tiny-http-mcp-server 0.1.39 → 0.1.41

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.39",
+      "version": "0.1.41",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -95,6 +95,22 @@ without redeeming its refresh token again. A proven current token is refreshed
 on 401 even when the server omits `error="invalid_token"`. Invalid provenance
 fails without quoting token values.
 
+The native provider also exposes `authenticate({ requestUrl, fetch, signal,
+discover })` for explicit login, including servers whose initialization is
+public. `discover` lazily supplies validated OAuth metadata and is skipped for
+usable existing grants. Omit it to recover/reuse known sessions only; the method
+returns `void` if a new discovery lookup is needed. It honors `allowInteractive`,
+recovers pending refresh outcomes through consent, and returns an owned token
+snapshot. Normal transport request authorization remains noninteractive.
+
+`createResourceBoundOAuthStores(authStore, persistenceNamespace, resourceIdentity)`
+exposes the native named session/client stores and `reset(resource, { signal,
+timeoutMs })`. Reset acquires the raw identity backend lock, so it can recover
+corrupt or undecryptable records without reading their old contents. It atomically
+retires the identity's grant and registrations and writes a marker that suppresses
+stale initial grants. The default lock wait is 30 seconds. Other names/profiles
+are untouched, and symlink paths are still refused.
+
 Configure `client.metadata.scope` to request a precise scope set; broader
 discovery metadata does not override it. Explicit scopes must match the cached
 or imported grant's scope set; ordering, repeated spaces and duplicates are

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -66,6 +66,26 @@ export function createDefaultOAuthClientProvider(options) {
     }
     let initialGrantConsumed = false;
     return {
+        async authenticate(input) {
+            input.signal?.throwIfAborted();
+            assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
+            const resource = canonicalizeResourceIndicator(input.requestUrl);
+            let session = await ensureAuthorizedSession(resource, undefined, input.fetch, true, false, input.signal);
+            if (session?.tokens !== undefined && !isExpired(session.tokens, now))
+                return { ...session.tokens };
+            if (session === null && !initialGrantConsumed && initialGrant?.resource === resource &&
+                initialGrant.tokens !== undefined && !isExpired(initialGrant.tokens, now))
+                return { ...initialGrant.tokens };
+            if (input.discover === undefined)
+                return;
+            const discovery = await input.discover();
+            input.signal?.throwIfAborted();
+            assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
+            session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
+            if (session?.tokens === undefined || isExpired(session.tokens, now))
+                throw new Error("OAuth authentication did not establish a usable grant");
+            return { ...session.tokens };
+        },
         async authorizeRequest(input) {
             assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
             const requestUrl = canonicalizeResourceIndicator(input.requestUrl);

package/node_modules/mcp-oauth/dist/client/resource-bound-store.d.ts

@@ -1,9 +1,15 @@
 import type { CreateSecretStoreInput } from "auth-store";
 import { type OAuthClientStore } from "./auth-store-session-store.js";
 import type { OAuthSessionStore } from "./types.js";
+export interface ResourceBoundOAuthStores {
+    readonly sessionStore: OAuthSessionStore;
+    readonly clientStore: OAuthClientStore;
+    readonly initialGrantAllowed: boolean;
+    /** Retire grants/clients even when their document cannot be decrypted or parsed. */
+    reset(resource: string, options?: {
+        signal?: AbortSignal;
+        timeoutMs?: number;
+    }): Promise<void>;
+}
 /** One locked document owns a logical server's URL history, grant and clients. */
-export declare function createResourceBoundOAuthStores(options: CreateSecretStoreInput, namespace: string | undefined, identity: string): {
-    sessionStore: OAuthSessionStore;
-    clientStore: OAuthClientStore;
-    initialGrantAllowed: boolean;
-};
+export declare function createResourceBoundOAuthStores(options: CreateSecretStoreInput, namespace: string | undefined, identity: string): ResourceBoundOAuthStores;

package/node_modules/mcp-oauth/dist/client/resource-bound-store.js

@@ -4,9 +4,36 @@ import { normalizeStoredOAuthClient } from "./client-registration.js";
 /** One locked document owns a logical server's URL history, grant and clients. */
 export function createResourceBoundOAuthStores(options, namespace, identity) {
     assertPersistenceNamespace(identity);
+    assertPersistenceNamespace(namespace);
     const store = createNamedSecretStore(identity, options, { salt: "poe-code:mcp-oauth:resources:v1",
         directory: ".poe-code/mcp-oauth/resources", service: "poe-code-mcp-oauth-resources", accountPrefix: "resource" }, namespace);
-    const result = { initialGrantAllowed: true, sessionStore: {}, clientStore: {} };
+    const result = { initialGrantAllowed: true, sessionStore: {}, clientStore: {},
+        async reset(resource, options = {}) {
+            options.signal?.throwIfAborted();
+            let url;
+            try {
+                url = new URL(resource);
+            }
+            catch {
+                throw new Error("OAuth reset resource must be an absolute HTTP URL");
+            }
+            if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash)
+                throw new Error("OAuth reset resource must be an HTTP URL without credentials or fragment");
+            const timeoutMs = options.timeoutMs ?? 30_000;
+            if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)
+                throw new Error("OAuth reset timeoutMs must be a positive supported timer interval");
+            if (store.withLock === undefined)
+                throw new Error("OAuth resource identity backend must support transaction locks");
+            // Acquire the raw backend lock: the session lock reconciles by strictly
+            // reading the document, which must be bypassed for explicit corruption recovery.
+            await store.withLock(async () => {
+                options.signal?.throwIfAborted();
+                const record = { version: 1, resource: canonicalizeResourceIndicator(url), generation: 1, session: null, clients: {} };
+                await store.set(JSON.stringify(record));
+                result.initialGrantAllowed = false;
+            }, { signal: options.signal, timeoutMs });
+        }
+    };
     async function read() {
         const raw = await store.get();
         if (raw === null)

