tiny-http-mcp-server 0.1.32 → 0.1.33

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.32",
+      "version": "0.1.33",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -112,6 +112,13 @@ Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
 Input tokens are copied and invalid expiry values fail before authorization.
+Pass a complete DCR response as `client.registration` (or validate untrusted JSON
+with `parseOAuthClientRegistration`). Dynamic clients infer their original ID
+and secret from that response and reuse it without registering another app.
+Explicit ID/secret values must agree with the imported response. Sessions and
+native registration stores retain arrays, issuance/expiry timestamps and JSON
+provider metadata. Registration input is copied, bounded to 64 KiB and 64
+levels, and rejects invalid standard field types and non-JSON extensions.
 Static clients and dynamic initial-grant imports require cached grants to match
 the original normalized client ID and secret. A different client configuration
 fails before attaching or refreshing credentials and retains the stored record;

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.d.ts

@@ -1,9 +1,5 @@
 import { type CreateSecretStoreInput } from "auth-store";
-import type { OAuthSessionStore } from "./types.js";
-interface StoredOAuthClient {
-    clientId: string;
-    clientSecret?: string;
-}
+import type { OAuthSessionStore, StoredOAuthClient } from "./types.js";
 export interface OAuthClientStore {
     load(issuer: string): Promise<StoredOAuthClient | null>;
     save(issuer: string, client: StoredOAuthClient): Promise<void>;
@@ -12,4 +8,3 @@ export interface OAuthClientStore {
 export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput, namespace?: string): OAuthSessionStore;
 export declare function createAuthStoreClientStore(options: CreateSecretStoreInput, namespace?: string): OAuthClientStore;
 export declare function assertPersistenceNamespace(namespace: string | undefined): void;
-export {};

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -1,3 +1,4 @@
+import { normalizeStoredOAuthClient } from "./client-registration.js";
 import crypto from "node:crypto";
 import path from "node:path";
 import { createSecretStore } from "auth-store";
@@ -62,15 +63,10 @@ export function createAuthStoreClientStore(options, namespace) {
             catch {
                 throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
             }
-            const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : undefined;
-            if (clientId !== undefined) {
-                const client = { clientId };
-                if (isObjectRecord(parsed) &&
-                    Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
-                    client.clientSecret = getOwnEntry(parsed, "clientSecret");
-                }
-                return client;
-            }
+            // Preserve all registration metadata; provider normalization validates its
+            // identity and schema before it can authorize a request.
+            if (isObjectRecord(parsed) && typeof getOwnEntry(parsed, "clientId") === "string")
+                return parsed;
             throw new Error("Stored OAuth client must be a JSON object with clientId");
         },
         async save(issuer, client) {
@@ -142,21 +138,13 @@ function isStoredOAuthSession(value) {
     }
     return (isNonBlankOwnString(value, "resource") &&
         isNonBlankOwnString(value, "authorizationServer") &&
-        isStoredOAuthClient(getOwnEntry(value, "client")) &&
+        normalizeStoredOAuthClient(getOwnEntry(value, "client")) !== null &&
         isStoredOAuthDiscovery(getOwnEntry(value, "discovery")) &&
         (getOwnEntry(value, "requestedScope") === undefined || isNonBlankOwnString(value, "requestedScope")) &&
         (getOwnEntry(value, "refreshState") === undefined ||
             (getOwnEntry(value, "refreshState") === "pending" && getOwnEntry(value, "tokens") === undefined)) &&
         isStoredOAuthTokensOrMissing(getOwnEntry(value, "tokens")));
 }
-function isStoredOAuthClient(value) {
-    if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
-        return false;
-    }
-    const clientSecret = getOwnEntry(value, "clientSecret");
-    return (clientSecret === undefined ||
-        (typeof clientSecret === "string" && clientSecret.trim().length > 0));
-}
 function isStoredOAuthDiscovery(value) {
     if (!isObjectRecord(value)) {
         return false;

