tiny-http-mcp-server 0.1.31 → 0.1.33

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.31",
+      "version": "0.1.33",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -96,7 +96,14 @@ on 401 even when the server omits `error="invalid_token"`. Invalid provenance
 fails without quoting token values.
 
 Configure `client.metadata.scope` to request a precise scope set; broader
-discovery metadata does not override it.
+discovery metadata does not override it. Explicit scopes must match the cached
+or imported grant's scope set; ordering, repeated spaces and duplicates are
+normalized. An imported grant must declare its scope when a scope is configured.
+Authorization records the requested set when the endpoint omits scope, and
+refresh retains the previous granted set. Mismatched responses never activate
+credentials; an unusable refresh response retains the pending refresh record.
+Select a separate persistence namespace for another scope profile. No scope is
+invented when the client does not configure one.
 
 Imported `initialGrant.tokens` use `accessToken`, optional `refreshToken`,
 `tokenType: "Bearer"`, `expiresAt` (Unix epoch milliseconds or `null` if unknown),
@@ -105,6 +112,13 @@ Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
 Input tokens are copied and invalid expiry values fail before authorization.
+Pass a complete DCR response as `client.registration` (or validate untrusted JSON
+with `parseOAuthClientRegistration`). Dynamic clients infer their original ID
+and secret from that response and reuse it without registering another app.
+Explicit ID/secret values must agree with the imported response. Sessions and
+native registration stores retain arrays, issuance/expiry timestamps and JSON
+provider metadata. Registration input is copied, bounded to 64 KiB and 64
+levels, and rejects invalid standard field types and non-JSON extensions.
 Static clients and dynamic initial-grant imports require cached grants to match
 the original normalized client ID and secret. A different client configuration
 fails before attaching or refreshing credentials and retains the stored record;

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.d.ts

@@ -1,9 +1,5 @@
 import { type CreateSecretStoreInput } from "auth-store";
-import type { OAuthSessionStore } from "./types.js";
-interface StoredOAuthClient {
-    clientId: string;
-    clientSecret?: string;
-}
+import type { OAuthSessionStore, StoredOAuthClient } from "./types.js";
 export interface OAuthClientStore {
     load(issuer: string): Promise<StoredOAuthClient | null>;
     save(issuer: string, client: StoredOAuthClient): Promise<void>;
@@ -12,4 +8,3 @@ export interface OAuthClientStore {
 export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput, namespace?: string): OAuthSessionStore;
 export declare function createAuthStoreClientStore(options: CreateSecretStoreInput, namespace?: string): OAuthClientStore;
 export declare function assertPersistenceNamespace(namespace: string | undefined): void;
-export {};

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -1,3 +1,4 @@
+import { normalizeStoredOAuthClient } from "./client-registration.js";
 import crypto from "node:crypto";
 import path from "node:path";
 import { createSecretStore } from "auth-store";
@@ -62,15 +63,10 @@ export function createAuthStoreClientStore(options, namespace) {
             catch {
                 throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
             }
-            const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : undefined;
-            if (clientId !== undefined) {
-                const client = { clientId };
-                if (isObjectRecord(parsed) &&
-                    Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
-                    client.clientSecret = getOwnEntry(parsed, "clientSecret");
-                }
-                return client;
-            }
+            // Preserve all registration metadata; provider normalization validates its
+            // identity and schema before it can authorize a request.
+            if (isObjectRecord(parsed) && typeof getOwnEntry(parsed, "clientId") === "string")
+                return parsed;
             throw new Error("Stored OAuth client must be a JSON object with clientId");
         },
         async save(issuer, client) {
@@ -142,20 +138,13 @@ function isStoredOAuthSession(value) {
     }
     return (isNonBlankOwnString(value, "resource") &&
         isNonBlankOwnString(value, "authorizationServer") &&
-        isStoredOAuthClient(getOwnEntry(value, "client")) &&
+        normalizeStoredOAuthClient(getOwnEntry(value, "client")) !== null &&
         isStoredOAuthDiscovery(getOwnEntry(value, "discovery")) &&
+        (getOwnEntry(value, "requestedScope") === undefined || isNonBlankOwnString(value, "requestedScope")) &&
         (getOwnEntry(value, "refreshState") === undefined ||
             (getOwnEntry(value, "refreshState") === "pending" && getOwnEntry(value, "tokens") === undefined)) &&
         isStoredOAuthTokensOrMissing(getOwnEntry(value, "tokens")));
 }
-function isStoredOAuthClient(value) {
-    if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
-        return false;
-    }
-    const clientSecret = getOwnEntry(value, "clientSecret");
-    return (clientSecret === undefined ||
-        (typeof clientSecret === "string" && clientSecret.trim().length > 0));
-}
 function isStoredOAuthDiscovery(value) {
     if (!isObjectRecord(value)) {
         return false;

package/node_modules/mcp-oauth/dist/client/client-registration.d.ts

@@ -0,0 +1,4 @@
+import type { OAuthClientRegistration, StoredOAuthClient } from "./types.js";
+/** Validate and copy a bounded JSON DCR response without quoting credential input. */
+export declare function parseOAuthClientRegistration(value: unknown): OAuthClientRegistration;
+export declare function normalizeStoredOAuthClient(value: unknown): StoredOAuthClient | null;

