tiny-http-mcp-server 0.1.43 → 0.1.45

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.43",
+      "version": "0.1.45",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -29,9 +29,11 @@ const verifier = createJwksTokenVerifier({
 - `createAuthStoreSessionStore(options)`: persisted OAuth session store backed by `auth-store`.
 - `createLoopbackAuthorizationSession(options)`: local callback server for browser authorization.
 - `generateCodeVerifier()` and `generateCodeChallenge(...)`: PKCE helpers.
+- `normalizeStoredOAuthClient(value)`: normalize a saved client identity, full registration and ownership marker.
+- `normalizeOAuthScope(value)`: validate scope syntax and normalize its case-sensitive set.
 - `canonicalizeResourceIndicator(value)`: resource indicator canonicalization.
 - `createJwksTokenVerifier(options)`: JWKS-backed access-token verifier for MCP servers.
-- `OAuthError`: token endpoint error type.
+- `OAuthError`: OAuth HTTP error type with status, retryability and known-outcome fields.
 
 ## Configuration
 
@@ -242,3 +244,10 @@ cannot disable this policy.
 
 This package exposes no direct environment variables. When `authStore` is used,
 `auth-store` honors its own backend environment variables.
+
+Malformed OAuth HTTP errors retain their numeric HTTP status without echoing
+response bodies. Raw/incomplete client-error responses (including registration
+HTTP 403) are nonretryable `invalid_response` errors; authorization fails without
+waiting for consent that never started. Raw server errors remain transient.
+`outcomeKnown: false` still withholds an uncertain rotating refresh family: a
+nonretryable HTTP status alone does not prove a refresh token was unconsumed.

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -16,13 +16,15 @@ export class OAuthError extends Error {
     /** True only when a complete OAuth error response establishes rejection. */
     outcomeKnown;
     constructor(shape, status, outcomeKnown = true) {
-        super(shape.error_description ?? shape.error);
+        const description = Object.hasOwn(shape, "error_description") ? shape.error_description : undefined;
+        const uri = Object.hasOwn(shape, "error_uri") ? shape.error_uri : undefined;
+        super(description ?? (outcomeKnown ? shape.error : `OAuth HTTP response did not contain a valid error (HTTP ${status})`));
         this.name = "OAuthError";
         this.error = shape.error;
-        this.errorDescription = shape.error_description;
-        this.errorUri = shape.error_uri;
-        this.error_description = shape.error_description;
-        this.error_uri = shape.error_uri;
+        this.errorDescription = description;
+        this.errorUri = uri;
+        this.error_description = description;
+        this.error_uri = uri;
         this.status = status;
         this.retryable = isRetryableOAuthError(this);
         this.terminal = !this.retryable;
@@ -164,7 +166,9 @@ export async function readOAuthJsonObjectResponse(response, signal) {
     const record = payload;
     if (!response.ok) {
         const error = getOwnEntry(record, "error");
-        throw new OAuthError(readOAuthError(record, fallbackError.error), response.status, typeof error === "string" && error.trim().length > 0);
+        if (typeof error !== "string" || error.trim() === "")
+            throw fallbackError;
+        throw new OAuthError(readOAuthError(record), response.status);
     }
     return record;
 }
@@ -182,7 +186,7 @@ function getOwnEntry(record, key) {
     return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
 }
 function createFallbackOAuthError(status) {
-    const error = status === 503 ? "temporarily_unavailable" : "server_error";
+    const error = status === 503 ? "temporarily_unavailable" : status >= 500 ? "server_error" : "invalid_response";
     return new OAuthError({ error }, status, false);
 }
 function normalizeBearerTokenType(value) {

package/node_modules/mcp-oauth/dist/http-fetch.js

@@ -1,8 +1,45 @@
 export async function fetchMcpResponse(fetchImplementation, input, init = {}) {
-    const response = await fetchImplementation(input, { ...init, redirect: "error" });
-    if (response.redirected || response.type === "opaqueredirect") {
-        void response.body?.cancel().catch(() => undefined);
-        throw new Error("MCP HTTP redirects are not allowed");
-    }
-    return response;
+    const signal = init.signal;
+    signal?.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (error, response) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener("abort", abort);
+            if (response === undefined)
+                reject(error);
+            else
+                resolve(response);
+        };
+        const abort = () => finish(signal?.reason);
+        signal?.addEventListener("abort", abort, { once: true });
+        if (signal?.aborted) {
+            abort();
+            return;
+        }
+        let pending;
+        try {
+            pending = fetchImplementation(input, { ...init, redirect: "error" });
+        }
+        catch (error) {
+            finish(error);
+            return;
+        }
+        void pending.then(response => {
+            if (settled || signal?.aborted) {
+                void response.body?.cancel().catch(() => undefined);
+                if (!settled)
+                    abort();
+                return;
+            }
+            if (response.redirected || response.type === "opaqueredirect") {
+                void response.body?.cancel().catch(() => undefined);
+                finish(new Error("MCP HTTP redirects are not allowed"));
+            }
+            else
+                finish(undefined, response);
+        }, error => finish(error));
+    });
 }

package/node_modules/mcp-oauth/dist/index.d.ts

@@ -1,9 +1,10 @@
+export { normalizeOAuthScope } from "./client/scope.js";
 export { parseOAuthTokenGrant } from "./client/token-grant.js";
 export type { OAuthTokenGrantImportOptions } from "./client/token-grant.js";
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
 export { createResourceBoundOAuthStores } from "./client/resource-bound-store.js";
 export type { ResourceBoundOAuthStores } from "./client/resource-bound-store.js";
-export { parseOAuthClientRegistration } from "./client/client-registration.js";
+export { parseOAuthClientRegistration, normalizeStoredOAuthClient } from "./client/client-registration.js";
 export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
 export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, } from "./client/loopback-authorization.js";
 export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";

