tiny-http-mcp-server 0.1.27 → 0.1.29

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.27",
+      "version": "0.1.29",
       "license": "MIT"
     },
     {

package/node_modules/auth-store/README.md

@@ -56,6 +56,10 @@ directory or filesystem adapter. Injected encrypted-file adapters need
 - Configurable salt, directory, and file name
 - File permissions: `0600`
 - Random IV per write
+- `fileStore.throwOnInvalidDocument: true` makes malformed or unauthenticated
+  existing documents fail with a safe diagnostic; missing files still return
+  `null`. The default treats invalid documents as absent. Strict reads preserve
+  the existing file until an explicit reset or replacement.
 
 ### macOS Keychain
 

package/node_modules/auth-store/dist/encrypted-file-store.d.ts

@@ -31,6 +31,8 @@ export interface EncryptedFileStoreInput {
     getMachineIdentity?: () => MachineIdentity | Promise<MachineIdentity>;
     getHomeDirectory?: () => string;
     getRandomBytes?: (size: number) => Buffer;
+    /** Fail closed instead of treating malformed or unauthenticated documents as absent. */
+    throwOnInvalidDocument?: boolean;
 }
 export declare class EncryptedFileStore implements SecretStore {
     private readonly fs;
@@ -40,6 +42,7 @@ export declare class EncryptedFileStore implements SecretStore {
     private readonly getMachineIdentity;
     private readonly getRandomBytes;
     private keyPromise;
+    private readonly throwOnInvalidDocument;
     constructor(input: EncryptedFileStoreInput);
     get(): Promise<string | null>;
     withLock<T>(operation: () => Promise<T>, options?: SecretStoreLockOptions): Promise<T>;

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -19,6 +19,7 @@ export class EncryptedFileStore {
     getMachineIdentity;
     getRandomBytes;
     keyPromise = null;
+    throwOnInvalidDocument;
     constructor(input) {
         this.fs = input.fs ?? fs;
         this.salt = input.salt;
@@ -37,6 +38,7 @@ export class EncryptedFileStore {
         }
         this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
         this.getRandomBytes = input.getRandomBytes ?? randomBytes;
+        this.throwOnInvalidDocument = input.throwOnInvalidDocument ?? false;
     }
     async get() {
         await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
@@ -52,6 +54,8 @@ export class EncryptedFileStore {
         }
         const document = parseEncryptedDocument(rawDocument);
         if (!document) {
+            if (this.throwOnInvalidDocument)
+                throw new Error("Invalid encrypted credential document; reset the store explicitly to recover");
             return null;
         }
         const key = await this.getEncryptionKey();
@@ -61,6 +65,8 @@ export class EncryptedFileStore {
             const ciphertext = Buffer.from(document.ciphertext, "base64");
             if (iv.byteLength !== ENCRYPTION_IV_BYTES ||
                 authTag.byteLength !== ENCRYPTION_AUTH_TAG_BYTES) {
+                if (this.throwOnInvalidDocument)
+                    throw new Error("Invalid encrypted credential document; reset the store explicitly to recover");
                 return null;
             }
             const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key, iv);
@@ -69,6 +75,8 @@ export class EncryptedFileStore {
             return plaintext.toString("utf8");
         }
         catch {
+            if (this.throwOnInvalidDocument)
+                throw new Error("Invalid encrypted credential document; reset the store explicitly to recover");
             return null;
         }
     }