package/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -0,0 +1,94 @@
+import { normalizeOAuthScope } from "./scope.js";
+/** Validate and copy a bounded JSON DCR response without quoting credential input. */
+export function parseOAuthClientRegistration(value) {
+    const invalid = () => new Error("Invalid OAuth client registration metadata");
+    let nodes = 0;
+    function copy(input, depth) {
+        if (++nodes > 20_000 || depth > 64)
+            throw invalid();
+        if (input === null || typeof input === "boolean" || typeof input === "string")
+            return input;
+        if (typeof input === "number" && Number.isFinite(input))
+            return input;
+        if (typeof input !== "object" || input === null)
+            throw invalid();
+        const descriptors = Object.getOwnPropertyDescriptors(input);
+        if (Array.isArray(input)) {
+            const length = descriptors.length?.value;
+            if (length > 20_000)
+                throw invalid();
+            const result = [];
+            for (let index = 0; index < length; index++) {
+                const descriptor = descriptors[String(index)];
+                if (descriptor === undefined || !Object.hasOwn(descriptor, "value"))
+                    throw invalid();
+                result.push(copy(descriptor.value, depth + 1));
+            }
+            return result;
+        }
+        if (Object.getPrototypeOf(input) !== Object.prototype && Object.getPrototypeOf(input) !== null)
+            throw invalid();
+        return Object.fromEntries(Object.entries(descriptors).filter(([, descriptor]) => descriptor.enumerable).map(([key, descriptor]) => {
+            if (!Object.hasOwn(descriptor, "value"))
+                throw invalid();
+            return [key, copy(descriptor.value, depth + 1)];
+        }));
+    }
+    let result;
+    try {
+        result = copy(value, 0);
+    }
+    catch {
+        throw invalid();
+    }
+    if (typeof result !== "object" || result === null || Array.isArray(result))
+        throw invalid();
+    const record = result;
+    if (!Object.hasOwn(record, "client_id") || typeof record.client_id !== "string" || record.client_id.trim() === "")
+        throw new Error("OAuth client registration response missing client_id");
+    for (const key of ["client_id", "client_secret", "token_endpoint_auth_method", "application_type", "client_name", "client_uri", "logo_uri", "scope",
+        "tos_uri", "policy_uri", "jwks_uri", "software_id", "software_version", "software_statement", "registration_access_token", "registration_client_uri", "issuer"]) {
+        if (Object.hasOwn(record, key) && record[key] !== null && typeof record[key] !== "string")
+            throw invalid();
+    }
+    if (typeof record.client_secret === "string" && record.client_secret.trim() === "")
+        throw invalid();
+    for (const key of ["redirect_uris", "grant_types", "response_types", "contacts"]) {
+        const entry = record[key];
+        if (Object.hasOwn(record, key) && entry !== null && (!Array.isArray(entry) || entry.some(item => typeof item !== "string")))
+            throw invalid();
+    }
+    for (const key of ["client_id_issued_at", "client_secret_expires_at"]) {
+        const entry = record[key];
+        if (Object.hasOwn(record, key) && entry !== null && (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0))
+            throw invalid();
+    }
+    try {
+        normalizeOAuthScope(Object.hasOwn(record, "scope") && record.scope !== null ? record.scope : undefined);
+    }
+    catch {
+        throw invalid();
+    }
+    if (Buffer.byteLength(JSON.stringify(record), "utf8") > 64 * 1024)
+        throw invalid();
+    return record;
+}
+export function normalizeStoredOAuthClient(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const record = value;
+    const clientId = Object.hasOwn(record, "clientId") ? record.clientId : undefined;
+    const clientSecret = Object.hasOwn(record, "clientSecret") ? record.clientSecret : undefined;
+    if (typeof clientId !== "string" || clientId.trim() === "" ||
+        (clientSecret !== undefined && (typeof clientSecret !== "string" || clientSecret.trim() === "")))
+        return null;
+    const client = { clientId: clientId.trim(), ...(clientSecret === undefined ? {} : { clientSecret: clientSecret.trim() }) };
+    if (Object.hasOwn(record, "registration") && record.registration !== undefined) {
+        const registration = parseOAuthClientRegistration(record.registration);
+        const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : undefined;
+        if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
+            throw new Error("OAuth client registration does not match the client identity");
+        client.registration = registration;
+    }
+    return client;
+}

