fix(client/auth): propagate saveTokens errors after refresh

[SAY-5]

Closes #2034

The try { refreshAuthorization(...); saveTokens(...); } catch (error) block in auth() was wide enough to swallow saveTokens() failures (any non-OAuthError, plus ServerError). With rotating refresh tokens, that loses the freshly minted refresh token while the AS has already invalidated the old one, leaving the client unable to recover.

Split the block: the try/catch now wraps only refreshAuthorization, where fall-through to a fresh authorization flow is the intended recovery. saveTokens runs after the catch on a separate, unguarded path so its errors propagate to the caller.

Added a vitest regression test under OAuth Authorization > auth function that mocks saveTokens to reject, asserts the rejection bubbles to the auth() caller, and asserts redirectToAuthorization is never reached. The test fails on main and passes with this change. Full packages/client suite (365 tests) passes; pnpm lint clean.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 39747b1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2053

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2053

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2053

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2053

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2053

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2053

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2053

commit: 39747b1

[SAY-5]

The test (22) job failed on test/server/cloudflareWorkers.test.ts with a miniflare Network connection lost error. This is unrelated to the auth.ts changes in this PR (no cloudflare code was touched). It looks like an infra flake.