tiny-http-mcp-server 0.1.32 → 0.1.34

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.32",
+      "version": "0.1.34",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -112,6 +112,23 @@ Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
 Input tokens are copied and invalid expiry values fail before authorization.
+Pass a complete DCR response as `client.registration` (or validate untrusted JSON
+with `parseOAuthClientRegistration`). Dynamic clients infer their original ID
+and secret from that response and reuse it without registering another app.
+Explicit ID/secret values must agree with the imported response. Sessions and
+native registration stores retain arrays, issuance/expiry timestamps and JSON
+provider metadata. Registration input is copied, bounded to 64 KiB and 64
+levels, and rejects invalid standard field types and non-JSON extensions.
+Set `client.tokenEndpointAuthMethod` to `none`, `client_secret_post` or
+`client_secret_basic`; a full registration can supply the same field as
+`token_endpoint_auth_method`. Public clients never transmit a stored secret.
+Basic credentials are individually form-encoded before Base64 encoding and
+are omitted from the form body. Cached grants retain their registered method;
+an explicitly different configured method requires separate persistence or a
+reset. Native DCR chooses a supported method, preferring public PKCE when
+advertised. Unsupported methods and missing confidential secrets fail before
+token requests. Existing clients without a method keep the previous default:
+body authentication when a secret is present, public authentication otherwise.
 Static clients and dynamic initial-grant imports require cached grants to match
 the original normalized client ID and secret. A different client configuration
 fails before attaching or refreshing credentials and retains the stored record;

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.d.ts

@@ -1,9 +1,5 @@
 import { type CreateSecretStoreInput } from "auth-store";
-import type { OAuthSessionStore } from "./types.js";
-interface StoredOAuthClient {
-    clientId: string;
-    clientSecret?: string;
-}
+import type { OAuthSessionStore, StoredOAuthClient } from "./types.js";
 export interface OAuthClientStore {
     load(issuer: string): Promise<StoredOAuthClient | null>;
     save(issuer: string, client: StoredOAuthClient): Promise<void>;
@@ -12,4 +8,3 @@ export interface OAuthClientStore {
 export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput, namespace?: string): OAuthSessionStore;
 export declare function createAuthStoreClientStore(options: CreateSecretStoreInput, namespace?: string): OAuthClientStore;
 export declare function assertPersistenceNamespace(namespace: string | undefined): void;
-export {};

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -1,3 +1,4 @@
+import { normalizeStoredOAuthClient } from "./client-registration.js";
 import crypto from "node:crypto";
 import path from "node:path";
 import { createSecretStore } from "auth-store";
@@ -62,15 +63,10 @@ export function createAuthStoreClientStore(options, namespace) {
             catch {
                 throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
             }
-            const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : undefined;
-            if (clientId !== undefined) {
-                const client = { clientId };
-                if (isObjectRecord(parsed) &&
-                    Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
-                    client.clientSecret = getOwnEntry(parsed, "clientSecret");
-                }
-                return client;
-            }
+            // Preserve all registration metadata; provider normalization validates its
+            // identity and schema before it can authorize a request.
+            if (isObjectRecord(parsed) && typeof getOwnEntry(parsed, "clientId") === "string")
+                return parsed;
             throw new Error("Stored OAuth client must be a JSON object with clientId");
         },
         async save(issuer, client) {
@@ -142,21 +138,13 @@ function isStoredOAuthSession(value) {
     }
     return (isNonBlankOwnString(value, "resource") &&
         isNonBlankOwnString(value, "authorizationServer") &&
-        isStoredOAuthClient(getOwnEntry(value, "client")) &&
+        normalizeStoredOAuthClient(getOwnEntry(value, "client")) !== null &&
         isStoredOAuthDiscovery(getOwnEntry(value, "discovery")) &&
         (getOwnEntry(value, "requestedScope") === undefined || isNonBlankOwnString(value, "requestedScope")) &&
         (getOwnEntry(value, "refreshState") === undefined ||
             (getOwnEntry(value, "refreshState") === "pending" && getOwnEntry(value, "tokens") === undefined)) &&
         isStoredOAuthTokensOrMissing(getOwnEntry(value, "tokens")));
 }
-function isStoredOAuthClient(value) {
-    if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
-        return false;
-    }
-    const clientSecret = getOwnEntry(value, "clientSecret");
-    return (clientSecret === undefined ||
-        (typeof clientSecret === "string" && clientSecret.trim().length > 0));
-}
 function isStoredOAuthDiscovery(value) {
     if (!isObjectRecord(value)) {
         return false;

package/node_modules/mcp-oauth/dist/client/client-registration.d.ts

@@ -0,0 +1,4 @@
+import type { OAuthClientRegistration, StoredOAuthClient } from "./types.js";
+/** Validate and copy a bounded JSON DCR response without quoting credential input. */
+export declare function parseOAuthClientRegistration(value: unknown): OAuthClientRegistration;
+export declare function normalizeStoredOAuthClient(value: unknown): StoredOAuthClient | null;

