clanka 0.8.3 → 0.8.5

package/dist/bin/{McpClient-DP4jlaD1.mjs → McpClient-C0FVuDj2.mjs}

@@ -1,5 +1,5 @@
-import { Ct as promise, Ta as Service, Wt as sync, Y as gen, Yt as tryPromise, er as effect, t as acquireRelease, z as fn } from "./Effect-BCeySOy1.mjs";
-import { d as Defect, z as TaggedError } from "./Schema-C9JQ5hI0.mjs";
+import { B as fn, Ea as Service, Gt as sync, X as gen, Xt as tryPromise, t as acquireRelease, tr as effect, wt as promise } from "./Effect-BEUn4I5E.mjs";
+import { d as Defect, z as TaggedError } from "./Schema-CjUGw2Xh.mjs";
 import { O as __commonJSMin, k as __toESM } from "./cli.mjs";
 //#region node_modules/.pnpm/zod@4.4.2/node_modules/zod/v4/core/core.js
 var _a$1;
@@ -3383,7 +3383,7 @@ const optionalProcessor = (schema, ctx, _json, params) => {
 	seen.ref = def.innerType;
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
 	return !!s._zod;
 }
@@ -4349,7 +4349,7 @@ function number(params) {
 	return _coercedNumber(ZodNumber, params);
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 const LATEST_PROTOCOL_VERSION = "2025-11-25";
 const SUPPORTED_PROTOCOL_VERSIONS = [
 	LATEST_PROTOCOL_VERSION,
@@ -5150,12 +5150,12 @@ var UrlElicitationRequiredError = class extends McpError {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
 	return status === "completed" || status === "failed" || status === "cancelled";
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function getMethodLiteral(schema) {
 	const methodSchema = getObjectShape(schema)?.method;
 	if (!methodSchema) throw new Error("Schema is missing a method literal");
@@ -5169,7 +5169,7 @@ function parseWithCompat(schema, data) {
 	return result.data;
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 const DEFAULT_REQUEST_TIMEOUT_MSEC = 6e4;
 var Protocol = class {
 	constructor(_options) {
@@ -5202,6 +5202,7 @@ var Protocol = class {
 			this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
 				const handleTaskResult = async () => {
 					const taskId = request.params.taskId;
+					if (!await this._taskStore.getTask(taskId, extra.sessionId)) throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
 					if (this._taskMessageQueue) {
 						let queuedMessage;
 						while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -5228,12 +5229,12 @@ var Protocol = class {
 					const task = await this._taskStore.getTask(taskId, extra.sessionId);
 					if (!task) throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
 					if (!isTerminal(task.status)) {
-						await this._waitForTaskUpdate(taskId, extra.signal);
+						await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
 						return await handleTaskResult();
 					}
 					if (isTerminal(task.status)) {
 						const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-						this._clearTaskQueue(taskId);
+						this._clearTaskQueue(taskId, extra.sessionId);
 						return {
 							...result,
 							_meta: {
@@ -5264,7 +5265,7 @@ var Protocol = class {
 					if (!task) throw new McpError(ErrorCode.InvalidParams, `Task not found: ${request.params.taskId}`);
 					if (isTerminal(task.status)) throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
 					await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-					this._clearTaskQueue(request.params.taskId);
+					this._clearTaskQueue(request.params.taskId, extra.sessionId);
 					const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
 					if (!cancelledTask) throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
 					return {
@@ -5364,6 +5365,17 @@ var Protocol = class {
 		const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
 		const capturedTransport = this._transport;
 		const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+		const sessionId = capturedTransport?.sessionId;
+		const store = this._taskStore;
+		let relatedTaskFound = true;
+		let relatedTaskLookup;
+		if (relatedTaskId && store && this._taskMessageQueue && sessionId !== void 0) {
+			relatedTaskFound = false;
+			relatedTaskLookup = (async () => {
+				if (!await store.getTask(relatedTaskId, sessionId)) throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+				relatedTaskFound = true;
+			})();
