fix(client): don't match WWW-Authenticate field names inside longer param names

[VihaanAgarwal]

extractFieldFromWwwAuth builds its regex as ${fieldName}=(?:...) with nothing anchoring the start of the param name. Asking for scope also matches error_scope="...", so whichever param appears first shadows the real value. The worst case is resource_metadata: a header like Bearer x_resource_metadata="https://decoy.example.com" returns a URL from a param that isn't resource_metadata at all, and that value is what extractWWWAuthenticateParams feeds into protected-resource-metadata discovery.

Repro on current main:

const res = new Response(null, {
    status: 401,
    headers: { 'WWW-Authenticate': 'Bearer error_scope="decoy", scope="read write"' }
});
extractWWWAuthenticateParams(res).scope; // 'decoy' (expected 'read write')

The fix anchors the param name to the header start or a whitespace/comma separator, so it only matches as a complete auth-param name. Two regression tests cover both shadowing shapes (scope inside error_scope, and a decoy x_resource_metadata); both fail without the one-line change. Changeset included.

The same unanchored pattern exists on v1.x (src/client/auth.ts). Happy to send the equivalent patch there too if useful.

[changeset-bot]

🦋 Changeset detected

Latest commit: 7d3a506

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/client	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2503

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2503

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2503

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2503

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2503

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2503

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2503

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2503

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2503

commit: 7d3a506