tiny-http-mcp-server 0.1.65 → 0.1.67

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.65",
+      "version": "0.1.67",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -98,7 +98,8 @@ Native provider calls capture request option handles before host work. Unauthori
 handling also owns complete discovery metadata, presented grant values, rejected
 request headers and the selected challenge error before reading persistence.
 A browser callback cannot redirect a later code exchange by changing caller
-metadata. Explicit authentication owns metadata when lazy discovery returns;
+metadata. Metadata loaded from a host session store is copied before clock or
+fetch callbacks, retaining the original refresh endpoint and persisted extensions. Explicit authentication owns metadata when lazy discovery returns;
 the selected discovery method retains its original receiver and live host state.
 
 Provider request inputs accept an optional `signal`. It reaches callback waits,

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -593,12 +593,13 @@ function normalizeLoadedSession(session) {
     if (session === null) {
         return null;
     }
+    const discovery = structuredClone(session.discovery);
     const refreshState = getOwnEntry(session, "refreshState");
     if (refreshState !== undefined && (refreshState !== "pending" || getOwnEntry(session, "tokens") !== undefined))
         throw new Error("Stored OAuth refresh state is invalid");
     const client = normalizeStoredOAuthClient(getOwnEntry(session, "client"));
     if (client === null) {
-        return { ...session, client: { clientId: "" }, tokens: undefined };
+        return { ...session, discovery, client: { clientId: "" }, tokens: undefined };
     }
     const tokens = normalizeStoredTokens(getOwnEntry(session, "tokens"));
     if (tokens !== undefined) {
@@ -609,7 +610,7 @@ function normalizeLoadedSession(session) {
             throw new Error("Stored OAuth access token is not a valid HTTP header value");
         }
     }
-    return { ...session, client, tokens };
+    return { ...session, discovery, client, tokens };
 }
 function normalizeImportedTokens(value, now) {
     if (!isObjectRecord(value))

package/node_modules/tiny-mcp-client/README.md

@@ -101,7 +101,7 @@ const transport = new HttpTransport({
 });
 ```
 
-You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or instantiate `OAuthMetadataDiscovery` with a custom `fetch` implementation and shared cache. Lookup options accept `signal`; cancellation stops metadata fetches and body reads without trying another discovery candidate.
+You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or instantiate `OAuthMetadataDiscovery` with a custom `fetch` implementation and shared cache. An explicit `resourceMetadataUrl` requires fresh network discovery without reading either cache; validated results still populate both caches. Lookup options accept `signal`; cancellation stops metadata fetches and body reads without trying another discovery candidate. It also settles while shared-cache reads, writes or eviction wait. Host cache work may finish afterward; its late rejection remains observed, and canceled discovery does not start another candidate.
 
 OAuth provider inputs receive the originating request's `signal`, covering header authorization and unauthorized handling. Modern request cancellation stops its OAuth work while leaving other requests usable; transport disposal cancels all pending OAuth operations. The default provider propagates this signal to callback, registration and token work. Custom providers must observe it for their own operations.
 

package/node_modules/tiny-mcp-client/dist/index.js

@@ -5837,12 +5837,13 @@ function normalizeLoadedSession(session) {
   if (session === null) {
     return null;
   }
+  const discovery = structuredClone(session.discovery);
   const refreshState = getOwnEntry6(session, "refreshState");
   if (refreshState !== void 0 && (refreshState !== "pending" || getOwnEntry6(session, "tokens") !== void 0))
     throw new Error("Stored OAuth refresh state is invalid");
   const client = normalizeStoredOAuthClient(getOwnEntry6(session, "client"));
   if (client === null) {
-    return { ...session, client: { clientId: "" }, tokens: void 0 };
+    return { ...session, discovery, client: { clientId: "" }, tokens: void 0 };
   }
   const tokens = normalizeStoredTokens(getOwnEntry6(session, "tokens"));
   if (tokens !== void 0) {
@@ -5852,7 +5853,7 @@ function normalizeLoadedSession(session) {
       throw new Error("Stored OAuth access token is not a valid HTTP header value");
     }
   }
-  return { ...session, client, tokens };
+  return { ...session, discovery, client, tokens };
 }
 function normalizeImportedTokens(value, now) {
   if (!isObjectRecord3(value))
@@ -6423,6 +6424,20 @@ function validateCachedDiscovery(value, resource) {
     authorizationServerMetadata
   });
 }
+async function waitForCache(operation, signal) {
+  if (signal === void 0) return operation;
+  let abort;
+  try {
+    return await new Promise((resolve, reject) => {
+      abort = () => reject(signal.reason);
+      signal.addEventListener("abort", abort, { once: true });
+      Promise.resolve(operation).then(resolve, reject);
+      if (signal.aborted) abort();
+    });
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
 var OAuthMetadataDiscovery = class {
   fetchImpl;
   cache;
@@ -6459,7 +6474,7 @@ var OAuthMetadataDiscovery = class {
     if (memoryCachedResult !== void 0 && resourceMetadataUrl === void 0) {
       return structuredClone(memoryCachedResult);
     }
-    const sharedCachedResult = await this.cache?.get(cacheKey);
+    const sharedCachedResult = resourceMetadataUrl === void 0 ? await waitForCache(this.cache?.get(cacheKey), signal) : void 0;
     signal?.throwIfAborted();
     if (sharedCachedResult !== null && sharedCachedResult !== void 0 && resourceMetadataUrl === void 0) {
       try {
@@ -6467,7 +6482,7 @@ var OAuthMetadataDiscovery = class {
         this.memoryCache.set(cacheKey, structuredClone(result));
         return result;
       } catch {
-        await this.cache?.delete?.(cacheKey);
+        await waitForCache(this.cache?.delete?.(cacheKey), signal);
       }
     }
     const { location: resourceMetadataLocation, metadata: resourceMetadata } = await this.discoverProtectedResource(cacheKey, resourceMetadataUrl, signal);
@@ -6490,7 +6505,7 @@ var OAuthMetadataDiscovery = class {
             authorizationServerMetadata
           };
           this.memoryCache.set(cacheKey, structuredClone(result));
-          await this.cache?.set(cacheKey, structuredClone(result));
+          await waitForCache(this.cache?.set(cacheKey, structuredClone(result)), signal);
           return result;
         } catch (error) {
           signal?.throwIfAborted();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.65",
+  "version": "0.1.67",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",