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,3 +1,5 @@
+import { normalizeStoredOAuthClient, parseOAuthClientRegistration } from "./client-registration.js";
+import { normalizeOAuthScope } from "./scope.js";
 import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
@@ -18,6 +20,9 @@ export function createOAuthClientProvider(options) {
 export function createDefaultOAuthClientProvider(options) {
     loopbackTarget(options.browser);
     assertPersistenceNamespace(options.persistenceNamespace);
+    const clientMetadata = getClientMetadata(options.client);
+    const requestedScope = clientMetadata?.scope;
+    const configuredClient = normalizeConfiguredClient(options.client);
     const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
     const now = options.now ?? Date.now;
@@ -36,11 +41,13 @@ export function createDefaultOAuthClientProvider(options) {
     const initialGrant = options.initialGrant === undefined ? undefined : {
         resource: canonicalizeResourceIndicator(options.initialGrant.resource),
         tokens: normalizeStoredTokens(options.initialGrant.tokens),
-        client: normalizeConfiguredClient(options.client)
+        client: configuredClient
     };
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
         throw new Error("OAuth initial grant requires valid tokens and the original client ID");
     if (initialGrant?.tokens !== undefined) {
+        if (requestedScope !== undefined && initialGrant.tokens.scope !== requestedScope)
+            throw new Error("OAuth initial grant does not match the requested OAuth scope");
         try {
             new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
         }
@@ -133,7 +140,8 @@ export function createDefaultOAuthClientProvider(options) {
                 initialGrant.tokens !== undefined && initialGrant.client !== null) {
                 assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
                 session = { resource: canonicalResource, authorizationServer: discovery.authorizationServer,
-                    client: initialGrant.client, tokens: initialGrant.tokens, discovery: toStoredDiscovery(discovery) };
+                    client: initialGrant.client, tokens: initialGrant.tokens,
+                    ...(requestedScope === undefined ? {} : { requestedScope }), discovery: toStoredDiscovery(discovery) };
                 await saveSession(canonicalResource, session);
                 initialGrantConsumed = true;
                 signal?.throwIfAborted();
@@ -141,11 +149,13 @@ export function createDefaultOAuthClientProvider(options) {
             if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
                 forceRefresh = false;
             const sessionDiscovery = resolveDiscovery(discovery, session);
-            if ((options.client.mode === "static" || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
-                const configured = normalizeConfiguredClient(options.client);
+            if ((options.client.mode === "static" || configuredClient?.registration !== undefined || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
+                const configured = configuredClient;
                 if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
                     throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
             }
+            if (requestedScope !== undefined && session?.tokens !== undefined && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
+                throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
             if (session?.refreshState === "pending") {
                 if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === undefined)
                     throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -226,10 +236,13 @@ export function createDefaultOAuthClientProvider(options) {
             ...session,
             tokens: {
                 ...refreshedTokens,
-                refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
+                refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken,
+                scope: refreshedTokens.scope ?? session.tokens.scope
             },
             discovery: toStoredDiscovery(discovery)
         };
+        if (requestedScope !== undefined && normalizeOAuthScope(updatedSession.tokens?.scope ?? session.requestedScope) !== requestedScope)
+            throw new Error("OAuth refresh response does not match the requested OAuth scope; authorize again");
         await saveSession(resource, updatedSession);
         return updatedSession;
     }
@@ -257,6 +270,7 @@ export function createDefaultOAuthClientProvider(options) {
                     resource,
                     authorizationServer: discovery.authorizationServer,
                     client: resolvedClient.client,
+                    ...(requestedScope === undefined ? {} : { requestedScope }),
                     discovery: toStoredDiscovery(discovery)
                 };
                 await saveSession(resource, sessionWithoutTokens);
@@ -268,7 +282,7 @@ export function createDefaultOAuthClientProvider(options) {
                     clientId: resolvedClient.client.clientId,
                     redirectUri: loopback.redirectUri,
                     codeChallenge: challenge,
-                    clientMetadata: getClientMetadata(options.client)
+                    clientMetadata
                 });
                 const code = await loopback.waitForCode(authorizationUrl);
                 const tokens = await exchangeAuthorizationCode({
@@ -282,6 +296,8 @@ export function createDefaultOAuthClientProvider(options) {
                     fetch, signal,
                     now
                 });
+                if (requestedScope !== undefined && tokens.scope !== undefined && normalizeOAuthScope(tokens.scope) !== requestedScope)
+                    throw new Error("OAuth authorization response does not match the requested OAuth scope");
                 const session = {
                     ...sessionWithoutTokens,
                     tokens
@@ -313,8 +329,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
     async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
         parentSignal?.throwIfAborted();
-        const configuredClient = normalizeConfiguredClient(options.client);
-        if (options.client.mode === "static") {
+        if (options.client.mode === "static" || configuredClient?.registration !== undefined) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }
@@ -363,7 +378,7 @@ export function createDefaultOAuthClientProvider(options) {
                 };
             }
         }
-        const registrationBody = buildClientRegistrationBody(getClientMetadata(options.client), redirectUri);
+        const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri);
         const deadline = AbortSignal.timeout(30_000);
         const signal = parentSignal === undefined ? deadline : AbortSignal.any([parentSignal, deadline]);
         const response = await fetchMcpResponse(fetch, registrationEndpoint, {
@@ -375,16 +390,12 @@ export function createDefaultOAuthClientProvider(options) {
             signal
         });
         const payload = await readOAuthJsonObjectResponse(response, signal);
-        const clientId = getOwnString(payload, "client_id");
-        if (clientId === undefined || clientId.trim().length === 0) {
-            throw new Error("OAuth client registration response missing client_id");
-        }
-        const clientSecret = getOwnString(payload, "client_secret");
+        const registration = parseOAuthClientRegistration(payload);
+        const registeredSecret = getOwnString(registration, "client_secret");
         const registeredClient = {
-            clientId: clientId.trim(),
-            clientSecret: clientSecret !== undefined && clientSecret.trim().length > 0
-                ? clientSecret.trim()
-                : undefined
+            clientId: registration.client_id.trim(),
+            ...(registeredSecret === undefined ? {} : { clientSecret: registeredSecret.trim() }),
+            registration
         };
         await saveRegisteredClient(discovery.authorizationServer, registeredClient);
         return {
@@ -410,7 +421,7 @@ export function createDefaultOAuthClientProvider(options) {
             return null;
         }
         const client = await clientStore.load(issuer);
-        const normalizedClient = client === null ? null : normalizeStoredClient(client);
+        const normalizedClient = client === null ? null : normalizeStoredOAuthClient(client);
         if (client !== null && normalizedClient === null) {
             await clientStore.clear(issuer);
             return null;
@@ -489,7 +500,7 @@ function normalizeLoadedSession(session) {
     const refreshState = getOwnEntry(session, "refreshState");
     if (refreshState !== undefined && (refreshState !== "pending" || getOwnEntry(session, "tokens") !== undefined))
         throw new Error("Stored OAuth refresh state is invalid");
-    const client = normalizeStoredClient(getOwnEntry(session, "client"));
+    const client = normalizeStoredOAuthClient(getOwnEntry(session, "client"));
     if (client === null) {
         return { ...session, client: { clientId: "" }, tokens: undefined };
     }
@@ -499,25 +510,6 @@ function normalizeLoadedSession(session) {
         tokens: normalizeStoredTokens(getOwnEntry(session, "tokens"))
     };
 }
-function normalizeStoredClient(value) {
-    if (!isObjectRecord(value)) {
-        return null;
-    }
-    const clientId = getOwnString(value, "clientId");
-    if (clientId === undefined || clientId.trim().length === 0) {
-        return null;
-    }
-    const normalizedClientId = clientId.trim();
-    const clientSecret = getOwnEntry(value, "clientSecret");
-    if (clientSecret === undefined) {
-        return { clientId: normalizedClientId };
-    }
-    if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
-        return null;
-    }
-    const normalizedClientSecret = clientSecret.trim();
-    return { clientId: normalizedClientId, clientSecret: normalizedClientSecret };
-}
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {
         return undefined;
@@ -526,10 +518,10 @@ function normalizeStoredTokens(value) {
     const tokenType = getOwnString(value, "tokenType");
     const expiresAt = getOwnEntry(value, "expiresAt");
     const refreshToken = getOwnEntry(value, "refreshToken");
-    const scope = getOwnString(value, "scope");
+    const scope = getOwnEntry(value, "scope");
     const normalizedAccessToken = accessToken?.trim();
     const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : undefined;
-    const normalizedScope = scope?.trim();
+    const normalizedScope = normalizeOAuthScope(scope);
     if (accessToken === undefined ||
         normalizedAccessToken === undefined ||
         normalizedAccessToken.length === 0 ||
@@ -561,18 +553,18 @@ function getClientMetadata(client) {
     }
     return {
         clientName: normalizeOptionalOAuthString(client.metadata.clientName),
-        scope: normalizeOptionalOAuthString(client.metadata.scope),
+        scope: normalizeOAuthScope(client.metadata.scope),
         softwareId: normalizeOptionalOAuthString(client.metadata.softwareId),
         softwareVersion: normalizeOptionalOAuthString(client.metadata.softwareVersion)
     };
 }
 function normalizeConfiguredClient(client) {
-    const clientId = normalizeOptionalOAuthString(client.clientId);
-    if (clientId === undefined) {
+    const registration = client.registration === undefined ? undefined : parseOAuthClientRegistration(client.registration);
+    const clientId = normalizeOptionalOAuthString(client.clientId) ?? registration?.client_id.trim();
+    if (clientId === undefined)
         return null;
-    }
-    const clientSecret = normalizeOptionalOAuthString(client.clientSecret);
-    return clientSecret === undefined ? { clientId } : { clientId, clientSecret };
+    const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === undefined ? undefined : getOwnString(registration, "client_secret")?.trim());
+    return normalizeStoredOAuthClient({ clientId, clientSecret, registration });
 }
 function normalizeOptionalOAuthString(value) {
     if (value === undefined) {

