tiny-http-mcp-server 0.1.24 → 0.1.26

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.24",
+      "version": "0.1.26",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -41,6 +41,7 @@ const verifier = createJwksTokenVerifier({
   - `mode: "dynamic"` with optional `metadata`
   - `mode: "static"` with `clientId`, optional `clientSecret`, optional `metadata`
 - `allowInteractive: false` prevents interactive login while retaining cached tokens and silent refresh
+- `sessionLockTimeoutMs` limits acquisition waits for a session transaction lock (default 30,000 ms; integer from 1 to 2147483647)
 - `initialGrant: { resource, tokens }` optionally imports an existing Bearer grant for one HTTP resource; requires the original client ID
 - `browser.openBrowser(url)` optional
 - `browser.readLine()` optional
@@ -84,6 +85,15 @@ registration, token requests and bounded token-body reads. Cancellation retains
 its original reason and does not retry authorization. Custom providers should
 observe the supplied signal and pass it to any work they start.
 
+`authorizeRequest` may return an owned token snapshot for the request it
+authorized. The HTTP client supplies that snapshot as `presentedTokens`, along
+with the actual request's `requestHeaders`, to `handleUnauthorized`. Providers
+that return `void` remain supported. The native provider compares the rejected
+snapshot with persisted credentials: delayed 401s retry with a newer grant
+without redeeming its refresh token again. A proven current token is refreshed
+on 401 even when the server omits `error="invalid_token"`. Invalid provenance
+fails without quoting token values.
+
 Configure `client.metadata.scope` to request a precise scope set; broader
 discovery metadata does not override it.
 
@@ -97,6 +107,16 @@ Input tokens are copied and invalid expiry values fail before authorization.
 
 `createAuthStoreSessionStore(options)` accepts the standard `auth-store` config.
 
+Providers sharing the same `sessionStore` object serialize the complete session
+read, refresh/authorization and persistence transaction for each resource.
+Waiting requests can cancel or time out independently; they cannot release an
+active owner's lock. Custom stores may implement
+`withLock(resource, operation, { signal, timeoutMs })` to serialize the same
+transaction across store instances or processes. The hook must honor acquisition
+cancellation and keep the lock until the operation settles. The timeout bounds
+acquisition, while token and browser operations retain their own deadlines.
+Cross-process locking for the native secret-store backend is under development.
+
 ## Environment Variables
 
 This package exposes no direct environment variables. When `authStore` is used,

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -7,6 +7,7 @@ import { createAuthorizationState } from "./authorization-state.js";
 import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
 import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError, readOAuthJsonObjectResponse } from "./token-endpoint.js";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+import { withOAuthSessionTransaction } from "./session-transaction.js";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export function createOAuthClientProvider(options) {
     if (isProviderOptions(options)) {
@@ -20,8 +21,6 @@ export function createDefaultOAuthClientProvider(options) {
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore);
     const now = options.now ?? Date.now;
     const registeredClients = new Map();
-    const refreshPromises = new Map();
-    const authorizationPromises = new Map();
     if (options.initialGrant !== undefined) {
         let resource;
         try {
@@ -58,7 +57,7 @@ export function createDefaultOAuthClientProvider(options) {
             if (session === null && !initialGrantConsumed && initialGrant?.resource === requestUrl &&
                 initialGrant.tokens !== undefined && !isExpired(initialGrant.tokens, now)) {
                 input.headers.set("Authorization", `Bearer ${initialGrant.tokens.accessToken}`);
-                return;
+                return { ...initialGrant.tokens };
             }
             if (session === null ||
                 accessToken === undefined ||
@@ -68,6 +67,7 @@ export function createDefaultOAuthClientProvider(options) {
             }
             assertRequestMatchesResource(requestUrl, session.resource);
             input.headers.set("Authorization", `Bearer ${accessToken}`);
+            return { ...session.tokens };
         },
         async handleUnauthorized(input) {
             try {
@@ -75,12 +75,28 @@ export function createDefaultOAuthClientProvider(options) {
                 const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
                 const resource = canonicalizeResourceIndicator(input.discovery.resource);
                 assertRequestMatchesResource(requestUrl, resource);
-                const forceRefresh = (hasCachedAccessToken(await loadSession(resource)) || (!initialGrantConsumed && initialGrant?.resource === resource)) &&
-                    input.challenge?.params.error === "invalid_token";
+                const cached = await loadSession(resource);
+                const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : undefined);
+                let rejectedCurrentGrant = hasCachedAccessToken(cached) || (!initialGrantConsumed && initialGrant?.resource === resource);
+                let presentedTokens = input.presentedTokens;
+                if (input.presentedTokens !== undefined) {
+                    rejectedCurrentGrant = false;
+                    if (input.presentedTokens !== null) {
+                        const presented = normalizeStoredTokens(input.presentedTokens);
+                        const header = input.requestHeaders?.get("Authorization") ?? "";
+                        const separator = header.indexOf(" ");
+                        if (presented === undefined || header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented.accessToken)
+                            throw new Error("OAuth rejected-request provenance does not match its authorization header");
+                        presentedTokens = presented;
+                        rejectedCurrentGrant = currentTokens !== undefined && sameTokenGrant(currentTokens, presented);
+                    }
+                }
+                const challengeError = input.challenge?.params.error;
+                const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || (input.presentedTokens !== undefined && challengeError === undefined));
                 const session = await ensureAuthorizedSession(resource, {
                     ...input.discovery,
                     resource
-                }, input.fetch, true, forceRefresh, input.signal);
+                }, input.fetch, true, forceRefresh, input.signal, presentedTokens);
                 if (session?.tokens?.accessToken === undefined) {
                     return { action: "fail" };
                 }
@@ -95,206 +111,186 @@ export function createDefaultOAuthClientProvider(options) {
             }
         }
     };
-    async function ensureAuthorizedSession(resource, discovery, fetch, allowInteractive, forceRefresh = false, signal) {
