tiny-http-mcp-server 0.1.33 → 0.1.35

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.33",
+      "version": "0.1.35",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -106,8 +106,13 @@ Select a separate persistence namespace for another scope profile. No scope is
 invented when the client does not configure one.
 
 Imported `initialGrant.tokens` use `accessToken`, optional `refreshToken`,
-`tokenType: "Bearer"`, `expiresAt` (Unix epoch milliseconds or `null` if unknown),
-and optional `scope`. A fresh imported token is used only for its resource.
+`tokenType: "Bearer"`, optional `expiresAt` (Unix epoch milliseconds or `null`
+if unknown), and optional `scope`. `expiresIn` is a lifetime in seconds and is
+anchored once at import. For a delayed import, provide the original `issuedAt`
+in epoch milliseconds or its real absolute `expiresAt`; a numeric absolute
+expiry takes precedence. Without either, the relative value means remaining
+lifetime at import. Omitted expiry stays unknown. A fresh imported token is
+used only for its resource.
 Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
@@ -119,6 +124,24 @@ Explicit ID/secret values must agree with the imported response. Sessions and
 native registration stores retain arrays, issuance/expiry timestamps and JSON
 provider metadata. Registration input is copied, bounded to 64 KiB and 64
 levels, and rejects invalid standard field types and non-JSON extensions.
+An optional registration `issuer` must match discovery and the persisted
+authorization server exactly. Contradictory metadata fails without activating
+or redeeming the grant. `client_secret_expires_at` uses Unix epoch seconds;
+zero means no expiry. Live access tokens remain usable after secret expiry,
+but an expired secret is never submitted for refresh. Native DCR can replace
+an expired registration during explicit authorization; caller-owned imports
+must be updated. Headless requests retain the old record and report recovery
+is required without creating a pending refresh marker.
+Set `client.tokenEndpointAuthMethod` to `none`, `client_secret_post` or
+`client_secret_basic`; a full registration can supply the same field as
+`token_endpoint_auth_method`. Public clients never transmit a stored secret.
+Basic credentials are individually form-encoded before Base64 encoding and
+are omitted from the form body. Cached grants retain their registered method;
+an explicitly different configured method requires separate persistence or a
+reset. Native DCR chooses a supported method, preferring public PKCE when
+advertised. Unsupported methods and missing confidential secrets fail before
+token requests. Existing clients without a method keep the previous default:
+body authentication when a secret is present, public authentication otherwise.
 Static clients and dynamic initial-grant imports require cached grants to match
 the original normalized client ID and secret. A different client configuration
 fails before attaching or refreshing credentials and retains the stored record;

package/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -1,4 +1,5 @@
 import { normalizeOAuthScope } from "./scope.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 /** Validate and copy a bounded JSON DCR response without quoting credential input. */
 export function parseOAuthClientRegistration(value) {
     const invalid = () => new Error("Invalid OAuth client registration metadata");
@@ -83,12 +84,20 @@ export function normalizeStoredOAuthClient(value) {
         (clientSecret !== undefined && (typeof clientSecret !== "string" || clientSecret.trim() === "")))
         return null;
     const client = { clientId: clientId.trim(), ...(clientSecret === undefined ? {} : { clientSecret: clientSecret.trim() }) };
+    const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record, "tokenEndpointAuthMethod") ? record.tokenEndpointAuthMethod : undefined);
     if (Object.hasOwn(record, "registration") && record.registration !== undefined) {
         const registration = parseOAuthClientRegistration(record.registration);
         const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : undefined;
         if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
             throw new Error("OAuth client registration does not match the client identity");
         client.registration = registration;
+        const registrationMethod = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(registration, "token_endpoint_auth_method") ? registration.token_endpoint_auth_method : undefined);
+        if (method !== undefined && registrationMethod !== undefined && method !== registrationMethod)
+            throw new Error("OAuth token endpoint authentication conflicts with the client registration");
+        if (registrationMethod !== undefined)
+            client.tokenEndpointAuthMethod = registrationMethod;
     }
+    if (method !== undefined)
+        client.tokenEndpointAuthMethod = method;
     return client;
 }