package/node_modules/mcp-oauth/dist/client/scope.d.ts

@@ -0,0 +1,2 @@
+/** Compare OAuth scope sets without accepting controls or changing token case. */
+export declare function normalizeOAuthScope(scope: unknown): string | undefined;

package/node_modules/mcp-oauth/dist/client/scope.js

@@ -0,0 +1,9 @@
+/** Compare OAuth scope sets without accepting controls or changing token case. */
+export function normalizeOAuthScope(scope) {
+    if (scope === undefined)
+        return undefined;
+    if (typeof scope !== "string" || [...scope].some(char => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
+        throw new Error("Invalid OAuth scope syntax");
+    const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
+    return normalized || undefined;
+}

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -1,6 +1,7 @@
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 import { readBoundedResponseText } from "../http-response.js";
 import { fetchMcpResponse } from "../http-fetch.js";
+import { normalizeOAuthScope } from "./scope.js";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export class OAuthError extends Error {
     error;
@@ -117,7 +118,9 @@ async function requestTokens(input) {
     const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0
         ? refreshToken.trim()
         : undefined;
-    const normalizedScope = typeof scope === "string" && scope.trim().length > 0 ? scope.trim() : undefined;
+    const normalizedScope = normalizeOAuthScope(scope);
+    if (scope !== undefined && normalizedScope === undefined)
+        throw new Error("Invalid OAuth scope syntax in token response");
     return {
         accessToken: normalizedAccessToken,
         refreshToken: normalizedRefreshToken === undefined ? undefined : normalizedRefreshToken,