+    async function ensureAuthorizedSession(resource, discovery, fetch, allowInteractive, forceRefresh = false, signal, rejectedTokens) {
         signal?.throwIfAborted();
         const canonicalResource = canonicalizeResourceIndicator(resource);
-        let session = await loadSession(canonicalResource);
-        if (session !== null && initialGrant?.resource === canonicalResource)
-            initialGrantConsumed = true;
-        signal?.throwIfAborted();
-        if (discovery !== undefined && getOwnString(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
-            throw new Error("OAuth discovery authorization-server issuer mismatch");
-        }
-        if (session !== null && (canonicalizeResourceIndicator(session.resource) !== canonicalResource
-            || getOwnString(session.discovery.authorizationServerMetadata, "issuer") !== session.authorizationServer
-            || (discovery !== undefined && discovery.authorizationServer !== session.authorizationServer))) {
-            await clearSession(canonicalResource);
-            session = null;
-        }
-        if (session === null && discovery !== undefined && !initialGrantConsumed && initialGrant?.resource === canonicalResource &&
-            initialGrant.tokens !== undefined && initialGrant.client !== null) {
-            assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
-            session = { resource: canonicalResource, authorizationServer: discovery.authorizationServer,
-                client: initialGrant.client, tokens: initialGrant.tokens, discovery: toStoredDiscovery(discovery) };
-            await saveSession(canonicalResource, session);
-            initialGrantConsumed = true;
+        return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
+            let session = await loadSession(canonicalResource);
+            if (session !== null && initialGrant?.resource === canonicalResource)
+                initialGrantConsumed = true;
             signal?.throwIfAborted();
-        }
-        const sessionDiscovery = resolveDiscovery(discovery, session);
-        if (session?.tokens !== undefined && !forceRefresh && !isExpired(session.tokens, now)) {
-            return session;
-        }
-        if (session?.tokens?.refreshToken !== undefined &&
-            sessionDiscovery !== undefined &&
-            (forceRefresh || isExpired(session.tokens, now))) {
-            session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch, signal);
-            if (session?.tokens !== undefined && !isExpired(session.tokens, now)) {
+            if (discovery !== undefined && getOwnString(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
+                throw new Error("OAuth discovery authorization-server issuer mismatch");
+            }
+            if (session !== null && (canonicalizeResourceIndicator(session.resource) !== canonicalResource
+                || getOwnString(session.discovery.authorizationServerMetadata, "issuer") !== session.authorizationServer
+                || (discovery !== undefined && discovery.authorizationServer !== session.authorizationServer))) {
+                await clearSession(canonicalResource);
+                session = null;
+            }
+            if (session === null && discovery !== undefined && !initialGrantConsumed && initialGrant?.resource === canonicalResource &&
+                initialGrant.tokens !== undefined && initialGrant.client !== null) {
+                assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+                session = { resource: canonicalResource, authorizationServer: discovery.authorizationServer,
+                    client: initialGrant.client, tokens: initialGrant.tokens, discovery: toStoredDiscovery(discovery) };
+                await saveSession(canonicalResource, session);
+                initialGrantConsumed = true;
+                signal?.throwIfAborted();
+            }
+            if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
+                forceRefresh = false;
+            const sessionDiscovery = resolveDiscovery(discovery, session);
+            if (session?.tokens !== undefined && !forceRefresh && !isExpired(session.tokens, now)) {
                 return session;
             }
-        }
-        if (forceRefresh && session?.tokens !== undefined) {
-            session = clearSessionTokens(session);
-            await saveSession(canonicalResource, session);
-        }
-        if (!allowInteractive || sessionDiscovery === undefined) {
-            return session;
-        }
-        if (options.allowInteractive === false)
-            throw new Error("OAuth interactive authorization is disabled");
-        return authorizeSession(canonicalResource, session, sessionDiscovery, fetch, signal);
+            if (session?.tokens?.refreshToken !== undefined &&
+                sessionDiscovery !== undefined &&
+                (forceRefresh || isExpired(session.tokens, now))) {
+                session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch, signal);
+                if (session?.tokens !== undefined && !isExpired(session.tokens, now)) {
+                    return session;
+                }
+            }
+            if (forceRefresh && session?.tokens !== undefined) {
+                session = clearSessionTokens(session);
+                await saveSession(canonicalResource, session);
+            }
+            if (!allowInteractive || sessionDiscovery === undefined) {
+                return session;
+            }
+            if (options.allowInteractive === false)
+                throw new Error("OAuth interactive authorization is disabled");
+            return authorizeSession(canonicalResource, session, sessionDiscovery, fetch, signal);
+        }, { signal, timeoutMs: options.sessionLockTimeoutMs });
     }
     async function refreshSession(resource, session, discovery, fetch, signal) {
         signal?.throwIfAborted();
         assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
-        const inFlight = refreshPromises.get(resource);
-        if (inFlight !== undefined) {
-            return inFlight;
+        if (session.tokens?.refreshToken === undefined) {
+            return session;
         }
-        const promise = (async () => {
+        let refreshAttempted = false;
+        let refreshedTokens;
+        while (true) {
             try {
-                if (session.tokens?.refreshToken === undefined) {
-                    return session;
+                refreshedTokens = await refreshAccessToken({
+                    tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
+                    clientId: session.client.clientId,
+                    clientSecret: session.client.clientSecret,
+                    refreshToken: session.tokens.refreshToken,
+                    resource,
+                    fetch, signal,
+                    now
+                });
+                break;
+            }
+            catch (error) {
+                signal?.throwIfAborted();
+                if (error instanceof OAuthError && error.error === "invalid_grant") {
+                    const clearedSession = clearSessionTokens(session);