package/node_modules/mcp-oauth/dist/client/client-registration.d.ts

@@ -0,0 +1,4 @@
+import type { OAuthClientRegistration, StoredOAuthClient } from "./types.js";
+/** Validate and copy a bounded JSON DCR response without quoting credential input. */
+export declare function parseOAuthClientRegistration(value: unknown): OAuthClientRegistration;
+export declare function normalizeStoredOAuthClient(value: unknown): StoredOAuthClient | null;

package/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -0,0 +1,94 @@
+import { normalizeOAuthScope } from "./scope.js";
+/** Validate and copy a bounded JSON DCR response without quoting credential input. */
+export function parseOAuthClientRegistration(value) {
+    const invalid = () => new Error("Invalid OAuth client registration metadata");
+    let nodes = 0;
+    function copy(input, depth) {
+        if (++nodes > 20_000 || depth > 64)
+            throw invalid();
+        if (input === null || typeof input === "boolean" || typeof input === "string")
+            return input;
+        if (typeof input === "number" && Number.isFinite(input))
+            return input;
+        if (typeof input !== "object" || input === null)
+            throw invalid();
+        const descriptors = Object.getOwnPropertyDescriptors(input);
+        if (Array.isArray(input)) {
+            const length = descriptors.length?.value;
+            if (length > 20_000)
+                throw invalid();
+            const result = [];
+            for (let index = 0; index < length; index++) {
+                const descriptor = descriptors[String(index)];
+                if (descriptor === undefined || !Object.hasOwn(descriptor, "value"))
+                    throw invalid();
+                result.push(copy(descriptor.value, depth + 1));
+            }
+            return result;
+        }
+        if (Object.getPrototypeOf(input) !== Object.prototype && Object.getPrototypeOf(input) !== null)
+            throw invalid();
+        return Object.fromEntries(Object.entries(descriptors).filter(([, descriptor]) => descriptor.enumerable).map(([key, descriptor]) => {
+            if (!Object.hasOwn(descriptor, "value"))
+                throw invalid();
+            return [key, copy(descriptor.value, depth + 1)];
+        }));
+    }
+    let result;
+    try {
+        result = copy(value, 0);
+    }
+    catch {
+        throw invalid();
+    }
+    if (typeof result !== "object" || result === null || Array.isArray(result))
+        throw invalid();
+    const record = result;
+    if (!Object.hasOwn(record, "client_id") || typeof record.client_id !== "string" || record.client_id.trim() === "")
+        throw new Error("OAuth client registration response missing client_id");
+    for (const key of ["client_id", "client_secret", "token_endpoint_auth_method", "application_type", "client_name", "client_uri", "logo_uri", "scope",
+        "tos_uri", "policy_uri", "jwks_uri", "software_id", "software_version", "software_statement", "registration_access_token", "registration_client_uri", "issuer"]) {
+        if (Object.hasOwn(record, key) && record[key] !== null && typeof record[key] !== "string")
+            throw invalid();
+    }
+    if (typeof record.client_secret === "string" && record.client_secret.trim() === "")
+        throw invalid();
+    for (const key of ["redirect_uris", "grant_types", "response_types", "contacts"]) {
+        const entry = record[key];
+        if (Object.hasOwn(record, key) && entry !== null && (!Array.isArray(entry) || entry.some(item => typeof item !== "string")))
+            throw invalid();
+    }
+    for (const key of ["client_id_issued_at", "client_secret_expires_at"]) {
+        const entry = record[key];
+        if (Object.hasOwn(record, key) && entry !== null && (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0))
+            throw invalid();
+    }
+    try {
+        normalizeOAuthScope(Object.hasOwn(record, "scope") && record.scope !== null ? record.scope : undefined);
+    }
+    catch {
+        throw invalid();
+    }
+    if (Buffer.byteLength(JSON.stringify(record), "utf8") > 64 * 1024)
+        throw invalid();
+    return record;
+}
+export function normalizeStoredOAuthClient(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const record = value;
+    const clientId = Object.hasOwn(record, "clientId") ? record.clientId : undefined;
+    const clientSecret = Object.hasOwn(record, "clientSecret") ? record.clientSecret : undefined;
+    if (typeof clientId !== "string" || clientId.trim() === "" ||
+        (clientSecret !== undefined && (typeof clientSecret !== "string" || clientSecret.trim() === "")))
+        return null;
+    const client = { clientId: clientId.trim(), ...(clientSecret === undefined ? {} : { clientSecret: clientSecret.trim() }) };
+    if (Object.hasOwn(record, "registration") && record.registration !== undefined) {
+        const registration = parseOAuthClientRegistration(record.registration);
+        const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : undefined;
+        if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
+            throw new Error("OAuth client registration does not match the client identity");
+        client.registration = registration;
+    }
+    return client;
+}