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -70,16 +70,32 @@ export interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Full RFC 7591 response, including JSON provider extensions. */
+export interface OAuthClientRegistration extends Record<string, unknown> {
+    client_id: string;
+    client_secret?: string | null;
+    redirect_uris?: string[] | null;
+    grant_types?: string[] | null;
+    response_types?: string[] | null;
+    contacts?: string[] | null;
+    client_id_issued_at?: number | null;
+    client_secret_expires_at?: number | null;
+    token_endpoint_auth_method?: string | null;
+}
+export interface StoredOAuthClient {
+    clientId: string;
+    clientSecret?: string;
+    registration?: OAuthClientRegistration;
+}
 export interface StoredOAuthSession {
     resource: string;
     authorizationServer: string;
-    client: {
-        clientId: string;
-        clientSecret?: string;
-    };
+    client: StoredOAuthClient;
     tokens?: StoredOAuthTokens;
     /** A refresh was begun; its winning response may not have been persisted. */
     refreshState?: "pending";
+    /** Canonical explicitly requested scope set when the server omits token scope. */
+    requestedScope?: string;
     discovery: {
         resourceMetadataUrl: string;
         resourceMetadata: Record<string, unknown>;
@@ -102,11 +118,14 @@ export interface DefaultOAuthClientProviderOptions {
         clientId?: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        /** Import a complete registration owned by the caller. */
+        registration?: OAuthClientRegistration;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        registration?: OAuthClientRegistration;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;

package/node_modules/mcp-oauth/dist/index.d.ts

@@ -1,11 +1,12 @@
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
+export { parseOAuthClientRegistration } from "./client/client-registration.js";
 export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
 export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, } from "./client/loopback-authorization.js";
 export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";
 export { OAuthError, } from "./client/token-endpoint.js";
 export { canonicalizeResourceIndicator, } from "./resource-indicator.js";
 export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
-export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, StoredOAuthSession, StoredOAuthTokens, } from "./client/types.js";
+export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, } from "./client/types.js";
 export type { JwksTokenVerifier, JwksTokenVerifierOptions, JwksVerifiedAccessToken, } from "./server/jwks-token-verifier.js";
 export type { LoopbackAuthorizationOptions, LoopbackAuthorizationSession, OAuthLandingPage, } from "./client/loopback-authorization.js";
 export { readBoundedResponseText } from "./http-response.js";

package/node_modules/mcp-oauth/dist/index.js

@@ -1,4 +1,5 @@
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
+export { parseOAuthClientRegistration } from "./client/client-registration.js";
 export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
 export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, } from "./client/loopback-authorization.js";
 export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -173,16 +173,32 @@ interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Full RFC 7591 response, including JSON provider extensions. */
+interface OAuthClientRegistration extends Record<string, unknown> {
+    client_id: string;
+    client_secret?: string | null;
+    redirect_uris?: string[] | null;
+    grant_types?: string[] | null;
+    response_types?: string[] | null;
+    contacts?: string[] | null;
+    client_id_issued_at?: number | null;
+    client_secret_expires_at?: number | null;
+    token_endpoint_auth_method?: string | null;
+}
+interface StoredOAuthClient {
+    clientId: string;
+    clientSecret?: string;
+    registration?: OAuthClientRegistration;
+}
 interface StoredOAuthSession {
     resource: string;
     authorizationServer: string;
-    client: {
-        clientId: string;
-        clientSecret?: string;
-    };
+    client: StoredOAuthClient;
     tokens?: StoredOAuthTokens;
     /** A refresh was begun; its winning response may not have been persisted. */
     refreshState?: "pending";
+    /** Canonical explicitly requested scope set when the server omits token scope. */
+    requestedScope?: string;
     discovery: {
         resourceMetadataUrl: string;
         resourceMetadata: Record<string, unknown>;
@@ -205,11 +221,14 @@ interface DefaultOAuthClientProviderOptions {
         clientId?: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        /** Import a complete registration owned by the caller. */
+        registration?: OAuthClientRegistration;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        registration?: OAuthClientRegistration;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3395,6 +3395,124 @@ var SubscriptionManager = class {
   }
 };
 
