tiny-http-mcp-server 0.1.59 → 0.1.61

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.59",
+      "version": "0.1.61",
       "license": "MIT"
     },
     {

package/node_modules/auth-store/README.md

@@ -25,6 +25,10 @@ const value = await store.get(); // "secret-value"
 await store.delete();
 ```
 
+Use `resolveSecretStoreBackend(options)` to select and validate the backend
+without constructing a store or reading credentials. Pass the returned backend
+explicitly when deferred operations must keep the same environment selection.
+
 Both built-in backends expose `store.withLock(operation, { signal, timeoutMs })`
 for transactions spanning a read, external operation and write. Independent
 instances and processes serialize the same encrypted file or Keychain

package/node_modules/auth-store/dist/create-secret-store.d.ts

@@ -1,2 +1,4 @@
-import type { CreateSecretStoreInput, CreateSecretStoreResult } from "./types.js";
+import type { CreateSecretStoreInput, CreateSecretStoreResult, StoreBackend } from "./types.js";
 export declare function createSecretStore(input: CreateSecretStoreInput): CreateSecretStoreResult;
+/** Select and validate a backend without constructing a store or accessing credentials. */
+export declare function resolveSecretStoreBackend(input: CreateSecretStoreInput): StoreBackend;

package/node_modules/auth-store/dist/create-secret-store.js

@@ -17,7 +17,7 @@ const storeFactories = {
     }
 };
 export function createSecretStore(input) {
-    const backend = resolveBackend(input);
+    const backend = resolveSecretStoreBackend(input);
     const platform = input.platform ?? process.platform;
     if (backend === "keychain" && platform !== MACOS_PLATFORM) {
         throw new Error(`Keychain backend is only supported on macOS. Current platform: ${platform}`);
@@ -25,7 +25,8 @@ export function createSecretStore(input) {
     const store = storeFactories[backend](input);
     return { backend, store };
 }
-function resolveBackend(input) {
+/** Select and validate a backend without constructing a store or accessing credentials. */
+export function resolveSecretStoreBackend(input) {
     const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
     const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
     const backend = configuredBackend?.trim();

package/node_modules/auth-store/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { createSecretStore } from "./create-secret-store.js";
+export { createSecretStore, resolveSecretStoreBackend } from "./create-secret-store.js";
 export { EncryptedFileStore } from "./encrypted-file-store.js";
 export { KeychainStore } from "./keychain-store.js";
 export type { SecretStoreLockOptions, SecretStoreLockFileSystem } from "./transaction-lock.js";

package/node_modules/auth-store/dist/index.js

@@ -1,4 +1,4 @@
-export { createSecretStore } from "./create-secret-store.js";
+export { createSecretStore, resolveSecretStoreBackend } from "./create-secret-store.js";
 export { EncryptedFileStore } from "./encrypted-file-store.js";
 export { KeychainStore } from "./keychain-store.js";
 export { key, MigratingSecretStore } from "./provider-store.js";

package/node_modules/mcp-oauth/README.md

@@ -64,6 +64,8 @@ aborting the original signal still cancels authorization.
 Native session and client persistence factories also capture file paths, salts,
 Keychain identities, lock locations and selected filesystem/command handles.
 Mutating these settings cannot redirect a later read or write.
+The factories resolve the selected backend environment variable once at creation;
+later environment changes cannot move a transaction between file and Keychain.
 
 `createJwksTokenVerifier(options)` accepts:
 
@@ -93,7 +95,11 @@ Always close a successful standalone session in `finally`.
 
 Provider request inputs accept an optional `signal`. It reaches callback waits,
 registration, token requests and bounded token-body reads. Cancellation retains
-its original reason and does not retry authorization. Custom providers should
+its original reason and does not retry authorization. Native provider calls
+also settle cancellation while host persistence or lazy discovery callbacks are
+waiting. An unfinished transaction keeps its lease until its host work finishes;
+following callers must wait or reach their own lock-acquisition limit. This
+prevents overlap with a pending refresh-intent write. Custom providers should
 observe the supplied signal and pass it to any work they start.
