tiny-http-mcp-server 0.1.61 → 0.1.63

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.61",
+      "version": "0.1.63",
       "license": "MIT"
     },
     {

package/node_modules/auth-store/README.md

@@ -34,7 +34,9 @@ for transactions spanning a read, external operation and write. Independent
 instances and processes serialize the same encrypted file or Keychain
 service/account; unrelated identities proceed independently. The default
 acquisition timeout is 30 seconds. Cancellation during acquisition does not
-release the active owner's lock. Individual `get`, `set` and `delete` calls do
+release the active owner's lock. Each acquisition retains its original signal
+and timeout before path checks wait; replacing the caller's option handles cannot
+bypass original cancellation or introduce another signal's cancellation. Individual `get`, `set` and `delete` calls do
 not implicitly acquire it.
 
 Locks use private filesystem claim directories, containing PID/random names

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -81,6 +81,7 @@ export class EncryptedFileStore {
         }
     }
     async withLock(operation, options = {}) {
+        options = { ...options };
         await this.assertCredentialPathHasNoSymbolicLinks(`${this.filePath}.lock`);
         if (this.fs.readdir === undefined)
             throw new Error("Secret-store transaction locks require filesystem readdir support");

package/node_modules/auth-store/dist/transaction-lock.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { hasOwnErrorCode } from "./error-codes.js";
 /** Filesystem bakery lock: unique claims allow dead-owner cleanup without deleting a replacement owner's lock. */
 export async function withSecretStoreFileLock(fs, lockDirectory, operation, options = {}) {
+    options = { ...options };
     const timeoutMs = options.timeoutMs ?? 30_000;
     if (!Number.isFinite(timeoutMs) || timeoutMs < 0 || timeoutMs > 2_147_483_647)
         throw new Error("Invalid secret-store transaction lock timeout");

package/node_modules/mcp-oauth/README.md

@@ -64,7 +64,8 @@ aborting the original signal still cancels authorization.
 Native session and client persistence factories also capture file paths, salts,
 Keychain identities, lock locations and selected filesystem/command handles.
 Mutating these settings cannot redirect a later read or write.
-The factories resolve the selected backend environment variable once at creation;
+The factories copy these settings before reading the selected backend environment
+variable, so its getter cannot replace them. They resolve that variable once at creation;
 later environment changes cannot move a transaction between file and Keychain.
 
 `createJwksTokenVerifier(options)` accepts:
@@ -157,9 +158,13 @@ used only for its resource.
 Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
-Input tokens are copied and invalid expiry values fail before authorization.
+Input tokens are copied before any host clock anchors a relative lifetime;
+clock mutation cannot replace the selected access/refresh/scope values. Invalid
+expiry values fail before authorization.
 For a raw OAuth response, `parseOAuthTokenGrant(response, { issuedAt, expiresAt })`
-returns normalized `StoredOAuthTokens`. It accepts `access_token`, `refresh_token`,
+returns normalized `StoredOAuthTokens`. Timing options are captured before the
+host clock runs, so it cannot bypass their earlier validation. The parser accepts
+`access_token`, `refresh_token`,
 `token_type`, `scope`, `expires_in` (seconds), `expires_at` (epoch seconds), and
 `expiresAt` (epoch milliseconds). Numeric absolute expiry wins over relative
 lifetime; the options timestamp wins over response timestamps. The optional

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -82,12 +82,14 @@ export function createAuthStoreClientStore(options, namespace) {
     };
 }
 function snapshotPersistenceOptions(options) {
-    return {
-        ...options, backend: resolveSecretStoreBackend(options),
+    const snapshot = {
+        ...options,
         ...(options.fileStore === undefined ? {} : { fileStore: { ...options.fileStore } }),
         ...(options.keychainStore === undefined ? {} : { keychainStore: { ...options.keychainStore,
                 ...(options.keychainStore.lock === undefined ? {} : { lock: { ...options.keychainStore.lock } }) } })
     };
+    snapshot.backend = resolveSecretStoreBackend(snapshot);
+    return snapshot;
 }
 export function createNamedSecretStore(key, options, defaults, namespace) {
     const hash = crypto.createHash("sha256").update(namespace === undefined ? key : JSON.stringify([namespace, key])).digest("hex");