+// ../mcp-oauth/dist/client/scope.js
+function normalizeOAuthScope(scope) {
+  if (scope === void 0)
+    return void 0;
+  if (typeof scope !== "string" || [...scope].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
+    throw new Error("Invalid OAuth scope syntax");
+  const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
+  return normalized || void 0;
+}
+
+// ../mcp-oauth/dist/client/client-registration.js
+function parseOAuthClientRegistration(value) {
+  const invalid = () => new Error("Invalid OAuth client registration metadata");
+  let nodes = 0;
+  function copy(input, depth) {
+    if (++nodes > 2e4 || depth > 64)
+      throw invalid();
+    if (input === null || typeof input === "boolean" || typeof input === "string")
+      return input;
+    if (typeof input === "number" && Number.isFinite(input))
+      return input;
+    if (typeof input !== "object" || input === null)
+      throw invalid();
+    const descriptors = Object.getOwnPropertyDescriptors(input);
+    if (Array.isArray(input)) {
+      const length = descriptors.length?.value;
+      if (length > 2e4)
+        throw invalid();
+      const result2 = [];
+      for (let index = 0; index < length; index++) {
+        const descriptor = descriptors[String(index)];
+        if (descriptor === void 0 || !Object.hasOwn(descriptor, "value"))
+          throw invalid();
+        result2.push(copy(descriptor.value, depth + 1));
+      }
+      return result2;
+    }
+    if (Object.getPrototypeOf(input) !== Object.prototype && Object.getPrototypeOf(input) !== null)
+      throw invalid();
+    return Object.fromEntries(Object.entries(descriptors).filter(([, descriptor]) => descriptor.enumerable).map(([key2, descriptor]) => {
+      if (!Object.hasOwn(descriptor, "value"))
+        throw invalid();
+      return [key2, copy(descriptor.value, depth + 1)];
+    }));
+  }
+  let result;
+  try {
+    result = copy(value, 0);
+  } catch {
+    throw invalid();
+  }
+  if (typeof result !== "object" || result === null || Array.isArray(result))
+    throw invalid();
+  const record2 = result;
+  if (!Object.hasOwn(record2, "client_id") || typeof record2.client_id !== "string" || record2.client_id.trim() === "")
+    throw new Error("OAuth client registration response missing client_id");
+  for (const key2 of [
+    "client_id",
+    "client_secret",
+    "token_endpoint_auth_method",
+    "application_type",
+    "client_name",
+    "client_uri",
+    "logo_uri",
+    "scope",
+    "tos_uri",
+    "policy_uri",
+    "jwks_uri",
+    "software_id",
+    "software_version",
+    "software_statement",
+    "registration_access_token",
+    "registration_client_uri",
+    "issuer"
+  ]) {
+    if (Object.hasOwn(record2, key2) && record2[key2] !== null && typeof record2[key2] !== "string")
+      throw invalid();
+  }
+  if (typeof record2.client_secret === "string" && record2.client_secret.trim() === "")
+    throw invalid();
+  for (const key2 of ["redirect_uris", "grant_types", "response_types", "contacts"]) {
+    const entry = record2[key2];
+    if (Object.hasOwn(record2, key2) && entry !== null && (!Array.isArray(entry) || entry.some((item) => typeof item !== "string")))
+      throw invalid();
+  }
+  for (const key2 of ["client_id_issued_at", "client_secret_expires_at"]) {
+    const entry = record2[key2];
+    if (Object.hasOwn(record2, key2) && entry !== null && (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0))
+      throw invalid();
+  }
+  try {
+    normalizeOAuthScope(Object.hasOwn(record2, "scope") && record2.scope !== null ? record2.scope : void 0);
+  } catch {
+    throw invalid();
+  }
+  if (Buffer.byteLength(JSON.stringify(record2), "utf8") > 64 * 1024)
+    throw invalid();
+  return record2;
+}
+function normalizeStoredOAuthClient(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return null;
+  const record2 = value;
+  const clientId = Object.hasOwn(record2, "clientId") ? record2.clientId : void 0;
+  const clientSecret = Object.hasOwn(record2, "clientSecret") ? record2.clientSecret : void 0;
+  if (typeof clientId !== "string" || clientId.trim() === "" || clientSecret !== void 0 && (typeof clientSecret !== "string" || clientSecret.trim() === ""))
+    return null;
+  const client = { clientId: clientId.trim(), ...clientSecret === void 0 ? {} : { clientSecret: clientSecret.trim() } };
+  if (Object.hasOwn(record2, "registration") && record2.registration !== void 0) {
+    const registration = parseOAuthClientRegistration(record2.registration);
+    const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : void 0;
+    if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
+      throw new Error("OAuth client registration does not match the client identity");
+    client.registration = registration;
+  }
+  return client;
+}
+
 // ../mcp-oauth/dist/client/auth-store-session-store.js
 import crypto from "node:crypto";
 import path4 from "node:path";
@@ -4128,14 +4246,8 @@ function createAuthStoreClientStore(options, namespace) {
       } catch {
         throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
       }
-      const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : void 0;
-      if (clientId !== void 0) {
-        const client = { clientId };
-        if (isObjectRecord(parsed) && Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
-          client.clientSecret = getOwnEntry3(parsed, "clientSecret");
-        }
-        return client;
-      }
+      if (isObjectRecord(parsed) && typeof getOwnEntry3(parsed, "clientId") === "string")
+        return parsed;
       throw new Error("Stored OAuth client must be a JSON object with clientId");
     },
     async save(issuer, client) {
@@ -4201,14 +4313,7 @@ function isStoredOAuthSession(value) {
   if (!isObjectRecord(value)) {
     return false;
   }
-  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && isStoredOAuthClient(getOwnEntry3(value, "client")) && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
-}
-function isStoredOAuthClient(value) {
-  if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
-    return false;
-  }
-  const clientSecret = getOwnEntry3(value, "clientSecret");
-  return clientSecret === void 0 || typeof clientSecret === "string" && clientSecret.trim().length > 0;