+                    await saveSession(resource, clearedSession);
+                    return clearedSession;
                 }
-                let refreshAttempted = false;
-                let refreshedTokens;
-                while (true) {
-                    try {
-                        refreshedTokens = await refreshAccessToken({
-                            tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
-                            clientId: session.client.clientId,
-                            clientSecret: session.client.clientSecret,
-                            refreshToken: session.tokens.refreshToken,
-                            resource,
-                            fetch, signal,
-                            now
-                        });
-                        break;
-                    }
-                    catch (error) {
-                        signal?.throwIfAborted();
-                        if (error instanceof OAuthError && error.error === "invalid_grant") {
-                            const clearedSession = clearSessionTokens(session);
-                            await saveSession(resource, clearedSession);
-                            return clearedSession;
-                        }
-                        if (shouldReRegisterStoredDynamicClient(error, await loadRegisteredClient(discovery.authorizationServer), false)) {
-                            await clearRegisteredClient(discovery.authorizationServer);
-                            await clearSession(resource);
-                            return null;
-                        }
-                        if (!refreshAttempted && isRetryableOAuthError(error)) {
-                            refreshAttempted = true;
-                            continue;
-                        }
-                        throw error;
-                    }
+                if (shouldReRegisterStoredDynamicClient(error, await loadRegisteredClient(discovery.authorizationServer), false)) {
+                    await clearRegisteredClient(discovery.authorizationServer);
+                    await clearSession(resource);
+                    return null;
                 }
-                const updatedSession = {
-                    ...session,
-                    tokens: {
-                        ...refreshedTokens,
-                        refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
-                    },
-                    discovery: toStoredDiscovery(discovery)
-                };
-                await saveSession(resource, updatedSession);
-                return updatedSession;
-            }
-            finally {
-                refreshPromises.delete(resource);
+                if (!refreshAttempted && isRetryableOAuthError(error)) {
+                    refreshAttempted = true;
+                    continue;
+                }
+                throw error;
             }
-        })();
-        refreshPromises.set(resource, promise);
-        return promise;
+        }
+        const updatedSession = {
+            ...session,
+            tokens: {
+                ...refreshedTokens,
+                refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
+            },
+            discovery: toStoredDiscovery(discovery)
+        };
+        await saveSession(resource, updatedSession);
+        return updatedSession;
     }
     async function authorizeSession(resource, existingSession, discovery, fetch, signal) {
         signal?.throwIfAborted();
-        const inFlight = authorizationPromises.get(resource);
-        if (inFlight !== undefined) {
-            return inFlight;
-        }
-        const promise = (async () => {
-            assertS256PkceSupport(discovery.authorizationServerMetadata);
-            assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
-            let currentSession = existingSession;
-            let transientRetryAttempted = false;
-            let reRegistrationAttempted = false;
-            while (true) {
-                const loopback = await createLoopbackAuthorizationSession({
-                    openBrowser: options.browser.openBrowser,
-                    readLine: options.browser.readLine,
-                    createServer: options.browser.createServer,
-                    landingPage: options.browser.landingPage,
-                    redirectUri: options.browser.redirectUri,
-                    signal: options.browser.signal === undefined ? signal : signal === undefined ? options.browser.signal : AbortSignal.any([signal, options.browser.signal]),
-                    timeoutMs: options.browser.timeoutMs
+        assertS256PkceSupport(discovery.authorizationServerMetadata);
+        assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+        let currentSession = existingSession;
+        let transientRetryAttempted = false;
+        let reRegistrationAttempted = false;
+        while (true) {
+            const loopback = await createLoopbackAuthorizationSession({
+                openBrowser: options.browser.openBrowser,
+                readLine: options.browser.readLine,
+                createServer: options.browser.createServer,
+                landingPage: options.browser.landingPage,
+                redirectUri: options.browser.redirectUri,
+                signal: options.browser.signal === undefined ? signal : signal === undefined ? options.browser.signal : AbortSignal.any([signal, options.browser.signal]),
+                timeoutMs: options.browser.timeoutMs
+            });
+            let resolvedClient = null;
+            try {
+                resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch, signal);
+                const sessionWithoutTokens = {
+                    resource,
+                    authorizationServer: discovery.authorizationServer,
+                    client: resolvedClient.client,
+                    discovery: toStoredDiscovery(discovery)
+                };
+                await saveSession(resource, sessionWithoutTokens);
+                const verifier = generateCodeVerifier();
+                const challenge = generateCodeChallenge(verifier);
+                const authorizationUrl = buildAuthorizationUrl({
+                    metadata: discovery.authorizationServerMetadata,
+                    resource,
+                    clientId: resolvedClient.client.clientId,
+                    redirectUri: loopback.redirectUri,
+                    codeChallenge: challenge,
+                    clientMetadata: getClientMetadata(options.client)
                 });
-                let resolvedClient = null;
-                try {
-                    resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch, signal);
-                    const sessionWithoutTokens = {
-                        resource,
-                        authorizationServer: discovery.authorizationServer,
-                        client: resolvedClient.client,
-                        discovery: toStoredDiscovery(discovery)
-                    };
-                    await saveSession(resource, sessionWithoutTokens);
-                    const verifier = generateCodeVerifier();
-                    const challenge = generateCodeChallenge(verifier);
