuthorizationServerInformation,
+      currentAuthorizationServerInformation
+    });
     const codeVerifier2 = await provider.codeVerifier();
     const tokens2 = await exchangeAuthorization(authorizationServerUrl, {
       metadata,
@@ -1021,22 +1184,47 @@ async function authInternal(provider, {
       addClientAuthentication: provider.addClientAuthentication,
       fetchFn
     });
-    await provider.saveTokens(tokens2);
+    await provider.saveTokens(
+      addAuthorizationServerInformationToTokens(
+        tokens2,
+        currentAuthorizationServerInformation
+      )
+    );
     return "AUTHORIZED";
   }
   const tokens = await provider.tokens();
   if (tokens == null ? void 0 : tokens.refresh_token) {
-    try {
-      const newTokens = await refreshAuthorization(authorizationServerUrl, {
-        metadata,
-        clientInformation,
-        refreshToken: tokens.refresh_token,
-        resource,
-        addClientAuthentication: provider.addClientAuthentication,
-        fetchFn
+    const storedAuthorizationServerInformation = await getStoredAuthorizationServerInformation({
+      provider,
+      clientInformation,
+      tokens
+    });
+    if (storedAuthorizationServerInformation) {
+      assertAuthorizationServerInformationMatches({
+        storedAuthorizationServerInformation,
+        currentAuthorizationServerInformation
       });
-      await provider.saveTokens(newTokens);
-      return "AUTHORIZED";
+    } else {
+      await ((_b3 = provider.invalidateCredentials) == null ? void 0 : _b3.call(provider, "tokens"));
+    }
+    try {
+      if (storedAuthorizationServerInformation) {
+        const newTokens = await refreshAuthorization(authorizationServerUrl, {
+          metadata,
+          clientInformation,
+          refreshToken: tokens.refresh_token,
+          resource,
+          addClientAuthentication: provider.addClientAuthentication,
+          fetchFn
+        });
+        await provider.saveTokens(
+          addAuthorizationServerInformationToTokens(
+            newTokens,
+            currentAuthorizationServerInformation
+          )
+        );
+        return "AUTHORIZED";
+      }
     } catch (error) {
       if (
         // If this is a ServerError, or an unknown type, log it out and try to continue. Otherwise, escalate so we can fix things and retry.
@@ -1062,30 +1250,49 @@ async function authInternal(provider, {
       resource
     }
   );
+  const savedAuthorizationServerInformation = await saveAuthorizationServerInformation({
+    provider,
+    clientInformation,
+    authorizationServerInformation: currentAuthorizationServerInformation
+  });
+  if (!savedAuthorizationServerInformation) {
+    throw new MCPClientOAuthError({
+      message: "OAuth authorization server metadata must be saveable before starting authorization"
+    });
+  }
   await provider.saveCodeVerifier(codeVerifier);
   await provider.redirectToAuthorization(authorizationUrl);
   return "REDIRECT";
 }
 
 // src/tool/mcp-sse-transport.ts
+function isMessageEvent(event) {
+  return event === void 0 || event === "message";
+}
 var SseMCPTransport = class {
   constructor({
     url,
     headers,
     authProvider,
-    redirect = "follow"
+    redirect = "error",
+    fetch: fetchFn
   }) {
     this.connected = false;
     this.url = new URL(url);
     this.headers = headers;
     this.authProvider = authProvider;
     this.redirectMode = redirect;
+    this.fetchFn = fetchFn != null ? fetchFn : globalThis.fetch;
+  }
+  setProtocolVersion(version) {
+    this.protocolVersion = version;
   }
   async commonHeaders(base) {
+    var _a3;
     const headers = {
       ...this.headers,
       ...base,
-      "mcp-protocol-version": LATEST_PROTOCOL_VERSION
+      "mcp-protocol-version": (_a3 = this.protocolVersion) != null ? _a3 : LATEST_PROTOCOL_VERSION
