toolcraft 0.0.313 → 0.0.315

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.31",
+      "version": "0.1.34",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.313",
+      "version": "0.0.315",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.313",
+      "version": "0.0.315",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.31",
+      "version": "0.1.34",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.313",
+      "version": "0.0.315",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.313",
+      "version": "0.0.315",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.31",
+      "version": "0.1.34",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -96,7 +96,14 @@ on 401 even when the server omits `error="invalid_token"`. Invalid provenance
 fails without quoting token values.
 
 Configure `client.metadata.scope` to request a precise scope set; broader
-discovery metadata does not override it.
+discovery metadata does not override it. Explicit scopes must match the cached
+or imported grant's scope set; ordering, repeated spaces and duplicates are
+normalized. An imported grant must declare its scope when a scope is configured.
+Authorization records the requested set when the endpoint omits scope, and
+refresh retains the previous granted set. Mismatched responses never activate
+credentials; an unusable refresh response retains the pending refresh record.
+Select a separate persistence namespace for another scope profile. No scope is
+invented when the client does not configure one.
 
 Imported `initialGrant.tokens` use `accessToken`, optional `refreshToken`,
 `tokenType: "Bearer"`, `expiresAt` (Unix epoch milliseconds or `null` if unknown),
@@ -105,6 +112,23 @@ Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
 Input tokens are copied and invalid expiry values fail before authorization.
+Pass a complete DCR response as `client.registration` (or validate untrusted JSON
+with `parseOAuthClientRegistration`). Dynamic clients infer their original ID
+and secret from that response and reuse it without registering another app.
+Explicit ID/secret values must agree with the imported response. Sessions and
+native registration stores retain arrays, issuance/expiry timestamps and JSON
+provider metadata. Registration input is copied, bounded to 64 KiB and 64
+levels, and rejects invalid standard field types and non-JSON extensions.
+Set `client.tokenEndpointAuthMethod` to `none`, `client_secret_post` or
+`client_secret_basic`; a full registration can supply the same field as
+`token_endpoint_auth_method`. Public clients never transmit a stored secret.
+Basic credentials are individually form-encoded before Base64 encoding and
+are omitted from the form body. Cached grants retain their registered method;
+an explicitly different configured method requires separate persistence or a
+reset. Native DCR chooses a supported method, preferring public PKCE when
+advertised. Unsupported methods and missing confidential secrets fail before
+token requests. Existing clients without a method keep the previous default:
+body authentication when a secret is present, public authentication otherwise.
 Static clients and dynamic initial-grant imports require cached grants to match
 the original normalized client ID and secret. A different client configuration
 fails before attaching or refreshing credentials and retains the stored record;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.d.ts

@@ -1,9 +1,5 @@
 import { type CreateSecretStoreInput } from "auth-store";
-import type { OAuthSessionStore } from "./types.js";
-interface StoredOAuthClient {
-    clientId: string;
-    clientSecret?: string;
-}
+import type { OAuthSessionStore, StoredOAuthClient } from "./types.js";
 export interface OAuthClientStore {
     load(issuer: string): Promise<StoredOAuthClient | null>;
     save(issuer: string, client: StoredOAuthClient): Promise<void>;
@@ -12,4 +8,3 @@ export interface OAuthClientStore {
 export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput, namespace?: string): OAuthSessionStore;
 export declare function createAuthStoreClientStore(options: CreateSecretStoreInput, namespace?: string): OAuthClientStore;
 export declare function assertPersistenceNamespace(namespace: string | undefined): void;
-export {};

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -1,3 +1,4 @@
+import { normalizeStoredOAuthClient } from "./client-registration.js";
 import crypto from "node:crypto";
 import path from "node:path";
 import { createSecretStore } from "auth-store";
@@ -62,15 +63,10 @@ export function createAuthStoreClientStore(options, namespace) {
             catch {
                 throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
             }
-            const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : undefined;
-            if (clientId !== undefined) {
-                const client = { clientId };
-                if (isObjectRecord(parsed) &&
-                    Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
-                    client.clientSecret = getOwnEntry(parsed, "clientSecret");
-                }
-                return client;
-            }
+            // Preserve all registration metadata; provider normalization validates its
+            // identity and schema before it can authorize a request.