+		}
 		if (handler === void 0) {
 			const errorResponse = {
 				jsonrpc: "2.0",
@@ -5373,7 +5385,14 @@ var Protocol = class {
 					message: "Method not found"
 				}
 			};
-			if (relatedTaskId && this._taskMessageQueue) this._enqueueTaskMessage(relatedTaskId, {
+			if (relatedTaskId && relatedTaskLookup) {
+				const queuedError = {
+					type: "error",
+					message: errorResponse,
+					timestamp: Date.now()
+				};
+				relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error) => this._onerror(new Error(`Failed to send an error response: ${error}`)));
+			} else if (relatedTaskId && this._taskMessageQueue) this._enqueueTaskMessage(relatedTaskId, {
 				type: "error",
 				message: errorResponse,
 				timestamp: Date.now()
@@ -5415,7 +5434,8 @@ var Protocol = class {
 			closeSSEStream: extra?.closeSSEStream,
 			closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
 		};
-		Promise.resolve().then(() => {
+		(relatedTaskLookup ?? Promise.resolve()).then(() => {
+			if (relatedTaskLookup && abortController.signal.aborted) throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
 			if (taskCreationParams) this.assertTaskHandlerCapability(request.method);
 		}).then(() => handler(request, fullExtra)).then(async (result) => {
 			if (abortController.signal.aborted) return;
@@ -5441,7 +5461,7 @@ var Protocol = class {
 					...error["data"] !== void 0 && { data: error["data"] }
 				}
 			};
-			if (relatedTaskId && this._taskMessageQueue) await this._enqueueTaskMessage(relatedTaskId, {
+			if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) await this._enqueueTaskMessage(relatedTaskId, {
 				type: "error",
 				message: errorResponse,
 				timestamp: Date.now()
@@ -5801,7 +5821,7 @@ var Protocol = class {
 	async _enqueueTaskMessage(taskId, message, sessionId) {
 		if (!this._taskStore || !this._taskMessageQueue) throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
 		const maxQueueSize = this._options?.maxTaskQueueSize;
-		await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+		await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
 	}
 	async _clearTaskQueue(taskId, sessionId) {
 		if (this._taskMessageQueue) {
@@ -5816,10 +5836,10 @@ var Protocol = class {
 			}
 		}
 	}
-	async _waitForTaskUpdate(taskId, signal) {
+	async _waitForTaskUpdate(taskId, signal, sessionId) {
 		let interval = this._options?.defaultTaskPollInterval ?? 1e3;
 		try {
-			const task = await this._taskStore?.getTask(taskId);
+			const task = await this._taskStore?.getTask(taskId, sessionId);
 			if (task?.pollInterval) interval = task.pollInterval;
 		} catch {}
 		return new Promise((resolve, reject) => {
@@ -12227,7 +12247,7 @@ var require_dist = __commonJSMin(((exports, module) => {
 	exports.default = formatsPlugin;
 }));
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 var import_ajv = __toESM(require_ajv(), 1);
 var import_dist = __toESM(require_dist(), 1);
 function createDefaultAjvInstance() {
@@ -12261,7 +12281,7 @@ var AjvJsonSchemaValidator = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/client.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/client.js
 var ExperimentalClientTasks = class {
 	constructor(_client) {
 		this._client = _client;
@@ -12331,7 +12351,7 @@ var ExperimentalClientTasks = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
 	if (!requests) throw new Error(`${entityName} does not support task creation (required for ${method})`);
 	switch (method) {
@@ -12348,7 +12368,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/client/index.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/client/index.js
 function applyElicitationDefaults(schema, data) {
 	if (!schema || data === null || typeof data !== "object") return;
 	if (schema.type === "object" && schema.properties && typeof schema.properties === "object") {
@@ -12770,7 +12790,7 @@ var require_content_type = __commonJSMin(((exports) => {
 	}
 }));
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
 var import_content_type = __toESM(require_content_type(), 1);
 function mediaTypeEssence(header) {
 	if (!header) return;