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,3 +1,4 @@
+import { normalizeStoredOAuthClient, parseOAuthClientRegistration } from "./client-registration.js";
 import { normalizeOAuthScope } from "./scope.js";
 import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
@@ -21,6 +22,7 @@ export function createDefaultOAuthClientProvider(options) {
     assertPersistenceNamespace(options.persistenceNamespace);
     const clientMetadata = getClientMetadata(options.client);
     const requestedScope = clientMetadata?.scope;
+    const configuredClient = normalizeConfiguredClient(options.client);
     const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
     const now = options.now ?? Date.now;
@@ -39,7 +41,7 @@ export function createDefaultOAuthClientProvider(options) {
     const initialGrant = options.initialGrant === undefined ? undefined : {
         resource: canonicalizeResourceIndicator(options.initialGrant.resource),
         tokens: normalizeStoredTokens(options.initialGrant.tokens),
-        client: normalizeConfiguredClient(options.client)
+        client: configuredClient
     };
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
         throw new Error("OAuth initial grant requires valid tokens and the original client ID");
@@ -147,8 +149,8 @@ export function createDefaultOAuthClientProvider(options) {
             if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
                 forceRefresh = false;
             const sessionDiscovery = resolveDiscovery(discovery, session);
-            if ((options.client.mode === "static" || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
-                const configured = normalizeConfiguredClient(options.client);
+            if ((options.client.mode === "static" || configuredClient?.registration !== undefined || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
+                const configured = configuredClient;
                 if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
                     throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
             }
@@ -327,8 +329,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
     async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
         parentSignal?.throwIfAborted();
-        const configuredClient = normalizeConfiguredClient(options.client);
-        if (options.client.mode === "static") {
+        if (options.client.mode === "static" || configuredClient?.registration !== undefined) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }
@@ -389,16 +390,12 @@ export function createDefaultOAuthClientProvider(options) {
             signal
         });
         const payload = await readOAuthJsonObjectResponse(response, signal);
-        const clientId = getOwnString(payload, "client_id");
-        if (clientId === undefined || clientId.trim().length === 0) {
-            throw new Error("OAuth client registration response missing client_id");
-        }
-        const clientSecret = getOwnString(payload, "client_secret");
+        const registration = parseOAuthClientRegistration(payload);
+        const registeredSecret = getOwnString(registration, "client_secret");
         const registeredClient = {
-            clientId: clientId.trim(),
-            clientSecret: clientSecret !== undefined && clientSecret.trim().length > 0
-                ? clientSecret.trim()
-                : undefined
+            clientId: registration.client_id.trim(),
+            ...(registeredSecret === undefined ? {} : { clientSecret: registeredSecret.trim() }),
+            registration
         };
         await saveRegisteredClient(discovery.authorizationServer, registeredClient);
         return {
@@ -424,7 +421,7 @@ export function createDefaultOAuthClientProvider(options) {
             return null;
         }
         const client = await clientStore.load(issuer);
-        const normalizedClient = client === null ? null : normalizeStoredClient(client);
+        const normalizedClient = client === null ? null : normalizeStoredOAuthClient(client);
         if (client !== null && normalizedClient === null) {
             await clientStore.clear(issuer);
             return null;
@@ -503,7 +500,7 @@ function normalizeLoadedSession(session) {
     const refreshState = getOwnEntry(session, "refreshState");
     if (refreshState !== undefined && (refreshState !== "pending" || getOwnEntry(session, "tokens") !== undefined))
         throw new Error("Stored OAuth refresh state is invalid");
-    const client = normalizeStoredClient(getOwnEntry(session, "client"));
+    const client = normalizeStoredOAuthClient(getOwnEntry(session, "client"));
     if (client === null) {
         return { ...session, client: { clientId: "" }, tokens: undefined };
     }
@@ -513,25 +510,6 @@ function normalizeLoadedSession(session) {
         tokens: normalizeStoredTokens(getOwnEntry(session, "tokens"))
     };
 }
-function normalizeStoredClient(value) {
-    if (!isObjectRecord(value)) {
-        return null;
-    }
-    const clientId = getOwnString(value, "clientId");
-    if (clientId === undefined || clientId.trim().length === 0) {
-        return null;
-    }
-    const normalizedClientId = clientId.trim();
-    const clientSecret = getOwnEntry(value, "clientSecret");
-    if (clientSecret === undefined) {
-        return { clientId: normalizedClientId };
-    }
-    if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
-        return null;
-    }
-    const normalizedClientSecret = clientSecret.trim();
-    return { clientId: normalizedClientId, clientSecret: normalizedClientSecret };
-}
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {
         return undefined;
@@ -581,12 +559,12 @@ function getClientMetadata(client) {
     };
 }
 function normalizeConfiguredClient(client) {
-    const clientId = normalizeOptionalOAuthString(client.clientId);
-    if (clientId === undefined) {
+    const registration = client.registration === undefined ? undefined : parseOAuthClientRegistration(client.registration);
+    const clientId = normalizeOptionalOAuthString(client.clientId) ?? registration?.client_id.trim();
+    if (clientId === undefined)
         return null;
-    }
-    const clientSecret = normalizeOptionalOAuthString(client.clientSecret);
-    return clientSecret === undefined ? { clientId } : { clientId, clientSecret };
+    const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === undefined ? undefined : getOwnString(registration, "client_secret")?.trim());
+    return normalizeStoredOAuthClient({ clientId, clientSecret, registration });
 }
 function normalizeOptionalOAuthString(value) {
     if (value === undefined) {