+            if (isObjectRecord(parsed) && typeof getOwnEntry(parsed, "clientId") === "string")
+                return parsed;
             throw new Error("Stored OAuth client must be a JSON object with clientId");
         },
         async save(issuer, client) {
@@ -142,20 +138,13 @@ function isStoredOAuthSession(value) {
     }
     return (isNonBlankOwnString(value, "resource") &&
         isNonBlankOwnString(value, "authorizationServer") &&
-        isStoredOAuthClient(getOwnEntry(value, "client")) &&
+        normalizeStoredOAuthClient(getOwnEntry(value, "client")) !== null &&
         isStoredOAuthDiscovery(getOwnEntry(value, "discovery")) &&
+        (getOwnEntry(value, "requestedScope") === undefined || isNonBlankOwnString(value, "requestedScope")) &&
         (getOwnEntry(value, "refreshState") === undefined ||
             (getOwnEntry(value, "refreshState") === "pending" && getOwnEntry(value, "tokens") === undefined)) &&
         isStoredOAuthTokensOrMissing(getOwnEntry(value, "tokens")));
 }
-function isStoredOAuthClient(value) {
-    if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
-        return false;
-    }
-    const clientSecret = getOwnEntry(value, "clientSecret");
-    return (clientSecret === undefined ||
-        (typeof clientSecret === "string" && clientSecret.trim().length > 0));
-}
 function isStoredOAuthDiscovery(value) {
     if (!isObjectRecord(value)) {
         return false;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/client-registration.d.ts

@@ -0,0 +1,4 @@
+import type { OAuthClientRegistration, StoredOAuthClient } from "./types.js";
+/** Validate and copy a bounded JSON DCR response without quoting credential input. */
+export declare function parseOAuthClientRegistration(value: unknown): OAuthClientRegistration;
+export declare function normalizeStoredOAuthClient(value: unknown): StoredOAuthClient | null;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -0,0 +1,103 @@
+import { normalizeOAuthScope } from "./scope.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
+/** Validate and copy a bounded JSON DCR response without quoting credential input. */
+export function parseOAuthClientRegistration(value) {
+    const invalid = () => new Error("Invalid OAuth client registration metadata");
+    let nodes = 0;
+    function copy(input, depth) {
+        if (++nodes > 20_000 || depth > 64)
+            throw invalid();
+        if (input === null || typeof input === "boolean" || typeof input === "string")
+            return input;
+        if (typeof input === "number" && Number.isFinite(input))
+            return input;
+        if (typeof input !== "object" || input === null)
+            throw invalid();
+        const descriptors = Object.getOwnPropertyDescriptors(input);
+        if (Array.isArray(input)) {
+            const length = descriptors.length?.value;
+            if (length > 20_000)
+                throw invalid();
+            const result = [];
+            for (let index = 0; index < length; index++) {
+                const descriptor = descriptors[String(index)];
+                if (descriptor === undefined || !Object.hasOwn(descriptor, "value"))
+                    throw invalid();
+                result.push(copy(descriptor.value, depth + 1));
+            }
+            return result;
+        }
+        if (Object.getPrototypeOf(input) !== Object.prototype && Object.getPrototypeOf(input) !== null)
+            throw invalid();
+        return Object.fromEntries(Object.entries(descriptors).filter(([, descriptor]) => descriptor.enumerable).map(([key, descriptor]) => {
+            if (!Object.hasOwn(descriptor, "value"))
+                throw invalid();
+            return [key, copy(descriptor.value, depth + 1)];
+        }));
+    }
+    let result;
+    try {
+        result = copy(value, 0);
+    }
+    catch {
+        throw invalid();
+    }
+    if (typeof result !== "object" || result === null || Array.isArray(result))
+        throw invalid();
+    const record = result;
+    if (!Object.hasOwn(record, "client_id") || typeof record.client_id !== "string" || record.client_id.trim() === "")
+        throw new Error("OAuth client registration response missing client_id");
+    for (const key of ["client_id", "client_secret", "token_endpoint_auth_method", "application_type", "client_name", "client_uri", "logo_uri", "scope",
+        "tos_uri", "policy_uri", "jwks_uri", "software_id", "software_version", "software_statement", "registration_access_token", "registration_client_uri", "issuer"]) {
