tiny-http-mcp-server 0.1.29 → 0.1.30

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.29",
+      "version": "0.1.30",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -104,6 +104,10 @@ Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
 Input tokens are copied and invalid expiry values fail before authorization.
+Static clients and dynamic initial-grant imports require cached grants to match
+the original normalized client ID and secret. A different client configuration
+fails before attaching or refreshing credentials and retains the stored record;
+select separate persistence or explicitly reset the session to change apps.
 
 `createAuthStoreSessionStore(options)` accepts the standard `auth-store` config.
 

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -140,6 +140,11 @@ export function createDefaultOAuthClientProvider(options) {
             if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
                 forceRefresh = false;
             const sessionDiscovery = resolveDiscovery(discovery, session);
+            if ((options.client.mode === "static" || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
+                const configured = normalizeConfiguredClient(options.client);
+                if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
+                    throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
+            }
             if (session?.refreshState === "pending") {
                 if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === undefined)
                     throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4958,6 +4958,11 @@ function createDefaultOAuthClientProvider(options) {
       if (forceRefresh && rejectedTokens !== void 0 && (rejectedTokens === null || session?.tokens === void 0 || !sameTokenGrant(session.tokens, rejectedTokens)))
         forceRefresh = false;
       const sessionDiscovery = resolveDiscovery(discovery, session);
+      if ((options.client.mode === "static" || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
+        const configured = normalizeConfiguredClient(options.client);
+        if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
+          throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
+      }
       if (session?.refreshState === "pending") {
         if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === void 0)
           throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",