tiny-http-mcp-server 0.1.63 → 0.1.64

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.63",
+      "version": "0.1.64",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -126,7 +126,11 @@ timeoutMs })`. Reset acquires the raw identity backend lock, so it can recover
 corrupt or undecryptable records without reading their old contents. It atomically
 retires the identity's grant and registrations and writes a marker that suppresses
 stale initial grants. The default lock wait is 30 seconds. Other names/profiles
-are untouched, and symlink paths are still refused.
+are untouched, and symlink paths are still refused. Native reset, import and
+transaction callbacks retain their original signal while locks or reconciliation
+wait; replacing a caller handle cannot change subsequent cancellation checks.
+Cancellation after a completed identity write prevents the transaction callback
+from running and retains that already persisted identity.
 
 Configure `client.metadata.scope` to request a precise scope set; broader
 discovery metadata does not override it. Explicit scopes must match the cached
@@ -256,7 +260,11 @@ transient retry or restoration of the original grant. Gateway error pages do not
 Native persisted OAuth reads always reject corrupt encrypted documents and
 invalid stored JSON, with diagnostics that omit decrypted contents. They retain
 the existing record for explicit reset rather than interpreting corruption as
-an absent session and reviving an initial grant. Caller file-backend settings
+an absent session and reviving an initial grant. Persisted access tokens that
+cannot be sent as HTTP headers fail with diagnostics that omit token contents;
+the original record remains available for explicit recovery. Token responses are
+checked before activation or persistence. An unusable rotated access token keeps
+refresh intent pending, preventing rotating-token replay. Caller file-backend settings
 cannot disable this policy.
 
 ## Environment Variables

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -591,11 +591,16 @@ function normalizeLoadedSession(session) {
     if (client === null) {
         return { ...session, client: { clientId: "" }, tokens: undefined };
     }
-    return {
-        ...session,
-        client,
-        tokens: normalizeStoredTokens(getOwnEntry(session, "tokens"))
-    };
+    const tokens = normalizeStoredTokens(getOwnEntry(session, "tokens"));
+    if (tokens !== undefined) {
+        try {
+            new Headers({ Authorization: `Bearer ${tokens.accessToken}` });
+        }
+        catch {
+            throw new Error("Stored OAuth access token is not a valid HTTP header value");
+        }
+    }
+    return { ...session, client, tokens };
 }
 function normalizeImportedTokens(value, now) {
     if (!isObjectRecord(value))

package/node_modules/mcp-oauth/dist/client/resource-bound-store.js

@@ -51,6 +51,7 @@ export function createResourceBoundOAuthStores(options, namespace, identity) {
         }
     };
     async function replace(record, options) {
+        options = { ...options };
         options.signal?.throwIfAborted();
         const timeoutMs = options.timeoutMs ?? 30_000;
         if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)
@@ -124,6 +125,7 @@ export function createResourceBoundOAuthStores(options, namespace, identity) {
     }
     result.sessionStore = {
         async withLock(resource, operation, options) {
+            options = { ...options };
             if (store.withLock === undefined)
                 throw new Error("OAuth resource identity backend must support transaction locks");
             return store.withLock(async () => {

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -105,6 +105,12 @@ async function requestTokens(input) {
         throw new Error("OAuth token response missing access_token");
     }
     const normalizedAccessToken = accessToken.trim();
+    try {
+        new Headers({ Authorization: `Bearer ${normalizedAccessToken}` });
+    }
+    catch {
+        throw new Error("OAuth token response access_token is not a valid HTTP header value");
+    }
     const tokenType = normalizeBearerTokenType(getOwnEntry(payload, "token_type"));
     if (tokenType === null) {
         throw new Error("OAuth token response missing token_type=Bearer");

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4793,6 +4793,7 @@ function createResourceBoundOAuthStores(options, namespace, identity) {
     }
   };
   async function replace(record2, options2) {
+    options2 = { ...options2 };
     options2.signal?.throwIfAborted();
     const timeoutMs = options2.timeoutMs ?? 3e4;
     if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
@@ -4858,6 +4859,7 @@ function createResourceBoundOAuthStores(options, namespace, identity) {
   }
   result.sessionStore = {
     async withLock(resource, operation, options2) {
+      options2 = { ...options2 };
       if (store.withLock === void 0)
         throw new Error("OAuth resource identity backend must support transaction locks");
       return store.withLock(async () => {
@@ -5114,6 +5116,11 @@ async function requestTokens(input) {
     throw new Error("OAuth token response missing access_token");
   }
   const normalizedAccessToken = accessToken.trim();
+  try {
+    new Headers({ Authorization: `Bearer ${normalizedAccessToken}` });
+  } catch {
+    throw new Error("OAuth token response access_token is not a valid HTTP header value");
+  }
   const tokenType = normalizeBearerTokenType(getOwnEntry5(payload, "token_type"));
   if (tokenType === null) {
     throw new Error("OAuth token response missing token_type=Bearer");
@@ -5825,11 +5832,15 @@ function normalizeLoadedSession(session) {
   if (client === null) {
     return { ...session, client: { clientId: "" }, tokens: void 0 };
   }
-  return {
-    ...session,
-    client,
-    tokens: normalizeStoredTokens(getOwnEntry6(session, "tokens"))
-  };
+  const tokens = normalizeStoredTokens(getOwnEntry6(session, "tokens"));
+  if (tokens !== void 0) {
+    try {
+      new Headers({ Authorization: `Bearer ${tokens.accessToken}` });
+    } catch {
+      throw new Error("Stored OAuth access token is not a valid HTTP header value");
+    }
+  }
+  return { ...session, client, tokens };
 }
 function normalizeImportedTokens(value, now) {
   if (!isObjectRecord3(value))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.63",
+  "version": "0.1.64",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",