+        if (Object.hasOwn(record, key) && record[key] !== null && typeof record[key] !== "string")
+            throw invalid();
+    }
+    if (typeof record.client_secret === "string" && record.client_secret.trim() === "")
+        throw invalid();
+    for (const key of ["redirect_uris", "grant_types", "response_types", "contacts"]) {
+        const entry = record[key];
+        if (Object.hasOwn(record, key) && entry !== null && (!Array.isArray(entry) || entry.some(item => typeof item !== "string")))
+            throw invalid();
+    }
+    for (const key of ["client_id_issued_at", "client_secret_expires_at"]) {
+        const entry = record[key];
+        if (Object.hasOwn(record, key) && entry !== null && (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0))
+            throw invalid();
+    }
+    try {
+        normalizeOAuthScope(Object.hasOwn(record, "scope") && record.scope !== null ? record.scope : undefined);
+    }
+    catch {
+        throw invalid();
+    }
+    if (Buffer.byteLength(JSON.stringify(record), "utf8") > 64 * 1024)
+        throw invalid();
+    return record;
+}
+export function normalizeStoredOAuthClient(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const record = value;
+    const clientId = Object.hasOwn(record, "clientId") ? record.clientId : undefined;
+    const clientSecret = Object.hasOwn(record, "clientSecret") ? record.clientSecret : undefined;
+    if (typeof clientId !== "string" || clientId.trim() === "" ||
+        (clientSecret !== undefined && (typeof clientSecret !== "string" || clientSecret.trim() === "")))
+        return null;
+    const client = { clientId: clientId.trim(), ...(clientSecret === undefined ? {} : { clientSecret: clientSecret.trim() }) };
+    const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record, "tokenEndpointAuthMethod") ? record.tokenEndpointAuthMethod : undefined);
+    if (Object.hasOwn(record, "registration") && record.registration !== undefined) {
+        const registration = parseOAuthClientRegistration(record.registration);
+        const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : undefined;
+        if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
+            throw new Error("OAuth client registration does not match the client identity");
+        client.registration = registration;
+        const registrationMethod = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(registration, "token_endpoint_auth_method") ? registration.token_endpoint_auth_method : undefined);
+        if (method !== undefined && registrationMethod !== undefined && method !== registrationMethod)
+            throw new Error("OAuth token endpoint authentication conflicts with the client registration");
+        if (registrationMethod !== undefined)
+            client.tokenEndpointAuthMethod = registrationMethod;
+    }
+    if (method !== undefined)
+        client.tokenEndpointAuthMethod = method;
+    return client;
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,3 +1,6 @@
+import { normalizeStoredOAuthClient, parseOAuthClientRegistration } from "./client-registration.js";
+import { normalizeOAuthScope } from "./scope.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
@@ -18,6 +21,11 @@ export function createOAuthClientProvider(options) {
 export function createDefaultOAuthClientProvider(options) {
     loopbackTarget(options.browser);
     assertPersistenceNamespace(options.persistenceNamespace);
+    const clientMetadata = getClientMetadata(options.client);
+    const requestedScope = clientMetadata?.scope;
+    const configuredClient = normalizeConfiguredClient(options.client);
+    const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
+    const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
     const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
     const now = options.now ?? Date.now;
@@ -36,11 +44,13 @@ export function createDefaultOAuthClientProvider(options) {
     const initialGrant = options.initialGrant === undefined ? undefined : {
         resource: canonicalizeResourceIndicator(options.initialGrant.resource),
         tokens: normalizeStoredTokens(options.initialGrant.tokens),
-        client: normalizeConfiguredClient(options.client)
+        client: configuredClient
     };
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
         throw new Error("OAuth initial grant requires valid tokens and the original client ID");