package/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -0,0 +1,103 @@
+import { normalizeOAuthScope } from "./scope.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
+/** Validate and copy a bounded JSON DCR response without quoting credential input. */
+export function parseOAuthClientRegistration(value) {
+    const invalid = () => new Error("Invalid OAuth client registration metadata");
+    let nodes = 0;
+    function copy(input, depth) {
+        if (++nodes > 20_000 || depth > 64)
+            throw invalid();
+        if (input === null || typeof input === "boolean" || typeof input === "string")
+            return input;
+        if (typeof input === "number" && Number.isFinite(input))
+            return input;
+        if (typeof input !== "object" || input === null)
+            throw invalid();
+        const descriptors = Object.getOwnPropertyDescriptors(input);
+        if (Array.isArray(input)) {
+            const length = descriptors.length?.value;
+            if (length > 20_000)
+                throw invalid();
+            const result = [];
+            for (let index = 0; index < length; index++) {
+                const descriptor = descriptors[String(index)];
+                if (descriptor === undefined || !Object.hasOwn(descriptor, "value"))
+                    throw invalid();
+                result.push(copy(descriptor.value, depth + 1));
+            }
+            return result;
+        }
+        if (Object.getPrototypeOf(input) !== Object.prototype && Object.getPrototypeOf(input) !== null)
+            throw invalid();
+        return Object.fromEntries(Object.entries(descriptors).filter(([, descriptor]) => descriptor.enumerable).map(([key, descriptor]) => {
+            if (!Object.hasOwn(descriptor, "value"))
+                throw invalid();
+            return [key, copy(descriptor.value, depth + 1)];
+        }));
+    }
+    let result;
+    try {
+        result = copy(value, 0);
+    }
+    catch {
+        throw invalid();
+    }
+    if (typeof result !== "object" || result === null || Array.isArray(result))
+        throw invalid();
+    const record = result;
+    if (!Object.hasOwn(record, "client_id") || typeof record.client_id !== "string" || record.client_id.trim() === "")
+        throw new Error("OAuth client registration response missing client_id");
+    for (const key of ["client_id", "client_secret", "token_endpoint_auth_method", "application_type", "client_name", "client_uri", "logo_uri", "scope",
+        "tos_uri", "policy_uri", "jwks_uri", "software_id", "software_version", "software_statement", "registration_access_token", "registration_client_uri", "issuer"]) {
+        if (Object.hasOwn(record, key) && record[key] !== null && typeof record[key] !== "string")
+            throw invalid();
+    }
+    if (typeof record.client_secret === "string" && record.client_secret.trim() === "")
+        throw invalid();
+    for (const key of ["redirect_uris", "grant_types", "response_types", "contacts"]) {
+        const entry = record[key];
+        if (Object.hasOwn(record, key) && entry !== null && (!Array.isArray(entry) || entry.some(item => typeof item !== "string")))
+            throw invalid();
+    }
+    for (const key of ["client_id_issued_at", "client_secret_expires_at"]) {
+        const entry = record[key];
+        if (Object.hasOwn(record, key) && entry !== null && (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0))
+            throw invalid();
+    }
+    try {
+        normalizeOAuthScope(Object.hasOwn(record, "scope") && record.scope !== null ? record.scope : undefined);
+    }
+    catch {
+        throw invalid();
+    }
+    if (Buffer.byteLength(JSON.stringify(record), "utf8") > 64 * 1024)
+        throw invalid();
+    return record;
+}
+export function normalizeStoredOAuthClient(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const record = value;
+    const clientId = Object.hasOwn(record, "clientId") ? record.clientId : undefined;
+    const clientSecret = Object.hasOwn(record, "clientSecret") ? record.clientSecret : undefined;
+    if (typeof clientId !== "string" || clientId.trim() === "" ||
+        (clientSecret !== undefined && (typeof clientSecret !== "string" || clientSecret.trim() === "")))
+        return null;
+    const client = { clientId: clientId.trim(), ...(clientSecret === undefined ? {} : { clientSecret: clientSecret.trim() }) };
+    const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record, "tokenEndpointAuthMethod") ? record.tokenEndpointAuthMethod : undefined);
+    if (Object.hasOwn(record, "registration") && record.registration !== undefined) {
+        const registration = parseOAuthClientRegistration(record.registration);
+        const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : undefined;
+        if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
+            throw new Error("OAuth client registration does not match the client identity");
+        client.registration = registration;
+        const registrationMethod = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(registration, "token_endpoint_auth_method") ? registration.token_endpoint_auth_method : undefined);
+        if (method !== undefined && registrationMethod !== undefined && method !== registrationMethod)
+            throw new Error("OAuth token endpoint authentication conflicts with the client registration");
+        if (registrationMethod !== undefined)
+            client.tokenEndpointAuthMethod = registrationMethod;
+    }
+    if (method !== undefined)
+        client.tokenEndpointAuthMethod = method;
+    return client;
+}

