tiny-http-mcp-server 0.1.64 → 0.1.66

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.64",
+      "version": "0.1.66",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -94,6 +94,13 @@ accept the same `redirectUri`, `signal` and `timeoutMs` options. Cancellation,
 timeout and explicit close settle pending code waits and release listeners.
 Always close a successful standalone session in `finally`.
 
+Native provider calls capture request option handles before host work. Unauthorized
+handling also owns complete discovery metadata, presented grant values, rejected
+request headers and the selected challenge error before reading persistence.
+A browser callback cannot redirect a later code exchange by changing caller
+metadata. Explicit authentication owns metadata when lazy discovery returns;
+the selected discovery method retains its original receiver and live host state.
+
 Provider request inputs accept an optional `signal`. It reaches callback waits,
 registration, token requests and bounded token-body reads. Cancellation retains
 its original reason and does not retry authorization. Native provider calls

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -73,6 +73,7 @@ export function createDefaultOAuthClientProvider(options) {
     let initialGrantConsumed = false;
     return {
         async authenticate(input) {
+            input = { ...input, ...(input.discover === undefined ? {} : { discover: input.discover.bind(input) }) };
             input.signal?.throwIfAborted();
             assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
             const resource = canonicalizeResourceIndicator(input.requestUrl);
@@ -84,7 +85,7 @@ export function createDefaultOAuthClientProvider(options) {
                 return { ...initialGrant.tokens };
             if (input.discover === undefined)
                 return;
-            const discovery = await waitForOAuthOperation(input.discover(), input.signal);
+            const discovery = structuredClone(await waitForOAuthOperation(input.discover(), input.signal));
             input.signal?.throwIfAborted();
             assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
             session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
@@ -93,6 +94,7 @@ export function createDefaultOAuthClientProvider(options) {
             return { ...session.tokens };
         },
         async authorizeRequest(input) {
+            input = { ...input };
             assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
             const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
             const session = await ensureAuthorizedSession(requestUrl, undefined, input.fetch, false, false, input.signal);
@@ -113,8 +115,16 @@ export function createDefaultOAuthClientProvider(options) {
             return { ...session.tokens };
         },
         async handleUnauthorized(input) {
+            input = { ...input };
             try {
                 input.signal?.throwIfAborted();
+                const presented = input.presentedTokens == null ? input.presentedTokens : normalizeStoredTokens(input.presentedTokens);
+                if (input.presentedTokens != null && presented === undefined)
+                    throw new Error("OAuth rejected-request provenance does not match its authorization header");
+                const challengeError = input.challenge?.params.error;
+                input = { ...input, discovery: structuredClone(input.discovery),
+                    ...(input.requestHeaders === undefined ? {} : { requestHeaders: new Headers(input.requestHeaders) }),
+                    ...(presented === undefined ? {} : { presentedTokens: presented }) };
                 assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
                 const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
                 const resource = canonicalizeResourceIndicator(input.discovery.resource);
@@ -126,16 +136,15 @@ export function createDefaultOAuthClientProvider(options) {
                 if (input.presentedTokens !== undefined) {
                     rejectedCurrentGrant = false;
                     if (input.presentedTokens !== null) {
-                        const presented = normalizeStoredTokens(input.presentedTokens);
+                        const presented = input.presentedTokens;
                         const header = input.requestHeaders?.get("Authorization") ?? "";
                         const separator = header.indexOf(" ");
-                        if (presented === undefined || header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented.accessToken)
+                        if (header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented.accessToken)
                             throw new Error("OAuth rejected-request provenance does not match its authorization header");
                         presentedTokens = presented;
                         rejectedCurrentGrant = currentTokens !== undefined && sameTokenGrant(currentTokens, presented);
                     }
                 }
-                const challengeError = input.challenge?.params.error;
                 const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || (input.presentedTokens !== undefined && challengeError === undefined));
                 const session = await ensureAuthorizedSession(resource, {
                     ...input.discovery,