@@ -12783,7 +12803,7 @@ function mediaTypeEssence(header) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/transport.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/transport.js
 function normalizeHeaders(headers) {
 	if (!headers) return {};
 	if (headers instanceof Headers) return Object.fromEntries(headers.entries());
@@ -12803,6 +12823,65 @@ function createFetchWithInit(baseFetch = fetch, baseInit) {
 		});
 	};
 }
+const MAX_REDIRECTS = 5;
+const REDIRECT_STATUSES = [
+	301,
+	302,
+	303,
+	307,
+	308
+];
+function isWithinOrigin(from, to) {
+	if (from.protocol === to.protocol && from.hostname === to.hostname && from.port === to.port) return true;
+	return from.hostname === to.hostname && from.protocol === "http:" && from.port === "" && to.protocol === "https:" && to.port === "";
+}
+function redirectTarget(response, requestUrl) {
+	const location = REDIRECT_STATUSES.includes(response.status) ? response.headers.get("location") : null;
+	try {
+		return location ? new URL(location, requestUrl) : void 0;
+	} catch {
+		return;
+	}
+}
+function followWithinOrigin(baseFetch, url, init, response, followed = 0) {
+	const target = redirectTarget(response, url);
+	const keepsMethod = response.status === 307 || response.status === 308 || (init?.method ?? "GET").toUpperCase() === "GET";
+	if (!target || followed === MAX_REDIRECTS || !keepsMethod) return;
+	const from = new URL(url);
+	if ((target.username || target.password) && (target.username !== from.username || target.password !== from.password) || !isWithinOrigin(from, target)) return;
+	return Promise.resolve(response.body?.cancel()).then(() => baseFetch(target, {
+		...init,
+		redirect: "manual"
+	})).then((next) => followWithinOrigin(baseFetch, target, init, next, followed + 1) ?? next);
+}
+const followingFetches = new WeakSet();
+function fetchLeavingRedirects(baseFetch) {
+	const following = (url, init) => (baseFetch ?? fetch)(url, init);
+	followingFetches.add(following);
+	return following;
+}
+function fetchWithinOrigin(baseFetch = fetch) {
+	if (followingFetches.has(baseFetch)) return baseFetch;
+	return (url, init) => {
+		if (init?.redirect === "error" || init?.redirect === "manual") return baseFetch(url, init);
+		return Promise.resolve(baseFetch(url, {
+			...init,
+			redirect: "manual"
+		})).then((response) => followWithinOrigin(baseFetch, url, init, response) ?? response);
+	};
+}
+function unfollowedRedirect(response, requestUrl) {
+	if (response.type === "opaqueredirect") return "Redirect not followed: this runtime does not expose the redirect target";
+	const from = response.url || requestUrl;
+	const target = redirectTarget(response, from);
+	if (!target) return;
+	target.username = target.password = target.search = target.hash = "";
+	if (target.protocol === "http:" && new URL(from).protocol === "https:") {
+		target.protocol = "https:";
+		return `Redirect to plain http not followed; try ${target.href} instead`;
+	}
+	return `Redirect to ${target.href} not followed`;
+}
 //#endregion
 //#region node_modules/.pnpm/pkce-challenge@5.0.1/node_modules/pkce-challenge/dist/index.node.js
 let crypto;
@@ -12837,7 +12916,7 @@ async function pkceChallenge(length) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
 const SafeUrlSchema = url().superRefine((val, ctx) => {
 	if (!URL.canParse(val)) {
 		ctx.addIssue({
@@ -12936,7 +13015,8 @@ const OAuthTokensSchema = object({
 	token_type: string(),
 	expires_in: number().optional(),
 	scope: string().optional(),
-	refresh_token: string().optional()
+	refresh_token: string().optional(),
+	issuer: string().optional().catch(void 0)
 }).strip();
 const OAuthErrorResponseSchema = object({
 	error: string(),
@@ -12966,7 +13046,8 @@ const OAuthClientInformationSchema = object({
 	client_id: string(),
 	client_secret: string().optional(),
 	client_id_issued_at: number$1().optional(),
-	client_secret_expires_at: number$1().optional()
+	client_secret_expires_at: number$1().optional(),
+	issuer: string().optional().catch(void 0)
 }).strip();
 const OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
 const OAuthClientRegistrationErrorSchema = object({
@@ -12978,7 +13059,7 @@ const OAuthTokenRevocationRequestSchema = object({