     if (initialGrant?.tokens !== undefined) {
+        if (requestedScope !== undefined && initialGrant.tokens.scope !== requestedScope)
+            throw new Error("OAuth initial grant does not match the requested OAuth scope");
         try {
             new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
         }
@@ -133,7 +143,8 @@ export function createDefaultOAuthClientProvider(options) {
                 initialGrant.tokens !== undefined && initialGrant.client !== null) {
                 assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
                 session = { resource: canonicalResource, authorizationServer: discovery.authorizationServer,
-                    client: initialGrant.client, tokens: initialGrant.tokens, discovery: toStoredDiscovery(discovery) };
+                    client: initialGrant.client, tokens: initialGrant.tokens,
+                    ...(requestedScope === undefined ? {} : { requestedScope }), discovery: toStoredDiscovery(discovery) };
                 await saveSession(canonicalResource, session);
                 initialGrantConsumed = true;
                 signal?.throwIfAborted();
@@ -141,11 +152,16 @@ export function createDefaultOAuthClientProvider(options) {
             if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
                 forceRefresh = false;
             const sessionDiscovery = resolveDiscovery(discovery, session);
-            if ((options.client.mode === "static" || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
-                const configured = normalizeConfiguredClient(options.client);
+            if ((options.client.mode === "static" || configuredClient?.registration !== undefined || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
+                const configured = configuredClient;
                 if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
                     throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
             }
+            if (requestedScope !== undefined && session?.tokens !== undefined && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
+                throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
+            if (configuredTokenMethod !== undefined && session !== null && (session.tokens !== undefined || session.refreshState === "pending") &&
+                (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === undefined ? "none" : "client_secret_post")) !== configuredTokenMethod)
+                throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
             if (session?.refreshState === "pending") {
                 if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === undefined)
                     throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -180,6 +196,7 @@ export function createDefaultOAuthClientProvider(options) {
         if (session.tokens?.refreshToken === undefined) {
             return session;
         }
+        assertTokenEndpointAuthentication(session.client, discovery.authorizationServerMetadata);
         const pendingSession = { ...clearSessionTokens(session), refreshState: "pending" };
         await saveSession(resource, pendingSession);
         signal?.throwIfAborted();
@@ -191,6 +208,7 @@ export function createDefaultOAuthClientProvider(options) {
                     tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
                     clientId: session.client.clientId,
                     clientSecret: session.client.clientSecret,
+                    tokenEndpointAuthMethod: session.client.tokenEndpointAuthMethod,
                     refreshToken: session.tokens.refreshToken,
                     resource,
                     fetch, signal,
@@ -226,10 +244,13 @@ export function createDefaultOAuthClientProvider(options) {
             ...session,
             tokens: {
                 ...refreshedTokens,
-                refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
+                refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken,
+                scope: refreshedTokens.scope ?? session.tokens.scope
             },
             discovery: toStoredDiscovery(discovery)
         };
+        if (requestedScope !== undefined && normalizeOAuthScope(updatedSession.tokens?.scope ?? session.requestedScope) !== requestedScope)
+            throw new Error("OAuth refresh response does not match the requested OAuth scope; authorize again");
         await saveSession(resource, updatedSession);
         return updatedSession;