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,5 +1,6 @@
 import { normalizeStoredOAuthClient, parseOAuthClientRegistration } from "./client-registration.js";
 import { normalizeOAuthScope } from "./scope.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
@@ -23,6 +24,8 @@ export function createDefaultOAuthClientProvider(options) {
     const clientMetadata = getClientMetadata(options.client);
     const requestedScope = clientMetadata?.scope;
     const configuredClient = normalizeConfiguredClient(options.client);
+    const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
+    const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
     const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
     const now = options.now ?? Date.now;
@@ -40,7 +43,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
     const initialGrant = options.initialGrant === undefined ? undefined : {
         resource: canonicalizeResourceIndicator(options.initialGrant.resource),
-        tokens: normalizeStoredTokens(options.initialGrant.tokens),
+        tokens: normalizeImportedTokens(options.initialGrant.tokens, now),
         client: configuredClient
     };
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
@@ -124,6 +127,10 @@ export function createDefaultOAuthClientProvider(options) {
         const canonicalResource = canonicalizeResourceIndicator(resource);
         return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
             let session = await loadSession(canonicalResource);
+            if (session !== null)
+                assertRegistrationIssuer(session.client, session.authorizationServer);
+            if (configuredClient !== null && discovery !== undefined)
+                assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
             if (session !== null && initialGrant?.resource === canonicalResource)
                 initialGrantConsumed = true;
             signal?.throwIfAborted();
@@ -156,6 +163,9 @@ export function createDefaultOAuthClientProvider(options) {
             }
             if (requestedScope !== undefined && session?.tokens !== undefined && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
                 throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
+            if (configuredTokenMethod !== undefined && session !== null && (session.tokens !== undefined || session.refreshState === "pending") &&
+                (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === undefined ? "none" : "client_secret_post")) !== configuredTokenMethod)
+                throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
             if (session?.refreshState === "pending") {
                 if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === undefined)
                     throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -167,6 +177,11 @@ export function createDefaultOAuthClientProvider(options) {
             if (session?.tokens?.refreshToken !== undefined &&
                 sessionDiscovery !== undefined &&
                 (forceRefresh || isExpired(session.tokens, now))) {
+                if (hasExpiredClientSecret(session.client, now)) {
+                    if (!allowInteractive || options.allowInteractive === false || options.client.mode === "static" || configuredClient?.registration !== undefined)
+                        throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
+                    return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch, signal);
+                }
                 session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch, signal);
                 if (session?.tokens !== undefined && !isExpired(session.tokens, now)) {
                     return session;
@@ -190,6 +205,7 @@ export function createDefaultOAuthClientProvider(options) {
         if (session.tokens?.refreshToken === undefined) {
             return session;
         }
+        assertTokenEndpointAuthentication(session.client, discovery.authorizationServerMetadata);
         const pendingSession = { ...clearSessionTokens(session), refreshState: "pending" };
         await saveSession(resource, pendingSession);
         signal?.throwIfAborted();
@@ -201,6 +217,7 @@ export function createDefaultOAuthClientProvider(options) {
                     tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
                     clientId: session.client.clientId,
                     clientSecret: session.client.clientSecret,
+                    tokenEndpointAuthMethod: session.client.tokenEndpointAuthMethod,
                     refreshToken: session.tokens.refreshToken,
                     resource,
                     fetch, signal,
@@ -266,6 +283,7 @@ export function createDefaultOAuthClientProvider(options) {
             let resolvedClient = null;
             try {
                 resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch, signal);
+                assertTokenEndpointAuthentication(resolvedClient.client, discovery.authorizationServerMetadata);
                 const sessionWithoutTokens = {
                     resource,
                     authorizationServer: discovery.authorizationServer,
@@ -289,6 +307,7 @@ export function createDefaultOAuthClientProvider(options) {
                     tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
                     clientId: resolvedClient.client.clientId,
                     clientSecret: resolvedClient.client.clientSecret,
+                    tokenEndpointAuthMethod: resolvedClient.client.tokenEndpointAuthMethod,
                     code,
                     codeVerifier: verifier,
                     redirectUri: loopback.redirectUri,
@@ -333,6 +352,9 @@ export function createDefaultOAuthClientProvider(options) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }
+            assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(configuredClient, now))
+                throw new Error("OAuth client secret has expired; update the imported registration");
             return {
                 kind: "static",
                 fromStoredRegistration: false,
@@ -347,7 +369,14 @@ export function createDefaultOAuthClientProvider(options) {
                 client: configuredClient
             };
         }
-        const storedClient = await loadRegisteredClient(discovery.authorizationServer);
+        let storedClient = await loadRegisteredClient(discovery.authorizationServer);
+        if (storedClient !== null) {
+            assertRegistrationIssuer(storedClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(storedClient, now)) {
+                await clearRegisteredClient(discovery.authorizationServer);
+                storedClient = null;
+            }
+        }
         if (storedClient !== null) {
             return {
                 kind: "dynamic",
@@ -356,7 +385,7 @@ export function createDefaultOAuthClientProvider(options) {
             };
         }
         if (registrationEndpoint === undefined) {
-            if (existingSession !== null && existingSession.client.clientId.length > 0) {
+            if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now)) {
                 return {
                     kind: "dynamic",
                     fromStoredRegistration: true,
@@ -365,7 +394,7 @@ export function createDefaultOAuthClientProvider(options) {
