tiny-http-mcp-server 0.1.60 → 0.1.61

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.60",
+      "version": "0.1.61",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -95,7 +95,11 @@ Always close a successful standalone session in `finally`.
 
 Provider request inputs accept an optional `signal`. It reaches callback waits,
 registration, token requests and bounded token-body reads. Cancellation retains
-its original reason and does not retry authorization. Custom providers should
+its original reason and does not retry authorization. Native provider calls
+also settle cancellation while host persistence or lazy discovery callbacks are
+waiting. An unfinished transaction keeps its lease until its host work finishes;
+following callers must wait or reach their own lock-acquisition limit. This
+prevents overlap with a pending refresh-intent write. Custom providers should
 observe the supplied signal and pass it to any work they start.
 
 `authorizeRequest` may return an owned token snapshot for the request it

package/node_modules/mcp-oauth/dist/client/cancellable-operation.d.ts

@@ -0,0 +1,2 @@
+/** Settle the caller on cancellation without abandoning observation of host completion. */
+export declare function waitForOAuthOperation<T>(operation: Promise<T>, signal?: AbortSignal): Promise<T>;

package/node_modules/mcp-oauth/dist/client/cancellable-operation.js

@@ -0,0 +1,18 @@
+/** Settle the caller on cancellation without abandoning observation of host completion. */
+export async function waitForOAuthOperation(operation, signal) {
+    if (signal === undefined)
+        return operation;
+    let abort;
+    try {
+        return await new Promise((resolve, reject) => {
+            abort = () => reject(signal.reason);
+            signal.addEventListener("abort", abort, { once: true });
+            operation.then(resolve, reject);
+            if (signal.aborted)
+                abort();
+        });
+    }
+    finally {
+        signal.removeEventListener("abort", abort);
+    }
+}

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -12,6 +12,7 @@ import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
 import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError, readOAuthJsonObjectResponse } from "./token-endpoint.js";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 import { withOAuthSessionTransaction } from "./session-transaction.js";
+import { waitForOAuthOperation } from "./cancellable-operation.js";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export function createOAuthClientProvider(options) {
     if (isProviderOptions(options)) {
@@ -83,7 +84,7 @@ export function createDefaultOAuthClientProvider(options) {
                 return { ...initialGrant.tokens };
             if (input.discover === undefined)
                 return;
-            const discovery = await input.discover();
+            const discovery = await waitForOAuthOperation(input.discover(), input.signal);
             input.signal?.throwIfAborted();
             assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
             session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
@@ -113,11 +114,12 @@ export function createDefaultOAuthClientProvider(options) {
         },
         async handleUnauthorized(input) {
             try {
+                input.signal?.throwIfAborted();
                 assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
                 const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
                 const resource = canonicalizeResourceIndicator(input.discovery.resource);
                 assertRequestMatchesResource(requestUrl, resource);
-                const cached = await loadSession(resource);
+                const cached = await waitForOAuthOperation(loadSession(resource), input.signal);
                 const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : undefined);
                 let rejectedCurrentGrant = hasCachedAccessToken(cached) || (!initialGrantConsumed && initialGrant?.resource === resource);
                 let presentedTokens = input.presentedTokens;

package/node_modules/mcp-oauth/dist/client/session-transaction.js

@@ -1,3 +1,4 @@
+import { waitForOAuthOperation } from "./cancellable-operation.js";
 const queues = new WeakMap();
 /** Serialize the complete read/redeem/write operation, with independent cancellation for waiters. */
 export async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
@@ -13,6 +14,7 @@ export async function withOAuthSessionTransaction(store, resource, operation, op
     const current = new Promise(resolve => { release = resolve; });
     const tail = previous.then(() => current);
     pending.set(resource, tail);
+    let running;
     try {
         let timer;
         let rejectWait;
@@ -30,12 +32,17 @@ export async function withOAuthSessionTransaction(store, resource, operation, op
             options.signal?.removeEventListener("abort", abort);
         }
         options.signal?.throwIfAborted();
-        return store.withLock === undefined ? await operation() : await store.withLock(resource, operation, {
+        running = (async () => store.withLock === undefined ? operation() : store.withLock(resource, operation, {
             signal: options.signal, timeoutMs: Math.max(0, timeoutMs - (performance.now() - started))
-        });
+        }))();
+        return await waitForOAuthOperation(running, options.signal);
     }
     finally {
-        release();
+        // Cancellation settles the caller, but unfinished host work still owns the lease.
+        if (running === undefined)
+            release();
+        else
+            void running.then(release, release);
         void tail.then(() => { if (pending.get(resource) === tail)
             pending.delete(resource); });
     }

package/node_modules/tiny-mcp-client/dist/index.js

@@ -5194,6 +5194,24 @@ function normalizeBearerTokenType(value) {
   return value.toLowerCase() === "bearer" ? "Bearer" : null;
 }
 
+// ../mcp-oauth/dist/client/cancellable-operation.js
+async function waitForOAuthOperation(operation, signal) {
+  if (signal === void 0)
+    return operation;
+  let abort;
+  try {
+    return await new Promise((resolve, reject) => {
+      abort = () => reject(signal.reason);
+      signal.addEventListener("abort", abort, { once: true });
+      operation.then(resolve, reject);
+      if (signal.aborted)
+        abort();
+    });
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
+
 // ../mcp-oauth/dist/client/session-transaction.js
 var queues = /* @__PURE__ */ new WeakMap();
 async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
@@ -5211,6 +5229,7 @@ async function withOAuthSessionTransaction(store, resource, operation, options =
   });
   const tail = previous.then(() => current);
   pending.set(resource, tail);
+  let running;
   try {
     let timer;
     let rejectWait;
@@ -5230,12 +5249,16 @@ async function withOAuthSessionTransaction(store, resource, operation, options =
       options.signal?.removeEventListener("abort", abort);
     }
     options.signal?.throwIfAborted();
-    return store.withLock === void 0 ? await operation() : await store.withLock(resource, operation, {
+    running = (async () => store.withLock === void 0 ? operation() : store.withLock(resource, operation, {
       signal: options.signal,
       timeoutMs: Math.max(0, timeoutMs - (performance.now() - started))
-    });
+    }))();
+    return await waitForOAuthOperation(running, options.signal);
   } finally {
-    release();
+    if (running === void 0)
+      release();
+    else
+      void running.then(release, release);
     void tail.then(() => {
       if (pending.get(resource) === tail)
         pending.delete(resource);
@@ -5312,7 +5335,7 @@ function createDefaultOAuthClientProvider(options) {
         return { ...initialGrant.tokens };
       if (input.discover === void 0)
         return;
-      const discovery = await input.discover();
+      const discovery = await waitForOAuthOperation(input.discover(), input.signal);
       input.signal?.throwIfAborted();
       assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
       session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
@@ -5338,11 +5361,12 @@ function createDefaultOAuthClientProvider(options) {
     },
     async handleUnauthorized(input) {
       try {
+        input.signal?.throwIfAborted();
         assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
         const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
         const resource = canonicalizeResourceIndicator(input.discovery.resource);
         assertRequestMatchesResource(requestUrl, resource);
-        const cached = await loadSession(resource);
+        const cached = await waitForOAuthOperation(loadSession(resource), input.signal);
         const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : void 0);
         let rejectedCurrentGrant = hasCachedAccessToken(cached) || !initialGrantConsumed && initialGrant?.resource === resource;
         let presentedTokens = input.presentedTokens;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.60",
+  "version": "0.1.61",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",