     };
     if (this.authProvider) {
       const tokens = await this.authProvider.tokens();
@@ -1093,10 +1300,10 @@ var SseMCPTransport = class {
         headers["Authorization"] = `Bearer ${tokens.access_token}`;
       }
     }
-    return (0, import_provider_utils.withUserAgentSuffix)(
+    return withUserAgentSuffix(
       headers,
       `ai-sdk/${VERSION}`,
-      (0, import_provider_utils.getRuntimeEnvironmentUserAgent)()
+      getRuntimeEnvironmentUserAgent()
     );
   }
   async start() {
@@ -1111,7 +1318,7 @@ var SseMCPTransport = class {
           const headers = await this.commonHeaders({
             Accept: "text/event-stream"
           });
-          const response = await fetch(this.url.href, {
+          const response = await this.fetchFn(this.url.href, {
             headers,
             signal: (_a3 = this.abortController) == null ? void 0 : _a3.signal,
             redirect: this.redirectMode
@@ -1121,7 +1328,8 @@ var SseMCPTransport = class {
             try {
               const result = await auth(this.authProvider, {
                 serverUrl: this.url,
-                resourceMetadataUrl: this.resourceMetadataUrl
+                resourceMetadataUrl: this.resourceMetadataUrl,
+                fetchFn: this.fetchFn
               });
               if (result !== "AUTHORIZED") {
                 const error = new UnauthorizedError();
@@ -1145,10 +1353,10 @@ var SseMCPTransport = class {
             (_d = this.onerror) == null ? void 0 : _d.call(this, error);
             return reject(error);
           }
-          const stream = response.body.pipeThrough(new TextDecoderStream()).pipeThrough(new import_provider_utils.EventSourceParserStream());
+          const stream = response.body.pipeThrough(new TextDecoderStream()).pipeThrough(new EventSourceParserStream());
           const reader = stream.getReader();
           const processEvents = async () => {
-            var _a4, _b4, _c2;
+            var _a4, _b4, _c2, _d2, _e2;
             try {
               while (true) {
                 const { done, value } = await reader.read();
@@ -1163,26 +1371,32 @@ var SseMCPTransport = class {
                 }
                 const { event, data } = value;
                 if (event === "endpoint") {
-                  this.endpoint = new URL(data, this.url);
-                  if (this.endpoint.origin !== this.url.origin) {
+                  if (this.endpoint) {
+                    continue;
+                  }
+                  const endpoint = new URL(data, this.url);
+                  if (endpoint.origin !== this.url.origin) {
+                    this.connected = false;
+                    this.endpoint = void 0;
+                    (_a4 = this.sseConnection) == null ? void 0 : _a4.close();
+                    (_b4 = this.abortController) == null ? void 0 : _b4.abort();
                     throw new MCPClientError({
-                      message: `MCP SSE Transport Error: Endpoint origin does not match connection origin: ${this.endpoint.origin}`
+                      message: `MCP SSE Transport Error: Endpoint origin does not match connection origin: ${endpoint.origin}`
                     });
                   }
+                  this.endpoint = endpoint;
                   this.connected = true;
                   resolve();
-                } else if (event === "message") {
+                } else if (isMessageEvent(event)) {
                   try {
-                    const message = JSONRPCMessageSchema.parse(
-                      JSON.parse(data)
-                    );
-                    (_a4 = this.onmessage) == null ? void 0 : _a4.call(this, message);
+                    const message = await parseJSONRPCMessage(data);
+                    (_c2 = this.onmessage) == null ? void 0 : _c2.call(this, message);