     }
@@ -253,10 +274,12 @@ export function createDefaultOAuthClientProvider(options) {
             let resolvedClient = null;
             try {
                 resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch, signal);
+                assertTokenEndpointAuthentication(resolvedClient.client, discovery.authorizationServerMetadata);
                 const sessionWithoutTokens = {
                     resource,
                     authorizationServer: discovery.authorizationServer,
                     client: resolvedClient.client,
+                    ...(requestedScope === undefined ? {} : { requestedScope }),
                     discovery: toStoredDiscovery(discovery)
                 };
                 await saveSession(resource, sessionWithoutTokens);
@@ -268,13 +291,14 @@ export function createDefaultOAuthClientProvider(options) {
                     clientId: resolvedClient.client.clientId,
                     redirectUri: loopback.redirectUri,
                     codeChallenge: challenge,
-                    clientMetadata: getClientMetadata(options.client)
+                    clientMetadata
                 });
                 const code = await loopback.waitForCode(authorizationUrl);
                 const tokens = await exchangeAuthorizationCode({
                     tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
                     clientId: resolvedClient.client.clientId,
                     clientSecret: resolvedClient.client.clientSecret,
+                    tokenEndpointAuthMethod: resolvedClient.client.tokenEndpointAuthMethod,
                     code,
                     codeVerifier: verifier,
                     redirectUri: loopback.redirectUri,
@@ -282,6 +306,8 @@ export function createDefaultOAuthClientProvider(options) {
                     fetch, signal,
                     now
                 });
+                if (requestedScope !== undefined && tokens.scope !== undefined && normalizeOAuthScope(tokens.scope) !== requestedScope)
+                    throw new Error("OAuth authorization response does not match the requested OAuth scope");
                 const session = {
                     ...sessionWithoutTokens,
                     tokens
@@ -313,8 +339,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
     async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
         parentSignal?.throwIfAborted();
-        const configuredClient = normalizeConfiguredClient(options.client);
-        if (options.client.mode === "static") {
+        if (options.client.mode === "static" || configuredClient?.registration !== undefined) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }
@@ -363,7 +388,12 @@ export function createDefaultOAuthClientProvider(options) {
                 };
             }
         }
-        const registrationBody = buildClientRegistrationBody(getClientMetadata(options.client), redirectUri);
+        const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
+        const registrationMethod = requestedTokenMethod ?? (supported === undefined ? "none" :
+            ["none", "client_secret_basic", "client_secret_post"].find(method => supported.includes(method)));
+        if (registrationMethod === undefined || (supported !== undefined && !supported.includes(registrationMethod)))
+            throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+        const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri, registrationMethod);
         const deadline = AbortSignal.timeout(30_000);
         const signal = parentSignal === undefined ? deadline : AbortSignal.any([parentSignal, deadline]);
         const response = await fetchMcpResponse(fetch, registrationEndpoint, {
@@ -375,16 +405,15 @@ export function createDefaultOAuthClientProvider(options) {
             signal
         });
         const payload = await readOAuthJsonObjectResponse(response, signal);
-        const clientId = getOwnString(payload, "client_id");
-        if (clientId === undefined || clientId.trim().length === 0) {
-            throw new Error("OAuth client registration response missing client_id");
-        }
-        const clientSecret = getOwnString(payload, "client_secret");
+        const registration = parseOAuthClientRegistration(payload);
+        const registeredSecret = getOwnString(registration, "client_secret");
+        const responseMethod = normalizeOAuthTokenEndpointAuthMethod(getOwnEntry(registration, "token_endpoint_auth_method")) ??