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -70,13 +70,27 @@ export interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Full RFC 7591 response, including JSON provider extensions. */
+export interface OAuthClientRegistration extends Record<string, unknown> {
+    client_id: string;
+    client_secret?: string | null;
+    redirect_uris?: string[] | null;
+    grant_types?: string[] | null;
+    response_types?: string[] | null;
+    contacts?: string[] | null;
+    client_id_issued_at?: number | null;
+    client_secret_expires_at?: number | null;
+    token_endpoint_auth_method?: string | null;
+}
+export interface StoredOAuthClient {
+    clientId: string;
+    clientSecret?: string;
+    registration?: OAuthClientRegistration;
+}
 export interface StoredOAuthSession {
     resource: string;
     authorizationServer: string;
-    client: {
-        clientId: string;
-        clientSecret?: string;
-    };
+    client: StoredOAuthClient;
     tokens?: StoredOAuthTokens;
     /** A refresh was begun; its winning response may not have been persisted. */
     refreshState?: "pending";
@@ -104,11 +118,14 @@ export interface DefaultOAuthClientProviderOptions {
         clientId?: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        /** Import a complete registration owned by the caller. */
+        registration?: OAuthClientRegistration;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        registration?: OAuthClientRegistration;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;

package/node_modules/mcp-oauth/dist/index.d.ts

@@ -1,11 +1,12 @@
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
+export { parseOAuthClientRegistration } from "./client/client-registration.js";
 export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
 export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, } from "./client/loopback-authorization.js";
 export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";
 export { OAuthError, } from "./client/token-endpoint.js";
 export { canonicalizeResourceIndicator, } from "./resource-indicator.js";
 export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
-export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, StoredOAuthSession, StoredOAuthTokens, } from "./client/types.js";
+export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, } from "./client/types.js";
 export type { JwksTokenVerifier, JwksTokenVerifierOptions, JwksVerifiedAccessToken, } from "./server/jwks-token-verifier.js";
 export type { LoopbackAuthorizationOptions, LoopbackAuthorizationSession, OAuthLandingPage, } from "./client/loopback-authorization.js";
 export { readBoundedResponseText } from "./http-response.js";

package/node_modules/mcp-oauth/dist/index.js

@@ -1,4 +1,5 @@
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
+export { parseOAuthClientRegistration } from "./client/client-registration.js";
 export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
 export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, } from "./client/loopback-authorization.js";
 export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -173,13 +173,27 @@ interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Full RFC 7591 response, including JSON provider extensions. */
+interface OAuthClientRegistration extends Record<string, unknown> {
+    client_id: string;
+    client_secret?: string | null;
+    redirect_uris?: string[] | null;
+    grant_types?: string[] | null;
+    response_types?: string[] | null;
+    contacts?: string[] | null;
+    client_id_issued_at?: number | null;
+    client_secret_expires_at?: number | null;
+    token_endpoint_auth_method?: string | null;
+}
+interface StoredOAuthClient {
+    clientId: string;
+    clientSecret?: string;
+    registration?: OAuthClientRegistration;
+}
 interface StoredOAuthSession {
     resource: string;
     authorizationServer: string;
-    client: {
-        clientId: string;
-        clientSecret?: string;
-    };
+    client: StoredOAuthClient;
     tokens?: StoredOAuthTokens;
     /** A refresh was begun; its winning response may not have been persisted. */
     refreshState?: "pending";
@@ -207,11 +221,14 @@ interface DefaultOAuthClientProviderOptions {
         clientId?: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        /** Import a complete registration owned by the caller. */
+        registration?: OAuthClientRegistration;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        registration?: OAuthClientRegistration;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3395,6 +3395,124 @@ var SubscriptionManager = class {
   }
 };
 
