tiny-http-mcp-server 0.1.44 → 0.1.45

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.44",
+      "version": "0.1.45",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -33,7 +33,7 @@ const verifier = createJwksTokenVerifier({
 - `normalizeOAuthScope(value)`: validate scope syntax and normalize its case-sensitive set.
 - `canonicalizeResourceIndicator(value)`: resource indicator canonicalization.
 - `createJwksTokenVerifier(options)`: JWKS-backed access-token verifier for MCP servers.
-- `OAuthError`: token endpoint error type.
+- `OAuthError`: OAuth HTTP error type with status, retryability and known-outcome fields.
 
 ## Configuration
 
@@ -244,3 +244,10 @@ cannot disable this policy.
 
 This package exposes no direct environment variables. When `authStore` is used,
 `auth-store` honors its own backend environment variables.
+
+Malformed OAuth HTTP errors retain their numeric HTTP status without echoing
+response bodies. Raw/incomplete client-error responses (including registration
+HTTP 403) are nonretryable `invalid_response` errors; authorization fails without
+waiting for consent that never started. Raw server errors remain transient.
+`outcomeKnown: false` still withholds an uncertain rotating refresh family: a
+nonretryable HTTP status alone does not prove a refresh token was unconsumed.

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -16,13 +16,15 @@ export class OAuthError extends Error {
     /** True only when a complete OAuth error response establishes rejection. */
     outcomeKnown;
     constructor(shape, status, outcomeKnown = true) {
-        super(shape.error_description ?? shape.error);
+        const description = Object.hasOwn(shape, "error_description") ? shape.error_description : undefined;
+        const uri = Object.hasOwn(shape, "error_uri") ? shape.error_uri : undefined;
+        super(description ?? (outcomeKnown ? shape.error : `OAuth HTTP response did not contain a valid error (HTTP ${status})`));
         this.name = "OAuthError";
         this.error = shape.error;
-        this.errorDescription = shape.error_description;
-        this.errorUri = shape.error_uri;
-        this.error_description = shape.error_description;
-        this.error_uri = shape.error_uri;
+        this.errorDescription = description;
+        this.errorUri = uri;
+        this.error_description = description;
+        this.error_uri = uri;
         this.status = status;
         this.retryable = isRetryableOAuthError(this);
         this.terminal = !this.retryable;
@@ -164,7 +166,9 @@ export async function readOAuthJsonObjectResponse(response, signal) {
     const record = payload;
     if (!response.ok) {
         const error = getOwnEntry(record, "error");
-        throw new OAuthError(readOAuthError(record, fallbackError.error), response.status, typeof error === "string" && error.trim().length > 0);
+        if (typeof error !== "string" || error.trim() === "")
+            throw fallbackError;
+        throw new OAuthError(readOAuthError(record), response.status);
     }
     return record;
 }
@@ -182,7 +186,7 @@ function getOwnEntry(record, key) {
     return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
 }
 function createFallbackOAuthError(status) {
-    const error = status === 503 ? "temporarily_unavailable" : "server_error";
+    const error = status === 503 ? "temporarily_unavailable" : status >= 500 ? "server_error" : "invalid_response";
     return new OAuthError({ error }, status, false);
 }
 function normalizeBearerTokenType(value) {

package/node_modules/tiny-mcp-client/dist/index.js

@@ -5014,13 +5014,15 @@ var OAuthError = class extends Error {
   /** True only when a complete OAuth error response establishes rejection. */
   outcomeKnown;
   constructor(shape, status, outcomeKnown = true) {
-    super(shape.error_description ?? shape.error);
+    const description = Object.hasOwn(shape, "error_description") ? shape.error_description : void 0;
+    const uri = Object.hasOwn(shape, "error_uri") ? shape.error_uri : void 0;
+    super(description ?? (outcomeKnown ? shape.error : `OAuth HTTP response did not contain a valid error (HTTP ${status})`));
     this.name = "OAuthError";
     this.error = shape.error;
-    this.errorDescription = shape.error_description;
-    this.errorUri = shape.error_uri;
-    this.error_description = shape.error_description;
-    this.error_uri = shape.error_uri;
+    this.errorDescription = description;
+    this.errorUri = uri;
+    this.error_description = description;
+    this.error_uri = uri;
     this.status = status;
     this.retryable = isRetryableOAuthError(this);
     this.terminal = !this.retryable;
@@ -5149,7 +5151,9 @@ async function readOAuthJsonObjectResponse(response, signal) {
   const record2 = payload;
   if (!response.ok) {
     const error = getOwnEntry5(record2, "error");
-    throw new OAuthError(readOAuthError(record2, fallbackError.error), response.status, typeof error === "string" && error.trim().length > 0);
+    if (typeof error !== "string" || error.trim() === "")
+      throw fallbackError;
+    throw new OAuthError(readOAuthError(record2), response.status);
   }
   return record2;
 }
@@ -5167,7 +5171,7 @@ function getOwnEntry5(record2, key2) {
   return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
 }
 function createFallbackOAuthError(status) {
-  const error = status === 503 ? "temporarily_unavailable" : "server_error";
+  const error = status === 503 ? "temporarily_unavailable" : status >= 500 ? "server_error" : "invalid_response";
   return new OAuthError({ error }, status, false);
 }
 function normalizeBearerTokenType(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.44",
+  "version": "0.1.45",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",