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -603,6 +603,7 @@ function normalizeImportedTokens(value, now) {
     const absolute = getOwnEntry(value, "expiresAt");
     const lifetime = getOwnEntry(value, "expiresIn");
     const issuedAt = getOwnEntry(value, "issuedAt");
+    const snapshot = { ...value };
     if (lifetime !== undefined && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
         throw new Error("OAuth initial grant has invalid relative expiry");
     if (issuedAt !== undefined && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) ||
@@ -610,7 +611,7 @@ function normalizeImportedTokens(value, now) {
         throw new Error("OAuth initial grant has invalid issuance time");
     const expiresAt = absolute !== undefined && absolute !== null ? absolute :
         lifetime === undefined ? null : (issuedAt === undefined ? now() : issuedAt) + lifetime * 1000;
-    return normalizeStoredTokens({ ...value, expiresAt });
+    return normalizeStoredTokens({ ...snapshot, expiresAt });
 }
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {

package/node_modules/mcp-oauth/dist/client/token-grant.js

@@ -2,6 +2,7 @@ import { copyBoundedOAuthJson } from "./bounded-json.js";
 import { normalizeOAuthScope } from "./scope.js";
 /** Validate a raw RFC token response and anchor its lifetime once for persistence. */
 export function parseOAuthTokenGrant(value, options = {}) {
+    options = { ...options };
     const invalid = () => new Error("Invalid OAuth token grant");
     const result = copyBoundedOAuthJson(value, "Invalid OAuth token grant");
     if (typeof result !== "object" || result === null || Array.isArray(result))

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3907,6 +3907,7 @@ function hasOwnErrorCode(error, code) {
 import { randomUUID } from "node:crypto";
 import path from "node:path";
 async function withSecretStoreFileLock(fs2, lockDirectory, operation, options = {}) {
+  options = { ...options };
   const timeoutMs = options.timeoutMs ?? 3e4;
   if (!Number.isFinite(timeoutMs) || timeoutMs < 0 || timeoutMs > 2147483647)
     throw new Error("Invalid secret-store transaction lock timeout");
@@ -4126,6 +4127,7 @@ var EncryptedFileStore = class {
     }
   }
   async withLock(operation, options = {}) {
+    options = { ...options };
     await this.assertCredentialPathHasNoSymbolicLinks(`${this.filePath}.lock`);
     if (this.fs.readdir === void 0)
       throw new Error("Secret-store transaction locks require filesystem readdir support");
@@ -4638,15 +4640,16 @@ function createAuthStoreClientStore(options, namespace) {
   };
 }
 function snapshotPersistenceOptions(options) {
-  return {
+  const snapshot = {
     ...options,
-    backend: resolveSecretStoreBackend(options),
     ...options.fileStore === void 0 ? {} : { fileStore: { ...options.fileStore } },
     ...options.keychainStore === void 0 ? {} : { keychainStore: {
       ...options.keychainStore,
       ...options.keychainStore.lock === void 0 ? {} : { lock: { ...options.keychainStore.lock } }
     } }
   };
+  snapshot.backend = resolveSecretStoreBackend(snapshot);
+  return snapshot;
 }
 function createNamedSecretStore(key2, options, defaults, namespace) {
   const hash = crypto2.createHash("sha256").update(namespace === void 0 ? key2 : JSON.stringify([namespace, key2])).digest("hex");
@@ -5834,12 +5837,13 @@ function normalizeImportedTokens(value, now) {
   const absolute = getOwnEntry6(value, "expiresAt");
   const lifetime = getOwnEntry6(value, "expiresIn");
   const issuedAt = getOwnEntry6(value, "issuedAt");
+  const snapshot = { ...value };
   if (lifetime !== void 0 && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
     throw new Error("OAuth initial grant has invalid relative expiry");
   if (issuedAt !== void 0 && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) || Math.abs(issuedAt) > MAX_JS_DATE_MS3))
     throw new Error("OAuth initial grant has invalid issuance time");
   const expiresAt = absolute !== void 0 && absolute !== null ? absolute : lifetime === void 0 ? null : (issuedAt === void 0 ? now() : issuedAt) + lifetime * 1e3;
-  return normalizeStoredTokens({ ...value, expiresAt });
+  return normalizeStoredTokens({ ...snapshot, expiresAt });
 }
 function normalizeStoredTokens(value) {
   if (value === void 0 || !isObjectRecord3(value)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.61",
+  "version": "0.1.63",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",