+// ../mcp-oauth/dist/client/scope.js
+function normalizeOAuthScope(scope) {
+  if (scope === void 0)
+    return void 0;
+  if (typeof scope !== "string" || [...scope].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
+    throw new Error("Invalid OAuth scope syntax");
+  const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
+  return normalized || void 0;
+}
+
+// ../mcp-oauth/dist/client/client-registration.js
+function parseOAuthClientRegistration(value) {
+  const invalid = () => new Error("Invalid OAuth client registration metadata");
+  let nodes = 0;
+  function copy(input, depth) {
+    if (++nodes > 2e4 || depth > 64)
+      throw invalid();
+    if (input === null || typeof input === "boolean" || typeof input === "string")
+      return input;
+    if (typeof input === "number" && Number.isFinite(input))
+      return input;
+    if (typeof input !== "object" || input === null)
+      throw invalid();
+    const descriptors = Object.getOwnPropertyDescriptors(input);
+    if (Array.isArray(input)) {
+      const length = descriptors.length?.value;
+      if (length > 2e4)
+        throw invalid();
+      const result2 = [];
+      for (let index = 0; index < length; index++) {
+        const descriptor = descriptors[String(index)];
+        if (descriptor === void 0 || !Object.hasOwn(descriptor, "value"))
+          throw invalid();
+        result2.push(copy(descriptor.value, depth + 1));
+      }
+      return result2;
+    }
+    if (Object.getPrototypeOf(input) !== Object.prototype && Object.getPrototypeOf(input) !== null)
+      throw invalid();
+    return Object.fromEntries(Object.entries(descriptors).filter(([, descriptor]) => descriptor.enumerable).map(([key2, descriptor]) => {
+      if (!Object.hasOwn(descriptor, "value"))
+        throw invalid();
+      return [key2, copy(descriptor.value, depth + 1)];
+    }));
+  }
+  let result;
+  try {
+    result = copy(value, 0);
+  } catch {
+    throw invalid();
+  }
+  if (typeof result !== "object" || result === null || Array.isArray(result))
+    throw invalid();
+  const record2 = result;
+  if (!Object.hasOwn(record2, "client_id") || typeof record2.client_id !== "string" || record2.client_id.trim() === "")
+    throw new Error("OAuth client registration response missing client_id");
+  for (const key2 of [
+    "client_id",
+    "client_secret",
+    "token_endpoint_auth_method",
+    "application_type",
+    "client_name",
+    "client_uri",
+    "logo_uri",
+    "scope",
+    "tos_uri",
+    "policy_uri",
+    "jwks_uri",
+    "software_id",
+    "software_version",
+    "software_statement",
+    "registration_access_token",
+    "registration_client_uri",
+    "issuer"
+  ]) {
+    if (Object.hasOwn(record2, key2) && record2[key2] !== null && typeof record2[key2] !== "string")
+      throw invalid();
+  }
+  if (typeof record2.client_secret === "string" && record2.client_secret.trim() === "")
+    throw invalid();
+  for (const key2 of ["redirect_uris", "grant_types", "response_types", "contacts"]) {
+    const entry = record2[key2];
+    if (Object.hasOwn(record2, key2) && entry !== null && (!Array.isArray(entry) || entry.some((item) => typeof item !== "string")))
+      throw invalid();
+  }
+  for (const key2 of ["client_id_issued_at", "client_secret_expires_at"]) {
+    const entry = record2[key2];
+    if (Object.hasOwn(record2, key2) && entry !== null && (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0))