-                    const authorizationUrl = buildAuthorizationUrl({
-                        metadata: discovery.authorizationServerMetadata,
-                        resource,
-                        clientId: resolvedClient.client.clientId,
-                        redirectUri: loopback.redirectUri,
-                        codeChallenge: challenge,
-                        clientMetadata: getClientMetadata(options.client)
-                    });
-                    const code = await loopback.waitForCode(authorizationUrl);
-                    const tokens = await exchangeAuthorizationCode({
-                        tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
-                        clientId: resolvedClient.client.clientId,
-                        clientSecret: resolvedClient.client.clientSecret,
-                        code,
-                        codeVerifier: verifier,
-                        redirectUri: loopback.redirectUri,
-                        resource,
-                        fetch, signal,
-                        now
-                    });
-                    const session = {
-                        ...sessionWithoutTokens,
-                        tokens
-                    };
-                    await saveSession(resource, session);
-                    return session;
-                }
-                catch (error) {
-                    signal?.throwIfAborted();
-                    if (shouldReRegisterStoredDynamicClient(error, resolvedClient, reRegistrationAttempted)) {
-                        reRegistrationAttempted = true;
-                        await clearRegisteredClient(discovery.authorizationServer);
-                        await clearSession(resource);
-                        currentSession = null;
-                        continue;
-                    }
-                    if (!transientRetryAttempted && isRetryableOAuthError(error)) {
-                        transientRetryAttempted = true;
-                        await clearSession(resource);
-                        currentSession = null;
-                        continue;
-                    }
-                    throw error;
+                const code = await loopback.waitForCode(authorizationUrl);
+                const tokens = await exchangeAuthorizationCode({
+                    tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
+                    clientId: resolvedClient.client.clientId,
+                    clientSecret: resolvedClient.client.clientSecret,
+                    code,
+                    codeVerifier: verifier,
+                    redirectUri: loopback.redirectUri,
+                    resource,
+                    fetch, signal,
+                    now
+                });
+                const session = {
+                    ...sessionWithoutTokens,
+                    tokens
+                };
+                await saveSession(resource, session);
+                return session;
+            }
+            catch (error) {
+                signal?.throwIfAborted();
+                if (shouldReRegisterStoredDynamicClient(error, resolvedClient, reRegistrationAttempted)) {
+                    reRegistrationAttempted = true;
+                    await clearRegisteredClient(discovery.authorizationServer);
+                    await clearSession(resource);
+                    currentSession = null;
+                    continue;
                 }
-                finally {
-                    loopback.close();
+                if (!transientRetryAttempted && isRetryableOAuthError(error)) {
+                    transientRetryAttempted = true;
+                    await clearSession(resource);
+                    currentSession = null;
+                    continue;
                 }
+                throw error;
             }
-        })();
-        const finalPromise = promise.finally(() => {
-            authorizationPromises.delete(resource);
-        });
-        authorizationPromises.set(resource, finalPromise);
-        return finalPromise;
+            finally {
+                loopback.close();
+            }
+        }
     }
     async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
         parentSignal?.throwIfAborted();
@@ -454,6 +450,10 @@ function resolveDiscovery(discovery, session) {
         authorizationServerMetadata: metadata
     };
 }
+function sameTokenGrant(left, right) {
+    return left.accessToken === right.accessToken && left.refreshToken === right.refreshToken &&
+        left.tokenType === right.tokenType && left.expiresAt === right.expiresAt && left.scope === right.scope;
+}
 function clearSessionTokens(session) {
     const nextSession = { ...session };
     delete nextSession.tokens;

package/node_modules/mcp-oauth/dist/client/session-transaction.d.ts

@@ -0,0 +1,6 @@
+import type { OAuthSessionStore } from "./types.js";
+/** Serialize the complete read/redeem/write operation, with independent cancellation for waiters. */
+export declare function withOAuthSessionTransaction<T>(store: OAuthSessionStore, resource: string, operation: () => Promise<T>, options?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}): Promise<T>;

package/node_modules/mcp-oauth/dist/client/session-transaction.js

@@ -0,0 +1,42 @@
+const queues = new WeakMap();
+/** Serialize the complete read/redeem/write operation, with independent cancellation for waiters. */
+export async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 30_000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)
+        throw new Error("sessionLockTimeoutMs must be an integer from 1 to 2147483647 milliseconds");
+    options.signal?.throwIfAborted();
+    const started = performance.now();
+    const pending = queues.get(store) ?? new Map();
+    queues.set(store, pending);
+    const previous = pending.get(resource) ?? Promise.resolve();
+    let release;
+    const current = new Promise(resolve => { release = resolve; });
+    const tail = previous.then(() => current);
+    pending.set(resource, tail);
+    try {
+        let timer;
+        let rejectWait;
+        const waiting = new Promise((resolve, reject) => { rejectWait = reject; previous.then(resolve, reject); });
+        const abort = () => rejectWait(options.signal?.reason);
+        try {
+            timer = setTimeout(() => rejectWait(new Error("Timed out waiting for OAuth session transaction lock")), timeoutMs);
+            options.signal?.addEventListener("abort", abort, { once: true });
+            if (options.signal?.aborted)
+                abort();
+            await waiting;
+        }
+        finally {
+            clearTimeout(timer);
+            options.signal?.removeEventListener("abort", abort);
+        }
+        options.signal?.throwIfAborted();
+        return store.withLock === undefined ? await operation() : await store.withLock(resource, operation, {
+            signal: options.signal, timeoutMs: Math.max(0, timeoutMs - (performance.now() - started))
+        });
+    }
+    finally {
+        release();
+        void tail.then(() => { if (pending.get(resource) === tail)
+            pending.delete(resource); });
+    }
+}

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -33,7 +33,7 @@ export interface OAuthClientProvider {