                   } catch (error) {
                     const e = new MCPClientError({
                       message: "MCP SSE Transport Error: Failed to parse message",
                       cause: error
                     });
-                    (_b4 = this.onerror) == null ? void 0 : _b4.call(this, e);
+                    (_d2 = this.onerror) == null ? void 0 : _d2.call(this, e);
                   }
                 }
               }
@@ -1190,7 +1404,7 @@ var SseMCPTransport = class {
               if (error instanceof Error && error.name === "AbortError") {
                 return;
               }
-              (_c2 = this.onerror) == null ? void 0 : _c2.call(this, error);
+              (_e2 = this.onerror) == null ? void 0 : _e2.call(this, error);
               reject(error);
             }
           };
@@ -1212,6 +1426,7 @@ var SseMCPTransport = class {
   async close() {
     var _a3, _b3, _c;
     this.connected = false;
+    this.endpoint = void 0;
     (_a3 = this.sseConnection) == null ? void 0 : _a3.close();
     (_b3 = this.abortController) == null ? void 0 : _b3.abort();
     (_c = this.onclose) == null ? void 0 : _c.call(this);
@@ -1236,13 +1451,14 @@ var SseMCPTransport = class {
           signal: (_a3 = this.abortController) == null ? void 0 : _a3.signal,
           redirect: this.redirectMode
         };
-        const response = await fetch(endpoint, init);
+        const response = await this.fetchFn(endpoint.href, init);
         if (response.status === 401 && this.authProvider && !triedAuth) {
           this.resourceMetadataUrl = extractResourceMetadataUrl(response);
           try {
             const result = await auth(this.authProvider, {
               serverUrl: this.url,
-              resourceMetadataUrl: this.resourceMetadataUrl
+              resourceMetadataUrl: this.resourceMetadataUrl,
+              fetchFn: this.fetchFn
             });
             if (result !== "AUTHORIZED") {
               const error = new UnauthorizedError();
@@ -1273,13 +1489,21 @@ var SseMCPTransport = class {
 };
 
 // src/tool/mcp-http-transport.ts
-var import_provider_utils2 = require("@ai-sdk/provider-utils");
+import {
+  EventSourceParserStream as EventSourceParserStream2,
+  withUserAgentSuffix as withUserAgentSuffix2,
+  getRuntimeEnvironmentUserAgent as getRuntimeEnvironmentUserAgent2
+} from "@ai-sdk/provider-utils";
+function isMessageEvent2(event) {
+  return event === void 0 || event === "message";
+}
 var HttpMCPTransport = class {
   constructor({
     url,
     headers,
     authProvider,
-    redirect = "follow"
+    redirect = "error",
+    fetch: fetchFn
   }) {
     this.inboundReconnectAttempts = 0;
     this.reconnectionOptions = {
@@ -1292,12 +1516,17 @@ var HttpMCPTransport = class {
     this.headers = headers;
     this.authProvider = authProvider;
     this.redirectMode = redirect;
+    this.fetchFn = fetchFn != null ? fetchFn : globalThis.fetch;
+  }
+  setProtocolVersion(version) {
+    this.protocolVersion = version;
   }
   async commonHeaders(base) {
+    var _a3;
     const headers = {
       ...this.headers,
       ...base,
-      "mcp-protocol-version": LATEST_PROTOCOL_VERSION
+      "mcp-protocol-version": (_a3 = this.protocolVersion) != null ? _a3 : LATEST_PROTOCOL_VERSION
     };
     if (this.sessionId) {
       headers["mcp-session-id"] = this.sessionId;
@@ -1308,12 +1537,30 @@ var HttpMCPTransport = class {
         headers["Authorization"] = `Bearer ${tokens.access_token}`;
       }
     }
-    return (0, import_provider_utils2.withUserAgentSuffix)(
+    return withUserAgentSuffix2(
       headers,
       `ai-sdk/${VERSION}`,
-      (0, import_provider_utils2.getRuntimeEnvironmentUserAgent)()
+      getRuntimeEnvironmentUserAgent2()
     );
   }
+  /**
+   * Runs a single OAuth recovery flow for concurrent 401 responses.