             }
             throw new Error("Authorization server metadata is missing registration_endpoint");
         }
-        if (existingSession !== null && existingSession.client.clientId.length > 0) {
+        if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now)) {
             const isConfiguredStaticFallback = configuredClient !== null &&
                 existingSession.client.clientId === configuredClient.clientId &&
                 existingSession.client.clientSecret === configuredClient.clientSecret;
@@ -378,7 +407,12 @@ export function createDefaultOAuthClientProvider(options) {
                 };
             }
         }
-        const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri);
+        const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
+        const registrationMethod = requestedTokenMethod ?? (supported === undefined ? "none" :
+            ["none", "client_secret_basic", "client_secret_post"].find(method => supported.includes(method)));
+        if (registrationMethod === undefined || (supported !== undefined && !supported.includes(registrationMethod)))
+            throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+        const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri, registrationMethod);
         const deadline = AbortSignal.timeout(30_000);
         const signal = parentSignal === undefined ? deadline : AbortSignal.any([parentSignal, deadline]);
         const response = await fetchMcpResponse(fetch, registrationEndpoint, {
@@ -392,11 +426,17 @@ export function createDefaultOAuthClientProvider(options) {
         const payload = await readOAuthJsonObjectResponse(response, signal);
         const registration = parseOAuthClientRegistration(payload);
         const registeredSecret = getOwnString(registration, "client_secret");
+        const responseMethod = normalizeOAuthTokenEndpointAuthMethod(getOwnEntry(registration, "token_endpoint_auth_method")) ??
+            requestedTokenMethod ?? (supported === undefined ? undefined : normalizeOAuthTokenEndpointAuthMethod(registrationMethod));
         const registeredClient = {
             clientId: registration.client_id.trim(),
             ...(registeredSecret === undefined ? {} : { clientSecret: registeredSecret.trim() }),
+            ...(responseMethod === undefined ? {} : { tokenEndpointAuthMethod: responseMethod }),
             registration
         };
+        assertRegistrationIssuer(registeredClient, discovery.authorizationServer);
+        if (hasExpiredClientSecret(registeredClient, now))
+            throw new Error("OAuth client secret has expired in the registration response");
         await saveRegisteredClient(discovery.authorizationServer, registeredClient);
         return {
             kind: "dynamic",
@@ -408,7 +448,7 @@ export function createDefaultOAuthClientProvider(options) {
         return normalizeLoadedSession(await sessionStore.load(resource));
     }
     async function saveSession(resource, session) {
-        await sessionStore.save(resource, session);
+        await sessionStore.save(resource, structuredClone(session));
     }
     async function clearSession(resource) {
         await sessionStore.clear(resource);
@@ -510,6 +550,21 @@ function normalizeLoadedSession(session) {
         tokens: normalizeStoredTokens(getOwnEntry(session, "tokens"))
     };
 }
+function normalizeImportedTokens(value, now) {
+    if (!isObjectRecord(value))
+        return undefined;
+    const absolute = getOwnEntry(value, "expiresAt");
+    const lifetime = getOwnEntry(value, "expiresIn");
+    const issuedAt = getOwnEntry(value, "issuedAt");
+    if (lifetime !== undefined && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
+        throw new Error("OAuth initial grant has invalid relative expiry");
+    if (issuedAt !== undefined && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) ||
+        Math.abs(issuedAt) > MAX_JS_DATE_MS))
+        throw new Error("OAuth initial grant has invalid issuance time");
+    const expiresAt = absolute !== undefined && absolute !== null ? absolute :
+        lifetime === undefined ? null : (issuedAt === undefined ? now() : issuedAt) + lifetime * 1000;
+    return normalizeStoredTokens({ ...value, expiresAt });
+}
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {
         return undefined;
@@ -564,7 +619,7 @@ function normalizeConfiguredClient(client) {
     if (clientId === undefined)
         return null;
     const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === undefined ? undefined : getOwnString(registration, "client_secret")?.trim());
-    return normalizeStoredOAuthClient({ clientId, clientSecret, registration });
+    return normalizeStoredOAuthClient({ clientId, clientSecret, registration, tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
 }
 function normalizeOptionalOAuthString(value) {
     if (value === undefined) {
@@ -671,12 +726,39 @@ function assertRequestMatchesResource(requestUrl, resource) {
         throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
     }
 }
-function buildClientRegistrationBody(metadata, redirectUri) {
+function assertRegistrationIssuer(client, issuer) {
+    const registrationIssuer = client.registration === undefined ? undefined : getOwnString(client.registration, "issuer");
+    if (registrationIssuer !== undefined && registrationIssuer !== issuer)
+        throw new Error("OAuth client registration issuer does not match the authorization server");
+}
+function hasExpiredClientSecret(client, now) {
+    if (client.clientSecret === undefined || client.tokenEndpointAuthMethod === "none" || client.registration === undefined)
+        return false;
+    const expiry = getOwnEntry(client.registration, "client_secret_expires_at");
+    return typeof expiry === "number" && expiry !== 0 && expiry <= now() / 1000;
+}
+function getSupportedTokenAuthMethods(metadata) {
+    const value = getOwnEntry(metadata, "token_endpoint_auth_methods_supported");
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length > 128 || value.some(method => typeof method !== "string"))
+        throw new Error("Invalid OAuth token endpoint authentication metadata");
+    return value;
+}
+function assertTokenEndpointAuthentication(client, metadata) {
+    const method = client.tokenEndpointAuthMethod ?? (client.clientSecret === undefined ? "none" : "client_secret_post");
+    if (method !== "none" && client.clientSecret === undefined)
+        throw new Error("OAuth token endpoint authentication requires a client secret");
+    const supported = getSupportedTokenAuthMethods(metadata);
+    if (supported !== undefined && !supported.includes(method))
+        throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+}
+function buildClientRegistrationBody(metadata, redirectUri, tokenEndpointAuthMethod) {
     const body = {
         redirect_uris: [redirectUri],
         grant_types: ["authorization_code", "refresh_token"],
         response_types: ["code"],
-        token_endpoint_auth_method: "none"
+        token_endpoint_auth_method: tokenEndpointAuthMethod
     };
     const clientName = metadata === undefined ? undefined : getOwnString(metadata, "clientName");
     const scope = metadata === undefined ? undefined : getOwnString(metadata, "scope");