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,4 +1,6 @@
+import { normalizeStoredOAuthClient, parseOAuthClientRegistration } from "./client-registration.js";
 import { normalizeOAuthScope } from "./scope.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
@@ -21,6 +23,9 @@ export function createDefaultOAuthClientProvider(options) {
     assertPersistenceNamespace(options.persistenceNamespace);
     const clientMetadata = getClientMetadata(options.client);
     const requestedScope = clientMetadata?.scope;
+    const configuredClient = normalizeConfiguredClient(options.client);
+    const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
+    const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
     const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
     const now = options.now ?? Date.now;
@@ -39,7 +44,7 @@ export function createDefaultOAuthClientProvider(options) {
     const initialGrant = options.initialGrant === undefined ? undefined : {
         resource: canonicalizeResourceIndicator(options.initialGrant.resource),
         tokens: normalizeStoredTokens(options.initialGrant.tokens),
-        client: normalizeConfiguredClient(options.client)
+        client: configuredClient
     };
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
         throw new Error("OAuth initial grant requires valid tokens and the original client ID");
@@ -147,13 +152,16 @@ export function createDefaultOAuthClientProvider(options) {
             if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
                 forceRefresh = false;
             const sessionDiscovery = resolveDiscovery(discovery, session);
-            if ((options.client.mode === "static" || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
-                const configured = normalizeConfiguredClient(options.client);
+            if ((options.client.mode === "static" || configuredClient?.registration !== undefined || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
+                const configured = configuredClient;
                 if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
                     throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
             }
             if (requestedScope !== undefined && session?.tokens !== undefined && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
                 throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
+            if (configuredTokenMethod !== undefined && session !== null && (session.tokens !== undefined || session.refreshState === "pending") &&
+                (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === undefined ? "none" : "client_secret_post")) !== configuredTokenMethod)
+                throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
             if (session?.refreshState === "pending") {
                 if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === undefined)
                     throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -188,6 +196,7 @@ export function createDefaultOAuthClientProvider(options) {
         if (session.tokens?.refreshToken === undefined) {
             return session;
         }
+        assertTokenEndpointAuthentication(session.client, discovery.authorizationServerMetadata);
         const pendingSession = { ...clearSessionTokens(session), refreshState: "pending" };
         await saveSession(resource, pendingSession);
         signal?.throwIfAborted();
@@ -199,6 +208,7 @@ export function createDefaultOAuthClientProvider(options) {
                     tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
                     clientId: session.client.clientId,
                     clientSecret: session.client.clientSecret,
+                    tokenEndpointAuthMethod: session.client.tokenEndpointAuthMethod,
                     refreshToken: session.tokens.refreshToken,
                     resource,
                     fetch, signal,
@@ -264,6 +274,7 @@ export function createDefaultOAuthClientProvider(options) {
             let resolvedClient = null;
             try {
                 resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch, signal);
+                assertTokenEndpointAuthentication(resolvedClient.client, discovery.authorizationServerMetadata);
                 const sessionWithoutTokens = {
                     resource,
                     authorizationServer: discovery.authorizationServer,
@@ -287,6 +298,7 @@ export function createDefaultOAuthClientProvider(options) {
                     tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
                     clientId: resolvedClient.client.clientId,
                     clientSecret: resolvedClient.client.clientSecret,
+                    tokenEndpointAuthMethod: resolvedClient.client.tokenEndpointAuthMethod,
                     code,
                     codeVerifier: verifier,
                     redirectUri: loopback.redirectUri,
@@ -327,8 +339,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
     async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
         parentSignal?.throwIfAborted();
-        const configuredClient = normalizeConfiguredClient(options.client);
-        if (options.client.mode === "static") {
+        if (options.client.mode === "static" || configuredClient?.registration !== undefined) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }
@@ -377,7 +388,12 @@ export function createDefaultOAuthClientProvider(options) {
                 };
             }
         }
-        const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri);
+        const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
+        const registrationMethod = requestedTokenMethod ?? (supported === undefined ? "none" :
+            ["none", "client_secret_basic", "client_secret_post"].find(method => supported.includes(method)));
+        if (registrationMethod === undefined || (supported !== undefined && !supported.includes(registrationMethod)))
+            throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+        const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri, registrationMethod);
         const deadline = AbortSignal.timeout(30_000);
         const signal = parentSignal === undefined ? deadline : AbortSignal.any([parentSignal, deadline]);
         const response = await fetchMcpResponse(fetch, registrationEndpoint, {
@@ -389,16 +405,15 @@ export function createDefaultOAuthClientProvider(options) {
             signal
         });
         const payload = await readOAuthJsonObjectResponse(response, signal);
-        const clientId = getOwnString(payload, "client_id");
-        if (clientId === undefined || clientId.trim().length === 0) {
-            throw new Error("OAuth client registration response missing client_id");
-        }
-        const clientSecret = getOwnString(payload, "client_secret");
+        const registration = parseOAuthClientRegistration(payload);
+        const registeredSecret = getOwnString(registration, "client_secret");
+        const responseMethod = normalizeOAuthTokenEndpointAuthMethod(getOwnEntry(registration, "token_endpoint_auth_method")) ??
+            requestedTokenMethod ?? (supported === undefined ? undefined : normalizeOAuthTokenEndpointAuthMethod(registrationMethod));
         const registeredClient = {
-            clientId: clientId.trim(),
-            clientSecret: clientSecret !== undefined && clientSecret.trim().length > 0
-                ? clientSecret.trim()
-                : undefined
+            clientId: registration.client_id.trim(),
+            ...(registeredSecret === undefined ? {} : { clientSecret: registeredSecret.trim() }),
+            ...(responseMethod === undefined ? {} : { tokenEndpointAuthMethod: responseMethod }),
+            registration
         };
         await saveRegisteredClient(discovery.authorizationServer, registeredClient);
         return {
@@ -411,7 +426,7 @@ export function createDefaultOAuthClientProvider(options) {
         return normalizeLoadedSession(await sessionStore.load(resource));
     }
     async function saveSession(resource, session) {
-        await sessionStore.save(resource, session);
+        await sessionStore.save(resource, structuredClone(session));
     }
     async function clearSession(resource) {
         await sessionStore.clear(resource);
@@ -424,7 +439,7 @@ export function createDefaultOAuthClientProvider(options) {
             return null;
         }
         const client = await clientStore.load(issuer);
-        const normalizedClient = client === null ? null : normalizeStoredClient(client);
+        const normalizedClient = client === null ? null : normalizeStoredOAuthClient(client);
         if (client !== null && normalizedClient === null) {
             await clientStore.clear(issuer);
             return null;
@@ -503,7 +518,7 @@ function normalizeLoadedSession(session) {
     const refreshState = getOwnEntry(session, "refreshState");
     if (refreshState !== undefined && (refreshState !== "pending" || getOwnEntry(session, "tokens") !== undefined))
         throw new Error("Stored OAuth refresh state is invalid");
-    const client = normalizeStoredClient(getOwnEntry(session, "client"));
+    const client = normalizeStoredOAuthClient(getOwnEntry(session, "client"));
     if (client === null) {
         return { ...session, client: { clientId: "" }, tokens: undefined };
     }
@@ -513,25 +528,6 @@ function normalizeLoadedSession(session) {
         tokens: normalizeStoredTokens(getOwnEntry(session, "tokens"))
     };
 }
-function normalizeStoredClient(value) {
-    if (!isObjectRecord(value)) {
-        return null;
-    }
-    const clientId = getOwnString(value, "clientId");
-    if (clientId === undefined || clientId.trim().length === 0) {
-        return null;
-    }
-    const normalizedClientId = clientId.trim();
-    const clientSecret = getOwnEntry(value, "clientSecret");
-    if (clientSecret === undefined) {
-        return { clientId: normalizedClientId };
-    }
-    if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
-        return null;
-    }
-    const normalizedClientSecret = clientSecret.trim();
-    return { clientId: normalizedClientId, clientSecret: normalizedClientSecret };
-}
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {
         return undefined;
@@ -581,12 +577,12 @@ function getClientMetadata(client) {
     };
 }
 function normalizeConfiguredClient(client) {
-    const clientId = normalizeOptionalOAuthString(client.clientId);
-    if (clientId === undefined) {
+    const registration = client.registration === undefined ? undefined : parseOAuthClientRegistration(client.registration);
+    const clientId = normalizeOptionalOAuthString(client.clientId) ?? registration?.client_id.trim();
+    if (clientId === undefined)
         return null;
-    }
-    const clientSecret = normalizeOptionalOAuthString(client.clientSecret);
-    return clientSecret === undefined ? { clientId } : { clientId, clientSecret };
+    const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === undefined ? undefined : getOwnString(registration, "client_secret")?.trim());
+    return normalizeStoredOAuthClient({ clientId, clientSecret, registration, tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
 }
 function normalizeOptionalOAuthString(value) {
     if (value === undefined) {
@@ -693,12 +689,28 @@ function assertRequestMatchesResource(requestUrl, resource) {
         throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
     }
 }
-function buildClientRegistrationBody(metadata, redirectUri) {
+function getSupportedTokenAuthMethods(metadata) {
+    const value = getOwnEntry(metadata, "token_endpoint_auth_methods_supported");
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length > 128 || value.some(method => typeof method !== "string"))
+        throw new Error("Invalid OAuth token endpoint authentication metadata");
+    return value;
+}
+function assertTokenEndpointAuthentication(client, metadata) {
+    const method = client.tokenEndpointAuthMethod ?? (client.clientSecret === undefined ? "none" : "client_secret_post");
+    if (method !== "none" && client.clientSecret === undefined)
+        throw new Error("OAuth token endpoint authentication requires a client secret");
+    const supported = getSupportedTokenAuthMethods(metadata);
+    if (supported !== undefined && !supported.includes(method))
+        throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+}
+function buildClientRegistrationBody(metadata, redirectUri, tokenEndpointAuthMethod) {
     const body = {
         redirect_uris: [redirectUri],
         grant_types: ["authorization_code", "refresh_token"],
         response_types: ["code"],
-        token_endpoint_auth_method: "none"
+        token_endpoint_auth_method: tokenEndpointAuthMethod
     };
     const clientName = metadata === undefined ? undefined : getOwnString(metadata, "clientName");
     const scope = metadata === undefined ? undefined : getOwnString(metadata, "scope");

