toolcraft 0.0.314 → 0.0.316

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,4 +1,6 @@
+import { normalizeStoredOAuthClient, parseOAuthClientRegistration, registrationMatchesRedirect } from "./client-registration.js";
 import { normalizeOAuthScope } from "./scope.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
@@ -21,6 +23,9 @@ export function createDefaultOAuthClientProvider(options) {
     assertPersistenceNamespace(options.persistenceNamespace);
     const clientMetadata = getClientMetadata(options.client);
     const requestedScope = clientMetadata?.scope;
+    const configuredClient = normalizeConfiguredClient(options.client);
+    const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
+    const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
     const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
     const now = options.now ?? Date.now;
@@ -38,8 +43,8 @@ export function createDefaultOAuthClientProvider(options) {
     }
     const initialGrant = options.initialGrant === undefined ? undefined : {
         resource: canonicalizeResourceIndicator(options.initialGrant.resource),
-        tokens: normalizeStoredTokens(options.initialGrant.tokens),
-        client: normalizeConfiguredClient(options.client)
+        tokens: normalizeImportedTokens(options.initialGrant.tokens, now),
+        client: configuredClient
     };
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
         throw new Error("OAuth initial grant requires valid tokens and the original client ID");
@@ -122,6 +127,10 @@ export function createDefaultOAuthClientProvider(options) {
         const canonicalResource = canonicalizeResourceIndicator(resource);
         return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
             let session = await loadSession(canonicalResource);
+            if (session !== null)
+                assertRegistrationIssuer(session.client, session.authorizationServer);
+            if (configuredClient !== null && discovery !== undefined)
+                assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
             if (session !== null && initialGrant?.resource === canonicalResource)
                 initialGrantConsumed = true;
             signal?.throwIfAborted();
@@ -147,13 +156,16 @@ export function createDefaultOAuthClientProvider(options) {
             if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
                 forceRefresh = false;
             const sessionDiscovery = resolveDiscovery(discovery, session);
-            if ((options.client.mode === "static" || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
-                const configured = normalizeConfiguredClient(options.client);
+            if ((options.client.mode === "static" || configuredClient?.registration !== undefined || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
+                const configured = configuredClient;
                 if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
                     throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
             }
             if (requestedScope !== undefined && session?.tokens !== undefined && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
                 throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
+            if (configuredTokenMethod !== undefined && session !== null && (session.tokens !== undefined || session.refreshState === "pending") &&
+                (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === undefined ? "none" : "client_secret_post")) !== configuredTokenMethod)
+                throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
             if (session?.refreshState === "pending") {
                 if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === undefined)
                     throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -165,6 +177,11 @@ export function createDefaultOAuthClientProvider(options) {
             if (session?.tokens?.refreshToken !== undefined &&
                 sessionDiscovery !== undefined &&
                 (forceRefresh || isExpired(session.tokens, now))) {
+                if (hasExpiredClientSecret(session.client, now)) {
+                    if (!allowInteractive || options.allowInteractive === false || options.client.mode === "static" || configuredClient?.registration !== undefined)
+                        throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
+                    return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch, signal);
+                }
                 session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch, signal);
                 if (session?.tokens !== undefined && !isExpired(session.tokens, now)) {
                     return session;
@@ -188,6 +205,7 @@ export function createDefaultOAuthClientProvider(options) {
         if (session.tokens?.refreshToken === undefined) {
             return session;
         }
+        assertTokenEndpointAuthentication(session.client, discovery.authorizationServerMetadata);
         const pendingSession = { ...clearSessionTokens(session), refreshState: "pending" };
         await saveSession(resource, pendingSession);
         signal?.throwIfAborted();
@@ -199,6 +217,7 @@ export function createDefaultOAuthClientProvider(options) {
                     tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
                     clientId: session.client.clientId,
                     clientSecret: session.client.clientSecret,
+                    tokenEndpointAuthMethod: session.client.tokenEndpointAuthMethod,
                     refreshToken: session.tokens.refreshToken,