package/node_modules/mcp-oauth/dist/client/token-auth-method.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthTokenEndpointAuthMethod } from "./types.js";
+export declare function normalizeOAuthTokenEndpointAuthMethod(value: unknown): OAuthTokenEndpointAuthMethod | undefined;

package/node_modules/mcp-oauth/dist/client/token-auth-method.js

@@ -0,0 +1,7 @@
+export function normalizeOAuthTokenEndpointAuthMethod(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
+        throw new Error("Unsupported OAuth token endpoint authentication method");
+    return value;
+}

package/node_modules/mcp-oauth/dist/client/token-endpoint.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthMetadataFetch, StoredOAuthTokens } from "./types.js";
+import type { OAuthMetadataFetch, StoredOAuthTokens, OAuthTokenEndpointAuthMethod } from "./types.js";
 interface OAuthErrorShape {
     error: string;
     error_description?: string;
@@ -22,6 +22,7 @@ export declare function exchangeAuthorizationCode(input: {
     tokenEndpoint: string;
     clientId: string;
     clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     code: string;
     codeVerifier: string;
     redirectUri: string;
@@ -34,6 +35,7 @@ export declare function refreshAccessToken(input: {
     tokenEndpoint: string;
     clientId: string;
     clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     refreshToken: string;
     resource: string;
     fetch: OAuthMetadataFetch;

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -1,3 +1,4 @@
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 import { readBoundedResponseText } from "../http-response.js";
 import { fetchMcpResponse } from "../http-fetch.js";
@@ -40,6 +41,7 @@ export async function exchangeAuthorizationCode(input) {
         tokenEndpoint: input.tokenEndpoint,
         clientId: input.clientId,
         clientSecret: input.clientSecret,
+        tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
         params: {
             grant_type: "authorization_code",
             code: input.code,
@@ -58,6 +60,7 @@ export async function refreshAccessToken(input) {
         tokenEndpoint: input.tokenEndpoint,
         clientId: input.clientId,
         clientSecret: input.clientSecret,
+        tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
         params: {
             grant_type: "refresh_token",
             refresh_token: input.refreshToken,
@@ -69,21 +72,28 @@ export async function refreshAccessToken(input) {
     });
 }
 async function requestTokens(input) {
-    const body = new URLSearchParams({
-        client_id: input.clientId,
-        ...input.params
-    });
-    if (input.clientSecret !== undefined) {
-        body.set("client_secret", input.clientSecret);
+    const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ??
+        (input.clientSecret === undefined ? "none" : "client_secret_post");
+    if (method !== "none" && (input.clientSecret === undefined || input.clientSecret.trim() === ""))
+        throw new Error("OAuth token endpoint authentication requires a client secret");
+    const body = new URLSearchParams(input.params);
+    const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
+    if (method === "client_secret_basic") {
+        const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
+        const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
+        headers.set("Authorization", `Basic ${Buffer.from(`${encoded}:${encodedSecret}`).toString("base64")}`);
+    }
+    else {
+        body.set("client_id", input.clientId);
+        if (method === "client_secret_post")
+            body.set("client_secret", input.clientSecret);
     }
     input.signal?.throwIfAborted();
     const deadline = AbortSignal.timeout(30_000);
     const signal = input.signal === undefined ? deadline : AbortSignal.any([input.signal, deadline]);
     const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
         method: "POST",
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded"
-        },
+        headers,
         body: body.toString(),
         signal
     });

