tiny-http-mcp-server 0.1.57 → 0.1.59

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.57",
+      "version": "0.1.59",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -57,6 +57,14 @@ const verifier = createJwksTokenVerifier({
 - `authStore` optional `auth-store` backend config for the default session store
 - `now()` optional clock override
 
+The default provider captures client, interaction, callback, landing-page and
+lock policies when created. Create a new provider to change those settings.
+Selected callbacks, stores, clocks and AbortSignals remain live host dependencies;
+aborting the original signal still cancels authorization.
+Native session and client persistence factories also capture file paths, salts,
+Keychain identities, lock locations and selected filesystem/command handles.
+Mutating these settings cannot redirect a later read or write.
+
 `createJwksTokenVerifier(options)` accepts:
 
 | Option                   | Type                | Default        | Description                                                                              |

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -12,6 +12,7 @@ const DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export function createAuthStoreSessionStore(options = {}, namespace) {
     assertPersistenceNamespace(namespace);
+    options = snapshotPersistenceOptions(options);
     return {
         async withLock(resource, operation, lockOptions) {
             const store = createResourceSecretStore(resource, options, namespace);
@@ -49,6 +50,7 @@ export function createAuthStoreSessionStore(options = {}, namespace) {
 }
 export function createAuthStoreClientStore(options, namespace) {
     assertPersistenceNamespace(namespace);
+    options = snapshotPersistenceOptions(options);
     return {
         async load(issuer) {
             const store = createIssuerSecretStore(issuer, options, namespace);
@@ -79,6 +81,14 @@ export function createAuthStoreClientStore(options, namespace) {
         }
     };
 }
+function snapshotPersistenceOptions(options) {
+    return {
+        ...options,
+        ...(options.fileStore === undefined ? {} : { fileStore: { ...options.fileStore } }),
+        ...(options.keychainStore === undefined ? {} : { keychainStore: { ...options.keychainStore,
+                ...(options.keychainStore.lock === undefined ? {} : { lock: { ...options.keychainStore.lock } }) } })
+    };
+}
 export function createNamedSecretStore(key, options, defaults, namespace) {
     const hash = crypto.createHash("sha256").update(namespace === undefined ? key : JSON.stringify([namespace, key])).digest("hex");
     const configuredFilePath = options.fileStore?.filePath;