+      throw invalid();
+  }
+  try {
+    normalizeOAuthScope(Object.hasOwn(record2, "scope") && record2.scope !== null ? record2.scope : void 0);
+  } catch {
+    throw invalid();
+  }
+  if (Buffer.byteLength(JSON.stringify(record2), "utf8") > 64 * 1024)
+    throw invalid();
+  return record2;
+}
+function normalizeStoredOAuthClient(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return null;
+  const record2 = value;
+  const clientId = Object.hasOwn(record2, "clientId") ? record2.clientId : void 0;
+  const clientSecret = Object.hasOwn(record2, "clientSecret") ? record2.clientSecret : void 0;
+  if (typeof clientId !== "string" || clientId.trim() === "" || clientSecret !== void 0 && (typeof clientSecret !== "string" || clientSecret.trim() === ""))
+    return null;
+  const client = { clientId: clientId.trim(), ...clientSecret === void 0 ? {} : { clientSecret: clientSecret.trim() } };
+  if (Object.hasOwn(record2, "registration") && record2.registration !== void 0) {
+    const registration = parseOAuthClientRegistration(record2.registration);
+    const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : void 0;
+    if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
+      throw new Error("OAuth client registration does not match the client identity");
+    client.registration = registration;
+  }
+  return client;
+}
+
 // ../mcp-oauth/dist/client/auth-store-session-store.js
 import crypto from "node:crypto";
 import path4 from "node:path";
@@ -4128,14 +4246,8 @@ function createAuthStoreClientStore(options, namespace) {
       } catch {
         throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
       }
-      const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : void 0;
-      if (clientId !== void 0) {
-        const client = { clientId };
-        if (isObjectRecord(parsed) && Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
-          client.clientSecret = getOwnEntry3(parsed, "clientSecret");
-        }
-        return client;
-      }
+      if (isObjectRecord(parsed) && typeof getOwnEntry3(parsed, "clientId") === "string")
+        return parsed;
       throw new Error("Stored OAuth client must be a JSON object with clientId");
     },
     async save(issuer, client) {
@@ -4201,14 +4313,7 @@ function isStoredOAuthSession(value) {
   if (!isObjectRecord(value)) {
     return false;
   }
-  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && isStoredOAuthClient(getOwnEntry3(value, "client")) && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "requestedScope") === void 0 || isNonBlankOwnString(value, "requestedScope")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
-}
-function isStoredOAuthClient(value) {
-  if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
-    return false;
-  }
-  const clientSecret = getOwnEntry3(value, "clientSecret");
-  return clientSecret === void 0 || typeof clientSecret === "string" && clientSecret.trim().length > 0;
+  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && normalizeStoredOAuthClient(getOwnEntry3(value, "client")) !== null && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "requestedScope") === void 0 || isNonBlankOwnString(value, "requestedScope")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
 }
 function isStoredOAuthDiscovery(value) {
   if (!isObjectRecord(value)) {
@@ -4242,16 +4347,6 @@ function isNonBlankOwnString(record2, key2) {
   return value !== void 0 && value.trim().length > 0;
 }
 