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -70,6 +70,14 @@ export interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Import-time lifetimes are normalized once into persisted epoch milliseconds. */
+export interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
+    expiresAt?: number | null;
+    /** Remaining lifetime at import, or total lifetime when issuedAt is provided. */
+    expiresIn?: number;
+    /** Original issuance time in Unix epoch milliseconds. */
+    issuedAt?: number;
+}
 /** Full RFC 7591 response, including JSON provider extensions. */
 export interface OAuthClientRegistration extends Record<string, unknown> {
     client_id: string;
@@ -86,7 +94,9 @@ export interface StoredOAuthClient {
     clientId: string;
     clientSecret?: string;
     registration?: OAuthClientRegistration;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
 }
+export type OAuthTokenEndpointAuthMethod = "none" | "client_secret_post" | "client_secret_basic";
 export interface StoredOAuthSession {
     resource: string;
     authorizationServer: string;
@@ -120,12 +130,14 @@ export interface DefaultOAuthClientProviderOptions {
         metadata?: OAuthClientMetadata;
         /** Import a complete registration owned by the caller. */
         registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
         registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
@@ -136,7 +148,7 @@ export interface DefaultOAuthClientProviderOptions {
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;
-        tokens: StoredOAuthTokens;
+        tokens: ImportedOAuthTokens;
     };
     browser: {
         openBrowser?(url: string): Promise<void>;

package/node_modules/mcp-oauth/dist/index.d.ts

@@ -6,7 +6,7 @@ export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";
 export { OAuthError, } from "./client/token-endpoint.js";
 export { canonicalizeResourceIndicator, } from "./resource-indicator.js";
 export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
-export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, } from "./client/types.js";
+export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, OAuthTokenEndpointAuthMethod, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, ImportedOAuthTokens, } from "./client/types.js";
 export type { JwksTokenVerifier, JwksTokenVerifierOptions, JwksVerifiedAccessToken, } from "./server/jwks-token-verifier.js";
 export type { LoopbackAuthorizationOptions, LoopbackAuthorizationSession, OAuthLandingPage, } from "./client/loopback-authorization.js";
 export { readBoundedResponseText } from "./http-response.js";

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -173,6 +173,14 @@ interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Import-time lifetimes are normalized once into persisted epoch milliseconds. */
+interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
+    expiresAt?: number | null;
+    /** Remaining lifetime at import, or total lifetime when issuedAt is provided. */
+    expiresIn?: number;
+    /** Original issuance time in Unix epoch milliseconds. */
+    issuedAt?: number;
+}
 /** Full RFC 7591 response, including JSON provider extensions. */
 interface OAuthClientRegistration extends Record<string, unknown> {
     client_id: string;
@@ -189,7 +197,9 @@ interface StoredOAuthClient {
     clientId: string;
     clientSecret?: string;
     registration?: OAuthClientRegistration;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
 }
+type OAuthTokenEndpointAuthMethod = "none" | "client_secret_post" | "client_secret_basic";
 interface StoredOAuthSession {
     resource: string;
     authorizationServer: string;
@@ -223,12 +233,14 @@ interface DefaultOAuthClientProviderOptions {
         metadata?: OAuthClientMetadata;
         /** Import a complete registration owned by the caller. */
         registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
         registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
@@ -239,7 +251,7 @@ interface DefaultOAuthClientProviderOptions {
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;
-        tokens: StoredOAuthTokens;
+        tokens: ImportedOAuthTokens;
     };
     browser: {
         openBrowser?(url: string): Promise<void>;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3405,6 +3405,15 @@ function normalizeOAuthScope(scope) {
   return normalized || void 0;
 }
 
+// ../mcp-oauth/dist/client/token-auth-method.js
+function normalizeOAuthTokenEndpointAuthMethod(value) {
+  if (value === void 0 || value === null)
+    return void 0;
+  if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
+    throw new Error("Unsupported OAuth token endpoint authentication method");
+  return value;
+}
+
 // ../mcp-oauth/dist/client/client-registration.js
 function parseOAuthClientRegistration(value) {
   const invalid = () => new Error("Invalid OAuth client registration metadata");
@@ -3503,13 +3512,21 @@ function normalizeStoredOAuthClient(value) {
   if (typeof clientId !== "string" || clientId.trim() === "" || clientSecret !== void 0 && (typeof clientSecret !== "string" || clientSecret.trim() === ""))
     return null;
   const client = { clientId: clientId.trim(), ...clientSecret === void 0 ? {} : { clientSecret: clientSecret.trim() } };
+  const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record2, "tokenEndpointAuthMethod") ? record2.tokenEndpointAuthMethod : void 0);
   if (Object.hasOwn(record2, "registration") && record2.registration !== void 0) {
     const registration = parseOAuthClientRegistration(record2.registration);
     const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : void 0;
     if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
       throw new Error("OAuth client registration does not match the client identity");
     client.registration = registration;
-  }
+    const registrationMethod = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(registration, "token_endpoint_auth_method") ? registration.token_endpoint_auth_method : void 0);
+    if (method !== void 0 && registrationMethod !== void 0 && method !== registrationMethod)
+      throw new Error("OAuth token endpoint authentication conflicts with the client registration");
+    if (registrationMethod !== void 0)
+      client.tokenEndpointAuthMethod = registrationMethod;
+  }
+  if (method !== void 0)
+    client.tokenEndpointAuthMethod = method;
   return client;
 }
 