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -20,7 +20,12 @@ export function createOAuthClientProvider(options) {
     return createDefaultOAuthClientProvider(options);
 }
 export function createDefaultOAuthClientProvider(options) {
-    loopbackTarget(options.browser);
+    const browser = { ...options.browser,
+        ...(options.browser.landingPage === undefined ? {} : { landingPage: { ...options.browser.landingPage } }) };
+    const clientMode = options.client.mode;
+    const interactiveEnabled = options.allowInteractive !== false;
+    const sessionLockTimeoutMs = options.sessionLockTimeoutMs;
+    loopbackTarget(browser);
     assertPersistenceNamespace(options.persistenceNamespace);
     const clientMetadata = getClientMetadata(options.client);
     const requestedScope = clientMetadata?.scope;
@@ -187,7 +192,7 @@ export function createDefaultOAuthClientProvider(options) {
             if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
                 forceRefresh = false;
             const sessionDiscovery = resolveDiscovery(discovery, session);
-            if ((options.client.mode === "static" || configuredClient !== null || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
+            if ((clientMode === "static" || configuredClient !== null || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
                 const configured = configuredClient;
                 if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
                     throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
@@ -198,7 +203,7 @@ export function createDefaultOAuthClientProvider(options) {
                 (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === undefined ? "none" : "client_secret_post")) !== configuredTokenMethod)
                 throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
             if (session?.refreshState === "pending") {
-                if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === undefined)
+                if (!allowInteractive || !interactiveEnabled || sessionDiscovery === undefined)
                     throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
                 return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch, signal);
             }
@@ -209,7 +214,7 @@ export function createDefaultOAuthClientProvider(options) {
                 sessionDiscovery !== undefined &&
                 (forceRefresh || isExpired(session.tokens, now))) {
                 if (hasExpiredClientSecret(session.client, now)) {
-                    if (!allowInteractive || options.allowInteractive === false || options.client.mode === "static" || configuredClient?.registration !== undefined)
+                    if (!allowInteractive || !interactiveEnabled || clientMode === "static" || configuredClient?.registration !== undefined)
                         throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
                     return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch, signal);
                 }
@@ -225,10 +230,10 @@ export function createDefaultOAuthClientProvider(options) {
             if (!allowInteractive || sessionDiscovery === undefined) {
                 return session;
             }
-            if (options.allowInteractive === false)
+            if (!interactiveEnabled)
                 throw new Error("OAuth interactive authorization is disabled");
             return authorizeSession(canonicalResource, session, sessionDiscovery, fetch, signal);
-        }, { signal, timeoutMs: options.sessionLockTimeoutMs });
+        }, { signal, timeoutMs: sessionLockTimeoutMs });
     }
     async function refreshSession(resource, session, discovery, fetch, signal) {
         signal?.throwIfAborted();
@@ -303,13 +308,8 @@ export function createDefaultOAuthClientProvider(options) {
         let reRegistrationAttempted = false;
         while (true) {
             const loopback = await createLoopbackAuthorizationSession({
-                openBrowser: options.browser.openBrowser,
-                readLine: options.browser.readLine,
-                createServer: options.browser.createServer,
-                landingPage: options.browser.landingPage,
-                redirectUri: options.browser.redirectUri,
-                signal: options.browser.signal === undefined ? signal : signal === undefined ? options.browser.signal : AbortSignal.any([signal, options.browser.signal]),
-                timeoutMs: options.browser.timeoutMs
+                ...browser,
+                signal: browser.signal === undefined ? signal : signal === undefined ? browser.signal : AbortSignal.any([signal, browser.signal])
             });
             let resolvedClient = null;
             try {
@@ -379,7 +379,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
     async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
         parentSignal?.throwIfAborted();
-        if (options.client.mode === "static" || configuredClient?.registration !== undefined) {
+        if (clientMode === "static" || configuredClient?.registration !== undefined) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -134,6 +134,7 @@ export interface OAuthSessionStore {
         timeoutMs: number;
     }): Promise<T>;
 }
+/** Configuration values are captured at creation; selected host dependencies remain live. */
 export interface DefaultOAuthClientProviderOptions {
     client: {
         mode: "dynamic";

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -237,6 +237,7 @@ interface OAuthSessionStore {
         timeoutMs: number;
     }): Promise<T>;
 }
+/** Configuration values are captured at creation; selected host dependencies remain live. */
 interface DefaultOAuthClientProviderOptions {
     client: {
         mode: "dynamic";

