tiny-http-mcp-server 0.1.41 → 0.1.42

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.41",
+      "version": "0.1.42",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -165,6 +165,9 @@ Authorization and code exchange always use the actual listener URI. Silent
 refresh keeps its original client regardless of callback changes. At interactive
 authorization, a native registration with an obsolete captured callback is
 replaced; caller-owned full registration imports retain their original identity.
+Their persisted `registrationOwnership: "caller"` survives reload and refresh;
+invalid-client responses never silently replace these apps. Callback changes or
+expired imported secrets require an explicit registration update.
 Set `client.tokenEndpointAuthMethod` to `none`, `client_secret_post` or
 `client_secret_basic`; a full registration can supply the same field as
 `token_endpoint_auth_method`. Public clients never transmit a stored secret.

package/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -112,6 +112,12 @@ export function normalizeStoredOAuthClient(value) {
     }
     if (method !== undefined)
         client.tokenEndpointAuthMethod = method;
+    const ownership = Object.hasOwn(record, "registrationOwnership") ? record.registrationOwnership : undefined;
+    if (ownership !== undefined) {
+        if (ownership !== "caller" || client.registration === undefined)
+            throw new Error("Invalid stored OAuth registration ownership");
+        client.registrationOwnership = "caller";
+    }
     return client;
 }
 /** Fresh DCR may describe a normalized loopback port; saved identity stays exact. */

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -401,6 +401,16 @@ export function createDefaultOAuthClientProvider(options) {
             };
         }
         let storedClient = await loadRegisteredClient(discovery.authorizationServer);
+        const importedClient = existingSession?.client.registrationOwnership === "caller" ? existingSession.client :
+            storedClient?.registrationOwnership === "caller" ? storedClient : undefined;
+        if (importedClient !== undefined) {
+            assertRegistrationIssuer(importedClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(importedClient, now))
+                throw new Error("OAuth client secret has expired; update the imported registration");
+            if (!registrationMatchesRedirect(importedClient, redirectUri))
+                throw new Error("OAuth imported registration does not match the configured redirect URI; update its callback configuration");
+            return { kind: "static", fromStoredRegistration: false, client: importedClient };
+        }
         if (storedClient !== null) {
             assertRegistrationIssuer(storedClient, discovery.authorizationServer);
             if (hasExpiredClientSecret(storedClient, now) || !registrationMatchesRedirect(storedClient, redirectUri)) {
@@ -653,7 +663,9 @@ function normalizeConfiguredClient(client) {
     if (clientId === undefined)
         return null;
     const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === undefined ? undefined : getOwnString(registration, "client_secret")?.trim());
-    return normalizeStoredOAuthClient({ clientId, clientSecret, registration, tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
+    return normalizeStoredOAuthClient({ clientId, clientSecret, registration,
+        ...(registration === undefined ? {} : { registrationOwnership: "caller" }),
+        tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
 }
 function normalizeOptionalOAuthString(value) {
     if (value === undefined) {
@@ -829,5 +841,5 @@ function shouldReRegisterStoredDynamicClient(error, client, alreadyAttempted) {
     if ("kind" in client) {
         return client.kind === "dynamic" && client.fromStoredRegistration;
     }
-    return true;
+    return client.registrationOwnership !== "caller";
 }

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -100,6 +100,8 @@ export interface OAuthClientRegistration extends Record<string, unknown> {
 }
 export interface StoredOAuthClient {
     clientId: string;
+    /** Externally registered apps must never be replaced by native DCR on reload. */
+    registrationOwnership?: "caller";
     /** Actual listener URI submitted when this native client was registered. */
     requestedRedirectUri?: string;
     clientSecret?: string;

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -203,6 +203,8 @@ interface OAuthClientRegistration extends Record<string, unknown> {
 }
 interface StoredOAuthClient {
     clientId: string;
+    /** Externally registered apps must never be replaced by native DCR on reload. */
+    registrationOwnership?: "caller";
     /** Actual listener URI submitted when this native client was registered. */
     requestedRedirectUri?: string;
     clientSecret?: string;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3843,6 +3843,12 @@ function normalizeStoredOAuthClient(value) {
   }
   if (method !== void 0)
     client.tokenEndpointAuthMethod = method;
+  const ownership = Object.hasOwn(record2, "registrationOwnership") ? record2.registrationOwnership : void 0;
+  if (ownership !== void 0) {
+    if (ownership !== "caller" || client.registration === void 0)
+      throw new Error("Invalid stored OAuth registration ownership");
+    client.registrationOwnership = "caller";
+  }
   return client;
 }
 function registrationMatchesRedirect(client, requestedUri, fresh = false) {
@@ -5524,6 +5530,15 @@ function createDefaultOAuthClientProvider(options) {
       };
     }
     let storedClient = await loadRegisteredClient(discovery.authorizationServer);
+    const importedClient = existingSession?.client.registrationOwnership === "caller" ? existingSession.client : storedClient?.registrationOwnership === "caller" ? storedClient : void 0;
+    if (importedClient !== void 0) {
+      assertRegistrationIssuer(importedClient, discovery.authorizationServer);
+      if (hasExpiredClientSecret(importedClient, now))
+        throw new Error("OAuth client secret has expired; update the imported registration");
+      if (!registrationMatchesRedirect(importedClient, redirectUri))
+        throw new Error("OAuth imported registration does not match the configured redirect URI; update its callback configuration");
+      return { kind: "static", fromStoredRegistration: false, client: importedClient };
+    }
     if (storedClient !== null) {
       assertRegistrationIssuer(storedClient, discovery.authorizationServer);
       if (hasExpiredClientSecret(storedClient, now) || !registrationMatchesRedirect(storedClient, redirectUri)) {
@@ -5750,7 +5765,13 @@ function normalizeConfiguredClient(client) {
   if (clientId === void 0)
     return null;
   const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === void 0 ? void 0 : getOwnString2(registration, "client_secret")?.trim());
-  return normalizeStoredOAuthClient({ clientId, clientSecret, registration, tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
+  return normalizeStoredOAuthClient({
+    clientId,
+    clientSecret,
+    registration,
+    ...registration === void 0 ? {} : { registrationOwnership: "caller" },
+    tokenEndpointAuthMethod: client.tokenEndpointAuthMethod
+  });
 }
 function normalizeOptionalOAuthString(value) {
   if (value === void 0) {
@@ -5919,7 +5940,7 @@ function shouldReRegisterStoredDynamicClient(error, client, alreadyAttempted) {
   if ("kind" in client) {
     return client.kind === "dynamic" && client.fromStoredRegistration;
   }
-  return true;
+  return client.registrationOwnership !== "caller";
 }
 
 // ../tiny-stdio-mcp-server/dist/headers.js

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.41",
+  "version": "0.1.42",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",