+  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && normalizeStoredOAuthClient(getOwnEntry3(value, "client")) !== null && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "requestedScope") === void 0 || isNonBlankOwnString(value, "requestedScope")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
 }
 function isStoredOAuthDiscovery(value) {
   if (!isObjectRecord(value)) {
@@ -4726,7 +4831,9 @@ async function requestTokens(input) {
   const refreshToken = getOwnEntry5(payload, "refresh_token");
   const scope = getOwnEntry5(payload, "scope");
   const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0 ? refreshToken.trim() : void 0;
-  const normalizedScope = typeof scope === "string" && scope.trim().length > 0 ? scope.trim() : void 0;
+  const normalizedScope = normalizeOAuthScope(scope);
+  if (scope !== void 0 && normalizedScope === void 0)
+    throw new Error("Invalid OAuth scope syntax in token response");
   return {
     accessToken: normalizedAccessToken,
     refreshToken: normalizedRefreshToken === void 0 ? void 0 : normalizedRefreshToken,
@@ -4847,6 +4954,9 @@ function createOAuthClientProvider(options) {
 function createDefaultOAuthClientProvider(options) {
   loopbackTarget(options.browser);
   assertPersistenceNamespace(options.persistenceNamespace);
+  const clientMetadata = getClientMetadata(options.client);
+  const requestedScope = clientMetadata?.scope;
+  const configuredClient = normalizeConfiguredClient(options.client);
   const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
   const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
   const now = options.now ?? Date.now;
@@ -4864,11 +4974,13 @@ function createDefaultOAuthClientProvider(options) {
   const initialGrant = options.initialGrant === void 0 ? void 0 : {
     resource: canonicalizeResourceIndicator(options.initialGrant.resource),
     tokens: normalizeStoredTokens(options.initialGrant.tokens),
-    client: normalizeConfiguredClient(options.client)
+    client: configuredClient
   };
   if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
     throw new Error("OAuth initial grant requires valid tokens and the original client ID");
   if (initialGrant?.tokens !== void 0) {
+    if (requestedScope !== void 0 && initialGrant.tokens.scope !== requestedScope)
+      throw new Error("OAuth initial grant does not match the requested OAuth scope");
     try {
       new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
     } catch {
@@ -4956,6 +5068,7 @@ function createDefaultOAuthClientProvider(options) {
           authorizationServer: discovery.authorizationServer,
           client: initialGrant.client,
           tokens: initialGrant.tokens,
+          ...requestedScope === void 0 ? {} : { requestedScope },
           discovery: toStoredDiscovery(discovery)
         };
         await saveSession(canonicalResource, session);
@@ -4965,11 +5078,13 @@ function createDefaultOAuthClientProvider(options) {
       if (forceRefresh && rejectedTokens !== void 0 && (rejectedTokens === null || session?.tokens === void 0 || !sameTokenGrant(session.tokens, rejectedTokens)))
         forceRefresh = false;
       const sessionDiscovery = resolveDiscovery(discovery, session);
-      if ((options.client.mode === "static" || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
-        const configured = normalizeConfiguredClient(options.client);
+      if ((options.client.mode === "static" || configuredClient?.registration !== void 0 || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
+        const configured = configuredClient;
         if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
           throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
       }
+      if (requestedScope !== void 0 && session?.tokens !== void 0 && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
+        throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
       if (session?.refreshState === "pending") {
         if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === void 0)
           throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -5046,10 +5161,13 @@ function createDefaultOAuthClientProvider(options) {
       ...session,
       tokens: {
         ...refreshedTokens,
-        refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
+        refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken,
+        scope: refreshedTokens.scope ?? session.tokens.scope
       },
       discovery: toStoredDiscovery(discovery)
     };
+    if (requestedScope !== void 0 && normalizeOAuthScope(updatedSession.tokens?.scope ?? session.requestedScope) !== requestedScope)
+      throw new Error("OAuth refresh response does not match the requested OAuth scope; authorize again");
     await saveSession(resource, updatedSession);
     return updatedSession;
   }
@@ -5077,6 +5195,7 @@ function createDefaultOAuthClientProvider(options) {
           resource,
           authorizationServer: discovery.authorizationServer,
           client: resolvedClient.client,
+          ...requestedScope === void 0 ? {} : { requestedScope },
           discovery: toStoredDiscovery(discovery)
         };
         await saveSession(resource, sessionWithoutTokens);
@@ -5088,7 +5207,7 @@ function createDefaultOAuthClientProvider(options) {
           clientId: resolvedClient.client.clientId,
           redirectUri: loopback.redirectUri,
           codeChallenge: challenge,
-          clientMetadata: getClientMetadata(options.client)
+          clientMetadata
         });
         const code = await loopback.waitForCode(authorizationUrl);
         const tokens = await exchangeAuthorizationCode({
@@ -5103,6 +5222,8 @@ function createDefaultOAuthClientProvider(options) {
           signal,
           now
         });
+        if (requestedScope !== void 0 && tokens.scope !== void 0 && normalizeOAuthScope(tokens.scope) !== requestedScope)
+          throw new Error("OAuth authorization response does not match the requested OAuth scope");
         const session = {
           ...sessionWithoutTokens,
           tokens
@@ -5132,8 +5253,7 @@ function createDefaultOAuthClientProvider(options) {
   }
   async function resolveClient(existingSession, discovery, redirectUri, fetch2, parentSignal) {