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4572,6 +4572,7 @@ var DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
 var MAX_JS_DATE_MS = 864e13;
 function createAuthStoreSessionStore(options = {}, namespace) {
   assertPersistenceNamespace(namespace);
+  options = snapshotPersistenceOptions(options);
   return {
     async withLock(resource, operation, lockOptions) {
       const store = createResourceSecretStore(resource, options, namespace);
@@ -4608,6 +4609,7 @@ function createAuthStoreSessionStore(options = {}, namespace) {
 }
 function createAuthStoreClientStore(options, namespace) {
   assertPersistenceNamespace(namespace);
+  options = snapshotPersistenceOptions(options);
   return {
     async load(issuer) {
       const store = createIssuerSecretStore(issuer, options, namespace);
@@ -4635,6 +4637,16 @@ function createAuthStoreClientStore(options, namespace) {
     }
   };
 }
+function snapshotPersistenceOptions(options) {
+  return {
+    ...options,
+    ...options.fileStore === void 0 ? {} : { fileStore: { ...options.fileStore } },
+    ...options.keychainStore === void 0 ? {} : { keychainStore: {
+      ...options.keychainStore,
+      ...options.keychainStore.lock === void 0 ? {} : { lock: { ...options.keychainStore.lock } }
+    } }
+  };
+}
 function createNamedSecretStore(key2, options, defaults, namespace) {
   const hash = crypto2.createHash("sha256").update(namespace === void 0 ? key2 : JSON.stringify([namespace, key2])).digest("hex");
   const configuredFilePath = options.fileStore?.filePath;
@@ -5239,7 +5251,14 @@ function createOAuthClientProvider(options) {
   return createDefaultOAuthClientProvider(options);
 }
 function createDefaultOAuthClientProvider(options) {
-  loopbackTarget(options.browser);
+  const browser = {
+    ...options.browser,
+    ...options.browser.landingPage === void 0 ? {} : { landingPage: { ...options.browser.landingPage } }
+  };
+  const clientMode = options.client.mode;
+  const interactiveEnabled = options.allowInteractive !== false;
+  const sessionLockTimeoutMs = options.sessionLockTimeoutMs;
+  loopbackTarget(browser);
   assertPersistenceNamespace(options.persistenceNamespace);
   const clientMetadata = getClientMetadata(options.client);
   const requestedScope = clientMetadata?.scope;
@@ -5398,7 +5417,7 @@ function createDefaultOAuthClientProvider(options) {
       if (forceRefresh && rejectedTokens !== void 0 && (rejectedTokens === null || session?.tokens === void 0 || !sameTokenGrant(session.tokens, rejectedTokens)))
         forceRefresh = false;
       const sessionDiscovery = resolveDiscovery(discovery, session);
-      if ((options.client.mode === "static" || configuredClient !== null || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
+      if ((clientMode === "static" || configuredClient !== null || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
         const configured = configuredClient;
         if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
           throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
@@ -5408,7 +5427,7 @@ function createDefaultOAuthClientProvider(options) {
       if (configuredTokenMethod !== void 0 && session !== null && (session.tokens !== void 0 || session.refreshState === "pending") && (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === void 0 ? "none" : "client_secret_post")) !== configuredTokenMethod)
         throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
       if (session?.refreshState === "pending") {
-        if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === void 0)
+        if (!allowInteractive || !interactiveEnabled || sessionDiscovery === void 0)
           throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
         return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch2, signal);
       }
@@ -5417,7 +5436,7 @@ function createDefaultOAuthClientProvider(options) {
       }
       if (session?.tokens?.refreshToken !== void 0 && sessionDiscovery !== void 0 && (forceRefresh || isExpired(session.tokens, now))) {
         if (hasExpiredClientSecret(session.client, now)) {
-          if (!allowInteractive || options.allowInteractive === false || options.client.mode === "static" || configuredClient?.registration !== void 0)
+          if (!allowInteractive || !interactiveEnabled || clientMode === "static" || configuredClient?.registration !== void 0)
             throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
           return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch2, signal);
         }
@@ -5433,10 +5452,10 @@ function createDefaultOAuthClientProvider(options) {
       if (!allowInteractive || sessionDiscovery === void 0) {
         return session;
       }
-      if (options.allowInteractive === false)
+      if (!interactiveEnabled)
         throw new Error("OAuth interactive authorization is disabled");
       return authorizeSession(canonicalResource, session, sessionDiscovery, fetch2, signal);
-    }, { signal, timeoutMs: options.sessionLockTimeoutMs });
+    }, { signal, timeoutMs: sessionLockTimeoutMs });
   }
   async function refreshSession(resource, session, discovery, fetch2, signal) {
     signal?.throwIfAborted();
@@ -5509,13 +5528,8 @@ function createDefaultOAuthClientProvider(options) {
     let reRegistrationAttempted = false;
     while (true) {
       const loopback = await createLoopbackAuthorizationSession({
-        openBrowser: options.browser.openBrowser,
-        readLine: options.browser.readLine,
-        createServer: options.browser.createServer,
-        landingPage: options.browser.landingPage,
-        redirectUri: options.browser.redirectUri,
-        signal: options.browser.signal === void 0 ? signal : signal === void 0 ? options.browser.signal : AbortSignal.any([signal, options.browser.signal]),
-        timeoutMs: options.browser.timeoutMs
+        ...browser,
+        signal: browser.signal === void 0 ? signal : signal === void 0 ? browser.signal : AbortSignal.any([signal, browser.signal])
       });
       let resolvedClient = null;
       try {
@@ -5584,7 +5598,7 @@ function createDefaultOAuthClientProvider(options) {
   }
   async function resolveClient(existingSession, discovery, redirectUri, fetch2, parentSignal) {
     parentSignal?.throwIfAborted();
-    if (options.client.mode === "static" || configuredClient?.registration !== void 0) {
+    if (clientMode === "static" || configuredClient?.registration !== void 0) {
       if (configuredClient === null) {
         throw new Error("OAuth client_id must not be blank");
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.57",
+  "version": "0.1.59",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",