package/node_modules/mcp-oauth/README.md

@@ -118,9 +118,23 @@ acquisition, while token and browser operations retain their own deadlines.
 The native `auth-store` session adapter implements this hook for both encrypted
 files and Keychain identities, including across independent processes. Locks
 cover the complete read, refresh/authorization and persisted winner. Dead-owner
-claims are recovered without stealing a live transaction. A process crash or
-cancellation after refresh redemption but before persistence is still an
-uncertain token outcome; recovery for that case is under development.
+claims are recovered without stealing a live transaction.
+
+Before sending a refresh request, the provider persists a tokenless session with
+`refreshState: "pending"`, retaining the original client and discovery binding.
+A successful response replaces it with the rotated grant. A crash, cancellation,
+network disconnect or incomplete response leaves the marker, so another process
+cannot replay a possibly consumed refresh token or revive the initial import.
+Such a session requires fresh authorization. Interactive unauthorized handling
+can recover it; headless requests fail with an explicit unknown-outcome error.
+Only complete OAuth error responses establish a rejected request and allow a
+transient retry or restoration of the original grant. Gateway error pages do not.
+
+Native persisted OAuth reads always reject corrupt encrypted documents and
+invalid stored JSON, with diagnostics that omit decrypted contents. They retain
+the existing record for explicit reset rather than interpreting corruption as
+an absent session and reviving an initial grant. Caller file-backend settings
+cannot disable this policy.
 
 ## Environment Variables
 

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -23,7 +23,13 @@ export function createAuthStoreSessionStore(options = {}) {
             if (value === null) {
                 return null;
             }
-            const parsed = JSON.parse(value);
+            let parsed;
+            try {
+                parsed = JSON.parse(value);
+            }
+            catch {
+                throw new Error("Stored OAuth session must be valid JSON; reset the store explicitly to recover");
+            }
             if (isStoredOAuthSession(parsed)) {
                 return parsed;
             }
@@ -47,7 +53,13 @@ export function createAuthStoreClientStore(options) {
             if (value === null) {
                 return null;
             }
-            const parsed = JSON.parse(value);
+            let parsed;
+            try {
+                parsed = JSON.parse(value);
+            }
+            catch {
+                throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
+            }
             const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : undefined;
             if (clientId !== undefined) {
                 const client = { clientId };
@@ -75,6 +87,7 @@ function createNamedSecretStore(key, options, defaults) {
     const parsedFilePath = configuredFilePath === undefined ? null : path.parse(configuredFilePath);
     const fileStore = {
         ...options.fileStore,
+        throwOnInvalidDocument: true,
         filePath: parsedFilePath === null
             ? undefined
             : path.join(parsedFilePath.dir, `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`),
@@ -125,6 +138,8 @@ function isStoredOAuthSession(value) {
         isNonBlankOwnString(value, "authorizationServer") &&
         isStoredOAuthClient(getOwnEntry(value, "client")) &&
         isStoredOAuthDiscovery(getOwnEntry(value, "discovery")) &&
+        (getOwnEntry(value, "refreshState") === undefined ||
+            (getOwnEntry(value, "refreshState") === "pending" && getOwnEntry(value, "tokens") === undefined)) &&
         isStoredOAuthTokensOrMissing(getOwnEntry(value, "tokens")));
 }
 function isStoredOAuthClient(value) {

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -140,6 +140,11 @@ export function createDefaultOAuthClientProvider(options) {
             if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
                 forceRefresh = false;
             const sessionDiscovery = resolveDiscovery(discovery, session);
+            if (session?.refreshState === "pending") {
+                if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === undefined)
+                    throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
+                return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch, signal);
+            }
             if (session?.tokens !== undefined && !forceRefresh && !isExpired(session.tokens, now)) {
                 return session;
             }
@@ -169,6 +174,9 @@ export function createDefaultOAuthClientProvider(options) {
         if (session.tokens?.refreshToken === undefined) {
             return session;
         }
+        const pendingSession = { ...clearSessionTokens(session), refreshState: "pending" };
+        await saveSession(resource, pendingSession);
+        signal?.throwIfAborted();
         let refreshAttempted = false;
         let refreshedTokens;
         while (true) {
@@ -186,7 +194,11 @@ export function createDefaultOAuthClientProvider(options) {
             }
             catch (error) {
                 signal?.throwIfAborted();
-                if (error instanceof OAuthError && error.error === "invalid_grant") {
+                // Network errors, lost/malformed bodies and gateway failures cannot
+                // establish whether a rotating refresh token was already consumed.
+                if (!(error instanceof OAuthError) || !error.outcomeKnown)
+                    throw error;
+                if (error.error === "invalid_grant") {
                     const clearedSession = clearSessionTokens(session);
                     await saveSession(resource, clearedSession);
                     return clearedSession;
@@ -200,6 +212,7 @@ export function createDefaultOAuthClientProvider(options) {
                     refreshAttempted = true;
                     continue;
                 }
+                await saveSession(resource, session);
                 throw error;
             }
         }
@@ -457,6 +470,7 @@ function sameTokenGrant(left, right) {
 function clearSessionTokens(session) {
     const nextSession = { ...session };
     delete nextSession.tokens;
+    delete nextSession.refreshState;
     return nextSession;
 }
 function hasCachedAccessToken(session) {
@@ -466,6 +480,9 @@ function normalizeLoadedSession(session) {
     if (session === null) {
         return null;
     }
+    const refreshState = getOwnEntry(session, "refreshState");
+    if (refreshState !== undefined && (refreshState !== "pending" || getOwnEntry(session, "tokens") !== undefined))
+        throw new Error("Stored OAuth refresh state is invalid");
     const client = normalizeStoredClient(getOwnEntry(session, "client"));
     if (client === null) {
         return { ...session, client: { clientId: "" }, tokens: undefined };