         headers: Headers;
         fetch: OAuthMetadataFetch;
         signal?: AbortSignal;
-    }): Promise<void> | void;
+    }): Promise<StoredOAuthTokens | void> | StoredOAuthTokens | void;
     handleUnauthorized(input: {
         requestUrl: URL;
         response: Response;
@@ -41,6 +41,10 @@ export interface OAuthClientProvider {
         discovery: OAuthDiscoveryResult;
         fetch: OAuthMetadataFetch;
         signal?: AbortSignal;
+        /** Headers actually attached to this rejected request. */
+        requestHeaders?: Headers;
+        /** Owned snapshot returned when this request was authorized, or null if absent. */
+        presentedTokens?: StoredOAuthTokens | null;
     }): Promise<{
         action: "retry";
     } | {
@@ -84,6 +88,11 @@ export interface OAuthSessionStore {
     load(resource: string): Promise<StoredOAuthSession | null>;
     save(resource: string, session: StoredOAuthSession): Promise<void>;
     clear(resource: string): Promise<void>;
+    /** Backend-wide lock covering a complete read/redeem/write transaction. */
+    withLock?<T>(resource: string, operation: () => Promise<T>, options: {
+        signal?: AbortSignal;
+        timeoutMs: number;
+    }): Promise<T>;
 }
 export interface DefaultOAuthClientProviderOptions {
     client: {
@@ -99,6 +108,8 @@ export interface DefaultOAuthClientProviderOptions {
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
+    /** Maximum wait to acquire a session transaction lock (default 30,000 ms). */
+    sessionLockTimeoutMs?: number;
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -110,7 +110,7 @@ interface OAuthClientProvider {
         headers: Headers;
         fetch: OAuthMetadataFetch;
         signal?: AbortSignal;
-    }): Promise<void> | void;
+    }): Promise<StoredOAuthTokens | void> | StoredOAuthTokens | void;
     handleUnauthorized(input: {
         requestUrl: URL;
         response: Response;
@@ -118,6 +118,10 @@ interface OAuthClientProvider {
         discovery: OAuthDiscoveryResult;
         fetch: OAuthMetadataFetch;
         signal?: AbortSignal;
+        /** Headers actually attached to this rejected request. */
+        requestHeaders?: Headers;
+        /** Owned snapshot returned when this request was authorized, or null if absent. */
+        presentedTokens?: StoredOAuthTokens | null;
     }): Promise<{
         action: "retry";
     } | {
@@ -161,6 +165,11 @@ interface OAuthSessionStore {
     load(resource: string): Promise<StoredOAuthSession | null>;
     save(resource: string, session: StoredOAuthSession): Promise<void>;
     clear(resource: string): Promise<void>;
+    /** Backend-wide lock covering a complete read/redeem/write transaction. */
+    withLock?<T>(resource: string, operation: () => Promise<T>, options: {
+        signal?: AbortSignal;
+        timeoutMs: number;
+    }): Promise<T>;
 }
 interface DefaultOAuthClientProviderOptions {
     client: {
@@ -176,6 +185,8 @@ interface DefaultOAuthClientProviderOptions {
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
+    /** Maximum wait to acquire a session transaction lock (default 30,000 ms). */
+    sessionLockTimeoutMs?: number;
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;
@@ -649,6 +660,7 @@ declare class HttpTransport implements McpTransport {
     private readonly oauthMetadataDiscovery;
     private readonly inFlightFetchAbortControllers;
     private readonly inFlightOAuthAbortControllers;
+    private readonly oauthRequestTokens;
     private readonly openResponseReaders;
     private readonly modernRequests;
     private modernMode;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4585,6 +4585,55 @@ function normalizeBearerTokenType(value) {
   return value.toLowerCase() === "bearer" ? "Bearer" : null;
 }
 
+// ../mcp-oauth/dist/client/session-transaction.js
+var queues = /* @__PURE__ */ new WeakMap();
+async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 3e4;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
+    throw new Error("sessionLockTimeoutMs must be an integer from 1 to 2147483647 milliseconds");
+  options.signal?.throwIfAborted();
+  const started = performance.now();
+  const pending = queues.get(store) ?? /* @__PURE__ */ new Map();
+  queues.set(store, pending);
+  const previous = pending.get(resource) ?? Promise.resolve();
+  let release;
+  const current = new Promise((resolve) => {
+    release = resolve;
+  });
+  const tail = previous.then(() => current);
+  pending.set(resource, tail);
+  try {
+    let timer;
+    let rejectWait;
+    const waiting = new Promise((resolve, reject) => {
+      rejectWait = reject;
+      previous.then(resolve, reject);
+    });
+    const abort = () => rejectWait(options.signal?.reason);
+    try {
+      timer = setTimeout(() => rejectWait(new Error("Timed out waiting for OAuth session transaction lock")), timeoutMs);
+      options.signal?.addEventListener("abort", abort, { once: true });
+      if (options.signal?.aborted)
+        abort();
+      await waiting;
+    } finally {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", abort);
+    }
+    options.signal?.throwIfAborted();
+    return store.withLock === void 0 ? await operation() : await store.withLock(resource, operation, {
+      signal: options.signal,
+      timeoutMs: Math.max(0, timeoutMs - (performance.now() - started))
+    });
+  } finally {
+    release();
+    void tail.then(() => {
+      if (pending.get(resource) === tail)
+        pending.delete(resource);
+    });
+  }
+}
+
 // ../mcp-oauth/dist/client/default-oauth-client-provider.js
 var MAX_JS_DATE_MS3 = 864e13;
 function createOAuthClientProvider(options) {
@@ -4599,8 +4648,6 @@ function createDefaultOAuthClientProvider(options) {
   const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore);
   const now = options.now ?? Date.now;
   const registeredClients = /* @__PURE__ */ new Map();
-  const refreshPromises = /* @__PURE__ */ new Map();
-  const authorizationPromises = /* @__PURE__ */ new Map();
   if (options.initialGrant !== void 0) {
     let resource;
     try {
@@ -4634,13 +4681,14 @@ function createDefaultOAuthClientProvider(options) {
       const accessToken = session?.tokens?.accessToken;
       if (session === null && !initialGrantConsumed && initialGrant?.resource === requestUrl && initialGrant.tokens !== void 0 && !isExpired(initialGrant.tokens, now)) {
         input.headers.set("Authorization", `Bearer ${initialGrant.tokens.accessToken}`);
-        return;
+        return { ...initialGrant.tokens };
       }
       if (session === null || accessToken === void 0 || session.tokens === void 0 || isExpired(session.tokens, now)) {
         return;
       }
       assertRequestMatchesResource(requestUrl, session.resource);
       input.headers.set("Authorization", `Bearer ${accessToken}`);
+      return { ...session.tokens };
     },
     async handleUnauthorized(input) {
       try {
@@ -4648,11 +4696,28 @@ function createDefaultOAuthClientProvider(options) {
         const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
         const resource = canonicalizeResourceIndicator(input.discovery.resource);
         assertRequestMatchesResource(requestUrl, resource);