+   */
+  authorizeOnce(resourceMetadataUrl) {
+    if (!this.authProvider) {
+      return Promise.resolve("REDIRECT");
+    }
+    if (!this.authPromise) {
+      this.authPromise = auth(this.authProvider, {
+        serverUrl: this.url,
+        resourceMetadataUrl,
+        fetchFn: this.fetchFn
+      }).finally(() => {
+        this.authPromise = void 0;
+      });
+    }
+    return this.authPromise;
+  }
   async start() {
     if (this.abortController) {
       throw new MCPClientError({
@@ -1329,7 +1576,7 @@ var HttpMCPTransport = class {
     try {
       if (this.sessionId && this.abortController && !this.abortController.signal.aborted) {
         const headers = await this.commonHeaders({});
-        await fetch(this.url, {
+        await this.fetchFn(this.url.href, {
           method: "DELETE",
           headers,
           signal: this.abortController.signal,
@@ -1356,7 +1603,7 @@ var HttpMCPTransport = class {
           signal: (_a3 = this.abortController) == null ? void 0 : _a3.signal,
           redirect: this.redirectMode
         };
-        const response = await fetch(this.url, init);
+        const response = await this.fetchFn(this.url.href, init);
         const sessionId = response.headers.get("mcp-session-id");
         if (sessionId) {
           this.sessionId = sessionId;
@@ -1364,10 +1611,7 @@ var HttpMCPTransport = class {
         if (response.status === 401 && this.authProvider && !triedAuth) {
           this.resourceMetadataUrl = extractResourceMetadataUrl(response);
           try {
-            const result = await auth(this.authProvider, {
-              serverUrl: this.url,
-              resourceMetadataUrl: this.resourceMetadataUrl
-            });
+            const result = await this.authorizeOnce(this.resourceMetadataUrl);
             if (result !== "AUTHORIZED") {
               const error2 = new UnauthorizedError();
               throw error2;
@@ -1391,7 +1635,10 @@ var HttpMCPTransport = class {
             errorMessage += ". This server does not support HTTP transport. Try using `sse` transport instead";
           }
           const error2 = new MCPClientError({
-            message: errorMessage
+            message: errorMessage,
+            statusCode: response.status,
+            url: this.url.href,
+            responseBody: text != null ? text : void 0
           });
           (_c = this.onerror) == null ? void 0 : _c.call(this, error2);
           throw error2;
@@ -1403,19 +1650,25 @@ var HttpMCPTransport = class {
         const contentType = response.headers.get("content-type") || "";
         if (contentType.includes("application/json")) {
           const data = await response.json();
-          const messages = Array.isArray(data) ? data.map((m) => JSONRPCMessageSchema.parse(m)) : [JSONRPCMessageSchema.parse(data)];
-          for (const m of messages) (_d = this.onmessage) == null ? void 0 : _d.call(this, m);
+          const messages = Array.isArray(data) ? data.map(
+            (message2) => JSONRPCMessageSchema.parse(message2)
+          ) : [JSONRPCMessageSchema.parse(data)];
+          for (const jsonRpcMessage of messages) {
+            (_d = this.onmessage) == null ? void 0 : _d.call(this, jsonRpcMessage);
+          }
           return;
         }
         if (contentType.includes("text/event-stream")) {
           if (!response.body) {
             const error2 = new MCPClientError({
-              message: "MCP HTTP Transport Error: text/event-stream response without body"
+              message: "MCP HTTP Transport Error: text/event-stream response without body",
+              statusCode: response.status,
+              url: this.url.href
             });
             (_e = this.onerror) == null ? void 0 : _e.call(this, error2);
             throw error2;