 	token_type_hint: string().optional()
 }).strip();
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js
 function resourceUrlFromServerUrl(url) {
 	const resourceURL = typeof url === "string" ? new URL(url) : new URL(url.href);
 	resourceURL.hash = "";
@@ -12994,7 +13075,7 @@ function checkResourceAllowed({ requestedResource, configuredResource }) {
 	return requestedPath.startsWith(configuredPath);
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js
 var OAuthError = class extends Error {
 	constructor(message, errorUri) {
 		super(message);
@@ -13067,7 +13148,7 @@ const OAUTH_ERRORS = {
 	[InvalidTargetError.errorCode]: InvalidTargetError
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.js
 var UnauthorizedError = class extends Error {
 	constructor(message) {
 		super(message ?? "Unauthorized");
@@ -13125,10 +13206,31 @@ async function parseErrorResponse(input) {
 		const { error, error_description, error_uri } = OAuthErrorResponseSchema.parse(JSON.parse(body));
 		return new (OAUTH_ERRORS[error] || ServerError)(error_description || "", error_uri);
 	} catch (error) {
-		const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}Invalid OAuth error response: ${error}. Raw body: ${body}`;
+		const redirect = input instanceof Response ? unfollowedRedirect(input, input.url) : void 0;
+		const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}${redirect ?? `Invalid OAuth error response: ${error}. Raw body: ${body}`}`;
 		return new ServerError(errorMessage);
 	}
 }
+function issuersMatch(a, b) {
+	let [x, y] = [a, b];
+	try {
+		[x, y] = [new URL(a).href, new URL(b).href];
+	} catch {}
+	return x === y || x.endsWith("/") && x.slice(0, -1) === y || y.endsWith("/") && y.slice(0, -1) === x;
+}
+function discardIfIssuerMismatch(stored, issuer) {
+	if (!stored) return void 0;
+	if (typeof stored.issuer !== "string") return stored.issuer == null ? stored : {
+		...stored,
+		issuer: void 0
+	};
+	return issuersMatch(stored.issuer, issuer) ? stored : void 0;
+}
+const TokenResponseSchema = OAuthTokensSchema.omit({ issuer: true });
+const RegistrationResponseSchema = OAuthClientInformationFullSchema.omit({ issuer: true });
+function boundElsewhereError(stored, issuer) {
+	return new Error(`OAuth client information is bound to authorization server ${stored.issuer} and is not presented to ${issuer}. Clear the stored client information, or correct \`expectedIssuer\`, if the authorization server has moved.`);
+}
 async function auth(provider, options) {
 	try {
 		return await authInternal(provider, options);
@@ -13178,27 +13280,46 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
 			authorizationServerMetadata: metadata
 		});
 	}
-	const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+	const issuer = String(authorizationServerUrl);
+	const selectedResource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+	const resource = selectedResource && resourceMetadata && !provider.validateResourceURL ? resourceMetadata.resource : selectedResource;
 	const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope;
-	let clientInformation = await Promise.resolve(provider.clientInformation());
+	const storedClientInformation = await Promise.resolve(provider.clientInformation());
+	let clientInformation = discardIfIssuerMismatch(storedClientInformation, issuer);
+	const canRegisterAgain = provider.saveClientInformation !== void 0 && !!provider.redirectUrl;
+	if (storedClientInformation && !clientInformation && !canRegisterAgain) throw boundElsewhereError(storedClientInformation, issuer);
+	const unstampedClientInformation = clientInformation?.issuer == null ? clientInformation : void 0;
+	const bindClientInformation = async () => {
+		try {
+			if (unstampedClientInformation) await provider.saveClientInformation?.({
+				...unstampedClientInformation,
+				issuer
+			});
+		} catch {}
+	};
 	if (!clientInformation) {
 		if (authorizationCode !== void 0) throw new Error("Existing OAuth client information is required when exchanging an authorization code");
 		const supportsUrlBasedClientId = metadata?.client_id_metadata_document_supported === true;
 		const clientMetadataUrl = provider.clientMetadataUrl;
