fix: preserve exact OAuth resource indicators

[hugosmoreira]

Summary

• preserve the exact OAuth resource indicator published in protected resource metadata
• continue validating the metadata value as a URL while avoiding URL.href normalization in authorization and token requests
• accept either string or URL resource indicators in the exported OAuth request helpers
• add regression coverage for authorization requests, token requests, and provider resource storage

Fixes #1968

Root cause

The default protected-resource flow converted the metadata's resource string to a URL and later serialized URL.href. For origin-only values such as https://resource.example.com, that serialization adds a trailing slash, which changes the OAuth resource indicator and can cause authorization servers to reject the request.

Custom provider validation remains unchanged: its returned URL is still used as the selected resource.

Validation

• pnpm --filter @modelcontextprotocol/client typecheck
• pnpm --filter @modelcontextprotocol/client build
• pnpm --filter @modelcontextprotocol/client test — 798 tests passed
• focused OAuth suite — 253 tests passed
• scoped ESLint and Prettier checks on the changed files
• repository-wide pre-push build and typecheck

[changeset-bot]

🦋 Changeset detected

Latest commit: 248e166

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/client	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2581

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2581

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2581

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2581

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2581

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2581

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2581

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2581

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2581

commit: 248e166