-        const forceRefresh = (hasCachedAccessToken(await loadSession(resource)) || !initialGrantConsumed && initialGrant?.resource === resource) && input.challenge?.params.error === "invalid_token";
+        const cached = await loadSession(resource);
+        const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : void 0);
+        let rejectedCurrentGrant = hasCachedAccessToken(cached) || !initialGrantConsumed && initialGrant?.resource === resource;
+        let presentedTokens = input.presentedTokens;
+        if (input.presentedTokens !== void 0) {
+          rejectedCurrentGrant = false;
+          if (input.presentedTokens !== null) {
+            const presented = normalizeStoredTokens(input.presentedTokens);
+            const header = input.requestHeaders?.get("Authorization") ?? "";
+            const separator = header.indexOf(" ");
+            if (presented === void 0 || header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented.accessToken)
+              throw new Error("OAuth rejected-request provenance does not match its authorization header");
+            presentedTokens = presented;
+            rejectedCurrentGrant = currentTokens !== void 0 && sameTokenGrant(currentTokens, presented);
+          }
+        }
+        const challengeError = input.challenge?.params.error;
+        const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || input.presentedTokens !== void 0 && challengeError === void 0);
         const session = await ensureAuthorizedSession(resource, {
           ...input.discovery,
           resource
-        }, input.fetch, true, forceRefresh, input.signal);
+        }, input.fetch, true, forceRefresh, input.signal, presentedTokens);
         if (session?.tokens?.accessToken === void 0) {
           return { action: "fail" };
         }
@@ -4666,204 +4731,185 @@ function createDefaultOAuthClientProvider(options) {
       }
     }
   };
-  async function ensureAuthorizedSession(resource, discovery, fetch2, allowInteractive, forceRefresh = false, signal) {
+  async function ensureAuthorizedSession(resource, discovery, fetch2, allowInteractive, forceRefresh = false, signal, rejectedTokens) {
     signal?.throwIfAborted();
     const canonicalResource = canonicalizeResourceIndicator(resource);
-    let session = await loadSession(canonicalResource);
-    if (session !== null && initialGrant?.resource === canonicalResource)
-      initialGrantConsumed = true;
-    signal?.throwIfAborted();
-    if (discovery !== void 0 && getOwnString2(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
-      throw new Error("OAuth discovery authorization-server issuer mismatch");
-    }
-    if (session !== null && (canonicalizeResourceIndicator(session.resource) !== canonicalResource || getOwnString2(session.discovery.authorizationServerMetadata, "issuer") !== session.authorizationServer || discovery !== void 0 && discovery.authorizationServer !== session.authorizationServer)) {
-      await clearSession(canonicalResource);
-      session = null;
-    }
-    if (session === null && discovery !== void 0 && !initialGrantConsumed && initialGrant?.resource === canonicalResource && initialGrant.tokens !== void 0 && initialGrant.client !== null) {
-      assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
-      session = {
-        resource: canonicalResource,
-        authorizationServer: discovery.authorizationServer,
-        client: initialGrant.client,
-        tokens: initialGrant.tokens,
-        discovery: toStoredDiscovery(discovery)
-      };
-      await saveSession(canonicalResource, session);
-      initialGrantConsumed = true;
+    return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
+      let session = await loadSession(canonicalResource);
+      if (session !== null && initialGrant?.resource === canonicalResource)
+        initialGrantConsumed = true;
       signal?.throwIfAborted();
-    }
-    const sessionDiscovery = resolveDiscovery(discovery, session);
-    if (session?.tokens !== void 0 && !forceRefresh && !isExpired(session.tokens, now)) {
-      return session;
-    }
-    if (session?.tokens?.refreshToken !== void 0 && sessionDiscovery !== void 0 && (forceRefresh || isExpired(session.tokens, now))) {
-      session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch2, signal);
-      if (session?.tokens !== void 0 && !isExpired(session.tokens, now)) {
+      if (discovery !== void 0 && getOwnString2(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
+        throw new Error("OAuth discovery authorization-server issuer mismatch");
+      }
+      if (session !== null && (canonicalizeResourceIndicator(session.resource) !== canonicalResource || getOwnString2(session.discovery.authorizationServerMetadata, "issuer") !== session.authorizationServer || discovery !== void 0 && discovery.authorizationServer !== session.authorizationServer)) {
+        await clearSession(canonicalResource);
+        session = null;
+      }
+      if (session === null && discovery !== void 0 && !initialGrantConsumed && initialGrant?.resource === canonicalResource && initialGrant.tokens !== void 0 && initialGrant.client !== null) {
+        assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+        session = {
+          resource: canonicalResource,
+          authorizationServer: discovery.authorizationServer,
+          client: initialGrant.client,
+          tokens: initialGrant.tokens,
+          discovery: toStoredDiscovery(discovery)
+        };
+        await saveSession(canonicalResource, session);
+        initialGrantConsumed = true;
+        signal?.throwIfAborted();
+      }
+      if (forceRefresh && rejectedTokens !== void 0 && (rejectedTokens === null || session?.tokens === void 0 || !sameTokenGrant(session.tokens, rejectedTokens)))
+        forceRefresh = false;
+      const sessionDiscovery = resolveDiscovery(discovery, session);
+      if (session?.tokens !== void 0 && !forceRefresh && !isExpired(session.tokens, now)) {
         return session;
       }
-    }
-    if (forceRefresh && session?.tokens !== void 0) {
-      session = clearSessionTokens(session);
-      await saveSession(canonicalResource, session);
-    }
-    if (!allowInteractive || sessionDiscovery === void 0) {
-      return session;
-    }
-    if (options.allowInteractive === false)
-      throw new Error("OAuth interactive authorization is disabled");
-    return authorizeSession(canonicalResource, session, sessionDiscovery, fetch2, signal);
+      if (session?.tokens?.refreshToken !== void 0 && sessionDiscovery !== void 0 && (forceRefresh || isExpired(session.tokens, now))) {
+        session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch2, signal);
+        if (session?.tokens !== void 0 && !isExpired(session.tokens, now)) {
+          return session;
+        }
+      }
+      if (forceRefresh && session?.tokens !== void 0) {
+        session = clearSessionTokens(session);
+        await saveSession(canonicalResource, session);
+      }
+      if (!allowInteractive || sessionDiscovery === void 0) {
+        return session;
+      }
+      if (options.allowInteractive === false)
+        throw new Error("OAuth interactive authorization is disabled");