@@ -4760,6 +4777,7 @@ async function exchangeAuthorizationCode(input) {
     tokenEndpoint: input.tokenEndpoint,
     clientId: input.clientId,
     clientSecret: input.clientSecret,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
     params: {
       grant_type: "authorization_code",
       code: input.code,
@@ -4778,6 +4796,7 @@ async function refreshAccessToken(input) {
     tokenEndpoint: input.tokenEndpoint,
     clientId: input.clientId,
     clientSecret: input.clientSecret,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
     params: {
       grant_type: "refresh_token",
       refresh_token: input.refreshToken,
@@ -4789,21 +4808,26 @@ async function refreshAccessToken(input) {
   });
 }
 async function requestTokens(input) {
-  const body = new URLSearchParams({
-    client_id: input.clientId,
-    ...input.params
-  });
-  if (input.clientSecret !== void 0) {
-    body.set("client_secret", input.clientSecret);
+  const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ?? (input.clientSecret === void 0 ? "none" : "client_secret_post");
+  if (method !== "none" && (input.clientSecret === void 0 || input.clientSecret.trim() === ""))
+    throw new Error("OAuth token endpoint authentication requires a client secret");
+  const body = new URLSearchParams(input.params);
+  const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
+  if (method === "client_secret_basic") {
+    const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
+    const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
+    headers.set("Authorization", `Basic ${Buffer.from(`${encoded}:${encodedSecret}`).toString("base64")}`);
+  } else {
+    body.set("client_id", input.clientId);
+    if (method === "client_secret_post")
+      body.set("client_secret", input.clientSecret);
   }
   input.signal?.throwIfAborted();
   const deadline = AbortSignal.timeout(3e4);
   const signal = input.signal === void 0 ? deadline : AbortSignal.any([input.signal, deadline]);
   const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
+    headers,
     body: body.toString(),
     signal
   });
@@ -4957,6 +4981,8 @@ function createDefaultOAuthClientProvider(options) {
   const clientMetadata = getClientMetadata(options.client);
   const requestedScope = clientMetadata?.scope;
   const configuredClient = normalizeConfiguredClient(options.client);
+  const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
+  const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
   const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
   const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
   const now = options.now ?? Date.now;
@@ -4973,7 +4999,7 @@ function createDefaultOAuthClientProvider(options) {
   }
   const initialGrant = options.initialGrant === void 0 ? void 0 : {
     resource: canonicalizeResourceIndicator(options.initialGrant.resource),
-    tokens: normalizeStoredTokens(options.initialGrant.tokens),
+    tokens: normalizeImportedTokens(options.initialGrant.tokens, now),
     client: configuredClient
   };
   if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
@@ -5051,6 +5077,10 @@ function createDefaultOAuthClientProvider(options) {
     const canonicalResource = canonicalizeResourceIndicator(resource);
     return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
       let session = await loadSession(canonicalResource);
+      if (session !== null)
+        assertRegistrationIssuer(session.client, session.authorizationServer);
+      if (configuredClient !== null && discovery !== void 0)
+        assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
       if (session !== null && initialGrant?.resource === canonicalResource)
         initialGrantConsumed = true;
       signal?.throwIfAborted();
@@ -5085,6 +5115,8 @@ function createDefaultOAuthClientProvider(options) {
       }
       if (requestedScope !== void 0 && session?.tokens !== void 0 && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
         throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
+      if (configuredTokenMethod !== void 0 && session !== null && (session.tokens !== void 0 || session.refreshState === "pending") && (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === void 0 ? "none" : "client_secret_post")) !== configuredTokenMethod)
+        throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
       if (session?.refreshState === "pending") {
         if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === void 0)
           throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -5094,6 +5126,11 @@ function createDefaultOAuthClientProvider(options) {
         return session;
       }
       if (session?.tokens?.refreshToken !== void 0 && sessionDiscovery !== void 0 && (forceRefresh || isExpired(session.tokens, now))) {
+        if (hasExpiredClientSecret(session.client, now)) {
+          if (!allowInteractive || options.allowInteractive === false || options.client.mode === "static" || configuredClient?.registration !== void 0)
+            throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
+          return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch2, signal);
+        }
         session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch2, signal);