package/node_modules/mcp-oauth/dist/client/token-auth-method.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthTokenEndpointAuthMethod } from "./types.js";
+export declare function normalizeOAuthTokenEndpointAuthMethod(value: unknown): OAuthTokenEndpointAuthMethod | undefined;

package/node_modules/mcp-oauth/dist/client/token-auth-method.js

@@ -0,0 +1,7 @@
+export function normalizeOAuthTokenEndpointAuthMethod(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
+        throw new Error("Unsupported OAuth token endpoint authentication method");
+    return value;
+}

package/node_modules/mcp-oauth/dist/client/token-endpoint.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthMetadataFetch, StoredOAuthTokens } from "./types.js";
+import type { OAuthMetadataFetch, StoredOAuthTokens, OAuthTokenEndpointAuthMethod } from "./types.js";
 interface OAuthErrorShape {
     error: string;
     error_description?: string;
@@ -22,6 +22,7 @@ export declare function exchangeAuthorizationCode(input: {
     tokenEndpoint: string;
     clientId: string;
     clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     code: string;
     codeVerifier: string;
     redirectUri: string;
@@ -34,6 +35,7 @@ export declare function refreshAccessToken(input: {
     tokenEndpoint: string;
     clientId: string;
     clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     refreshToken: string;
     resource: string;
     fetch: OAuthMetadataFetch;

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -1,3 +1,4 @@
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 import { readBoundedResponseText } from "../http-response.js";
 import { fetchMcpResponse } from "../http-fetch.js";
@@ -40,6 +41,7 @@ export async function exchangeAuthorizationCode(input) {
         tokenEndpoint: input.tokenEndpoint,
         clientId: input.clientId,
         clientSecret: input.clientSecret,
+        tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
         params: {
             grant_type: "authorization_code",
             code: input.code,
@@ -58,6 +60,7 @@ export async function refreshAccessToken(input) {
         tokenEndpoint: input.tokenEndpoint,
         clientId: input.clientId,
         clientSecret: input.clientSecret,
+        tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
         params: {
             grant_type: "refresh_token",
             refresh_token: input.refreshToken,
@@ -69,21 +72,28 @@ export async function refreshAccessToken(input) {
     });
 }
 async function requestTokens(input) {
-    const body = new URLSearchParams({
-        client_id: input.clientId,
-        ...input.params
-    });
-    if (input.clientSecret !== undefined) {
-        body.set("client_secret", input.clientSecret);
+    const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ??
+        (input.clientSecret === undefined ? "none" : "client_secret_post");
+    if (method !== "none" && (input.clientSecret === undefined || input.clientSecret.trim() === ""))
+        throw new Error("OAuth token endpoint authentication requires a client secret");
+    const body = new URLSearchParams(input.params);
+    const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
+    if (method === "client_secret_basic") {
+        const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
+        const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
+        headers.set("Authorization", `Basic ${Buffer.from(`${encoded}:${encodedSecret}`).toString("base64")}`);
+    }
+    else {
+        body.set("client_id", input.clientId);
+        if (method === "client_secret_post")
+            body.set("client_secret", input.clientSecret);
     }
     input.signal?.throwIfAborted();
     const deadline = AbortSignal.timeout(30_000);
     const signal = input.signal === undefined ? deadline : AbortSignal.any([input.signal, deadline]);
     const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
         method: "POST",
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded"
-        },
+        headers,
         body: body.toString(),
         signal
     });