           }
-          const stream = response.body.pipeThrough(new TextDecoderStream()).pipeThrough(new import_provider_utils2.EventSourceParserStream());
+          const stream = response.body.pipeThrough(new TextDecoderStream()).pipeThrough(new EventSourceParserStream2());
           const reader = stream.getReader();
           const processEvents = async () => {
             var _a4, _b4, _c2;
@@ -1424,10 +1677,10 @@ var HttpMCPTransport = class {
                 const { done, value } = await reader.read();
                 if (done) return;
                 const { event, data } = value;
-                if (event === "message") {
+                if (isMessageEvent2(event)) {
                   try {
-                    const msg = JSONRPCMessageSchema.parse(JSON.parse(data));
-                    (_a4 = this.onmessage) == null ? void 0 : _a4.call(this, msg);
+                    const jsonRpcMessage = await parseJSONRPCMessage(data);
+                    (_a4 = this.onmessage) == null ? void 0 : _a4.call(this, jsonRpcMessage);
                   } catch (error2) {
                     const e = new MCPClientError({
                       message: "MCP HTTP Transport Error: Failed to parse message",
@@ -1448,7 +1701,9 @@ var HttpMCPTransport = class {
           return;
         }
         const error = new MCPClientError({
-          message: `MCP HTTP Transport Error: Unexpected content type: ${contentType}`
+          message: `MCP HTTP Transport Error: Unexpected content type: ${contentType}`,
+          statusCode: response.status,
+          url: this.url.href
         });
         (_f = this.onerror) == null ? void 0 : _f.call(this, error);
         throw error;
@@ -1500,7 +1755,7 @@ var HttpMCPTransport = class {
       if (resumeToken) {
         headers["last-event-id"] = resumeToken;
       }
-      const response = await fetch(this.url.href, {
+      const response = await this.fetchFn(this.url.href, {
         method: "GET",
         headers,
         signal: (_a3 = this.abortController) == null ? void 0 : _a3.signal,
@@ -1513,10 +1768,7 @@ var HttpMCPTransport = class {
       if (response.status === 401 && this.authProvider && !triedAuth) {
         this.resourceMetadataUrl = extractResourceMetadataUrl(response);
         try {
-          const result = await auth(this.authProvider, {
-            serverUrl: this.url,
-            resourceMetadataUrl: this.resourceMetadataUrl
-          });
+          const result = await this.authorizeOnce(this.resourceMetadataUrl);
           if (result !== "AUTHORIZED") {
             const error = new UnauthorizedError();
             (_b3 = this.onerror) == null ? void 0 : _b3.call(this, error);
@@ -1533,12 +1785,14 @@ var HttpMCPTransport = class {
       }
       if (!response.ok || !response.body) {
         const error = new MCPClientError({
-          message: `MCP HTTP Transport Error: GET SSE failed: ${response.status} ${response.statusText}`
+          message: `MCP HTTP Transport Error: GET SSE failed: ${response.status} ${response.statusText}`,
+          statusCode: response.status,
+          url: this.url.href
         });
         (_d = this.onerror) == null ? void 0 : _d.call(this, error);
         return;
       }
-      const stream = response.body.pipeThrough(new TextDecoderStream()).pipeThrough(new import_provider_utils2.EventSourceParserStream());
+      const stream = response.body.pipeThrough(new TextDecoderStream()).pipeThrough(new EventSourceParserStream2());
       const reader = stream.getReader();
       const processEvents = async () => {
         var _a4, _b4, _c2, _d2;
@@ -1550,10 +1804,10 @@ var HttpMCPTransport = class {
             if (id) {
               this.lastInboundEventId = id;
             }
-            if (event === "message") {
