fix: prevent duplicate Authorization header in SSE client

[Christian-Sidak]

Summary

Fixes #1872. When both requestInit.headers and eventSourceInit.fetch provide the same Authorization header, the server receives a duplicated value (Bearer X, Bearer X) due to a case mismatch between the Headers instance (lowercase authorization) and the user's closure headers (original case Authorization).

• Remove eventSourceInit.fetch from the fetchImpl resolution chain in _startOrAuth() -- the SDK's internal wrapper already fully controls the fetch call passed to EventSource, so fetchImpl should use the raw transport (opts.fetch or global fetch), not the user's header-injecting wrapper
• Update existing test that relied on eventSourceInit.fetch being used as fetchImpl
• Add regression test verifying no duplicate Authorization header when both requestInit.headers and eventSourceInit.fetch inject the same token

Root cause

1. _commonHeaders() returns a Headers instance which lowercases keys (authorization)
2. _startOrAuth() used eventSourceInit.fetch as fetchImpl, calling it with the Headers instance
3. The user's custom fetch iterates the Headers into a plain object (lowercase keys), then merges closure headers (original case), producing both authorization and Authorization as separate keys
4. new Headers({ authorization: X, Authorization: X }) joins them per HTTP spec into X, X

Test plan

• Existing SSE tests pass (362/362)
• New regression test: when requestInit.headers and eventSourceInit.fetch both set Authorization, server receives exactly one value
• Verified eventSourceInit.fetch is no longer called as fetchImpl (spy test)

[changeset-bot]

🦋 Changeset detected

Latest commit: db4d179

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@modelcontextprotocol/client	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@1919

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@1919

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@1919

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@1919

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@1919

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@1919

commit: db4d179