+            requestedTokenMethod ?? (supported === undefined ? undefined : normalizeOAuthTokenEndpointAuthMethod(registrationMethod));
         const registeredClient = {
-            clientId: clientId.trim(),
-            clientSecret: clientSecret !== undefined && clientSecret.trim().length > 0
-                ? clientSecret.trim()
-                : undefined
+            clientId: registration.client_id.trim(),
+            ...(registeredSecret === undefined ? {} : { clientSecret: registeredSecret.trim() }),
+            ...(responseMethod === undefined ? {} : { tokenEndpointAuthMethod: responseMethod }),
+            registration
         };
         await saveRegisteredClient(discovery.authorizationServer, registeredClient);
         return {
@@ -397,7 +426,7 @@ export function createDefaultOAuthClientProvider(options) {
         return normalizeLoadedSession(await sessionStore.load(resource));
     }
     async function saveSession(resource, session) {
-        await sessionStore.save(resource, session);
+        await sessionStore.save(resource, structuredClone(session));
     }
     async function clearSession(resource) {
         await sessionStore.clear(resource);
@@ -410,7 +439,7 @@ export function createDefaultOAuthClientProvider(options) {
             return null;
         }
         const client = await clientStore.load(issuer);
-        const normalizedClient = client === null ? null : normalizeStoredClient(client);
+        const normalizedClient = client === null ? null : normalizeStoredOAuthClient(client);
         if (client !== null && normalizedClient === null) {
             await clientStore.clear(issuer);
             return null;
@@ -489,7 +518,7 @@ function normalizeLoadedSession(session) {
     const refreshState = getOwnEntry(session, "refreshState");
     if (refreshState !== undefined && (refreshState !== "pending" || getOwnEntry(session, "tokens") !== undefined))
         throw new Error("Stored OAuth refresh state is invalid");
-    const client = normalizeStoredClient(getOwnEntry(session, "client"));
+    const client = normalizeStoredOAuthClient(getOwnEntry(session, "client"));
     if (client === null) {
         return { ...session, client: { clientId: "" }, tokens: undefined };
     }
@@ -499,25 +528,6 @@ function normalizeLoadedSession(session) {
         tokens: normalizeStoredTokens(getOwnEntry(session, "tokens"))
     };
 }
-function normalizeStoredClient(value) {
-    if (!isObjectRecord(value)) {
-        return null;
-    }
-    const clientId = getOwnString(value, "clientId");
-    if (clientId === undefined || clientId.trim().length === 0) {
-        return null;
-    }
-    const normalizedClientId = clientId.trim();
-    const clientSecret = getOwnEntry(value, "clientSecret");
-    if (clientSecret === undefined) {
-        return { clientId: normalizedClientId };
-    }
-    if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
-        return null;
-    }
-    const normalizedClientSecret = clientSecret.trim();
-    return { clientId: normalizedClientId, clientSecret: normalizedClientSecret };
-}
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {
         return undefined;
@@ -526,10 +536,10 @@ function normalizeStoredTokens(value) {
     const tokenType = getOwnString(value, "tokenType");
     const expiresAt = getOwnEntry(value, "expiresAt");
     const refreshToken = getOwnEntry(value, "refreshToken");
-    const scope = getOwnString(value, "scope");
+    const scope = getOwnEntry(value, "scope");
     const normalizedAccessToken = accessToken?.trim();
     const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : undefined;
-    const normalizedScope = scope?.trim();
+    const normalizedScope = normalizeOAuthScope(scope);
     if (accessToken === undefined ||
         normalizedAccessToken === undefined ||
         normalizedAccessToken.length === 0 ||
@@ -561,18 +571,18 @@ function getClientMetadata(client) {
     }
     return {
         clientName: normalizeOptionalOAuthString(client.metadata.clientName),
-        scope: normalizeOptionalOAuthString(client.metadata.scope),
+        scope: normalizeOAuthScope(client.metadata.scope),
         softwareId: normalizeOptionalOAuthString(client.metadata.softwareId),
         softwareVersion: normalizeOptionalOAuthString(client.metadata.softwareVersion)
     };
 }
 function normalizeConfiguredClient(client) {
-    const clientId = normalizeOptionalOAuthString(client.clientId);
-    if (clientId === undefined) {
+    const registration = client.registration === undefined ? undefined : parseOAuthClientRegistration(client.registration);