+            if (isMessageEvent2(event)) {
               try {
-                const msg = JSONRPCMessageSchema.parse(JSON.parse(data));
-                (_a4 = this.onmessage) == null ? void 0 : _a4.call(this, msg);
+                const jsonRpcMessage = await parseJSONRPCMessage(data);
+                (_a4 = this.onmessage) == null ? void 0 : _a4.call(this, jsonRpcMessage);
               } catch (error) {
                 const e = new MCPClientError({
                   message: "MCP HTTP Transport Error: Failed to parse message",
@@ -1607,6 +1861,112 @@ function isCustomMcpTransport(transport) {
   return "start" in transport && typeof transport.start === "function" && "send" in transport && typeof transport.send === "function" && "close" in transport && typeof transport.close === "function";
 }
 
+// src/tool/mcp-apps.ts
+import { isJSONObject } from "@ai-sdk/provider";
+import { convertBase64ToUint8Array } from "@ai-sdk/provider-utils";
+var MCP_APP_EXTENSION_NAME = "io.modelcontextprotocol/ui";
+var MCP_APP_MIME_TYPE = "text/html;profile=mcp-app";
+var MCP_APP_LEGACY_RESOURCE_URI_META_KEY = "ui/resourceUri";
+var mcpAppClientCapabilities = {
+  extensions: {
+    [MCP_APP_EXTENSION_NAME]: {
+      mimeTypes: [MCP_APP_MIME_TYPE]
+    }
+  }
+};
+function getToolUiMeta(meta) {
+  const uiMeta = meta == null ? void 0 : meta.ui;
+  return isJSONObject(uiMeta) ? uiMeta : void 0;
+}
+function getResourceUiMeta(meta) {
+  const resourceMeta = isJSONObject(meta) ? meta : void 0;
+  const rawUiMeta = resourceMeta == null ? void 0 : resourceMeta.ui;
+  const uiMeta = isJSONObject(rawUiMeta) ? rawUiMeta : void 0;
+  return uiMeta;
+}
+function parseVisibility(value) {
+  return Array.isArray(value) ? value.filter(
+    (v) => v === "model" || v === "app"
+  ) : void 0;
+}
+function getMCPAppToolMeta(tool2) {
+  var _a3, _b3;
+  const uiMeta = getToolUiMeta(tool2._meta);
+  const resourceUri = (_b3 = uiMeta == null ? void 0 : uiMeta.resourceUri) != null ? _b3 : (_a3 = tool2._meta) == null ? void 0 : _a3[MCP_APP_LEGACY_RESOURCE_URI_META_KEY];
+  const visibility = parseVisibility(uiMeta == null ? void 0 : uiMeta.visibility);
+  if (resourceUri !== void 0) {
+    if (typeof resourceUri !== "string" || !resourceUri.startsWith("ui://")) {
+      throw new Error(
+        `Invalid MCP App resource URI: ${JSON.stringify(resourceUri)}`
+      );
+    }
+  } else if (uiMeta == null) {
+    return void 0;
+  }
+  return {
+    ...uiMeta,
+    ...resourceUri != null ? { resourceUri } : {},
+    ...visibility != null ? { visibility } : {}
+  };
+}
+function splitMCPAppTools(definitions) {
+  var _a3;
+  const modelVisibleTools = [];
+  const appVisibleTools = [];
+  for (const tool2 of definitions.tools) {
+    const visibility = (_a3 = getMCPAppToolMeta(tool2)) == null ? void 0 : _a3.visibility;
+    if (visibility == null || visibility.includes("model")) {
+      modelVisibleTools.push(tool2);
+    }
+    if ((visibility == null ? void 0 : visibility.includes("app")) === true) {
+      appVisibleTools.push(tool2);
+    }
+  }
+  return {
+    modelVisible: {
+      ...definitions,
+      tools: modelVisibleTools
+    },
+    appVisible: {
+      ...definitions,
+      tools: appVisibleTools
+    }
+  };
+}
+function getMCPAppResourceFromReadResult({
+  uri,
+  resource
+}) {
+  const content = resource.contents.find((content2) => content2.uri === uri);
+  if (content == null) {
+    throw new Error(`MCP App resource not found in read result: ${uri}`);
+  }
+  if (content.mimeType !== MCP_APP_MIME_TYPE) {
+    throw new Error(
+      `Unsupported MCP App resource MIME type: ${content.mimeType}`
+    );
+  }
+  const html = "text" in content && typeof content.text === "string" ? content.text : "blob" in content && typeof content.blob === "string" ? new TextDecoder().decode(convertBase64ToUint8Array(content.blob)) : void 0;