         if (session?.tokens !== void 0 && !isExpired(session.tokens, now)) {
           return session;
@@ -5117,6 +5154,7 @@ function createDefaultOAuthClientProvider(options) {
     if (session.tokens?.refreshToken === void 0) {
       return session;
     }
+    assertTokenEndpointAuthentication(session.client, discovery.authorizationServerMetadata);
     const pendingSession = { ...clearSessionTokens(session), refreshState: "pending" };
     await saveSession(resource, pendingSession);
     signal?.throwIfAborted();
@@ -5128,6 +5166,7 @@ function createDefaultOAuthClientProvider(options) {
           tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
           clientId: session.client.clientId,
           clientSecret: session.client.clientSecret,
+          tokenEndpointAuthMethod: session.client.tokenEndpointAuthMethod,
           refreshToken: session.tokens.refreshToken,
           resource,
           fetch: fetch2,
@@ -5191,6 +5230,7 @@ function createDefaultOAuthClientProvider(options) {
       let resolvedClient = null;
       try {
         resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch2, signal);
+        assertTokenEndpointAuthentication(resolvedClient.client, discovery.authorizationServerMetadata);
         const sessionWithoutTokens = {
           resource,
           authorizationServer: discovery.authorizationServer,
@@ -5214,6 +5254,7 @@ function createDefaultOAuthClientProvider(options) {
           tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
           clientId: resolvedClient.client.clientId,
           clientSecret: resolvedClient.client.clientSecret,
+          tokenEndpointAuthMethod: resolvedClient.client.tokenEndpointAuthMethod,
           code,
           codeVerifier: verifier,
           redirectUri: loopback.redirectUri,
@@ -5257,6 +5298,9 @@ function createDefaultOAuthClientProvider(options) {
       if (configuredClient === null) {
         throw new Error("OAuth client_id must not be blank");
       }
+      assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
+      if (hasExpiredClientSecret(configuredClient, now))
+        throw new Error("OAuth client secret has expired; update the imported registration");
       return {
         kind: "static",
         fromStoredRegistration: false,
@@ -5271,7 +5315,14 @@ function createDefaultOAuthClientProvider(options) {
         client: configuredClient
       };
     }
-    const storedClient = await loadRegisteredClient(discovery.authorizationServer);
+    let storedClient = await loadRegisteredClient(discovery.authorizationServer);
+    if (storedClient !== null) {
+      assertRegistrationIssuer(storedClient, discovery.authorizationServer);
+      if (hasExpiredClientSecret(storedClient, now)) {
+        await clearRegisteredClient(discovery.authorizationServer);
+        storedClient = null;
+      }
+    }
     if (storedClient !== null) {
       return {
         kind: "dynamic",
@@ -5280,7 +5331,7 @@ function createDefaultOAuthClientProvider(options) {
       };
     }
     if (registrationEndpoint === void 0) {
-      if (existingSession !== null && existingSession.client.clientId.length > 0) {
+      if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now)) {
         return {
           kind: "dynamic",
           fromStoredRegistration: true,
@@ -5289,7 +5340,7 @@ function createDefaultOAuthClientProvider(options) {
       }
       throw new Error("Authorization server metadata is missing registration_endpoint");
     }
-    if (existingSession !== null && existingSession.client.clientId.length > 0) {
+    if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now)) {
       const isConfiguredStaticFallback = configuredClient !== null && existingSession.client.clientId === configuredClient.clientId && existingSession.client.clientSecret === configuredClient.clientSecret;
       if (!isConfiguredStaticFallback) {
         await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
@@ -5300,7 +5351,11 @@ function createDefaultOAuthClientProvider(options) {
         };
       }
     }
-    const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri);
+    const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
+    const registrationMethod = requestedTokenMethod ?? (supported === void 0 ? "none" : ["none", "client_secret_basic", "client_secret_post"].find((method) => supported.includes(method)));
+    if (registrationMethod === void 0 || supported !== void 0 && !supported.includes(registrationMethod))
+      throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+    const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri, registrationMethod);
     const deadline = AbortSignal.timeout(3e4);
     const signal = parentSignal === void 0 ? deadline : AbortSignal.any([parentSignal, deadline]);
     const response = await fetchMcpResponse(fetch2, registrationEndpoint, {
@@ -5314,11 +5369,16 @@ function createDefaultOAuthClientProvider(options) {
     const payload = await readOAuthJsonObjectResponse(response, signal);
     const registration = parseOAuthClientRegistration(payload);
     const registeredSecret = getOwnString2(registration, "client_secret");