-// ../mcp-oauth/dist/client/scope.js
-function normalizeOAuthScope(scope) {
-  if (scope === void 0)
-    return void 0;
-  if (typeof scope !== "string" || [...scope].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
-    throw new Error("Invalid OAuth scope syntax");
-  const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
-  return normalized || void 0;
-}
-
 // ../mcp-oauth/dist/client/default-oauth-client-provider.js
 import { isIP } from "node:net";
 
@@ -4861,6 +4956,7 @@ function createDefaultOAuthClientProvider(options) {
   assertPersistenceNamespace(options.persistenceNamespace);
   const clientMetadata = getClientMetadata(options.client);
   const requestedScope = clientMetadata?.scope;
+  const configuredClient = normalizeConfiguredClient(options.client);
   const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
   const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
   const now = options.now ?? Date.now;
@@ -4878,7 +4974,7 @@ function createDefaultOAuthClientProvider(options) {
   const initialGrant = options.initialGrant === void 0 ? void 0 : {
     resource: canonicalizeResourceIndicator(options.initialGrant.resource),
     tokens: normalizeStoredTokens(options.initialGrant.tokens),
-    client: normalizeConfiguredClient(options.client)
+    client: configuredClient
   };
   if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
     throw new Error("OAuth initial grant requires valid tokens and the original client ID");
@@ -4982,8 +5078,8 @@ function createDefaultOAuthClientProvider(options) {
       if (forceRefresh && rejectedTokens !== void 0 && (rejectedTokens === null || session?.tokens === void 0 || !sameTokenGrant(session.tokens, rejectedTokens)))
         forceRefresh = false;
       const sessionDiscovery = resolveDiscovery(discovery, session);
-      if ((options.client.mode === "static" || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
-        const configured = normalizeConfiguredClient(options.client);
+      if ((options.client.mode === "static" || configuredClient?.registration !== void 0 || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
+        const configured = configuredClient;
         if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
           throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
       }
@@ -5157,8 +5253,7 @@ function createDefaultOAuthClientProvider(options) {
   }
   async function resolveClient(existingSession, discovery, redirectUri, fetch2, parentSignal) {
     parentSignal?.throwIfAborted();
-    const configuredClient = normalizeConfiguredClient(options.client);
-    if (options.client.mode === "static") {
+    if (options.client.mode === "static" || configuredClient?.registration !== void 0) {
       if (configuredClient === null) {
         throw new Error("OAuth client_id must not be blank");
       }
@@ -5217,14 +5312,12 @@ function createDefaultOAuthClientProvider(options) {
       signal
     });
     const payload = await readOAuthJsonObjectResponse(response, signal);
-    const clientId = getOwnString2(payload, "client_id");
-    if (clientId === void 0 || clientId.trim().length === 0) {
-      throw new Error("OAuth client registration response missing client_id");
-    }
-    const clientSecret = getOwnString2(payload, "client_secret");
+    const registration = parseOAuthClientRegistration(payload);
+    const registeredSecret = getOwnString2(registration, "client_secret");