+    const clientId = normalizeOptionalOAuthString(client.clientId) ?? registration?.client_id.trim();
+    if (clientId === undefined)
         return null;
-    }
-    const clientSecret = normalizeOptionalOAuthString(client.clientSecret);
-    return clientSecret === undefined ? { clientId } : { clientId, clientSecret };
+    const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === undefined ? undefined : getOwnString(registration, "client_secret")?.trim());
+    return normalizeStoredOAuthClient({ clientId, clientSecret, registration, tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
 }
 function normalizeOptionalOAuthString(value) {
     if (value === undefined) {
@@ -679,12 +689,28 @@ function assertRequestMatchesResource(requestUrl, resource) {
         throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
     }
 }
-function buildClientRegistrationBody(metadata, redirectUri) {
+function getSupportedTokenAuthMethods(metadata) {
+    const value = getOwnEntry(metadata, "token_endpoint_auth_methods_supported");
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length > 128 || value.some(method => typeof method !== "string"))
+        throw new Error("Invalid OAuth token endpoint authentication metadata");
+    return value;
+}
+function assertTokenEndpointAuthentication(client, metadata) {
+    const method = client.tokenEndpointAuthMethod ?? (client.clientSecret === undefined ? "none" : "client_secret_post");
+    if (method !== "none" && client.clientSecret === undefined)
+        throw new Error("OAuth token endpoint authentication requires a client secret");
+    const supported = getSupportedTokenAuthMethods(metadata);
+    if (supported !== undefined && !supported.includes(method))
+        throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+}
+function buildClientRegistrationBody(metadata, redirectUri, tokenEndpointAuthMethod) {
     const body = {
         redirect_uris: [redirectUri],
         grant_types: ["authorization_code", "refresh_token"],
         response_types: ["code"],
-        token_endpoint_auth_method: "none"
+        token_endpoint_auth_method: tokenEndpointAuthMethod
     };
     const clientName = metadata === undefined ? undefined : getOwnString(metadata, "clientName");
     const scope = metadata === undefined ? undefined : getOwnString(metadata, "scope");

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/scope.d.ts

@@ -0,0 +1,2 @@
+/** Compare OAuth scope sets without accepting controls or changing token case. */
+export declare function normalizeOAuthScope(scope: unknown): string | undefined;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/scope.js

@@ -0,0 +1,9 @@
+/** Compare OAuth scope sets without accepting controls or changing token case. */
+export function normalizeOAuthScope(scope) {
+    if (scope === undefined)
+        return undefined;
+    if (typeof scope !== "string" || [...scope].some(char => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
+        throw new Error("Invalid OAuth scope syntax");
+    const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
+    return normalized || undefined;
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-auth-method.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthTokenEndpointAuthMethod } from "./types.js";
+export declare function normalizeOAuthTokenEndpointAuthMethod(value: unknown): OAuthTokenEndpointAuthMethod | undefined;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-auth-method.js

@@ -0,0 +1,7 @@
+export function normalizeOAuthTokenEndpointAuthMethod(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
+        throw new Error("Unsupported OAuth token endpoint authentication method");
+    return value;
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-endpoint.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthMetadataFetch, StoredOAuthTokens } from "./types.js";
+import type { OAuthMetadataFetch, StoredOAuthTokens, OAuthTokenEndpointAuthMethod } from "./types.js";
 interface OAuthErrorShape {
     error: string;
     error_description?: string;
@@ -22,6 +22,7 @@ export declare function exchangeAuthorizationCode(input: {
     tokenEndpoint: string;
     clientId: string;
     clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     code: string;
     codeVerifier: string;
     redirectUri: string;
@@ -34,6 +35,7 @@ export declare function refreshAccessToken(input: {
     tokenEndpoint: string;
     clientId: string;
     clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     refreshToken: string;
     resource: string;
     fetch: OAuthMetadataFetch;