tiny-http-mcp-server 0.1.37 → 0.1.38

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.37",
+      "version": "0.1.38",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/dist/client/resource-bound-store.js

@@ -65,12 +65,22 @@ export function createResourceBoundOAuthStores(options, namespace, identity) {
         return record;
     }
     result.sessionStore = {
-        async withLock(_resource, operation, options) {
+        async withLock(resource, operation, options) {
             if (store.withLock === undefined)
                 throw new Error("OAuth resource identity backend must support transaction locks");
-            return store.withLock(operation, options);
+            return store.withLock(async () => {
+                options.signal?.throwIfAborted();
+                await reconcile(resource);
+                options.signal?.throwIfAborted();
+                return operation();
+            }, options);
+        },
+        async load(resource) {
+            // Unauthorized provenance may peek before acquiring the transaction lock.
+            // Only the lock owner may adopt a URL or retire the previous credentials.
+            const record = await read();
+            return record?.resource === canonicalizeResourceIndicator(resource) ? record.session : null;
         },
-        async load(resource) { return (await reconcile(resource)).session; },
         async save(resource, session) {
             const record = await reconcile(resource);
             if (canonicalizeResourceIndicator(session.resource) !== record.resource)

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4771,13 +4771,19 @@ function createResourceBoundOAuthStores(options, namespace, identity) {
     return record2;
   }
   result.sessionStore = {
-    async withLock(_resource, operation, options2) {
+    async withLock(resource, operation, options2) {
       if (store.withLock === void 0)
         throw new Error("OAuth resource identity backend must support transaction locks");
-      return store.withLock(operation, options2);
+      return store.withLock(async () => {
+        options2.signal?.throwIfAborted();
+        await reconcile(resource);
+        options2.signal?.throwIfAborted();
+        return operation();
+      }, options2);
     },
     async load(resource) {
-      return (await reconcile(resource)).session;
+      const record2 = await read();
+      return record2?.resource === canonicalizeResourceIndicator(resource) ? record2.session : null;
     },
     async save(resource, session) {
       const record2 = await reconcile(resource);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.37",
+  "version": "0.1.38",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",