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -28,6 +28,14 @@ export interface OAuthUnauthorizedChallenge {
     raw: string;
 }
 export interface OAuthClientProvider {
+    /** Establish a grant explicitly, including when resource initialization is public. */
+    authenticate?(input: {
+        requestUrl: URL;
+        fetch: OAuthMetadataFetch;
+        /** Lazy validated discovery. Without it, recover/reuse known grants only. */
+        discover?: () => Promise<OAuthDiscoveryResult>;
+        signal?: AbortSignal;
+    }): Promise<StoredOAuthTokens | void>;
     authorizeRequest?(input: {
         requestUrl: URL;
         headers: Headers;

package/node_modules/mcp-oauth/dist/index.d.ts

@@ -1,4 +1,6 @@
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
+export { createResourceBoundOAuthStores } from "./client/resource-bound-store.js";
+export type { ResourceBoundOAuthStores } from "./client/resource-bound-store.js";
 export { parseOAuthClientRegistration } from "./client/client-registration.js";
 export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
 export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, } from "./client/loopback-authorization.js";

package/node_modules/mcp-oauth/dist/index.js

@@ -1,4 +1,5 @@
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
+export { createResourceBoundOAuthStores } from "./client/resource-bound-store.js";
 export { parseOAuthClientRegistration } from "./client/client-registration.js";
 export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
 export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, } from "./client/loopback-authorization.js";

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -131,6 +131,14 @@ interface OAuthUnauthorizedChallenge {
     raw: string;
 }
 interface OAuthClientProvider {
+    /** Establish a grant explicitly, including when resource initialization is public. */
+    authenticate?(input: {
+        requestUrl: URL;
+        fetch: OAuthMetadataFetch;
+        /** Lazy validated discovery. Without it, recover/reuse known grants only. */
+        discover?: () => Promise<OAuthDiscoveryResult>;
+        signal?: AbortSignal;
+    }): Promise<StoredOAuthTokens | void>;
     authorizeRequest?(input: {
         requestUrl: URL;
         headers: Headers;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4712,13 +4712,40 @@ function isNonBlankOwnString(record2, key2) {
 // ../mcp-oauth/dist/client/resource-bound-store.js
 function createResourceBoundOAuthStores(options, namespace, identity) {
   assertPersistenceNamespace(identity);
+  assertPersistenceNamespace(namespace);
   const store = createNamedSecretStore(identity, options, {
     salt: "poe-code:mcp-oauth:resources:v1",
     directory: ".poe-code/mcp-oauth/resources",
     service: "poe-code-mcp-oauth-resources",
     accountPrefix: "resource"
   }, namespace);
-  const result = { initialGrantAllowed: true, sessionStore: {}, clientStore: {} };
+  const result = {
+    initialGrantAllowed: true,
+    sessionStore: {},
+    clientStore: {},
+    async reset(resource, options2 = {}) {
+      options2.signal?.throwIfAborted();
+      let url;
+      try {
+        url = new URL(resource);
+      } catch {
+        throw new Error("OAuth reset resource must be an absolute HTTP URL");
+      }
+      if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash)
+        throw new Error("OAuth reset resource must be an HTTP URL without credentials or fragment");
+      const timeoutMs = options2.timeoutMs ?? 3e4;
+      if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
+        throw new Error("OAuth reset timeoutMs must be a positive supported timer interval");
+      if (store.withLock === void 0)
+        throw new Error("OAuth resource identity backend must support transaction locks");
+      await store.withLock(async () => {
+        options2.signal?.throwIfAborted();
+        const record2 = { version: 1, resource: canonicalizeResourceIndicator(url), generation: 1, session: null, clients: {} };
+        await store.set(JSON.stringify(record2));
+        result.initialGrantAllowed = false;
+      }, { signal: options2.signal, timeoutMs });
+    }
+  };
   async function read() {
     const raw = await store.get();
     if (raw === null)
@@ -5172,6 +5199,25 @@ function createDefaultOAuthClientProvider(options) {
   }
   let initialGrantConsumed = false;
   return {
+    async authenticate(input) {
+      input.signal?.throwIfAborted();
+      assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
+      const resource = canonicalizeResourceIndicator(input.requestUrl);
+      let session = await ensureAuthorizedSession(resource, void 0, input.fetch, true, false, input.signal);
+      if (session?.tokens !== void 0 && !isExpired(session.tokens, now))
+        return { ...session.tokens };
+      if (session === null && !initialGrantConsumed && initialGrant?.resource === resource && initialGrant.tokens !== void 0 && !isExpired(initialGrant.tokens, now))
+        return { ...initialGrant.tokens };
+      if (input.discover === void 0)
+        return;
+      const discovery = await input.discover();
+      input.signal?.throwIfAborted();
+      assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
+      session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
+      if (session?.tokens === void 0 || isExpired(session.tokens, now))
+        throw new Error("OAuth authentication did not establish a usable grant");
+      return { ...session.tokens };
+    },
     async authorizeRequest(input) {
       assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
       const requestUrl = canonicalizeResourceIndicator(input.requestUrl);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",