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -70,13 +70,29 @@ export interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Full RFC 7591 response, including JSON provider extensions. */
+export interface OAuthClientRegistration extends Record<string, unknown> {
+    client_id: string;
+    client_secret?: string | null;
+    redirect_uris?: string[] | null;
+    grant_types?: string[] | null;
+    response_types?: string[] | null;
+    contacts?: string[] | null;
+    client_id_issued_at?: number | null;
+    client_secret_expires_at?: number | null;
+    token_endpoint_auth_method?: string | null;
+}
+export interface StoredOAuthClient {
+    clientId: string;
+    clientSecret?: string;
+    registration?: OAuthClientRegistration;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+}
+export type OAuthTokenEndpointAuthMethod = "none" | "client_secret_post" | "client_secret_basic";
 export interface StoredOAuthSession {
     resource: string;
     authorizationServer: string;
-    client: {
-        clientId: string;
-        clientSecret?: string;
-    };
+    client: StoredOAuthClient;
     tokens?: StoredOAuthTokens;
     /** A refresh was begun; its winning response may not have been persisted. */
     refreshState?: "pending";
@@ -104,11 +120,16 @@ export interface DefaultOAuthClientProviderOptions {
         clientId?: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        /** Import a complete registration owned by the caller. */
+        registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;

package/node_modules/mcp-oauth/dist/index.d.ts

@@ -1,11 +1,12 @@
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
+export { parseOAuthClientRegistration } from "./client/client-registration.js";
 export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
 export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, } from "./client/loopback-authorization.js";
 export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";
 export { OAuthError, } from "./client/token-endpoint.js";
 export { canonicalizeResourceIndicator, } from "./resource-indicator.js";
 export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
-export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, StoredOAuthSession, StoredOAuthTokens, } from "./client/types.js";
+export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, OAuthTokenEndpointAuthMethod, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, } from "./client/types.js";
 export type { JwksTokenVerifier, JwksTokenVerifierOptions, JwksVerifiedAccessToken, } from "./server/jwks-token-verifier.js";
 export type { LoopbackAuthorizationOptions, LoopbackAuthorizationSession, OAuthLandingPage, } from "./client/loopback-authorization.js";
 export { readBoundedResponseText } from "./http-response.js";

package/node_modules/mcp-oauth/dist/index.js

@@ -1,4 +1,5 @@
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
+export { parseOAuthClientRegistration } from "./client/client-registration.js";
 export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
 export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, } from "./client/loopback-authorization.js";
 export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -173,13 +173,29 @@ interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Full RFC 7591 response, including JSON provider extensions. */
+interface OAuthClientRegistration extends Record<string, unknown> {
+    client_id: string;
+    client_secret?: string | null;
+    redirect_uris?: string[] | null;
+    grant_types?: string[] | null;
+    response_types?: string[] | null;
+    contacts?: string[] | null;
+    client_id_issued_at?: number | null;
+    client_secret_expires_at?: number | null;
+    token_endpoint_auth_method?: string | null;
+}
+interface StoredOAuthClient {
+    clientId: string;
+    clientSecret?: string;
+    registration?: OAuthClientRegistration;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+}
+type OAuthTokenEndpointAuthMethod = "none" | "client_secret_post" | "client_secret_basic";
 interface StoredOAuthSession {
     resource: string;
     authorizationServer: string;
-    client: {
-        clientId: string;
-        clientSecret?: string;
-    };
+    client: StoredOAuthClient;
     tokens?: StoredOAuthTokens;
     /** A refresh was begun; its winning response may not have been persisted. */
     refreshState?: "pending";
@@ -207,11 +223,16 @@ interface DefaultOAuthClientProviderOptions {
         clientId?: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        /** Import a complete registration owned by the caller. */
+        registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3395,6 +3395,141 @@ var SubscriptionManager = class {
   }
 };
 
