@ai-sdk/mcp 2.0.54 → 2.0.55

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @ai-sdk/mcp
 
+## 2.0.55
+
+### Patch Changes
+
+- 7fc2bc1: fix(mcp): preserve pre-registered OAuth clients after client authentication errors and require explicit provider provenance before replacing dynamically registered credentials
+
 ## 2.0.54
 
 ### Patch Changes

package/dist/index.d.ts

@@ -199,6 +199,16 @@ interface OAuthClientProvider {
     get redirectUrl(): string | URL;
     get clientMetadata(): OAuthClientMetadata;
     clientInformation(): OAuthClientInformation | undefined | Promise<OAuthClientInformation | undefined>;
+    /**
+     * Returns whether the current client information was obtained through
+     * dynamic client registration.
+     *
+     * Return `true` only when the current client information was saved after a
+     * dynamic registration response. When this method is omitted or returns
+     * `false`, the client information is treated as pre-registered and is not
+     * automatically invalidated after client authentication errors.
+     */
+    isClientInformationDynamicallyRegistered?(): boolean | Promise<boolean>;
     saveClientInformation?(clientInformation: OAuthClientInformation): void | Promise<void>;
     authorizationServerInformation?(): OAuthAuthorizationServerInformation | undefined | Promise<OAuthAuthorizationServerInformation | undefined>;
     saveAuthorizationServerInformation?(authorizationServerInformation: OAuthAuthorizationServerInformation): void | Promise<void>;

package/dist/index.js

@@ -1258,15 +1258,18 @@ function inferOAuthApplicationType(redirectUris) {
   return redirectUris.every(isNativeRedirectUri) ? "native" : "web";
 }
 async function auth(provider, options) {
-  var _a3, _b3;
+  var _a3, _b3, _c;
   try {
     return await authInternal(provider, options);
   } catch (error) {
     if (error instanceof InvalidClientError || error instanceof UnauthorizedClientError) {
-      await ((_a3 = provider.invalidateCredentials) == null ? void 0 : _a3.call(provider, "all"));
+      if (options.authorizationCode !== void 0 || !await ((_a3 = provider.isClientInformationDynamicallyRegistered) == null ? void 0 : _a3.call(provider))) {
+        throw error;
+      }
+      await ((_b3 = provider.invalidateCredentials) == null ? void 0 : _b3.call(provider, "all"));
       return await authInternal(provider, options);
     } else if (error instanceof InvalidGrantError) {
-      await ((_b3 = provider.invalidateCredentials) == null ? void 0 : _b3.call(provider, "tokens"));
+      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens"));
       return await authInternal(provider, options);
     }
     throw error;