tiny-http-mcp-server 0.1.60 → 0.1.62

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.60",
+      "version": "0.1.62",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -95,7 +95,11 @@ Always close a successful standalone session in `finally`.
 
 Provider request inputs accept an optional `signal`. It reaches callback waits,
 registration, token requests and bounded token-body reads. Cancellation retains
-its original reason and does not retry authorization. Custom providers should
+its original reason and does not retry authorization. Native provider calls
+also settle cancellation while host persistence or lazy discovery callbacks are
+waiting. An unfinished transaction keeps its lease until its host work finishes;
+following callers must wait or reach their own lock-acquisition limit. This
+prevents overlap with a pending refresh-intent write. Custom providers should
 observe the supplied signal and pass it to any work they start.
 
 `authorizeRequest` may return an owned token snapshot for the request it
@@ -153,9 +157,13 @@ used only for its resource.
 Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
-Input tokens are copied and invalid expiry values fail before authorization.
+Input tokens are copied before any host clock anchors a relative lifetime;
+clock mutation cannot replace the selected access/refresh/scope values. Invalid
+expiry values fail before authorization.
 For a raw OAuth response, `parseOAuthTokenGrant(response, { issuedAt, expiresAt })`
-returns normalized `StoredOAuthTokens`. It accepts `access_token`, `refresh_token`,
+returns normalized `StoredOAuthTokens`. Timing options are captured before the
+host clock runs, so it cannot bypass their earlier validation. The parser accepts
+`access_token`, `refresh_token`,
 `token_type`, `scope`, `expires_in` (seconds), `expires_at` (epoch seconds), and
 `expiresAt` (epoch milliseconds). Numeric absolute expiry wins over relative
 lifetime; the options timestamp wins over response timestamps. The optional

package/node_modules/mcp-oauth/dist/client/cancellable-operation.d.ts

@@ -0,0 +1,2 @@
+/** Settle the caller on cancellation without abandoning observation of host completion. */
+export declare function waitForOAuthOperation<T>(operation: Promise<T>, signal?: AbortSignal): Promise<T>;

package/node_modules/mcp-oauth/dist/client/cancellable-operation.js

@@ -0,0 +1,18 @@
+/** Settle the caller on cancellation without abandoning observation of host completion. */
+export async function waitForOAuthOperation(operation, signal) {
+    if (signal === undefined)
+        return operation;
+    let abort;
+    try {
+        return await new Promise((resolve, reject) => {
+            abort = () => reject(signal.reason);
+            signal.addEventListener("abort", abort, { once: true });
+            operation.then(resolve, reject);
+            if (signal.aborted)
+                abort();
+        });
+    }
+    finally {
+        signal.removeEventListener("abort", abort);
+    }
+}

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -12,6 +12,7 @@ import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
 import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError, readOAuthJsonObjectResponse } from "./token-endpoint.js";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 import { withOAuthSessionTransaction } from "./session-transaction.js";
+import { waitForOAuthOperation } from "./cancellable-operation.js";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export function createOAuthClientProvider(options) {
     if (isProviderOptions(options)) {
@@ -83,7 +84,7 @@ export function createDefaultOAuthClientProvider(options) {
                 return { ...initialGrant.tokens };
             if (input.discover === undefined)
                 return;
-            const discovery = await input.discover();
+            const discovery = await waitForOAuthOperation(input.discover(), input.signal);
             input.signal?.throwIfAborted();
             assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
             session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
@@ -113,11 +114,12 @@ export function createDefaultOAuthClientProvider(options) {
         },
         async handleUnauthorized(input) {
             try {
+                input.signal?.throwIfAborted();
                 assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
                 const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
                 const resource = canonicalizeResourceIndicator(input.discovery.resource);
                 assertRequestMatchesResource(requestUrl, resource);
-                const cached = await loadSession(resource);
+                const cached = await waitForOAuthOperation(loadSession(resource), input.signal);
                 const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : undefined);
                 let rejectedCurrentGrant = hasCachedAccessToken(cached) || (!initialGrantConsumed && initialGrant?.resource === resource);
                 let presentedTokens = input.presentedTokens;
@@ -601,6 +603,7 @@ function normalizeImportedTokens(value, now) {
     const absolute = getOwnEntry(value, "expiresAt");
     const lifetime = getOwnEntry(value, "expiresIn");
     const issuedAt = getOwnEntry(value, "issuedAt");
+    const snapshot = { ...value };
     if (lifetime !== undefined && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
         throw new Error("OAuth initial grant has invalid relative expiry");
     if (issuedAt !== undefined && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) ||
@@ -608,7 +611,7 @@ function normalizeImportedTokens(value, now) {
         throw new Error("OAuth initial grant has invalid issuance time");
     const expiresAt = absolute !== undefined && absolute !== null ? absolute :
         lifetime === undefined ? null : (issuedAt === undefined ? now() : issuedAt) + lifetime * 1000;
-    return normalizeStoredTokens({ ...value, expiresAt });
+    return normalizeStoredTokens({ ...snapshot, expiresAt });
 }
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {

