tiny-http-mcp-server 0.1.62 → 0.1.64

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.62",
+      "version": "0.1.64",
       "license": "MIT"
     },
     {

package/node_modules/auth-store/README.md

@@ -34,7 +34,9 @@ for transactions spanning a read, external operation and write. Independent
 instances and processes serialize the same encrypted file or Keychain
 service/account; unrelated identities proceed independently. The default
 acquisition timeout is 30 seconds. Cancellation during acquisition does not
-release the active owner's lock. Individual `get`, `set` and `delete` calls do
+release the active owner's lock. Each acquisition retains its original signal
+and timeout before path checks wait; replacing the caller's option handles cannot
+bypass original cancellation or introduce another signal's cancellation. Individual `get`, `set` and `delete` calls do
 not implicitly acquire it.
 
 Locks use private filesystem claim directories, containing PID/random names

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -81,6 +81,7 @@ export class EncryptedFileStore {
         }
     }
     async withLock(operation, options = {}) {
+        options = { ...options };
         await this.assertCredentialPathHasNoSymbolicLinks(`${this.filePath}.lock`);
         if (this.fs.readdir === undefined)
             throw new Error("Secret-store transaction locks require filesystem readdir support");

package/node_modules/auth-store/dist/transaction-lock.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { hasOwnErrorCode } from "./error-codes.js";
 /** Filesystem bakery lock: unique claims allow dead-owner cleanup without deleting a replacement owner's lock. */
 export async function withSecretStoreFileLock(fs, lockDirectory, operation, options = {}) {
+    options = { ...options };
     const timeoutMs = options.timeoutMs ?? 30_000;
     if (!Number.isFinite(timeoutMs) || timeoutMs < 0 || timeoutMs > 2_147_483_647)
         throw new Error("Invalid secret-store transaction lock timeout");

package/node_modules/mcp-oauth/README.md

@@ -64,7 +64,8 @@ aborting the original signal still cancels authorization.
 Native session and client persistence factories also capture file paths, salts,
 Keychain identities, lock locations and selected filesystem/command handles.
 Mutating these settings cannot redirect a later read or write.
-The factories resolve the selected backend environment variable once at creation;
+The factories copy these settings before reading the selected backend environment
+variable, so its getter cannot replace them. They resolve that variable once at creation;
 later environment changes cannot move a transaction between file and Keychain.
 
 `createJwksTokenVerifier(options)` accepts:
@@ -125,7 +126,11 @@ timeoutMs })`. Reset acquires the raw identity backend lock, so it can recover
 corrupt or undecryptable records without reading their old contents. It atomically
 retires the identity's grant and registrations and writes a marker that suppresses
 stale initial grants. The default lock wait is 30 seconds. Other names/profiles
-are untouched, and symlink paths are still refused.
+are untouched, and symlink paths are still refused. Native reset, import and
+transaction callbacks retain their original signal while locks or reconciliation
+wait; replacing a caller handle cannot change subsequent cancellation checks.
+Cancellation after a completed identity write prevents the transaction callback
+from running and retains that already persisted identity.
 
 Configure `client.metadata.scope` to request a precise scope set; broader
 discovery metadata does not override it. Explicit scopes must match the cached
@@ -255,7 +260,11 @@ transient retry or restoration of the original grant. Gateway error pages do not
 Native persisted OAuth reads always reject corrupt encrypted documents and
 invalid stored JSON, with diagnostics that omit decrypted contents. They retain
 the existing record for explicit reset rather than interpreting corruption as
-an absent session and reviving an initial grant. Caller file-backend settings
+an absent session and reviving an initial grant. Persisted access tokens that
+cannot be sent as HTTP headers fail with diagnostics that omit token contents;
+the original record remains available for explicit recovery. Token responses are
+checked before activation or persistence. An unusable rotated access token keeps
+refresh intent pending, preventing rotating-token replay. Caller file-backend settings
 cannot disable this policy.
 
 ## Environment Variables

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -82,12 +82,14 @@ export function createAuthStoreClientStore(options, namespace) {
     };
 }
 function snapshotPersistenceOptions(options) {
-    return {
-        ...options, backend: resolveSecretStoreBackend(options),
+    const snapshot = {
+        ...options,
         ...(options.fileStore === undefined ? {} : { fileStore: { ...options.fileStore } }),
         ...(options.keychainStore === undefined ? {} : { keychainStore: { ...options.keychainStore,
                 ...(options.keychainStore.lock === undefined ? {} : { lock: { ...options.keychainStore.lock } }) } })
     };
+    snapshot.backend = resolveSecretStoreBackend(snapshot);
+    return snapshot;
 }
 export function createNamedSecretStore(key, options, defaults, namespace) {
     const hash = crypto.createHash("sha256").update(namespace === undefined ? key : JSON.stringify([namespace, key])).digest("hex");