 		if (clientMetadataUrl && !isHttpsUrl(clientMetadataUrl)) throw new InvalidClientMetadataError(`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${clientMetadataUrl}`);
 		if (supportsUrlBasedClientId && clientMetadataUrl) {
-			clientInformation = { client_id: clientMetadataUrl };
+			clientInformation = {
+				client_id: clientMetadataUrl,
+				issuer
+			};
 			await provider.saveClientInformation?.(clientInformation);
 		} else {
 			if (!provider.saveClientInformation) throw new Error("OAuth client information must be saveable for dynamic registration");
-			const fullInformation = await registerClient(authorizationServerUrl, {
-				metadata,
-				clientMetadata: provider.clientMetadata,
-				scope: resolvedScope,
-				fetchFn
-			});
-			await provider.saveClientInformation(fullInformation);
-			clientInformation = fullInformation;
+			clientInformation = {
+				...await registerClient(authorizationServerUrl, {
+					metadata,
+					clientMetadata: provider.clientMetadata,
+					scope: resolvedScope,
+					fetchFn
+				}),
+				issuer
+			};
+			await provider.saveClientInformation(clientInformation);
 		}
 	}
 	const nonInteractiveFlow = !provider.redirectUrl;
@@ -13209,10 +13330,15 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
 			authorizationCode,
 			fetchFn
 		});
-		await provider.saveTokens(tokens);
+		await bindClientInformation();
+		await provider.saveTokens({
+			...tokens,
+			issuer
+		});
 		return "AUTHORIZED";
 	}
-	const tokens = await provider.tokens();
+	const tokens = discardIfIssuerMismatch(await provider.tokens(), issuer);
+	if (tokens?.refresh_token && tokens.issuer == null) console.warn("[mcp-sdk] stored OAuth tokens have no 'issuer' property (saved by an earlier version, or by a provider that does not keep it) and are used as-is; make sure your OAuthClientProvider stores what saveTokens() and saveClientInformation() receive unchanged.");
 	if (tokens?.refresh_token) try {
 		const newTokens = await refreshAuthorization(authorizationServerUrl, {
 			metadata,
@@ -13222,7 +13348,11 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
 			addClientAuthentication: provider.addClientAuthentication,
 			fetchFn
 		});
-		await provider.saveTokens(newTokens);
+		await bindClientInformation();
+		await provider.saveTokens({
+			...newTokens,
+			issuer
+		});
 		return "AUTHORIZED";
 	} catch (error) {
 		if (!(error instanceof OAuthError) || error instanceof ServerError) {} else throw error;
@@ -13302,7 +13432,7 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn =
 }
 async function fetchWithCorsRetry(url, headers, fetchFn = fetch) {
 	try {
-		return await fetchFn(url, { headers });
+		return await fetchWithinOrigin(fetchFn)(url, { headers });
 	} catch (error) {
 		if (error instanceof TypeError) {
 			if (headers) return fetchWithCorsRetry(url, void 0, fetchFn);
@@ -13319,7 +13449,7 @@ async function tryMetadataDiscovery(url, protocolVersion, fetchFn = fetch) {
 	return await fetchWithCorsRetry(url, { "MCP-Protocol-Version": protocolVersion }, fetchFn);
 }
 function shouldAttemptFallback(response, pathname) {
-	return !response || response.status >= 400 && response.status < 500 && pathname !== "/";
+	return !response || !response.ok && response.status < 500 && pathname !== "/";
 }
 async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
 	const issuer = new URL(serverUrl);
@@ -13377,7 +13507,7 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fet
 		if (!response) continue;
 		if (!response.ok) {
 			await response.body?.cancel();
-			if (response.status >= 400 && response.status < 500) continue;
+			if (response.status < 500) continue;
 			throw new Error(`HTTP ${response.status} trying to load ${type === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
 		}
 		if (type === "oauth") return OAuthMetadataSchema.parse(await response.json());
@@ -13399,6 +13529,9 @@ async function discoverOAuthServerInfo(serverUrl, opts) {
 		resourceMetadata
 	};
 }
+function resourceIndicatorToString(resource) {
+	return typeof resource === "string" ? resource : resource.href;
+}
 async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