package/node_modules/mcp-oauth/dist/client/session-transaction.js

@@ -1,3 +1,4 @@
+import { waitForOAuthOperation } from "./cancellable-operation.js";
 const queues = new WeakMap();
 /** Serialize the complete read/redeem/write operation, with independent cancellation for waiters. */
 export async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
@@ -13,6 +14,7 @@ export async function withOAuthSessionTransaction(store, resource, operation, op
     const current = new Promise(resolve => { release = resolve; });
     const tail = previous.then(() => current);
     pending.set(resource, tail);
+    let running;
     try {
         let timer;
         let rejectWait;
@@ -30,12 +32,17 @@ export async function withOAuthSessionTransaction(store, resource, operation, op
             options.signal?.removeEventListener("abort", abort);
         }
         options.signal?.throwIfAborted();
-        return store.withLock === undefined ? await operation() : await store.withLock(resource, operation, {
+        running = (async () => store.withLock === undefined ? operation() : store.withLock(resource, operation, {
             signal: options.signal, timeoutMs: Math.max(0, timeoutMs - (performance.now() - started))
-        });
+        }))();
+        return await waitForOAuthOperation(running, options.signal);
     }
     finally {
-        release();
+        // Cancellation settles the caller, but unfinished host work still owns the lease.
+        if (running === undefined)
+            release();
+        else
+            void running.then(release, release);
         void tail.then(() => { if (pending.get(resource) === tail)
             pending.delete(resource); });
     }

package/node_modules/mcp-oauth/dist/client/token-grant.js

@@ -2,6 +2,7 @@ import { copyBoundedOAuthJson } from "./bounded-json.js";
 import { normalizeOAuthScope } from "./scope.js";
 /** Validate a raw RFC token response and anchor its lifetime once for persistence. */
 export function parseOAuthTokenGrant(value, options = {}) {
+    options = { ...options };
     const invalid = () => new Error("Invalid OAuth token grant");
     const result = copyBoundedOAuthJson(value, "Invalid OAuth token grant");
     if (typeof result !== "object" || result === null || Array.isArray(result))

package/node_modules/tiny-mcp-client/dist/index.js

@@ -5194,6 +5194,24 @@ function normalizeBearerTokenType(value) {
   return value.toLowerCase() === "bearer" ? "Bearer" : null;
 }
 
+// ../mcp-oauth/dist/client/cancellable-operation.js
+async function waitForOAuthOperation(operation, signal) {
+  if (signal === void 0)
+    return operation;
+  let abort;
+  try {
+    return await new Promise((resolve, reject) => {
+      abort = () => reject(signal.reason);
+      signal.addEventListener("abort", abort, { once: true });
+      operation.then(resolve, reject);
+      if (signal.aborted)
+        abort();
+    });
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
+
 // ../mcp-oauth/dist/client/session-transaction.js
 var queues = /* @__PURE__ */ new WeakMap();
 async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
@@ -5211,6 +5229,7 @@ async function withOAuthSessionTransaction(store, resource, operation, options =
   });
   const tail = previous.then(() => current);
   pending.set(resource, tail);
+  let running;
   try {
     let timer;
     let rejectWait;
@@ -5230,12 +5249,16 @@ async function withOAuthSessionTransaction(store, resource, operation, options =
       options.signal?.removeEventListener("abort", abort);
     }
     options.signal?.throwIfAborted();
-    return store.withLock === void 0 ? await operation() : await store.withLock(resource, operation, {
+    running = (async () => store.withLock === void 0 ? operation() : store.withLock(resource, operation, {
       signal: options.signal,
       timeoutMs: Math.max(0, timeoutMs - (performance.now() - started))
-    });
+    }))();
+    return await waitForOAuthOperation(running, options.signal);
   } finally {
-    release();
+    if (running === void 0)
+      release();
+    else
+      void running.then(release, release);
     void tail.then(() => {
       if (pending.get(resource) === tail)
         pending.delete(resource);
@@ -5312,7 +5335,7 @@ function createDefaultOAuthClientProvider(options) {
         return { ...initialGrant.tokens };
       if (input.discover === void 0)
         return;
-      const discovery = await input.discover();
+      const discovery = await waitForOAuthOperation(input.discover(), input.signal);
       input.signal?.throwIfAborted();
       assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
       session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
@@ -5338,11 +5361,12 @@ function createDefaultOAuthClientProvider(options) {
     },
     async handleUnauthorized(input) {
       try {
+        input.signal?.throwIfAborted();
         assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
         const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
         const resource = canonicalizeResourceIndicator(input.discovery.resource);
         assertRequestMatchesResource(requestUrl, resource);
-        const cached = await loadSession(resource);
+        const cached = await waitForOAuthOperation(loadSession(resource), input.signal);
         const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : void 0);
         let rejectedCurrentGrant = hasCachedAccessToken(cached) || !initialGrantConsumed && initialGrant?.resource === resource;
         let presentedTokens = input.presentedTokens;
@@ -5810,12 +5834,13 @@ function normalizeImportedTokens(value, now) {
   const absolute = getOwnEntry6(value, "expiresAt");
   const lifetime = getOwnEntry6(value, "expiresIn");
   const issuedAt = getOwnEntry6(value, "issuedAt");
+  const snapshot = { ...value };
   if (lifetime !== void 0 && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
     throw new Error("OAuth initial grant has invalid relative expiry");
   if (issuedAt !== void 0 && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) || Math.abs(issuedAt) > MAX_JS_DATE_MS3))
     throw new Error("OAuth initial grant has invalid issuance time");
   const expiresAt = absolute !== void 0 && absolute !== null ? absolute : lifetime === void 0 ? null : (issuedAt === void 0 ? now() : issuedAt) + lifetime * 1e3;
-  return normalizeStoredTokens({ ...value, expiresAt });
+  return normalizeStoredTokens({ ...snapshot, expiresAt });
 }
 function normalizeStoredTokens(value) {
   if (value === void 0 || !isObjectRecord3(value)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.60",
+  "version": "0.1.62",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",