+// ../mcp-oauth/dist/client/scope.js
+function normalizeOAuthScope(scope) {
+  if (scope === void 0)
+    return void 0;
+  if (typeof scope !== "string" || [...scope].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
+    throw new Error("Invalid OAuth scope syntax");
+  const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
+  return normalized || void 0;
+}
+
+// ../mcp-oauth/dist/client/token-auth-method.js
+function normalizeOAuthTokenEndpointAuthMethod(value) {
+  if (value === void 0 || value === null)
+    return void 0;
+  if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
+    throw new Error("Unsupported OAuth token endpoint authentication method");
+  return value;
+}
+
+// ../mcp-oauth/dist/client/client-registration.js
+function parseOAuthClientRegistration(value) {
+  const invalid = () => new Error("Invalid OAuth client registration metadata");
+  let nodes = 0;
+  function copy(input, depth) {
+    if (++nodes > 2e4 || depth > 64)
+      throw invalid();
+    if (input === null || typeof input === "boolean" || typeof input === "string")
+      return input;
+    if (typeof input === "number" && Number.isFinite(input))
+      return input;
+    if (typeof input !== "object" || input === null)
+      throw invalid();
+    const descriptors = Object.getOwnPropertyDescriptors(input);
+    if (Array.isArray(input)) {
+      const length = descriptors.length?.value;
+      if (length > 2e4)
+        throw invalid();
+      const result2 = [];
+      for (let index = 0; index < length; index++) {
+        const descriptor = descriptors[String(index)];
+        if (descriptor === void 0 || !Object.hasOwn(descriptor, "value"))
+          throw invalid();
+        result2.push(copy(descriptor.value, depth + 1));
+      }
+      return result2;
+    }
+    if (Object.getPrototypeOf(input) !== Object.prototype && Object.getPrototypeOf(input) !== null)
+      throw invalid();
+    return Object.fromEntries(Object.entries(descriptors).filter(([, descriptor]) => descriptor.enumerable).map(([key2, descriptor]) => {
+      if (!Object.hasOwn(descriptor, "value"))
+        throw invalid();
+      return [key2, copy(descriptor.value, depth + 1)];
+    }));
+  }
+  let result;
+  try {
+    result = copy(value, 0);
+  } catch {
+    throw invalid();
+  }
+  if (typeof result !== "object" || result === null || Array.isArray(result))
+    throw invalid();
+  const record2 = result;
+  if (!Object.hasOwn(record2, "client_id") || typeof record2.client_id !== "string" || record2.client_id.trim() === "")
+    throw new Error("OAuth client registration response missing client_id");
+  for (const key2 of [
+    "client_id",
+    "client_secret",
+    "token_endpoint_auth_method",
+    "application_type",
+    "client_name",
+    "client_uri",
+    "logo_uri",
+    "scope",
+    "tos_uri",
+    "policy_uri",
+    "jwks_uri",
+    "software_id",
+    "software_version",
+    "software_statement",
+    "registration_access_token",
+    "registration_client_uri",
+    "issuer"
+  ]) {
+    if (Object.hasOwn(record2, key2) && record2[key2] !== null && typeof record2[key2] !== "string")
+      throw invalid();
+  }
+  if (typeof record2.client_secret === "string" && record2.client_secret.trim() === "")
+    throw invalid();
+  for (const key2 of ["redirect_uris", "grant_types", "response_types", "contacts"]) {
+    const entry = record2[key2];
+    if (Object.hasOwn(record2, key2) && entry !== null && (!Array.isArray(entry) || entry.some((item) => typeof item !== "string")))
+      throw invalid();
+  }
+  for (const key2 of ["client_id_issued_at", "client_secret_expires_at"]) {
+    const entry = record2[key2];
+    if (Object.hasOwn(record2, key2) && entry !== null && (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0))
+      throw invalid();
+  }
+  try {
+    normalizeOAuthScope(Object.hasOwn(record2, "scope") && record2.scope !== null ? record2.scope : void 0);
+  } catch {
+    throw invalid();
+  }
+  if (Buffer.byteLength(JSON.stringify(record2), "utf8") > 64 * 1024)
+    throw invalid();
+  return record2;
+}
+function normalizeStoredOAuthClient(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return null;
+  const record2 = value;
+  const clientId = Object.hasOwn(record2, "clientId") ? record2.clientId : void 0;
+  const clientSecret = Object.hasOwn(record2, "clientSecret") ? record2.clientSecret : void 0;
+  if (typeof clientId !== "string" || clientId.trim() === "" || clientSecret !== void 0 && (typeof clientSecret !== "string" || clientSecret.trim() === ""))
+    return null;
+  const client = { clientId: clientId.trim(), ...clientSecret === void 0 ? {} : { clientSecret: clientSecret.trim() } };
+  const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record2, "tokenEndpointAuthMethod") ? record2.tokenEndpointAuthMethod : void 0);
+  if (Object.hasOwn(record2, "registration") && record2.registration !== void 0) {
+    const registration = parseOAuthClientRegistration(record2.registration);
+    const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : void 0;
+    if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
+      throw new Error("OAuth client registration does not match the client identity");
+    client.registration = registration;
+    const registrationMethod = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(registration, "token_endpoint_auth_method") ? registration.token_endpoint_auth_method : void 0);
+    if (method !== void 0 && registrationMethod !== void 0 && method !== registrationMethod)
+      throw new Error("OAuth token endpoint authentication conflicts with the client registration");
+    if (registrationMethod !== void 0)
+      client.tokenEndpointAuthMethod = registrationMethod;
+  }
+  if (method !== void 0)
+    client.tokenEndpointAuthMethod = method;
+  return client;
+}
+
 // ../mcp-oauth/dist/client/auth-store-session-store.js
 import crypto from "node:crypto";
 import path4 from "node:path";
@@ -4128,14 +4263,8 @@ function createAuthStoreClientStore(options, namespace) {
       } catch {
         throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
       }
-      const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : void 0;
-      if (clientId !== void 0) {
-        const client = { clientId };
-        if (isObjectRecord(parsed) && Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
-          client.clientSecret = getOwnEntry3(parsed, "clientSecret");
-        }
-        return client;
-      }
+      if (isObjectRecord(parsed) && typeof getOwnEntry3(parsed, "clientId") === "string")
+        return parsed;
       throw new Error("Stored OAuth client must be a JSON object with clientId");
     },
     async save(issuer, client) {
@@ -4201,14 +4330,7 @@ function isStoredOAuthSession(value) {
   if (!isObjectRecord(value)) {
     return false;
   }
-  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && isStoredOAuthClient(getOwnEntry3(value, "client")) && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "requestedScope") === void 0 || isNonBlankOwnString(value, "requestedScope")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
-}
-function isStoredOAuthClient(value) {
-  if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
-    return false;
-  }
-  const clientSecret = getOwnEntry3(value, "clientSecret");
-  return clientSecret === void 0 || typeof clientSecret === "string" && clientSecret.trim().length > 0;
+  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && normalizeStoredOAuthClient(getOwnEntry3(value, "client")) !== null && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "requestedScope") === void 0 || isNonBlankOwnString(value, "requestedScope")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
 }
 function isStoredOAuthDiscovery(value) {
   if (!isObjectRecord(value)) {
@@ -4242,16 +4364,6 @@ function isNonBlankOwnString(record2, key2) {
   return value !== void 0 && value.trim().length > 0;
 }
 
-// ../mcp-oauth/dist/client/scope.js
-function normalizeOAuthScope(scope) {
-  if (scope === void 0)
-    return void 0;
-  if (typeof scope !== "string" || [...scope].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
-    throw new Error("Invalid OAuth scope syntax");
-  const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
-  return normalized || void 0;
-}
-
 // ../mcp-oauth/dist/client/default-oauth-client-provider.js
 import { isIP } from "node:net";
 