package/node_modules/mcp-oauth/dist/client/token-endpoint.d.ts

@@ -13,7 +13,9 @@ export declare class OAuthError extends Error {
     readonly status: number;
     readonly retryable: boolean;
     readonly terminal: boolean;
-    constructor(shape: OAuthErrorShape, status: number);
+    /** True only when a complete OAuth error response establishes rejection. */
+    readonly outcomeKnown: boolean;
+    constructor(shape: OAuthErrorShape, status: number, outcomeKnown?: boolean);
 }
 export declare function isRetryableOAuthError(error: unknown): error is OAuthError;
 export declare function exchangeAuthorizationCode(input: {

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -11,7 +11,9 @@ export class OAuthError extends Error {
     status;
     retryable;
     terminal;
-    constructor(shape, status) {
+    /** True only when a complete OAuth error response establishes rejection. */
+    outcomeKnown;
+    constructor(shape, status, outcomeKnown = true) {
         super(shape.error_description ?? shape.error);
         this.name = "OAuthError";
         this.error = shape.error;
@@ -22,6 +24,7 @@ export class OAuthError extends Error {
         this.status = status;
         this.retryable = isRetryableOAuthError(this);
         this.terminal = !this.retryable;
+        this.outcomeKnown = outcomeKnown;
     }
 }
 export function isRetryableOAuthError(error) {
@@ -147,7 +150,8 @@ export async function readOAuthJsonObjectResponse(response, signal) {
     }
     const record = payload;
     if (!response.ok) {
-        throw new OAuthError(readOAuthError(record, fallbackError.error), response.status);
+        const error = getOwnEntry(record, "error");
+        throw new OAuthError(readOAuthError(record, fallbackError.error), response.status, typeof error === "string" && error.trim().length > 0);
     }
     return record;
 }
@@ -166,7 +170,7 @@ function getOwnEntry(record, key) {
 }
 function createFallbackOAuthError(status) {
     const error = status === 503 ? "temporarily_unavailable" : "server_error";
-    return new OAuthError({ error }, status);
+    return new OAuthError({ error }, status, false);
 }
 function normalizeBearerTokenType(value) {
     if (typeof value !== "string") {

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -78,6 +78,8 @@ export interface StoredOAuthSession {
         clientSecret?: string;
     };
     tokens?: StoredOAuthTokens;
+    /** A refresh was begun; its winning response may not have been persisted. */
+    refreshState?: "pending";
     discovery: {
         resourceMetadataUrl: string;
         resourceMetadata: Record<string, unknown>;