 
 `authorizeRequest` may return an owned token snapshot for the request it

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -1,7 +1,7 @@
 import { normalizeStoredOAuthClient } from "./client-registration.js";
 import crypto from "node:crypto";
 import path from "node:path";
-import { createSecretStore } from "auth-store";
+import { createSecretStore, resolveSecretStoreBackend } from "auth-store";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 const DEFAULT_FILE_SALT = "poe-code:mcp-oauth:v1";
 const DEFAULT_FILE_DIRECTORY = ".poe-code/mcp-oauth";
@@ -83,7 +83,7 @@ export function createAuthStoreClientStore(options, namespace) {
 }
 function snapshotPersistenceOptions(options) {
     return {
-        ...options,
+        ...options, backend: resolveSecretStoreBackend(options),
         ...(options.fileStore === undefined ? {} : { fileStore: { ...options.fileStore } }),
         ...(options.keychainStore === undefined ? {} : { keychainStore: { ...options.keychainStore,
                 ...(options.keychainStore.lock === undefined ? {} : { lock: { ...options.keychainStore.lock } }) } })

package/node_modules/mcp-oauth/dist/client/cancellable-operation.d.ts

@@ -0,0 +1,2 @@
+/** Settle the caller on cancellation without abandoning observation of host completion. */
+export declare function waitForOAuthOperation<T>(operation: Promise<T>, signal?: AbortSignal): Promise<T>;

package/node_modules/mcp-oauth/dist/client/cancellable-operation.js

@@ -0,0 +1,18 @@
+/** Settle the caller on cancellation without abandoning observation of host completion. */
+export async function waitForOAuthOperation(operation, signal) {
+    if (signal === undefined)
+        return operation;
+    let abort;
+    try {
+        return await new Promise((resolve, reject) => {
+            abort = () => reject(signal.reason);
+            signal.addEventListener("abort", abort, { once: true });
+            operation.then(resolve, reject);
+            if (signal.aborted)
+                abort();
+        });
+    }
+    finally {
+        signal.removeEventListener("abort", abort);
+    }
+}

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -12,6 +12,7 @@ import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
 import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError, readOAuthJsonObjectResponse } from "./token-endpoint.js";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 import { withOAuthSessionTransaction } from "./session-transaction.js";
+import { waitForOAuthOperation } from "./cancellable-operation.js";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export function createOAuthClientProvider(options) {
     if (isProviderOptions(options)) {
@@ -83,7 +84,7 @@ export function createDefaultOAuthClientProvider(options) {
                 return { ...initialGrant.tokens };
             if (input.discover === undefined)
                 return;
-            const discovery = await input.discover();
+            const discovery = await waitForOAuthOperation(input.discover(), input.signal);
             input.signal?.throwIfAborted();
             assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
             session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
@@ -113,11 +114,12 @@ export function createDefaultOAuthClientProvider(options) {
         },
         async handleUnauthorized(input) {
             try {
+                input.signal?.throwIfAborted();
                 assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
                 const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
                 const resource = canonicalizeResourceIndicator(input.discovery.resource);
                 assertRequestMatchesResource(requestUrl, resource);
-                const cached = await loadSession(resource);
+                const cached = await waitForOAuthOperation(loadSession(resource), input.signal);
                 const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : undefined);
                 let rejectedCurrentGrant = hasCachedAccessToken(cached) || (!initialGrantConsumed && initialGrant?.resource === resource);
                 let presentedTokens = input.presentedTokens;

package/node_modules/mcp-oauth/dist/client/session-transaction.js

@@ -1,3 +1,4 @@
+import { waitForOAuthOperation } from "./cancellable-operation.js";
 const queues = new WeakMap();
 /** Serialize the complete read/redeem/write operation, with independent cancellation for waiters. */
 export async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
@@ -13,6 +14,7 @@ export async function withOAuthSessionTransaction(store, resource, operation, op
     const current = new Promise(resolve => { release = resolve; });
     const tail = previous.then(() => current);
     pending.set(resource, tail);
+    let running;
     try {
         let timer;
         let rejectWait;
@@ -30,12 +32,17 @@ export async function withOAuthSessionTransaction(store, resource, operation, op
             options.signal?.removeEventListener("abort", abort);
         }
         options.signal?.throwIfAborted();
-        return store.withLock === undefined ? await operation() : await store.withLock(resource, operation, {
+        running = (async () => store.withLock === undefined ? operation() : store.withLock(resource, operation, {
             signal: options.signal, timeoutMs: Math.max(0, timeoutMs - (performance.now() - started))
-        });
+        }))();
+        return await waitForOAuthOperation(running, options.signal);
     }
     finally {
-        release();
+        // Cancellation settles the caller, but unfinished host work still owns the lease.