+  if (html == null) {
+    throw new Error(`Unsupported MCP App resource content format: ${uri}`);
+  }
+  const meta = getResourceUiMeta(content._meta);
+  return { uri, mimeType: MCP_APP_MIME_TYPE, html, meta };
+}
+async function readMCPAppResource({
+  client,
+  uri,
+  options
+}) {
+  if (!uri.startsWith("ui://")) {
+    throw new Error(`Unsupported MCP App resource URI: ${uri}`);
+  }
+  return getMCPAppResourceFromReadResult({
+    uri,
+    resource: await client.readResource({ uri, options })
+  });
+}
+
 // src/tool/mcp-client.ts
 var CLIENT_VERSION = "1.0.0";
 function mcpToModelOutput({
@@ -1623,9 +1983,9 @@ function mcpToModelOutput({
       }
       if (part.type === "image" && "data" in part && "mimeType" in part) {
         return {
-          type: "image-data",
-          data: part.data,
-          mediaType: part.mimeType
+          type: "file",
+          mediaType: part.mimeType,
+          data: { type: "data", data: part.data }
         };
       }
       return { type: "text", text: JSON.stringify(part) };
@@ -1641,7 +2001,8 @@ async function createMCPClient(config) {
 var DefaultMCPClient = class {
   constructor({
     transport: transportConfig,
-    name: name3 = "ai-sdk-mcp-client",
+    name: name3,
+    clientName = name3 != null ? name3 : "ai-sdk-mcp-client",
     version = CLIENT_VERSION,
     onUncaughtError,
     capabilities
@@ -1649,6 +2010,7 @@ var DefaultMCPClient = class {
     this.requestMessageId = 0;
     this.responseHandlers = /* @__PURE__ */ new Map();
     this.serverCapabilities = {};
+    this._serverInfo = { name: "", version: "" };
     this.isClosed = true;
     this.onUncaughtError = onUncaughtError;
     this.clientCapabilities = capabilities != null ? capabilities : {};
@@ -1675,10 +2037,16 @@ var DefaultMCPClient = class {
       this.onResponse(message);
     };
     this.clientInfo = {
-      name: name3,
+      name: clientName,
       version
     };
   }
+  get serverInfo() {
+    return this._serverInfo;
+  }
+  get instructions() {
+    return this._serverInstructions;
+  }
   async init() {
     try {
       await this.transport.start();
@@ -1705,6 +2073,13 @@ var DefaultMCPClient = class {
         });
       }
       this.serverCapabilities = result.capabilities;
+      this._serverInfo = result.serverInfo;
+      if (this.transport.setProtocolVersion) {
+        this.transport.setProtocolVersion(result.protocolVersion);
+      } else {
+        this.transport.protocolVersion = result.protocolVersion;
+      }
+      this._serverInstructions = result.instructions;
       await this.notification({
         method: "notifications/initialized"
       });
@@ -1821,16 +2196,14 @@ var DefaultMCPClient = class {
   }
   async callTool({
     name: name3,
-    args,
+    arguments: args = {},
     options
   }) {
     try {
       return this.request({
         request: { method: "tools/call", params: { name: name3, arguments: args } },
         resultSchema: CallToolResultSchema,
-        options: {
-          signal: options == null ? void 0 : options.abortSignal
-        }
+        options
       });
     } catch (error) {
       throw error;
@@ -1941,33 +2314,54 @@ var DefaultMCPClient = class {
       _meta
     } of definitions.tools) {
       const resolvedTitle = title != null ? title : annotations == null ? void 0 : annotations.title;
-      if (schemas !== "automatic" && !(name3 in schemas)) {
+      if (schemas !== "automatic" && !Object.prototype.hasOwnProperty.call(schemas, name3)) {
         continue;
       }
       const self = this;
       const outputSchema = schemas !== "automatic" ? (_a3 = schemas[name3]) == null ? void 0 : _a3.outputSchema : void 0;
