fix(merge): restore main-side drops — auth.test invalid_token case + JSONRPCResultResponse* migration rows

Author: felixweinberger

docs/migration/upgrade-to-v2.md

@@ -783,14 +783,18 @@ include task vocabulary; the deprecated `Task*` types remain importable on their
 | `JSONRPCErrorSchema` | `JSONRPCErrorResponseSchema` |
 | `isJSONRPCError` | `isJSONRPCErrorResponse` |
 | `isJSONRPCResponse` (deprecated in v1) | `isJSONRPCResultResponse` ² |
+| `JSONRPCResponseSchema` (result-only in v1) | `JSONRPCResultResponseSchema` ² |
+| `JSONRPCResponse` (result-only in v1) | `JSONRPCResultResponse` ² |
 | `ResourceReference` / `ResourceReferenceSchema` | `ResourceTemplateReference` / `ResourceTemplateReferenceSchema` |
 | `IsomorphicHeaders` | Web Standard `Headers` |
 | `RequestHandlerExtra` | `ServerContext` / `ClientContext` / `BaseContext` |
 | `ResourceTemplate` (the spec wire **type** from `sdk/types.js`) | `ResourceTemplateType` ³ |
 
-² v2 introduces a **new** `isJSONRPCResponse` with corrected semantics — it matches
-**both** result and error responses. v1's `isJSONRPCResponse` only matched results. To
-preserve v1 behavior, rename to `isJSONRPCResultResponse` (the codemod does this).
+² v2 introduces **new** `isJSONRPCResponse` / `JSONRPCResponse` / `JSONRPCResponseSchema`
+with corrected semantics — they match **both** result and error responses (the schema is
+`z.union([JSONRPCResultResponseSchema, JSONRPCErrorResponseSchema])`). v1's symbols only
+matched results. To preserve v1 behavior, rename to `isJSONRPCResultResponse` /
+`JSONRPCResultResponse` / `JSONRPCResultResponseSchema` (the codemod does this).
 
 ³ The `ResourceTemplate` URI-template helper **class** (from `sdk/server/mcp.js`) is
 **unchanged** — keep `new ResourceTemplate(...)` as-is. Only the like-named spec wire

packages/client/test/client/auth.test.ts

@@ -155,6 +155,25 @@ describe('OAuth Authorization', () => {
             expect(extractWWWAuthenticateParams(mockResponse)).toEqual({ error: 'insufficient_scope', scope: 'admin' });
         });
 
+        it('parses invalid_token challenges with protected resource metadata', async () => {
+            const resourceUrl = 'https://resource.example.com/.well-known/oauth-protected-resource/mcp';
+            const mockResponse = {
+                headers: {
+                    get: vi.fn(name =>
+                        name === 'WWW-Authenticate'
+                            ? `Bearer resource_metadata="${resourceUrl}", error="invalid_token", error_description="The access token expired"`
+                            : null
+                    )
+                }
+            } as unknown as Response;
+
+            expect(extractWWWAuthenticateParams(mockResponse)).toEqual({
+                resourceMetadataUrl: new URL(resourceUrl),
+                error: 'invalid_token',
+                errorDescription: 'The access token expired'
+            });
+        });
+
         it('returns error_description when present', async () => {
             const mockResponse = {
                 headers: {