     parentSignal?.throwIfAborted();
-    const configuredClient = normalizeConfiguredClient(options.client);
-    if (options.client.mode === "static") {
+    if (options.client.mode === "static" || configuredClient?.registration !== void 0) {
       if (configuredClient === null) {
         throw new Error("OAuth client_id must not be blank");
       }
@@ -5180,7 +5300,7 @@ function createDefaultOAuthClientProvider(options) {
         };
       }
     }
-    const registrationBody = buildClientRegistrationBody(getClientMetadata(options.client), redirectUri);
+    const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri);
     const deadline = AbortSignal.timeout(3e4);
     const signal = parentSignal === void 0 ? deadline : AbortSignal.any([parentSignal, deadline]);
     const response = await fetchMcpResponse(fetch2, registrationEndpoint, {
@@ -5192,14 +5312,12 @@ function createDefaultOAuthClientProvider(options) {
       signal
     });
     const payload = await readOAuthJsonObjectResponse(response, signal);
-    const clientId = getOwnString2(payload, "client_id");
-    if (clientId === void 0 || clientId.trim().length === 0) {
-      throw new Error("OAuth client registration response missing client_id");
-    }
-    const clientSecret = getOwnString2(payload, "client_secret");
+    const registration = parseOAuthClientRegistration(payload);
+    const registeredSecret = getOwnString2(registration, "client_secret");
     const registeredClient = {
-      clientId: clientId.trim(),
-      clientSecret: clientSecret !== void 0 && clientSecret.trim().length > 0 ? clientSecret.trim() : void 0
+      clientId: registration.client_id.trim(),
+      ...registeredSecret === void 0 ? {} : { clientSecret: registeredSecret.trim() },
+      registration
     };
     await saveRegisteredClient(discovery.authorizationServer, registeredClient);
     return {
@@ -5225,7 +5343,7 @@ function createDefaultOAuthClientProvider(options) {
       return null;
     }
     const client = await clientStore.load(issuer);
-    const normalizedClient = client === null ? null : normalizeStoredClient(client);
+    const normalizedClient = client === null ? null : normalizeStoredOAuthClient(client);
     if (client !== null && normalizedClient === null) {
       await clientStore.clear(issuer);
       return null;
@@ -5298,7 +5416,7 @@ function normalizeLoadedSession(session) {
   const refreshState = getOwnEntry6(session, "refreshState");
   if (refreshState !== void 0 && (refreshState !== "pending" || getOwnEntry6(session, "tokens") !== void 0))
     throw new Error("Stored OAuth refresh state is invalid");
-  const client = normalizeStoredClient(getOwnEntry6(session, "client"));
+  const client = normalizeStoredOAuthClient(getOwnEntry6(session, "client"));
   if (client === null) {
     return { ...session, client: { clientId: "" }, tokens: void 0 };
   }
@@ -5308,25 +5426,6 @@ function normalizeLoadedSession(session) {
     tokens: normalizeStoredTokens(getOwnEntry6(session, "tokens"))
   };
 }
-function normalizeStoredClient(value) {
-  if (!isObjectRecord3(value)) {
-    return null;
-  }
-  const clientId = getOwnString2(value, "clientId");
-  if (clientId === void 0 || clientId.trim().length === 0) {
-    return null;
-  }
-  const normalizedClientId = clientId.trim();
-  const clientSecret = getOwnEntry6(value, "clientSecret");
-  if (clientSecret === void 0) {
-    return { clientId: normalizedClientId };
-  }
-  if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
-    return null;
-  }
-  const normalizedClientSecret = clientSecret.trim();
-  return { clientId: normalizedClientId, clientSecret: normalizedClientSecret };
-}
 function normalizeStoredTokens(value) {
   if (value === void 0 || !isObjectRecord3(value)) {
     return void 0;
@@ -5335,10 +5434,10 @@ function normalizeStoredTokens(value) {
   const tokenType = getOwnString2(value, "tokenType");
   const expiresAt = getOwnEntry6(value, "expiresAt");
   const refreshToken = getOwnEntry6(value, "refreshToken");
-  const scope = getOwnString2(value, "scope");
+  const scope = getOwnEntry6(value, "scope");
   const normalizedAccessToken = accessToken?.trim();
   const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : void 0;
-  const normalizedScope = scope?.trim();
+  const normalizedScope = normalizeOAuthScope(scope);
   if (accessToken === void 0 || normalizedAccessToken === void 0 || normalizedAccessToken.length === 0 || tokenType !== "Bearer" || !(expiresAt === null || typeof expiresAt === "number" && Number.isSafeInteger(expiresAt) && expiresAt <= MAX_JS_DATE_MS3 && Number.isFinite(new Date(expiresAt).getTime())) || refreshToken !== void 0 && (typeof refreshToken !== "string" || normalizedRefreshToken === void 0 || normalizedRefreshToken.length === 0)) {
     return void 0;
   }
@@ -5356,18 +5455,18 @@ function getClientMetadata(client) {
   }
   return {
     clientName: normalizeOptionalOAuthString(client.metadata.clientName),
-    scope: normalizeOptionalOAuthString(client.metadata.scope),
+    scope: normalizeOAuthScope(client.metadata.scope),
     softwareId: normalizeOptionalOAuthString(client.metadata.softwareId),
     softwareVersion: normalizeOptionalOAuthString(client.metadata.softwareVersion)
   };
 }
 function normalizeConfiguredClient(client) {
-  const clientId = normalizeOptionalOAuthString(client.clientId);
-  if (clientId === void 0) {
+  const registration = client.registration === void 0 ? void 0 : parseOAuthClientRegistration(client.registration);
+  const clientId = normalizeOptionalOAuthString(client.clientId) ?? registration?.client_id.trim();
+  if (clientId === void 0)
     return null;
-  }
-  const clientSecret = normalizeOptionalOAuthString(client.clientSecret);
-  return clientSecret === void 0 ? { clientId } : { clientId, clientSecret };
+  const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === void 0 ? void 0 : getOwnString2(registration, "client_secret")?.trim());
+  return normalizeStoredOAuthClient({ clientId, clientSecret, registration });
 }
 function normalizeOptionalOAuthString(value) {
   if (value === void 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.31",
+  "version": "0.1.33",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",