package/node_modules/mcp-oauth/dist/index.js

@@ -1,7 +1,8 @@
+export { normalizeOAuthScope } from "./client/scope.js";
 export { parseOAuthTokenGrant } from "./client/token-grant.js";
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
 export { createResourceBoundOAuthStores } from "./client/resource-bound-store.js";
-export { parseOAuthClientRegistration } from "./client/client-registration.js";
+export { parseOAuthClientRegistration, normalizeStoredOAuthClient } from "./client/client-registration.js";
 export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
 export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, } from "./client/loopback-authorization.js";
 export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3395,6 +3395,16 @@ var SubscriptionManager = class {
   }
 };
 
+// ../mcp-oauth/dist/client/scope.js
+function normalizeOAuthScope(scope) {
+  if (scope === void 0)
+    return void 0;
+  if (typeof scope !== "string" || [...scope].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
+    throw new Error("Invalid OAuth scope syntax");
+  const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
+  return normalized || void 0;
+}
+
 // ../mcp-oauth/dist/client/bounded-json.js
 function copyBoundedOAuthJson(value, message) {
   const invalid = () => new Error(message);
@@ -3441,16 +3451,6 @@ function copyBoundedOAuthJson(value, message) {
   return result;
 }
 
-// ../mcp-oauth/dist/client/scope.js
-function normalizeOAuthScope(scope) {
-  if (scope === void 0)
-    return void 0;
-  if (typeof scope !== "string" || [...scope].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
-    throw new Error("Invalid OAuth scope syntax");
-  const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
-  return normalized || void 0;
-}
-
 // ../mcp-oauth/dist/client/loopback-authorization.js
 import http from "node:http";
 
@@ -4898,12 +4898,47 @@ import { isIP } from "node:net";
 
 // ../mcp-oauth/dist/http-fetch.js
 async function fetchMcpResponse(fetchImplementation, input, init = {}) {
-  const response = await fetchImplementation(input, { ...init, redirect: "error" });
-  if (response.redirected || response.type === "opaqueredirect") {
-    void response.body?.cancel().catch(() => void 0);
-    throw new Error("MCP HTTP redirects are not allowed");
-  }
-  return response;
+  const signal = init.signal;
+  signal?.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (error, response) => {
+      if (settled)
+        return;
+      settled = true;
+      signal?.removeEventListener("abort", abort);
+      if (response === void 0)
+        reject(error);
+      else
+        resolve(response);
+    };
+    const abort = () => finish(signal?.reason);
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) {
+      abort();
+      return;
+    }
+    let pending;
+    try {
+      pending = fetchImplementation(input, { ...init, redirect: "error" });
+    } catch (error) {
+      finish(error);
+      return;
+    }
+    void pending.then((response) => {
+      if (settled || signal?.aborted) {
+        void response.body?.cancel().catch(() => void 0);
+        if (!settled)
+          abort();
+        return;
+      }
+      if (response.redirected || response.type === "opaqueredirect") {
+        void response.body?.cancel().catch(() => void 0);
+        finish(new Error("MCP HTTP redirects are not allowed"));
+      } else
+        finish(void 0, response);
+    }, (error) => finish(error));
+  });
 }
 
 // ../mcp-oauth/dist/client/default-oauth-client-provider.js
@@ -4979,13 +5014,15 @@ var OAuthError = class extends Error {
   /** True only when a complete OAuth error response establishes rejection. */
   outcomeKnown;
   constructor(shape, status, outcomeKnown = true) {
-    super(shape.error_description ?? shape.error);
+    const description = Object.hasOwn(shape, "error_description") ? shape.error_description : void 0;
+    const uri = Object.hasOwn(shape, "error_uri") ? shape.error_uri : void 0;
+    super(description ?? (outcomeKnown ? shape.error : `OAuth HTTP response did not contain a valid error (HTTP ${status})`));
     this.name = "OAuthError";
     this.error = shape.error;
-    this.errorDescription = shape.error_description;
-    this.errorUri = shape.error_uri;
-    this.error_description = shape.error_description;
-    this.error_uri = shape.error_uri;
+    this.errorDescription = description;
+    this.errorUri = uri;
+    this.error_description = description;
+    this.error_uri = uri;
     this.status = status;
     this.retryable = isRetryableOAuthError(this);
     this.terminal = !this.retryable;
@@ -5114,7 +5151,9 @@ async function readOAuthJsonObjectResponse(response, signal) {
   const record2 = payload;
   if (!response.ok) {
     const error = getOwnEntry5(record2, "error");
-    throw new OAuthError(readOAuthError(record2, fallbackError.error), response.status, typeof error === "string" && error.trim().length > 0);
+    if (typeof error !== "string" || error.trim() === "")
+      throw fallbackError;
+    throw new OAuthError(readOAuthError(record2), response.status);
   }
   return record2;
 }
@@ -5132,7 +5171,7 @@ function getOwnEntry5(record2, key2) {
   return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
 }
 function createFallbackOAuthError(status) {
-  const error = status === 503 ? "temporarily_unavailable" : "server_error";
+  const error = status === 503 ? "temporarily_unavailable" : status >= 500 ? "server_error" : "invalid_response";
   return new OAuthError({ error }, status, false);
 }
 function normalizeBearerTokenType(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.43",
+  "version": "0.1.45",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",