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -70,6 +70,8 @@ interface EncryptedFileStoreInput {
     getMachineIdentity?: () => MachineIdentity | Promise<MachineIdentity>;
     getHomeDirectory?: () => string;
     getRandomBytes?: (size: number) => Buffer;
+    /** Fail closed instead of treating malformed or unauthenticated documents as absent. */
+    throwOnInvalidDocument?: boolean;
 }
 
 interface KeychainCommandResult {
@@ -179,6 +181,8 @@ interface StoredOAuthSession {
         clientSecret?: string;
     };
     tokens?: StoredOAuthTokens;
+    /** A refresh was begun; its winning response may not have been persisted. */
+    refreshState?: "pending";
     discovery: {
         resourceMetadataUrl: string;
         resourceMetadata: Record<string, unknown>;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3575,6 +3575,7 @@ var EncryptedFileStore = class {
   getMachineIdentity;
   getRandomBytes;
   keyPromise = null;
+  throwOnInvalidDocument;
   constructor(input) {
     this.fs = input.fs ?? fs;
     this.salt = input.salt;
@@ -3592,6 +3593,7 @@ var EncryptedFileStore = class {
     }
     this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
     this.getRandomBytes = input.getRandomBytes ?? randomBytes;
+    this.throwOnInvalidDocument = input.throwOnInvalidDocument ?? false;
   }
   async get() {
     await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
@@ -3606,6 +3608,8 @@ var EncryptedFileStore = class {
     }
     const document = parseEncryptedDocument(rawDocument);
     if (!document) {
+      if (this.throwOnInvalidDocument)
+        throw new Error("Invalid encrypted credential document; reset the store explicitly to recover");
       return null;
     }
     const key2 = await this.getEncryptionKey();
@@ -3614,6 +3618,8 @@ var EncryptedFileStore = class {
       const authTag = Buffer.from(document.authTag, "base64");
       const ciphertext = Buffer.from(document.ciphertext, "base64");
       if (iv.byteLength !== ENCRYPTION_IV_BYTES || authTag.byteLength !== ENCRYPTION_AUTH_TAG_BYTES) {
+        if (this.throwOnInvalidDocument)
+          throw new Error("Invalid encrypted credential document; reset the store explicitly to recover");
         return null;
       }
       const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key2, iv);
@@ -3621,6 +3627,8 @@ var EncryptedFileStore = class {
       const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
       return plaintext.toString("utf8");
     } catch {
+      if (this.throwOnInvalidDocument)
+        throw new Error("Invalid encrypted credential document; reset the store explicitly to recover");
       return null;
     }
   }
@@ -4083,7 +4091,12 @@ function createAuthStoreSessionStore(options = {}) {
       if (value === null) {
         return null;
       }
-      const parsed = JSON.parse(value);
+      let parsed;
+      try {
+        parsed = JSON.parse(value);
+      } catch {
+        throw new Error("Stored OAuth session must be valid JSON; reset the store explicitly to recover");
+      }
       if (isStoredOAuthSession(parsed)) {
         return parsed;
       }
@@ -4107,7 +4120,12 @@ function createAuthStoreClientStore(options) {
       if (value === null) {
         return null;
       }
-      const parsed = JSON.parse(value);
+      let parsed;
+      try {
+        parsed = JSON.parse(value);
+      } catch {
+        throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
+      }
       const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : void 0;
       if (clientId !== void 0) {
         const client = { clientId };
@@ -4134,6 +4152,7 @@ function createNamedSecretStore(key2, options, defaults) {
   const parsedFilePath = configuredFilePath === void 0 ? null : path4.parse(configuredFilePath);
   const fileStore = {
     ...options.fileStore,
+    throwOnInvalidDocument: true,
     filePath: parsedFilePath === null ? void 0 : path4.join(parsedFilePath.dir, `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`),
     salt: options.fileStore?.salt ?? defaults.salt,
     defaultDirectory: options.fileStore?.defaultDirectory || defaults.directory,
@@ -4176,7 +4195,7 @@ function isStoredOAuthSession(value) {
   if (!isObjectRecord(value)) {
     return false;
   }
-  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && isStoredOAuthClient(getOwnEntry3(value, "client")) && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