@@ -4665,6 +4777,7 @@ async function exchangeAuthorizationCode(input) {
     tokenEndpoint: input.tokenEndpoint,
     clientId: input.clientId,
     clientSecret: input.clientSecret,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
     params: {
       grant_type: "authorization_code",
       code: input.code,
@@ -4683,6 +4796,7 @@ async function refreshAccessToken(input) {
     tokenEndpoint: input.tokenEndpoint,
     clientId: input.clientId,
     clientSecret: input.clientSecret,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
     params: {
       grant_type: "refresh_token",
       refresh_token: input.refreshToken,
@@ -4694,21 +4808,26 @@ async function refreshAccessToken(input) {
   });
 }
 async function requestTokens(input) {
-  const body = new URLSearchParams({
-    client_id: input.clientId,
-    ...input.params
-  });
-  if (input.clientSecret !== void 0) {
-    body.set("client_secret", input.clientSecret);
+  const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ?? (input.clientSecret === void 0 ? "none" : "client_secret_post");
+  if (method !== "none" && (input.clientSecret === void 0 || input.clientSecret.trim() === ""))
+    throw new Error("OAuth token endpoint authentication requires a client secret");
+  const body = new URLSearchParams(input.params);
+  const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
+  if (method === "client_secret_basic") {
+    const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
+    const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
+    headers.set("Authorization", `Basic ${Buffer.from(`${encoded}:${encodedSecret}`).toString("base64")}`);
+  } else {
+    body.set("client_id", input.clientId);
+    if (method === "client_secret_post")
+      body.set("client_secret", input.clientSecret);
   }
   input.signal?.throwIfAborted();
   const deadline = AbortSignal.timeout(3e4);
   const signal = input.signal === void 0 ? deadline : AbortSignal.any([input.signal, deadline]);
   const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
+    headers,
     body: body.toString(),
     signal
   });
@@ -4861,6 +4980,9 @@ function createDefaultOAuthClientProvider(options) {
   assertPersistenceNamespace(options.persistenceNamespace);
   const clientMetadata = getClientMetadata(options.client);
   const requestedScope = clientMetadata?.scope;
+  const configuredClient = normalizeConfiguredClient(options.client);
+  const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
+  const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
   const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
   const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
   const now = options.now ?? Date.now;
@@ -4878,7 +5000,7 @@ function createDefaultOAuthClientProvider(options) {
   const initialGrant = options.initialGrant === void 0 ? void 0 : {
     resource: canonicalizeResourceIndicator(options.initialGrant.resource),
     tokens: normalizeStoredTokens(options.initialGrant.tokens),
-    client: normalizeConfiguredClient(options.client)
+    client: configuredClient
   };
   if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
     throw new Error("OAuth initial grant requires valid tokens and the original client ID");
@@ -4982,13 +5104,15 @@ function createDefaultOAuthClientProvider(options) {
       if (forceRefresh && rejectedTokens !== void 0 && (rejectedTokens === null || session?.tokens === void 0 || !sameTokenGrant(session.tokens, rejectedTokens)))
         forceRefresh = false;
       const sessionDiscovery = resolveDiscovery(discovery, session);
-      if ((options.client.mode === "static" || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
-        const configured = normalizeConfiguredClient(options.client);
+      if ((options.client.mode === "static" || configuredClient?.registration !== void 0 || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
+        const configured = configuredClient;
         if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
           throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
       }
       if (requestedScope !== void 0 && session?.tokens !== void 0 && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
         throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
+      if (configuredTokenMethod !== void 0 && session !== null && (session.tokens !== void 0 || session.refreshState === "pending") && (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === void 0 ? "none" : "client_secret_post")) !== configuredTokenMethod)
+        throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
       if (session?.refreshState === "pending") {
         if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === void 0)
           throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -5021,6 +5145,7 @@ function createDefaultOAuthClientProvider(options) {
     if (session.tokens?.refreshToken === void 0) {
       return session;
     }
+    assertTokenEndpointAuthentication(session.client, discovery.authorizationServerMetadata);
     const pendingSession = { ...clearSessionTokens(session), refreshState: "pending" };
     await saveSession(resource, pendingSession);
     signal?.throwIfAborted();
@@ -5032,6 +5157,7 @@ function createDefaultOAuthClientProvider(options) {
           tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
           clientId: session.client.clientId,
           clientSecret: session.client.clientSecret,
+          tokenEndpointAuthMethod: session.client.tokenEndpointAuthMethod,
           refreshToken: session.tokens.refreshToken,
           resource,
           fetch: fetch2,
@@ -5095,6 +5221,7 @@ function createDefaultOAuthClientProvider(options) {
       let resolvedClient = null;
       try {
         resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch2, signal);
+        assertTokenEndpointAuthentication(resolvedClient.client, discovery.authorizationServerMetadata);
         const sessionWithoutTokens = {
           resource,
           authorizationServer: discovery.authorizationServer,
@@ -5118,6 +5245,7 @@ function createDefaultOAuthClientProvider(options) {
           tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
           clientId: resolvedClient.client.clientId,
           clientSecret: resolvedClient.client.clientSecret,
+          tokenEndpointAuthMethod: resolvedClient.client.tokenEndpointAuthMethod,
           code,
           codeVerifier: verifier,
           redirectUri: loopback.redirectUri,
@@ -5157,8 +5285,7 @@ function createDefaultOAuthClientProvider(options) {
   }
   async function resolveClient(existingSession, discovery, redirectUri, fetch2, parentSignal) {
     parentSignal?.throwIfAborted();
-    const configuredClient = normalizeConfiguredClient(options.client);
-    if (options.client.mode === "static") {
+    if (options.client.mode === "static" || configuredClient?.registration !== void 0) {
       if (configuredClient === null) {
         throw new Error("OAuth client_id must not be blank");
       }
@@ -5205,7 +5332,11 @@ function createDefaultOAuthClientProvider(options) {
         };
       }
     }