+    const responseMethod = normalizeOAuthTokenEndpointAuthMethod(getOwnEntry6(registration, "token_endpoint_auth_method")) ?? requestedTokenMethod ?? (supported === void 0 ? void 0 : normalizeOAuthTokenEndpointAuthMethod(registrationMethod));
     const registeredClient = {
       clientId: registration.client_id.trim(),
       ...registeredSecret === void 0 ? {} : { clientSecret: registeredSecret.trim() },
+      ...responseMethod === void 0 ? {} : { tokenEndpointAuthMethod: responseMethod },
       registration
     };
+    assertRegistrationIssuer(registeredClient, discovery.authorizationServer);
+    if (hasExpiredClientSecret(registeredClient, now))
+      throw new Error("OAuth client secret has expired in the registration response");
     await saveRegisteredClient(discovery.authorizationServer, registeredClient);
     return {
       kind: "dynamic",
@@ -5330,7 +5390,7 @@ function createDefaultOAuthClientProvider(options) {
     return normalizeLoadedSession(await sessionStore.load(resource));
   }
   async function saveSession(resource, session) {
-    await sessionStore.save(resource, session);
+    await sessionStore.save(resource, structuredClone(session));
   }
   async function clearSession(resource) {
     await sessionStore.clear(resource);
@@ -5426,6 +5486,19 @@ function normalizeLoadedSession(session) {
     tokens: normalizeStoredTokens(getOwnEntry6(session, "tokens"))
   };
 }
+function normalizeImportedTokens(value, now) {
+  if (!isObjectRecord3(value))
+    return void 0;
+  const absolute = getOwnEntry6(value, "expiresAt");
+  const lifetime = getOwnEntry6(value, "expiresIn");
+  const issuedAt = getOwnEntry6(value, "issuedAt");
+  if (lifetime !== void 0 && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
+    throw new Error("OAuth initial grant has invalid relative expiry");
+  if (issuedAt !== void 0 && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) || Math.abs(issuedAt) > MAX_JS_DATE_MS3))
+    throw new Error("OAuth initial grant has invalid issuance time");
+  const expiresAt = absolute !== void 0 && absolute !== null ? absolute : lifetime === void 0 ? null : (issuedAt === void 0 ? now() : issuedAt) + lifetime * 1e3;
+  return normalizeStoredTokens({ ...value, expiresAt });
+}
 function normalizeStoredTokens(value) {
   if (value === void 0 || !isObjectRecord3(value)) {
     return void 0;
@@ -5466,7 +5539,7 @@ function normalizeConfiguredClient(client) {
   if (clientId === void 0)
     return null;
   const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === void 0 ? void 0 : getOwnString2(registration, "client_secret")?.trim());
-  return normalizeStoredOAuthClient({ clientId, clientSecret, registration });
+  return normalizeStoredOAuthClient({ clientId, clientSecret, registration, tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
 }
 function normalizeOptionalOAuthString(value) {
   if (value === void 0) {
@@ -5566,12 +5639,39 @@ function assertRequestMatchesResource(requestUrl, resource) {
     throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
   }
 }
-function buildClientRegistrationBody(metadata, redirectUri) {
+function assertRegistrationIssuer(client, issuer) {
+  const registrationIssuer = client.registration === void 0 ? void 0 : getOwnString2(client.registration, "issuer");
+  if (registrationIssuer !== void 0 && registrationIssuer !== issuer)
+    throw new Error("OAuth client registration issuer does not match the authorization server");
+}
+function hasExpiredClientSecret(client, now) {
+  if (client.clientSecret === void 0 || client.tokenEndpointAuthMethod === "none" || client.registration === void 0)
+    return false;
+  const expiry = getOwnEntry6(client.registration, "client_secret_expires_at");
+  return typeof expiry === "number" && expiry !== 0 && expiry <= now() / 1e3;
+}
+function getSupportedTokenAuthMethods(metadata) {
+  const value = getOwnEntry6(metadata, "token_endpoint_auth_methods_supported");
+  if (value === void 0)
+    return void 0;
+  if (!Array.isArray(value) || value.length > 128 || value.some((method) => typeof method !== "string"))
+    throw new Error("Invalid OAuth token endpoint authentication metadata");
+  return value;
+}
+function assertTokenEndpointAuthentication(client, metadata) {
+  const method = client.tokenEndpointAuthMethod ?? (client.clientSecret === void 0 ? "none" : "client_secret_post");
+  if (method !== "none" && client.clientSecret === void 0)
+    throw new Error("OAuth token endpoint authentication requires a client secret");
+  const supported = getSupportedTokenAuthMethods(metadata);
+  if (supported !== void 0 && !supported.includes(method))
+    throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+}
+function buildClientRegistrationBody(metadata, redirectUri, tokenEndpointAuthMethod) {
   const body = {
     redirect_uris: [redirectUri],
     grant_types: ["authorization_code", "refresh_token"],
     response_types: ["code"],
-    token_endpoint_auth_method: "none"
+    token_endpoint_auth_method: tokenEndpointAuthMethod
   };
   const clientName = metadata === void 0 ? void 0 : getOwnString2(metadata, "clientName");
   const scope = metadata === void 0 ? void 0 : getOwnString2(metadata, "scope");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",