     const registeredClient = {
-      clientId: clientId.trim(),
-      clientSecret: clientSecret !== void 0 && clientSecret.trim().length > 0 ? clientSecret.trim() : void 0
+      clientId: registration.client_id.trim(),
+      ...registeredSecret === void 0 ? {} : { clientSecret: registeredSecret.trim() },
+      registration
     };
     await saveRegisteredClient(discovery.authorizationServer, registeredClient);
     return {
@@ -5250,7 +5343,7 @@ function createDefaultOAuthClientProvider(options) {
       return null;
     }
     const client = await clientStore.load(issuer);
-    const normalizedClient = client === null ? null : normalizeStoredClient(client);
+    const normalizedClient = client === null ? null : normalizeStoredOAuthClient(client);
     if (client !== null && normalizedClient === null) {
       await clientStore.clear(issuer);
       return null;
@@ -5323,7 +5416,7 @@ function normalizeLoadedSession(session) {
   const refreshState = getOwnEntry6(session, "refreshState");
   if (refreshState !== void 0 && (refreshState !== "pending" || getOwnEntry6(session, "tokens") !== void 0))
     throw new Error("Stored OAuth refresh state is invalid");
-  const client = normalizeStoredClient(getOwnEntry6(session, "client"));
+  const client = normalizeStoredOAuthClient(getOwnEntry6(session, "client"));
   if (client === null) {
     return { ...session, client: { clientId: "" }, tokens: void 0 };
   }
@@ -5333,25 +5426,6 @@ function normalizeLoadedSession(session) {
     tokens: normalizeStoredTokens(getOwnEntry6(session, "tokens"))
   };
 }
-function normalizeStoredClient(value) {
-  if (!isObjectRecord3(value)) {
-    return null;
-  }
-  const clientId = getOwnString2(value, "clientId");
-  if (clientId === void 0 || clientId.trim().length === 0) {
-    return null;
-  }
-  const normalizedClientId = clientId.trim();
-  const clientSecret = getOwnEntry6(value, "clientSecret");
-  if (clientSecret === void 0) {
-    return { clientId: normalizedClientId };
-  }
-  if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
-    return null;
-  }
-  const normalizedClientSecret = clientSecret.trim();
-  return { clientId: normalizedClientId, clientSecret: normalizedClientSecret };
-}
 function normalizeStoredTokens(value) {
   if (value === void 0 || !isObjectRecord3(value)) {
     return void 0;
@@ -5387,12 +5461,12 @@ function getClientMetadata(client) {
   };
 }
 function normalizeConfiguredClient(client) {
-  const clientId = normalizeOptionalOAuthString(client.clientId);
-  if (clientId === void 0) {
+  const registration = client.registration === void 0 ? void 0 : parseOAuthClientRegistration(client.registration);
+  const clientId = normalizeOptionalOAuthString(client.clientId) ?? registration?.client_id.trim();
+  if (clientId === void 0)
     return null;
-  }
-  const clientSecret = normalizeOptionalOAuthString(client.clientSecret);
-  return clientSecret === void 0 ? { clientId } : { clientId, clientSecret };
+  const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === void 0 ? void 0 : getOwnString2(registration, "client_secret")?.trim());
+  return normalizeStoredOAuthClient({ clientId, clientSecret, registration });
 }
 function normalizeOptionalOAuthString(value) {
   if (value === void 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.32",
+  "version": "0.1.33",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",