 	let authorizationUrl;
 	if (metadata) {
@@ -13417,7 +13550,7 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
 	if (state) authorizationUrl.searchParams.set("state", state);
 	if (scope) authorizationUrl.searchParams.set("scope", scope);
 	if (scope?.includes("offline_access")) authorizationUrl.searchParams.append("prompt", "consent");
-	if (resource) authorizationUrl.searchParams.set("resource", resource.href);
+	if (resource) authorizationUrl.searchParams.set("resource", resourceIndicatorToString(resource));
 	return {
 		authorizationUrl,
 		codeVerifier
@@ -13437,16 +13570,16 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
 		"Content-Type": "application/x-www-form-urlencoded",
 		Accept: "application/json"
 	});
-	if (resource) tokenRequestParams.set("resource", resource.href);
+	if (resource) tokenRequestParams.set("resource", resourceIndicatorToString(resource));
 	if (addClientAuthentication) await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
 	else if (clientInformation) applyClientAuthentication(selectClientAuthMethod(clientInformation, metadata?.token_endpoint_auth_methods_supported ?? []), clientInformation, headers, tokenRequestParams);
-	const response = await (fetchFn ?? fetch)(tokenUrl, {
+	const response = await fetchWithinOrigin(fetchFn ?? fetch)(tokenUrl, {
 		method: "POST",
 		headers,
 		body: tokenRequestParams
 	});
 	if (!response.ok) throw await parseErrorResponse(response);
-	return OAuthTokensSchema.parse(await response.json());
+	return TokenResponseSchema.parse(await response.json());
 }
 async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
 	return {
@@ -13465,6 +13598,13 @@ async function refreshAuthorization(authorizationServerUrl, { metadata, clientIn
 	};
 }
 async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
+	const readClientInformation = async () => {
+		const storedClientInformation = await provider.clientInformation();
+		const checked = discardIfIssuerMismatch(storedClientInformation, String(authorizationServerUrl));
+		if (storedClientInformation && !checked) throw boundElsewhereError(storedClientInformation, String(authorizationServerUrl));
+		return checked;
+	};
+	let clientInformation = await readClientInformation();
 	const scope = provider.clientMetadata.scope;
 	let tokenRequestParams;
 	if (provider.prepareTokenRequest) tokenRequestParams = await provider.prepareTokenRequest(scope);
@@ -13473,11 +13613,11 @@ async function fetchToken(provider, authorizationServerUrl, { metadata, resource
 		if (!provider.redirectUrl) throw new Error("redirectUrl is required for authorization_code flow");
 		tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, await provider.codeVerifier(), provider.redirectUrl);
 	}
-	const clientInformation = await provider.clientInformation();
+	clientInformation ?? (clientInformation = await readClientInformation());
 	return executeTokenRequest(authorizationServerUrl, {
 		metadata,
 		tokenRequestParams,
-		clientInformation: clientInformation ?? void 0,
+		clientInformation,
 		addClientAuthentication: provider.addClientAuthentication,
 		resource,
 		fetchFn
@@ -13489,7 +13629,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
 		if (!metadata.registration_endpoint) throw new Error("Incompatible auth server: does not support dynamic client registration");
 		registrationUrl = new URL(metadata.registration_endpoint);
 	} else registrationUrl = new URL("/register", authorizationServerUrl);
-	const response = await (fetchFn ?? fetch)(registrationUrl, {
+	const response = await fetchWithinOrigin(fetchFn ?? fetch)(registrationUrl, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify({
@@ -13498,7 +13638,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
 		})
 	});
 	if (!response.ok) throw await parseErrorResponse(response);
-	return OAuthClientInformationFullSchema.parse(await response.json());
+	return RegistrationResponseSchema.parse(await response.json());
 }
 //#endregion
 //#region node_modules/.pnpm/eventsource-parser@3.1.1/node_modules/eventsource-parser/dist/index.js
@@ -13694,7 +13834,7 @@ var EventSourceParserStream = class extends TransformStream {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.4.2/node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.js