+  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && isStoredOAuthClient(getOwnEntry3(value, "client")) && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
 }
 function isStoredOAuthClient(value) {
   if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
@@ -4605,7 +4624,9 @@ var OAuthError = class extends Error {
   status;
   retryable;
   terminal;
-  constructor(shape, status) {
+  /** True only when a complete OAuth error response establishes rejection. */
+  outcomeKnown;
+  constructor(shape, status, outcomeKnown = true) {
     super(shape.error_description ?? shape.error);
     this.name = "OAuthError";
     this.error = shape.error;
@@ -4616,6 +4637,7 @@ var OAuthError = class extends Error {
     this.status = status;
     this.retryable = isRetryableOAuthError(this);
     this.terminal = !this.retryable;
+    this.outcomeKnown = outcomeKnown;
   }
 };
 function isRetryableOAuthError(error) {
@@ -4730,7 +4752,8 @@ async function readOAuthJsonObjectResponse(response, signal) {
   }
   const record2 = payload;
   if (!response.ok) {
-    throw new OAuthError(readOAuthError(record2, fallbackError.error), response.status);
+    const error = getOwnEntry5(record2, "error");
+    throw new OAuthError(readOAuthError(record2, fallbackError.error), response.status, typeof error === "string" && error.trim().length > 0);
   }
   return record2;
 }
@@ -4749,7 +4772,7 @@ function getOwnEntry5(record2, key2) {
 }
 function createFallbackOAuthError(status) {
   const error = status === 503 ? "temporarily_unavailable" : "server_error";
-  return new OAuthError({ error }, status);
+  return new OAuthError({ error }, status, false);
 }
 function normalizeBearerTokenType(value) {
   if (typeof value !== "string") {
@@ -4935,6 +4958,11 @@ function createDefaultOAuthClientProvider(options) {
       if (forceRefresh && rejectedTokens !== void 0 && (rejectedTokens === null || session?.tokens === void 0 || !sameTokenGrant(session.tokens, rejectedTokens)))
         forceRefresh = false;
       const sessionDiscovery = resolveDiscovery(discovery, session);
+      if (session?.refreshState === "pending") {
+        if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === void 0)
+          throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
+        return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch2, signal);
+      }
       if (session?.tokens !== void 0 && !forceRefresh && !isExpired(session.tokens, now)) {
         return session;
       }
@@ -4962,6 +4990,9 @@ function createDefaultOAuthClientProvider(options) {
     if (session.tokens?.refreshToken === void 0) {
       return session;
     }
+    const pendingSession = { ...clearSessionTokens(session), refreshState: "pending" };
+    await saveSession(resource, pendingSession);
+    signal?.throwIfAborted();
     let refreshAttempted = false;
     let refreshedTokens;
     while (true) {
@@ -4979,7 +5010,9 @@ function createDefaultOAuthClientProvider(options) {
         break;
       } catch (error) {
         signal?.throwIfAborted();
-        if (error instanceof OAuthError && error.error === "invalid_grant") {
+        if (!(error instanceof OAuthError) || !error.outcomeKnown)
+          throw error;
+        if (error.error === "invalid_grant") {
           const clearedSession = clearSessionTokens(session);
           await saveSession(resource, clearedSession);
           return clearedSession;
@@ -4993,6 +5026,7 @@ function createDefaultOAuthClientProvider(options) {
           refreshAttempted = true;
           continue;
         }
+        await saveSession(resource, session);
         throw error;
       }
     }
@@ -5239,6 +5273,7 @@ function sameTokenGrant(left, right) {
 function clearSessionTokens(session) {
   const nextSession = { ...session };
   delete nextSession.tokens;
+  delete nextSession.refreshState;
   return nextSession;
 }
 function hasCachedAccessToken(session) {
@@ -5248,6 +5283,9 @@ function normalizeLoadedSession(session) {
   if (session === null) {
     return null;
   }
+  const refreshState = getOwnEntry6(session, "refreshState");
+  if (refreshState !== void 0 && (refreshState !== "pending" || getOwnEntry6(session, "tokens") !== void 0))
+    throw new Error("Stored OAuth refresh state is invalid");
   const client = normalizeStoredClient(getOwnEntry6(session, "client"));
   if (client === null) {
     return { ...session, client: { clientId: "" }, tokens: void 0 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.27",
+  "version": "0.1.29",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",