package/node_modules/tiny-mcp-client/README.md

@@ -101,7 +101,7 @@ const transport = new HttpTransport({
 });
 ```
 
-You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or instantiate `OAuthMetadataDiscovery` with a custom `fetch` implementation and shared cache. Lookup options accept `signal`; cancellation stops metadata fetches and body reads without trying another discovery candidate.
+You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or instantiate `OAuthMetadataDiscovery` with a custom `fetch` implementation and shared cache. Lookup options accept `signal`; cancellation stops metadata fetches and body reads without trying another discovery candidate. It also settles while shared-cache reads, writes or eviction wait. Host cache work may finish afterward; its late rejection remains observed, and canceled discovery does not start another candidate.
 
 OAuth provider inputs receive the originating request's `signal`, covering header authorization and unauthorized handling. Modern request cancellation stops its OAuth work while leaving other requests usable; transport disposal cancels all pending OAuth operations. The default provider propagates this signal to callback, registration and token work. Custom providers must observe it for their own operations.
 

package/node_modules/tiny-mcp-client/dist/index.js

@@ -5335,6 +5335,7 @@ function createDefaultOAuthClientProvider(options) {
   let initialGrantConsumed = false;
   return {
     async authenticate(input) {
+      input = { ...input, ...input.discover === void 0 ? {} : { discover: input.discover.bind(input) } };
       input.signal?.throwIfAborted();
       assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
       const resource = canonicalizeResourceIndicator(input.requestUrl);
@@ -5345,7 +5346,7 @@ function createDefaultOAuthClientProvider(options) {
         return { ...initialGrant.tokens };
       if (input.discover === void 0)
         return;
-      const discovery = await waitForOAuthOperation(input.discover(), input.signal);
+      const discovery = structuredClone(await waitForOAuthOperation(input.discover(), input.signal));
       input.signal?.throwIfAborted();
       assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
       session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
@@ -5354,6 +5355,7 @@ function createDefaultOAuthClientProvider(options) {
       return { ...session.tokens };
     },
     async authorizeRequest(input) {
+      input = { ...input };
       assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
       const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
       const session = await ensureAuthorizedSession(requestUrl, void 0, input.fetch, false, false, input.signal);
@@ -5370,8 +5372,19 @@ function createDefaultOAuthClientProvider(options) {
       return { ...session.tokens };
     },
     async handleUnauthorized(input) {
+      input = { ...input };
       try {
         input.signal?.throwIfAborted();
+        const presented = input.presentedTokens == null ? input.presentedTokens : normalizeStoredTokens(input.presentedTokens);
+        if (input.presentedTokens != null && presented === void 0)
+          throw new Error("OAuth rejected-request provenance does not match its authorization header");
+        const challengeError = input.challenge?.params.error;
+        input = {
+          ...input,
+          discovery: structuredClone(input.discovery),
+          ...input.requestHeaders === void 0 ? {} : { requestHeaders: new Headers(input.requestHeaders) },
+          ...presented === void 0 ? {} : { presentedTokens: presented }
+        };
         assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
         const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
         const resource = canonicalizeResourceIndicator(input.discovery.resource);
@@ -5383,16 +5396,15 @@ function createDefaultOAuthClientProvider(options) {
         if (input.presentedTokens !== void 0) {
           rejectedCurrentGrant = false;
           if (input.presentedTokens !== null) {
-            const presented = normalizeStoredTokens(input.presentedTokens);
+            const presented2 = input.presentedTokens;
             const header = input.requestHeaders?.get("Authorization") ?? "";
             const separator = header.indexOf(" ");
-            if (presented === void 0 || header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented.accessToken)
+            if (header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented2.accessToken)
               throw new Error("OAuth rejected-request provenance does not match its authorization header");
-            presentedTokens = presented;
-            rejectedCurrentGrant = currentTokens !== void 0 && sameTokenGrant(currentTokens, presented);
+            presentedTokens = presented2;
+            rejectedCurrentGrant = currentTokens !== void 0 && sameTokenGrant(currentTokens, presented2);
           }
         }
-        const challengeError = input.challenge?.params.error;
         const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || input.presentedTokens !== void 0 && challengeError === void 0);
         const session = await ensureAuthorizedSession(resource, {
           ...input.discovery,
@@ -6411,6 +6423,20 @@ function validateCachedDiscovery(value, resource) {
     authorizationServerMetadata
   });
 }
+async function waitForCache(operation, signal) {
+  if (signal === void 0) return operation;
+  let abort;
+  try {
+    return await new Promise((resolve, reject) => {
+      abort = () => reject(signal.reason);
+      signal.addEventListener("abort", abort, { once: true });
+      Promise.resolve(operation).then(resolve, reject);
+      if (signal.aborted) abort();
+    });
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
 var OAuthMetadataDiscovery = class {
   fetchImpl;
   cache;
@@ -6447,7 +6473,7 @@ var OAuthMetadataDiscovery = class {
     if (memoryCachedResult !== void 0 && resourceMetadataUrl === void 0) {
       return structuredClone(memoryCachedResult);
     }
-    const sharedCachedResult = await this.cache?.get(cacheKey);
+    const sharedCachedResult = await waitForCache(this.cache?.get(cacheKey), signal);
     signal?.throwIfAborted();
     if (sharedCachedResult !== null && sharedCachedResult !== void 0 && resourceMetadataUrl === void 0) {
       try {
@@ -6455,7 +6481,7 @@ var OAuthMetadataDiscovery = class {
         this.memoryCache.set(cacheKey, structuredClone(result));
         return result;
       } catch {
-        await this.cache?.delete?.(cacheKey);
+        await waitForCache(this.cache?.delete?.(cacheKey), signal);
       }
     }
     const { location: resourceMetadataLocation, metadata: resourceMetadata } = await this.discoverProtectedResource(cacheKey, resourceMetadataUrl, signal);
@@ -6478,7 +6504,7 @@ var OAuthMetadataDiscovery = class {
             authorizationServerMetadata
           };
           this.memoryCache.set(cacheKey, structuredClone(result));
-          await this.cache?.set(cacheKey, structuredClone(result));
+          await waitForCache(this.cache?.set(cacheKey, structuredClone(result)), signal);
           return result;
         } catch (error) {
           signal?.throwIfAborted();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.64",
+  "version": "0.1.66",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",