+      return authorizeSession(canonicalResource, session, sessionDiscovery, fetch2, signal);
+    }, { signal, timeoutMs: options.sessionLockTimeoutMs });
   }
   async function refreshSession(resource, session, discovery, fetch2, signal) {
     signal?.throwIfAborted();
     assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
-    const inFlight = refreshPromises.get(resource);
-    if (inFlight !== void 0) {
-      return inFlight;
+    if (session.tokens?.refreshToken === void 0) {
+      return session;
     }
-    const promise = (async () => {
+    let refreshAttempted = false;
+    let refreshedTokens;
+    while (true) {
       try {
-        if (session.tokens?.refreshToken === void 0) {
-          return session;
-        }
-        let refreshAttempted = false;
-        let refreshedTokens;
-        while (true) {
-          try {
-            refreshedTokens = await refreshAccessToken({
-              tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
-              clientId: session.client.clientId,
-              clientSecret: session.client.clientSecret,
-              refreshToken: session.tokens.refreshToken,
-              resource,
-              fetch: fetch2,
-              signal,
-              now
-            });
-            break;
-          } catch (error) {
-            signal?.throwIfAborted();
-            if (error instanceof OAuthError && error.error === "invalid_grant") {
-              const clearedSession = clearSessionTokens(session);
-              await saveSession(resource, clearedSession);
-              return clearedSession;
-            }
-            if (shouldReRegisterStoredDynamicClient(error, await loadRegisteredClient(discovery.authorizationServer), false)) {
-              await clearRegisteredClient(discovery.authorizationServer);
-              await clearSession(resource);
-              return null;
-            }
-            if (!refreshAttempted && isRetryableOAuthError(error)) {
-              refreshAttempted = true;
-              continue;
-            }
-            throw error;
-          }
+        refreshedTokens = await refreshAccessToken({
+          tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
+          clientId: session.client.clientId,
+          clientSecret: session.client.clientSecret,
+          refreshToken: session.tokens.refreshToken,
+          resource,
+          fetch: fetch2,
+          signal,
+          now
+        });
+        break;
+      } catch (error) {
+        signal?.throwIfAborted();
+        if (error instanceof OAuthError && error.error === "invalid_grant") {
+          const clearedSession = clearSessionTokens(session);
+          await saveSession(resource, clearedSession);
+          return clearedSession;
+        }
+        if (shouldReRegisterStoredDynamicClient(error, await loadRegisteredClient(discovery.authorizationServer), false)) {
+          await clearRegisteredClient(discovery.authorizationServer);
+          await clearSession(resource);
+          return null;
+        }
+        if (!refreshAttempted && isRetryableOAuthError(error)) {
+          refreshAttempted = true;
+          continue;
         }
-        const updatedSession = {
-          ...session,
-          tokens: {
-            ...refreshedTokens,
-            refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
-          },
-          discovery: toStoredDiscovery(discovery)
-        };
-        await saveSession(resource, updatedSession);
-        return updatedSession;
-      } finally {
-        refreshPromises.delete(resource);
+        throw error;
       }
-    })();
-    refreshPromises.set(resource, promise);
-    return promise;
+    }
+    const updatedSession = {
+      ...session,
+      tokens: {
+        ...refreshedTokens,
+        refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
+      },
+      discovery: toStoredDiscovery(discovery)
+    };
+    await saveSession(resource, updatedSession);
+    return updatedSession;
   }
   async function authorizeSession(resource, existingSession, discovery, fetch2, signal) {
     signal?.throwIfAborted();
-    const inFlight = authorizationPromises.get(resource);
-    if (inFlight !== void 0) {
-      return inFlight;
-    }
-    const promise = (async () => {
-      assertS256PkceSupport(discovery.authorizationServerMetadata);
-      assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
-      let currentSession = existingSession;
-      let transientRetryAttempted = false;
-      let reRegistrationAttempted = false;
-      while (true) {
-        const loopback = await createLoopbackAuthorizationSession({
-          openBrowser: options.browser.openBrowser,
-          readLine: options.browser.readLine,
-          createServer: options.browser.createServer,
-          landingPage: options.browser.landingPage,
-          redirectUri: options.browser.redirectUri,
-          signal: options.browser.signal === void 0 ? signal : signal === void 0 ? options.browser.signal : AbortSignal.any([signal, options.browser.signal]),
-          timeoutMs: options.browser.timeoutMs
+    assertS256PkceSupport(discovery.authorizationServerMetadata);
+    assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+    let currentSession = existingSession;
+    let transientRetryAttempted = false;
+    let reRegistrationAttempted = false;
+    while (true) {
+      const loopback = await createLoopbackAuthorizationSession({
+        openBrowser: options.browser.openBrowser,
+        readLine: options.browser.readLine,
+        createServer: options.browser.createServer,
+        landingPage: options.browser.landingPage,
+        redirectUri: options.browser.redirectUri,
+        signal: options.browser.signal === void 0 ? signal : signal === void 0 ? options.browser.signal : AbortSignal.any([signal, options.browser.signal]),
+        timeoutMs: options.browser.timeoutMs
+      });
+      let resolvedClient = null;
+      try {
+        resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch2, signal);
+        const sessionWithoutTokens = {
+          resource,
+          authorizationServer: discovery.authorizationServer,
+          client: resolvedClient.client,
+          discovery: toStoredDiscovery(discovery)
+        };
+        await saveSession(resource, sessionWithoutTokens);
+        const verifier = generateCodeVerifier();
+        const challenge = generateCodeChallenge(verifier);
+        const authorizationUrl = buildAuthorizationUrl({
+          metadata: discovery.authorizationServerMetadata,
+          resource,
+          clientId: resolvedClient.client.clientId,
+          redirectUri: loopback.redirectUri,
+          codeChallenge: challenge,
+          clientMetadata: getClientMetadata(options.client)
         });
-        let resolvedClient = null;
-        try {
-          resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch2, signal);
-          const sessionWithoutTokens = {
-            resource,
-            authorizationServer: discovery.authorizationServer,
-            client: resolvedClient.client,
-            discovery: toStoredDiscovery(discovery)
-          };
-          await saveSession(resource, sessionWithoutTokens);
-          const verifier = generateCodeVerifier();
