tiny-http-mcp-server 0.1.61 → 0.1.62

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.61",
+      "version": "0.1.62",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -157,9 +157,13 @@ used only for its resource.
 Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
-Input tokens are copied and invalid expiry values fail before authorization.
+Input tokens are copied before any host clock anchors a relative lifetime;
+clock mutation cannot replace the selected access/refresh/scope values. Invalid
+expiry values fail before authorization.
 For a raw OAuth response, `parseOAuthTokenGrant(response, { issuedAt, expiresAt })`
-returns normalized `StoredOAuthTokens`. It accepts `access_token`, `refresh_token`,
+returns normalized `StoredOAuthTokens`. Timing options are captured before the
+host clock runs, so it cannot bypass their earlier validation. The parser accepts
+`access_token`, `refresh_token`,
 `token_type`, `scope`, `expires_in` (seconds), `expires_at` (epoch seconds), and
 `expiresAt` (epoch milliseconds). Numeric absolute expiry wins over relative
 lifetime; the options timestamp wins over response timestamps. The optional

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -603,6 +603,7 @@ function normalizeImportedTokens(value, now) {
     const absolute = getOwnEntry(value, "expiresAt");
     const lifetime = getOwnEntry(value, "expiresIn");
     const issuedAt = getOwnEntry(value, "issuedAt");
+    const snapshot = { ...value };
     if (lifetime !== undefined && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
         throw new Error("OAuth initial grant has invalid relative expiry");
     if (issuedAt !== undefined && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) ||
@@ -610,7 +611,7 @@ function normalizeImportedTokens(value, now) {
         throw new Error("OAuth initial grant has invalid issuance time");
     const expiresAt = absolute !== undefined && absolute !== null ? absolute :
         lifetime === undefined ? null : (issuedAt === undefined ? now() : issuedAt) + lifetime * 1000;
-    return normalizeStoredTokens({ ...value, expiresAt });
+    return normalizeStoredTokens({ ...snapshot, expiresAt });
 }
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {

package/node_modules/mcp-oauth/dist/client/token-grant.js

@@ -2,6 +2,7 @@ import { copyBoundedOAuthJson } from "./bounded-json.js";
 import { normalizeOAuthScope } from "./scope.js";
 /** Validate a raw RFC token response and anchor its lifetime once for persistence. */
 export function parseOAuthTokenGrant(value, options = {}) {
+    options = { ...options };
     const invalid = () => new Error("Invalid OAuth token grant");
     const result = copyBoundedOAuthJson(value, "Invalid OAuth token grant");
     if (typeof result !== "object" || result === null || Array.isArray(result))

package/node_modules/tiny-mcp-client/dist/index.js

@@ -5834,12 +5834,13 @@ function normalizeImportedTokens(value, now) {
   const absolute = getOwnEntry6(value, "expiresAt");
   const lifetime = getOwnEntry6(value, "expiresIn");
   const issuedAt = getOwnEntry6(value, "issuedAt");
+  const snapshot = { ...value };
   if (lifetime !== void 0 && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
     throw new Error("OAuth initial grant has invalid relative expiry");
   if (issuedAt !== void 0 && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) || Math.abs(issuedAt) > MAX_JS_DATE_MS3))
     throw new Error("OAuth initial grant has invalid issuance time");
   const expiresAt = absolute !== void 0 && absolute !== null ? absolute : lifetime === void 0 ? null : (issuedAt === void 0 ? now() : issuedAt) + lifetime * 1e3;
-  return normalizeStoredTokens({ ...value, expiresAt });
+  return normalizeStoredTokens({ ...snapshot, expiresAt });
 }
 function normalizeStoredTokens(value) {
   if (value === void 0 || !isObjectRecord3(value)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.61",
+  "version": "0.1.62",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",