-    const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri);
+    const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
+    const registrationMethod = requestedTokenMethod ?? (supported === void 0 ? "none" : ["none", "client_secret_basic", "client_secret_post"].find((method) => supported.includes(method)));
+    if (registrationMethod === void 0 || supported !== void 0 && !supported.includes(registrationMethod))
+      throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+    const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri, registrationMethod);
     const deadline = AbortSignal.timeout(3e4);
     const signal = parentSignal === void 0 ? deadline : AbortSignal.any([parentSignal, deadline]);
     const response = await fetchMcpResponse(fetch2, registrationEndpoint, {
@@ -5217,14 +5348,14 @@ function createDefaultOAuthClientProvider(options) {
       signal
     });
     const payload = await readOAuthJsonObjectResponse(response, signal);
-    const clientId = getOwnString2(payload, "client_id");
-    if (clientId === void 0 || clientId.trim().length === 0) {
-      throw new Error("OAuth client registration response missing client_id");
-    }
-    const clientSecret = getOwnString2(payload, "client_secret");
+    const registration = parseOAuthClientRegistration(payload);
+    const registeredSecret = getOwnString2(registration, "client_secret");
+    const responseMethod = normalizeOAuthTokenEndpointAuthMethod(getOwnEntry6(registration, "token_endpoint_auth_method")) ?? requestedTokenMethod ?? (supported === void 0 ? void 0 : normalizeOAuthTokenEndpointAuthMethod(registrationMethod));
     const registeredClient = {
-      clientId: clientId.trim(),
-      clientSecret: clientSecret !== void 0 && clientSecret.trim().length > 0 ? clientSecret.trim() : void 0
+      clientId: registration.client_id.trim(),
+      ...registeredSecret === void 0 ? {} : { clientSecret: registeredSecret.trim() },
+      ...responseMethod === void 0 ? {} : { tokenEndpointAuthMethod: responseMethod },
+      registration
     };
     await saveRegisteredClient(discovery.authorizationServer, registeredClient);
     return {
@@ -5237,7 +5368,7 @@ function createDefaultOAuthClientProvider(options) {
     return normalizeLoadedSession(await sessionStore.load(resource));
   }
   async function saveSession(resource, session) {
-    await sessionStore.save(resource, session);
+    await sessionStore.save(resource, structuredClone(session));
   }
   async function clearSession(resource) {
     await sessionStore.clear(resource);
@@ -5250,7 +5381,7 @@ function createDefaultOAuthClientProvider(options) {
       return null;
     }
     const client = await clientStore.load(issuer);
-    const normalizedClient = client === null ? null : normalizeStoredClient(client);
+    const normalizedClient = client === null ? null : normalizeStoredOAuthClient(client);
     if (client !== null && normalizedClient === null) {
       await clientStore.clear(issuer);
       return null;
@@ -5323,7 +5454,7 @@ function normalizeLoadedSession(session) {
   const refreshState = getOwnEntry6(session, "refreshState");
   if (refreshState !== void 0 && (refreshState !== "pending" || getOwnEntry6(session, "tokens") !== void 0))
     throw new Error("Stored OAuth refresh state is invalid");
-  const client = normalizeStoredClient(getOwnEntry6(session, "client"));
+  const client = normalizeStoredOAuthClient(getOwnEntry6(session, "client"));
   if (client === null) {
     return { ...session, client: { clientId: "" }, tokens: void 0 };
   }
@@ -5333,25 +5464,6 @@ function normalizeLoadedSession(session) {
     tokens: normalizeStoredTokens(getOwnEntry6(session, "tokens"))
   };
 }
-function normalizeStoredClient(value) {
-  if (!isObjectRecord3(value)) {
-    return null;
-  }
-  const clientId = getOwnString2(value, "clientId");
-  if (clientId === void 0 || clientId.trim().length === 0) {
-    return null;
-  }
-  const normalizedClientId = clientId.trim();
-  const clientSecret = getOwnEntry6(value, "clientSecret");
-  if (clientSecret === void 0) {
-    return { clientId: normalizedClientId };
-  }
-  if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
-    return null;
-  }
-  const normalizedClientSecret = clientSecret.trim();
-  return { clientId: normalizedClientId, clientSecret: normalizedClientSecret };
-}
 function normalizeStoredTokens(value) {
   if (value === void 0 || !isObjectRecord3(value)) {
     return void 0;
@@ -5387,12 +5499,12 @@ function getClientMetadata(client) {
   };
 }
 function normalizeConfiguredClient(client) {
-  const clientId = normalizeOptionalOAuthString(client.clientId);
-  if (clientId === void 0) {
+  const registration = client.registration === void 0 ? void 0 : parseOAuthClientRegistration(client.registration);
+  const clientId = normalizeOptionalOAuthString(client.clientId) ?? registration?.client_id.trim();
+  if (clientId === void 0)
     return null;
-  }
-  const clientSecret = normalizeOptionalOAuthString(client.clientSecret);
-  return clientSecret === void 0 ? { clientId } : { clientId, clientSecret };
+  const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === void 0 ? void 0 : getOwnString2(registration, "client_secret")?.trim());
+  return normalizeStoredOAuthClient({ clientId, clientSecret, registration, tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
 }
 function normalizeOptionalOAuthString(value) {
   if (value === void 0) {
@@ -5492,12 +5604,28 @@ function assertRequestMatchesResource(requestUrl, resource) {
     throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
   }
 }
-function buildClientRegistrationBody(metadata, redirectUri) {
+function getSupportedTokenAuthMethods(metadata) {
+  const value = getOwnEntry6(metadata, "token_endpoint_auth_methods_supported");
+  if (value === void 0)
+    return void 0;
+  if (!Array.isArray(value) || value.length > 128 || value.some((method) => typeof method !== "string"))
+    throw new Error("Invalid OAuth token endpoint authentication metadata");
+  return value;
+}
+function assertTokenEndpointAuthentication(client, metadata) {
+  const method = client.tokenEndpointAuthMethod ?? (client.clientSecret === void 0 ? "none" : "client_secret_post");
+  if (method !== "none" && client.clientSecret === void 0)
+    throw new Error("OAuth token endpoint authentication requires a client secret");
+  const supported = getSupportedTokenAuthMethods(metadata);
+  if (supported !== void 0 && !supported.includes(method))
+    throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+}
+function buildClientRegistrationBody(metadata, redirectUri, tokenEndpointAuthMethod) {
   const body = {
     redirect_uris: [redirectUri],
     grant_types: ["authorization_code", "refresh_token"],
     response_types: ["code"],
-    token_endpoint_auth_method: "none"
+    token_endpoint_auth_method: tokenEndpointAuthMethod
   };
   const clientName = metadata === void 0 ? void 0 : getOwnString2(metadata, "clientName");
   const scope = metadata === void 0 ? void 0 : getOwnString2(metadata, "scope");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",