-          const challenge = generateCodeChallenge(verifier);
-          const authorizationUrl = buildAuthorizationUrl({
-            metadata: discovery.authorizationServerMetadata,
-            resource,
-            clientId: resolvedClient.client.clientId,
-            redirectUri: loopback.redirectUri,
-            codeChallenge: challenge,
-            clientMetadata: getClientMetadata(options.client)
-          });
-          const code = await loopback.waitForCode(authorizationUrl);
-          const tokens = await exchangeAuthorizationCode({
-            tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
-            clientId: resolvedClient.client.clientId,
-            clientSecret: resolvedClient.client.clientSecret,
-            code,
-            codeVerifier: verifier,
-            redirectUri: loopback.redirectUri,
-            resource,
-            fetch: fetch2,
-            signal,
-            now
-          });
-          const session = {
-            ...sessionWithoutTokens,
-            tokens
-          };
-          await saveSession(resource, session);
-          return session;
-        } catch (error) {
-          signal?.throwIfAborted();
-          if (shouldReRegisterStoredDynamicClient(error, resolvedClient, reRegistrationAttempted)) {
-            reRegistrationAttempted = true;
-            await clearRegisteredClient(discovery.authorizationServer);
-            await clearSession(resource);
-            currentSession = null;
-            continue;
-          }
-          if (!transientRetryAttempted && isRetryableOAuthError(error)) {
-            transientRetryAttempted = true;
-            await clearSession(resource);
-            currentSession = null;
-            continue;
-          }
-          throw error;
-        } finally {
-          loopback.close();
+        const code = await loopback.waitForCode(authorizationUrl);
+        const tokens = await exchangeAuthorizationCode({
+          tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
+          clientId: resolvedClient.client.clientId,
+          clientSecret: resolvedClient.client.clientSecret,
+          code,
+          codeVerifier: verifier,
+          redirectUri: loopback.redirectUri,
+          resource,
+          fetch: fetch2,
+          signal,
+          now
+        });
+        const session = {
+          ...sessionWithoutTokens,
+          tokens
+        };
+        await saveSession(resource, session);
+        return session;
+      } catch (error) {
+        signal?.throwIfAborted();
+        if (shouldReRegisterStoredDynamicClient(error, resolvedClient, reRegistrationAttempted)) {
+          reRegistrationAttempted = true;
+          await clearRegisteredClient(discovery.authorizationServer);
+          await clearSession(resource);
+          currentSession = null;
+          continue;
+        }
+        if (!transientRetryAttempted && isRetryableOAuthError(error)) {
+          transientRetryAttempted = true;
+          await clearSession(resource);
+          currentSession = null;
+          continue;
         }
+        throw error;
+      } finally {
+        loopback.close();
       }
-    })();
-    const finalPromise = promise.finally(() => {
-      authorizationPromises.delete(resource);
-    });
-    authorizationPromises.set(resource, finalPromise);
-    return finalPromise;
+    }
   }
   async function resolveClient(existingSession, discovery, redirectUri, fetch2, parentSignal) {
     parentSignal?.throwIfAborted();
@@ -5014,6 +5060,9 @@ function resolveDiscovery(discovery, session) {
     authorizationServerMetadata: metadata
   };
 }
+function sameTokenGrant(left, right) {
+  return left.accessToken === right.accessToken && left.refreshToken === right.refreshToken && left.tokenType === right.tokenType && left.expiresAt === right.expiresAt && left.scope === right.scope;
+}
 function clearSessionTokens(session) {
   const nextSession = { ...session };
   delete nextSession.tokens;
@@ -6789,6 +6838,7 @@ var HttpTransport = class {
   oauthMetadataDiscovery;
   inFlightFetchAbortControllers = /* @__PURE__ */ new Set();
   inFlightOAuthAbortControllers = /* @__PURE__ */ new Set();
+  oauthRequestTokens = /* @__PURE__ */ new WeakMap();
   openResponseReaders = /* @__PURE__ */ new Set();
   modernRequests = /* @__PURE__ */ new Map();
   modernMode = false;
@@ -7059,7 +7109,7 @@ var HttpTransport = class {
   }
   async authorizeRequestHeaders(headers, signal) {
     signal?.throwIfAborted();
-    await this.oauthProvider?.authorizeRequest?.({
+    const tokens = await this.oauthProvider?.authorizeRequest?.({
       requestUrl: new URL(this.url),
       headers,
       signal,
@@ -7068,6 +7118,7 @@ var HttpTransport = class {
         signal: signal === void 0 ? init?.signal : init?.signal == null ? signal : AbortSignal.any([signal, init.signal])
       })
     });
+    if (tokens !== void 0) this.oauthRequestTokens.set(headers, { ...tokens });
     signal?.throwIfAborted();
     return headers;
   }
@@ -7211,7 +7262,7 @@ var HttpTransport = class {
     const message = responseBody.length === 0 ? `HTTP transport POST failed (${statusDescriptor})` : `HTTP transport POST failed (${statusDescriptor}): ${responseBody}`;
     throw new HttpTransportError(message, response.status, "POST");
   }
-  async maybeHandleUnauthorizedResponse(response, signal) {
+  async maybeHandleUnauthorizedResponse(response, signal, requestHeaders, presentedTokens) {
     if (response.status !== 401 || this.oauthProvider === void 0) {
       return false;
     }
@@ -7232,6 +7283,8 @@ var HttpTransport = class {
           challenge,
           discovery,
           signal,
+          requestHeaders: new Headers(requestHeaders),
+          presentedTokens,
           fetch: (url, init) => fetchMcpResponse(this.fetchImpl, url, {
             ...init,
             signal: init?.signal == null ? signal : AbortSignal.any([signal, init.signal])
@@ -7372,16 +7425,20 @@ var HttpTransport = class {
     const request = async () => {
       controller.signal.throwIfAborted();
       const headers = await input.createHeaders(controller.signal);
+      const headerSnapshot = new Headers(headers);
+      const tokens = this.oauthRequestTokens.get(headers) ?? null;
       controller.signal.throwIfAborted();
-      return this.fetchWithAbort(input.url ?? this.url, {
+      const response = await this.fetchWithAbort(input.url ?? this.url, {
         method: input.method,
         headers,
         body: input.body
       }, controller);
+      return { response, headers: headerSnapshot, tokens };
     };
     try {
-      let response = await request();
-      if (await this.maybeHandleUnauthorizedResponse(response, controller.signal)) response = await request();
+      let attempt = await request();
+      if (await this.maybeHandleUnauthorizedResponse(attempt.response, controller.signal, attempt.headers, attempt.tokens)) attempt = await request();
+      const response = attempt.response;
       const oauthError = this.oauthProvider === void 0 ? null : this.readOAuthChallengeError(response);
       if (oauthError !== null) {
         void response.body?.cancel().catch(() => void 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",