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -591,11 +591,16 @@ function normalizeLoadedSession(session) {
     if (client === null) {
         return { ...session, client: { clientId: "" }, tokens: undefined };
     }
-    return {
-        ...session,
-        client,
-        tokens: normalizeStoredTokens(getOwnEntry(session, "tokens"))
-    };
+    const tokens = normalizeStoredTokens(getOwnEntry(session, "tokens"));
+    if (tokens !== undefined) {
+        try {
+            new Headers({ Authorization: `Bearer ${tokens.accessToken}` });
+        }
+        catch {
+            throw new Error("Stored OAuth access token is not a valid HTTP header value");
+        }
+    }
+    return { ...session, client, tokens };
 }
 function normalizeImportedTokens(value, now) {
     if (!isObjectRecord(value))

package/node_modules/mcp-oauth/dist/client/resource-bound-store.js

@@ -51,6 +51,7 @@ export function createResourceBoundOAuthStores(options, namespace, identity) {
         }
     };
     async function replace(record, options) {
+        options = { ...options };
         options.signal?.throwIfAborted();
         const timeoutMs = options.timeoutMs ?? 30_000;
         if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)
@@ -124,6 +125,7 @@ export function createResourceBoundOAuthStores(options, namespace, identity) {
     }
     result.sessionStore = {
         async withLock(resource, operation, options) {
+            options = { ...options };
             if (store.withLock === undefined)
                 throw new Error("OAuth resource identity backend must support transaction locks");
             return store.withLock(async () => {

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -105,6 +105,12 @@ async function requestTokens(input) {
         throw new Error("OAuth token response missing access_token");
     }
     const normalizedAccessToken = accessToken.trim();
+    try {
+        new Headers({ Authorization: `Bearer ${normalizedAccessToken}` });
+    }
+    catch {
+        throw new Error("OAuth token response access_token is not a valid HTTP header value");
+    }
     const tokenType = normalizeBearerTokenType(getOwnEntry(payload, "token_type"));
     if (tokenType === null) {
         throw new Error("OAuth token response missing token_type=Bearer");

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3907,6 +3907,7 @@ function hasOwnErrorCode(error, code) {
 import { randomUUID } from "node:crypto";
 import path from "node:path";
 async function withSecretStoreFileLock(fs2, lockDirectory, operation, options = {}) {
+  options = { ...options };
   const timeoutMs = options.timeoutMs ?? 3e4;
   if (!Number.isFinite(timeoutMs) || timeoutMs < 0 || timeoutMs > 2147483647)
     throw new Error("Invalid secret-store transaction lock timeout");
@@ -4126,6 +4127,7 @@ var EncryptedFileStore = class {
     }
   }
   async withLock(operation, options = {}) {
+    options = { ...options };
     await this.assertCredentialPathHasNoSymbolicLinks(`${this.filePath}.lock`);
     if (this.fs.readdir === void 0)
       throw new Error("Secret-store transaction locks require filesystem readdir support");
@@ -4638,15 +4640,16 @@ function createAuthStoreClientStore(options, namespace) {
   };
 }
 function snapshotPersistenceOptions(options) {
-  return {
+  const snapshot = {
     ...options,
-    backend: resolveSecretStoreBackend(options),
     ...options.fileStore === void 0 ? {} : { fileStore: { ...options.fileStore } },
     ...options.keychainStore === void 0 ? {} : { keychainStore: {
       ...options.keychainStore,
       ...options.keychainStore.lock === void 0 ? {} : { lock: { ...options.keychainStore.lock } }
     } }
   };
+  snapshot.backend = resolveSecretStoreBackend(snapshot);
+  return snapshot;
 }
 function createNamedSecretStore(key2, options, defaults, namespace) {
   const hash = crypto2.createHash("sha256").update(namespace === void 0 ? key2 : JSON.stringify([namespace, key2])).digest("hex");
@@ -4790,6 +4793,7 @@ function createResourceBoundOAuthStores(options, namespace, identity) {
     }
   };
   async function replace(record2, options2) {
+    options2 = { ...options2 };
     options2.signal?.throwIfAborted();
     const timeoutMs = options2.timeoutMs ?? 3e4;
     if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
@@ -4855,6 +4859,7 @@ function createResourceBoundOAuthStores(options, namespace, identity) {
   }
   result.sessionStore = {
     async withLock(resource, operation, options2) {
+      options2 = { ...options2 };
       if (store.withLock === void 0)
         throw new Error("OAuth resource identity backend must support transaction locks");
       return store.withLock(async () => {
@@ -5111,6 +5116,11 @@ async function requestTokens(input) {
     throw new Error("OAuth token response missing access_token");
   }
   const normalizedAccessToken = accessToken.trim();
+  try {
+    new Headers({ Authorization: `Bearer ${normalizedAccessToken}` });
+  } catch {
+    throw new Error("OAuth token response access_token is not a valid HTTP header value");
+  }
   const tokenType = normalizeBearerTokenType(getOwnEntry5(payload, "token_type"));
   if (tokenType === null) {
     throw new Error("OAuth token response missing token_type=Bearer");
@@ -5822,11 +5832,15 @@ function normalizeLoadedSession(session) {
   if (client === null) {
     return { ...session, client: { clientId: "" }, tokens: void 0 };
   }
-  return {
-    ...session,
-    client,
-    tokens: normalizeStoredTokens(getOwnEntry6(session, "tokens"))
-  };
+  const tokens = normalizeStoredTokens(getOwnEntry6(session, "tokens"));
+  if (tokens !== void 0) {
+    try {
+      new Headers({ Authorization: `Bearer ${tokens.accessToken}` });
+    } catch {
+      throw new Error("Stored OAuth access token is not a valid HTTP header value");
+    }
+  }
+  return { ...session, client, tokens };
 }
 function normalizeImportedTokens(value, now) {
   if (!isObjectRecord3(value))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.62",
+  "version": "0.1.64",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",