+      const appMeta = getMCPAppToolMeta({ _meta });
+      const metadata = {
+        clientName: this.clientInfo.name,
+        toolName: name3,
+        ...resolvedTitle != null ? { title: resolvedTitle } : {},
+        ...(appMeta == null ? void 0 : appMeta.resourceUri) != null ? {
+          app: {
+            ...appMeta,
+            mimeType: MCP_APP_MIME_TYPE
+          }
+        } : {}
+      };
       const execute = async (args, options) => {
         var _a4;
         (_a4 = options == null ? void 0 : options.abortSignal) == null ? void 0 : _a4.throwIfAborted();
-        const result = await self.callTool({ name: name3, args, options });
+        const result = await self.callTool({
+          name: name3,
+          arguments: args,
+          options: { signal: options == null ? void 0 : options.abortSignal }
+        });
+        if (result.isError) {
+          return result;
+        }
         if (outputSchema != null) {
           return self.extractStructuredContent(result, outputSchema, name3);
         }
         return result;
       };
-      const toolWithExecute = schemas === "automatic" ? (0, import_provider_utils3.dynamicTool)({
+      const toolWithExecute = schemas === "automatic" ? dynamicTool({
         description,
         title: resolvedTitle,
-        inputSchema: (0, import_provider_utils3.jsonSchema)({
+        metadata,
+        inputSchema: jsonSchema({
           ...inputSchema,
           properties: (_b3 = inputSchema.properties) != null ? _b3 : {},
           additionalProperties: false
         }),
         execute,
         toModelOutput: mcpToModelOutput
-      }) : (0, import_provider_utils3.tool)({
+      }) : tool({
         description,
         title: resolvedTitle,
+        metadata,
         inputSchema: schemas[name3].inputSchema,
         ...outputSchema != null ? { outputSchema } : {},
         execute,
@@ -1982,9 +2376,9 @@ var DefaultMCPClient = class {
    */
   async extractStructuredContent(result, outputSchema, toolName) {
     if ("structuredContent" in result && result.structuredContent != null) {
-      const validationResult = await (0, import_provider_utils3.safeValidateTypes)({
+      const validationResult = await safeValidateTypes({
         value: result.structuredContent,
-        schema: (0, import_provider_utils3.asSchema)(outputSchema)
+        schema: asSchema(outputSchema)
       });
       if (!validationResult.success) {
         throw new MCPClientError({
@@ -1997,7 +2391,7 @@ var DefaultMCPClient = class {
     if ("content" in result && Array.isArray(result.content)) {
       const textContent = result.content.find((c) => c.type === "text");
       if (textContent && "text" in textContent) {
-        const parseResult = await (0, import_provider_utils3.safeParseJSON)({
+        const parseResult = await safeParseJSON({
           text: textContent.text,
           schema: outputSchema
         });
@@ -2054,6 +2448,14 @@ var DefaultMCPClient = class {
   }
   async onRequestMessage(request) {
     try {
+      if (request.method === "ping") {
+        await this.transport.send({
+          jsonrpc: "2.0",
+          id: request.id,
+          result: {}
+        });
+        return;
+      }
       if (request.method !== "elicitation/create") {
         await this.transport.send({
           jsonrpc: "2.0",
@@ -2152,13 +2554,16 @@ var DefaultMCPClient = class {
     );
   }
 };
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
+export {
   ElicitResultSchema,
   ElicitationRequestSchema,
+  MCP_APP_MIME_TYPE,
   UnauthorizedError,
   auth,
   createMCPClient,
-  experimental_createMCPClient
-});
+  createMCPClient as experimental_createMCPClient,
+  mcpAppClientCapabilities,
+  readMCPAppResource,
+  splitMCPAppTools
+};
 //# sourceMappingURL=index.js.map