@better-auth/mcp 1.7.0-beta.6 → 1.7.0-beta.7

package/dist/index.d.mts

@@ -23,6 +23,18 @@ verifyOptions: Parameters<typeof verifyAccessTokenRequest>[1], handler: (req: Re
  * the MCP resource identifier.
  */
 interface McpOptions extends OAuthOptions<Scope[]> {
+  /**
+   * Seconds that a rotated refresh token can be reused to receive the same
+   * token response for the same effective scopes, requested resources, and
+   * sender constraint.
+   *
+   * MCP overrides the OAuth Provider default because native/public MCP clients
+   * can have multiple local sessions racing the same refresh token. Set to `0`
+   * to keep strict replay handling.
+   *
+   * @default 30
+   */
+  refreshTokenReuseInterval?: OAuthOptions<Scope[]>["refreshTokenReuseInterval"];
   /**
    * The protected resource identifier (RFC 8707 / RFC 9728) that access tokens
    * are bound to. Published as `resource` in the protected resource metadata,
@@ -37,6 +49,9 @@ interface McpOptions extends OAuthOptions<Scope[]> {
  * MCP: it enables dynamic client registration, binds issued tokens to the MCP
  * `resource`, and, as the resource server, serves the RFC 9728 protected resource
  * metadata so MCP clients discover and use it through standard OAuth discovery.
+ * It also defaults `refreshTokenReuseInterval` to 30 seconds for native/public
+ * MCP clients that may retry a refresh after a local process loses the rotated
+ * response.
  * Because it is the OAuth provider, it cannot be combined with a separate
  * {@link oauthProvider}.
  *

package/dist/index.mjs

@@ -85,6 +85,9 @@ const buildResourceServerMetadata = (ctx, providerOptions, resource) => {
 * MCP: it enables dynamic client registration, binds issued tokens to the MCP
 * `resource`, and, as the resource server, serves the RFC 9728 protected resource
 * metadata so MCP clients discover and use it through standard OAuth discovery.
+* It also defaults `refreshTokenReuseInterval` to 30 seconds for native/public
+* MCP clients that may retry a refresh after a local process loses the rotated
+* response.
 * Because it is the OAuth provider, it cannot be combined with a separate
 * {@link oauthProvider}.
 *
@@ -107,11 +110,12 @@ const buildResourceServerMetadata = (ctx, providerOptions, resource) => {
 * ```
 */
 const mcp = (options) => {
-	const { resource, ...oauthOptions } = options;
+	const { resource, refreshTokenReuseInterval = 30, ...oauthOptions } = options;
 	ResourceUriSchema.parse(resource);
 	const provider = oauthProvider({
 		allowDynamicClientRegistration: true,
 		allowUnauthenticatedClientRegistration: true,
+		refreshTokenReuseInterval,
 		...oauthOptions,
 		resources: appendProtectedResource(oauthOptions.resources, resource)
 	});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/mcp",
-  "version": "1.7.0-beta.6",
+  "version": "1.7.0-beta.7",
   "description": "Model Context Protocol (MCP) plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -63,22 +63,22 @@
   },
   "dependencies": {
     "jose": "^6.1.3",
-    "@better-auth/oauth-provider": "^1.7.0-beta.6"
+    "@better-auth/oauth-provider": "^1.7.0-beta.10"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "better-call": "1.3.6",
+    "better-call": "1.3.7",
     "listhen": "1.9.0",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.6",
-    "better-auth": "1.7.0-beta.6"
+    "@better-auth/core": "1.7.0-beta.10",
+    "better-auth": "1.7.0-beta.10"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
-    "better-call": "1.3.6",
-    "@better-auth/core": "^1.7.0-beta.6",
-    "better-auth": "^1.7.0-beta.6"
+    "better-call": "1.3.7",
+    "@better-auth/core": "^1.7.0-beta.10",
+    "better-auth": "^1.7.0-beta.10"
   },
   "scripts": {
     "build": "tsdown",