 const DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS = {
 	initialReconnectionDelay: 1e3,
 	maxReconnectionDelay: 3e4,
@@ -13717,9 +13857,18 @@ var StreamableHTTPClientTransport = class {
 		this._authProvider = opts?.authProvider;
 		this._fetch = opts?.fetch;
 		this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
+		this._followRedirects = opts?.redirectPolicy === "follow";
+		if (this._followRedirects) {
+			this._fetch = fetchLeavingRedirects(this._fetch);
+			this._fetchWithInit = fetchLeavingRedirects(this._fetchWithInit);
+		}
 		this._sessionId = opts?.sessionId;
 		this._reconnectionOptions = opts?.reconnectionOptions ?? DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS;
 	}
+	_unfollowedRedirect(response, url) {
+		const text = unfollowedRedirect(response, url);
+		return text && !this._followRedirects ? `${text} (redirectPolicy: 'same-origin')` : text;
+	}
 	async _authThenStart() {
 		if (!this._authProvider) throw new UnauthorizedError("No auth provider");
 		let result;
@@ -13757,16 +13906,23 @@ var StreamableHTTPClientTransport = class {
 			const headers = await this._commonHeaders();
 			headers.set("Accept", "text/event-stream");
 			if (resumptionToken) headers.set("last-event-id", resumptionToken);
-			const response = await (this._fetch ?? fetch)(this._url, {
+			const fetchFn = this._fetch ?? fetch;
+			const init = {
 				method: "GET",
 				headers,
 				signal: this._abortController?.signal
+			};
+			let response = await fetchFn(this._url, this._followRedirects ? init : {
+				...init,
+				redirect: "manual"
 			});
+			const followed = this._followRedirects ? void 0 : followWithinOrigin(fetchFn, this._url, init, response);
+			if (followed) response = await followed;
 			if (!response.ok) {
 				await response.body?.cancel();
 				if (response.status === 401 && this._authProvider) return await this._authThenStart();
 				if (response.status === 405) return;
-				throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${response.statusText}`);
+				throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${this._unfollowedRedirect(response, this._url) ?? response.statusText}`);
 			}
 			this._handleSseStream(response.body, options, true);
 		} catch (error) {
@@ -13888,7 +14044,7 @@ var StreamableHTTPClientTransport = class {
 				body: JSON.stringify(message),
 				signal: this._abortController?.signal
 			};
-			const response = await (this._fetch ?? fetch)(this._url, init);
+			const response = await fetchWithinOrigin(this._fetch ?? fetch)(this._url, init);
 			const sessionId = response.headers.get("mcp-session-id");
 			if (sessionId) this._sessionId = sessionId;
 			if (!response.ok) {
@@ -13924,7 +14080,7 @@ var StreamableHTTPClientTransport = class {
 						return this.send(message);
 					}
 				}
-				throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${text}`);
+				throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${this._unfollowedRedirect(response, this._url) ?? text}`);
 			}
 			this._hasCompletedAuthFlow = false;
 			this._lastUpscopingHeader = void 0;
@@ -13965,9 +14121,9 @@ var StreamableHTTPClientTransport = class {
 				headers,
 				signal: this._abortController?.signal
 			};
-			const response = await (this._fetch ?? fetch)(this._url, init);
+			const response = await fetchWithinOrigin(this._fetch ?? fetch)(this._url, init);
 			await response.body?.cancel();
-			if (!response.ok && response.status !== 405) throw new StreamableHTTPError(response.status, `Failed to terminate session: ${response.statusText}`);
+			if (!response.ok && response.status !== 405) throw new StreamableHTTPError(response.status, `Failed to terminate session: ${this._unfollowedRedirect(response, this._url) ?? response.statusText}`);
 			this._sessionId = void 0;
 		} catch (error) {
 			this.onerror?.(error);
@@ -14020,4 +14176,4 @@ const layer = effect(McpClient, gen(function* () {
 //#endregion
 export { McpClient, McpClientError, layer };
 
-//# sourceMappingURL=McpClient-DP4jlaD1.mjs.map
+//# sourceMappingURL=McpClient-C0FVuDj2.mjs.map