tiny-http-mcp-server 0.1.62 → 0.1.63

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.62",
+      "version": "0.1.63",
       "license": "MIT"
     },
     {

package/node_modules/auth-store/README.md

@@ -34,7 +34,9 @@ for transactions spanning a read, external operation and write. Independent
 instances and processes serialize the same encrypted file or Keychain
 service/account; unrelated identities proceed independently. The default
 acquisition timeout is 30 seconds. Cancellation during acquisition does not
-release the active owner's lock. Individual `get`, `set` and `delete` calls do
+release the active owner's lock. Each acquisition retains its original signal
+and timeout before path checks wait; replacing the caller's option handles cannot
+bypass original cancellation or introduce another signal's cancellation. Individual `get`, `set` and `delete` calls do
 not implicitly acquire it.
 
 Locks use private filesystem claim directories, containing PID/random names

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -81,6 +81,7 @@ export class EncryptedFileStore {
         }
     }
     async withLock(operation, options = {}) {
+        options = { ...options };
         await this.assertCredentialPathHasNoSymbolicLinks(`${this.filePath}.lock`);
         if (this.fs.readdir === undefined)
             throw new Error("Secret-store transaction locks require filesystem readdir support");

package/node_modules/auth-store/dist/transaction-lock.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { hasOwnErrorCode } from "./error-codes.js";
 /** Filesystem bakery lock: unique claims allow dead-owner cleanup without deleting a replacement owner's lock. */
 export async function withSecretStoreFileLock(fs, lockDirectory, operation, options = {}) {
+    options = { ...options };
     const timeoutMs = options.timeoutMs ?? 30_000;
     if (!Number.isFinite(timeoutMs) || timeoutMs < 0 || timeoutMs > 2_147_483_647)
         throw new Error("Invalid secret-store transaction lock timeout");

package/node_modules/mcp-oauth/README.md

@@ -64,7 +64,8 @@ aborting the original signal still cancels authorization.
 Native session and client persistence factories also capture file paths, salts,
 Keychain identities, lock locations and selected filesystem/command handles.
 Mutating these settings cannot redirect a later read or write.
-The factories resolve the selected backend environment variable once at creation;
+The factories copy these settings before reading the selected backend environment
+variable, so its getter cannot replace them. They resolve that variable once at creation;
 later environment changes cannot move a transaction between file and Keychain.
 
 `createJwksTokenVerifier(options)` accepts:

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -82,12 +82,14 @@ export function createAuthStoreClientStore(options, namespace) {
     };
 }
 function snapshotPersistenceOptions(options) {
-    return {
-        ...options, backend: resolveSecretStoreBackend(options),
+    const snapshot = {
+        ...options,
         ...(options.fileStore === undefined ? {} : { fileStore: { ...options.fileStore } }),
         ...(options.keychainStore === undefined ? {} : { keychainStore: { ...options.keychainStore,
                 ...(options.keychainStore.lock === undefined ? {} : { lock: { ...options.keychainStore.lock } }) } })
     };
+    snapshot.backend = resolveSecretStoreBackend(snapshot);
+    return snapshot;
 }
 export function createNamedSecretStore(key, options, defaults, namespace) {
     const hash = crypto.createHash("sha256").update(namespace === undefined ? key : JSON.stringify([namespace, key])).digest("hex");

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3907,6 +3907,7 @@ function hasOwnErrorCode(error, code) {
 import { randomUUID } from "node:crypto";
 import path from "node:path";
 async function withSecretStoreFileLock(fs2, lockDirectory, operation, options = {}) {
+  options = { ...options };
   const timeoutMs = options.timeoutMs ?? 3e4;
   if (!Number.isFinite(timeoutMs) || timeoutMs < 0 || timeoutMs > 2147483647)
     throw new Error("Invalid secret-store transaction lock timeout");
@@ -4126,6 +4127,7 @@ var EncryptedFileStore = class {
     }
   }
   async withLock(operation, options = {}) {
+    options = { ...options };
     await this.assertCredentialPathHasNoSymbolicLinks(`${this.filePath}.lock`);
     if (this.fs.readdir === void 0)
       throw new Error("Secret-store transaction locks require filesystem readdir support");
@@ -4638,15 +4640,16 @@ function createAuthStoreClientStore(options, namespace) {
   };
 }
 function snapshotPersistenceOptions(options) {
-  return {
+  const snapshot = {
     ...options,
-    backend: resolveSecretStoreBackend(options),
     ...options.fileStore === void 0 ? {} : { fileStore: { ...options.fileStore } },
     ...options.keychainStore === void 0 ? {} : { keychainStore: {
       ...options.keychainStore,
       ...options.keychainStore.lock === void 0 ? {} : { lock: { ...options.keychainStore.lock } }
     } }
   };
+  snapshot.backend = resolveSecretStoreBackend(snapshot);
+  return snapshot;
 }
 function createNamedSecretStore(key2, options, defaults, namespace) {
   const hash = crypto2.createHash("sha256").update(namespace === void 0 ? key2 : JSON.stringify([namespace, key2])).digest("hex");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.62",
+  "version": "0.1.63",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",