+        if (running === undefined)
+            release();
+        else
+            void running.then(release, release);
         void tail.then(() => { if (pending.get(resource) === tail)
             pending.delete(resource); });
     }

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4526,7 +4526,7 @@ var storeFactories = {
   }
 };
 function createSecretStore(input) {
-  const backend = resolveBackend(input);
+  const backend = resolveSecretStoreBackend(input);
   const platform = input.platform ?? process.platform;
   if (backend === "keychain" && platform !== MACOS_PLATFORM) {
     throw new Error(`Keychain backend is only supported on macOS. Current platform: ${platform}`);
@@ -4534,7 +4534,7 @@ function createSecretStore(input) {
   const store = storeFactories[backend](input);
   return { backend, store };
 }
-function resolveBackend(input) {
+function resolveSecretStoreBackend(input) {
   const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
   const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
   const backend = configuredBackend?.trim();
@@ -4640,6 +4640,7 @@ function createAuthStoreClientStore(options, namespace) {
 function snapshotPersistenceOptions(options) {
   return {
     ...options,
+    backend: resolveSecretStoreBackend(options),
     ...options.fileStore === void 0 ? {} : { fileStore: { ...options.fileStore } },
     ...options.keychainStore === void 0 ? {} : { keychainStore: {
       ...options.keychainStore,
@@ -5193,6 +5194,24 @@ function normalizeBearerTokenType(value) {
   return value.toLowerCase() === "bearer" ? "Bearer" : null;
 }
 
+// ../mcp-oauth/dist/client/cancellable-operation.js
+async function waitForOAuthOperation(operation, signal) {
+  if (signal === void 0)
+    return operation;
+  let abort;
+  try {
+    return await new Promise((resolve, reject) => {
+      abort = () => reject(signal.reason);
+      signal.addEventListener("abort", abort, { once: true });
+      operation.then(resolve, reject);
+      if (signal.aborted)
+        abort();
+    });
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
+
 // ../mcp-oauth/dist/client/session-transaction.js
 var queues = /* @__PURE__ */ new WeakMap();
 async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
@@ -5210,6 +5229,7 @@ async function withOAuthSessionTransaction(store, resource, operation, options =
   });
   const tail = previous.then(() => current);
   pending.set(resource, tail);
+  let running;
   try {
     let timer;
     let rejectWait;
@@ -5229,12 +5249,16 @@ async function withOAuthSessionTransaction(store, resource, operation, options =
       options.signal?.removeEventListener("abort", abort);
     }
     options.signal?.throwIfAborted();
-    return store.withLock === void 0 ? await operation() : await store.withLock(resource, operation, {
+    running = (async () => store.withLock === void 0 ? operation() : store.withLock(resource, operation, {
       signal: options.signal,
       timeoutMs: Math.max(0, timeoutMs - (performance.now() - started))
-    });
+    }))();
+    return await waitForOAuthOperation(running, options.signal);
   } finally {
-    release();
+    if (running === void 0)
+      release();
+    else
+      void running.then(release, release);
     void tail.then(() => {
       if (pending.get(resource) === tail)
         pending.delete(resource);
@@ -5311,7 +5335,7 @@ function createDefaultOAuthClientProvider(options) {
         return { ...initialGrant.tokens };
       if (input.discover === void 0)
         return;
-      const discovery = await input.discover();
+      const discovery = await waitForOAuthOperation(input.discover(), input.signal);
       input.signal?.throwIfAborted();
       assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
       session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
@@ -5337,11 +5361,12 @@ function createDefaultOAuthClientProvider(options) {
     },
     async handleUnauthorized(input) {
       try {
+        input.signal?.throwIfAborted();
         assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
         const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
         const resource = canonicalizeResourceIndicator(input.discovery.resource);
         assertRequestMatchesResource(requestUrl, resource);
-        const cached = await loadSession(resource);
+        const cached = await waitForOAuthOperation(loadSession(resource), input.signal);
         const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : void 0);
         let rejectedCurrentGrant = hasCachedAccessToken(cached) || !initialGrantConsumed && initialGrant?.resource === resource;
         let presentedTokens = input.presentedTokens;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.59",
+  "version": "0.1.61",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",