                     resource,
                     fetch, signal,
@@ -264,6 +283,7 @@ export function createDefaultOAuthClientProvider(options) {
             let resolvedClient = null;
             try {
                 resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch, signal);
+                assertTokenEndpointAuthentication(resolvedClient.client, discovery.authorizationServerMetadata);
                 const sessionWithoutTokens = {
                     resource,
                     authorizationServer: discovery.authorizationServer,
@@ -287,6 +307,7 @@ export function createDefaultOAuthClientProvider(options) {
                     tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
                     clientId: resolvedClient.client.clientId,
                     clientSecret: resolvedClient.client.clientSecret,
+                    tokenEndpointAuthMethod: resolvedClient.client.tokenEndpointAuthMethod,
                     code,
                     codeVerifier: verifier,
                     redirectUri: loopback.redirectUri,
@@ -327,11 +348,13 @@ export function createDefaultOAuthClientProvider(options) {
     }
     async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
         parentSignal?.throwIfAborted();
-        const configuredClient = normalizeConfiguredClient(options.client);
-        if (options.client.mode === "static") {
+        if (options.client.mode === "static" || configuredClient?.registration !== undefined) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }
+            assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(configuredClient, now))
+                throw new Error("OAuth client secret has expired; update the imported registration");
             return {
                 kind: "static",
                 fromStoredRegistration: false,
@@ -346,7 +369,14 @@ export function createDefaultOAuthClientProvider(options) {
                 client: configuredClient
             };
         }
-        const storedClient = await loadRegisteredClient(discovery.authorizationServer);
+        let storedClient = await loadRegisteredClient(discovery.authorizationServer);
+        if (storedClient !== null) {
+            assertRegistrationIssuer(storedClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(storedClient, now) || !registrationMatchesRedirect(storedClient, redirectUri)) {
+                await clearRegisteredClient(discovery.authorizationServer);
+                storedClient = null;
+            }
+        }
         if (storedClient !== null) {
             return {
                 kind: "dynamic",
@@ -355,7 +385,7 @@ export function createDefaultOAuthClientProvider(options) {
             };
         }
         if (registrationEndpoint === undefined) {
-            if (existingSession !== null && existingSession.client.clientId.length > 0) {
+            if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
                 return {
                     kind: "dynamic",
                     fromStoredRegistration: true,
@@ -364,7 +394,7 @@ export function createDefaultOAuthClientProvider(options) {
             }
             throw new Error("Authorization server metadata is missing registration_endpoint");
         }
-        if (existingSession !== null && existingSession.client.clientId.length > 0) {
+        if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
             const isConfiguredStaticFallback = configuredClient !== null &&
                 existingSession.client.clientId === configuredClient.clientId &&
                 existingSession.client.clientSecret === configuredClient.clientSecret;
@@ -377,7 +407,12 @@ export function createDefaultOAuthClientProvider(options) {
                 };
             }
         }
-        const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri);
+        const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
+        const registrationMethod = requestedTokenMethod ?? (supported === undefined ? "none" :
+            ["none", "client_secret_basic", "client_secret_post"].find(method => supported.includes(method)));
+        if (registrationMethod === undefined || (supported !== undefined && !supported.includes(registrationMethod)))
+            throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+        const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri, registrationMethod);
         const deadline = AbortSignal.timeout(30_000);
         const signal = parentSignal === undefined ? deadline : AbortSignal.any([parentSignal, deadline]);
         const response = await fetchMcpResponse(fetch, registrationEndpoint, {
@@ -389,29 +424,34 @@ export function createDefaultOAuthClientProvider(options) {
             signal
         });
         const payload = await readOAuthJsonObjectResponse(response, signal);
-        const clientId = getOwnString(payload, "client_id");
-        if (clientId === undefined || clientId.trim().length === 0) {
-            throw new Error("OAuth client registration response missing client_id");
-        }
-        const clientSecret = getOwnString(payload, "client_secret");
+        const registration = parseOAuthClientRegistration(payload);
+        const registeredSecret = getOwnString(registration, "client_secret");
+        const responseMethod = normalizeOAuthTokenEndpointAuthMethod(getOwnEntry(registration, "token_endpoint_auth_method")) ??
+            requestedTokenMethod ?? (supported === undefined ? undefined : normalizeOAuthTokenEndpointAuthMethod(registrationMethod));
         const registeredClient = {
-            clientId: clientId.trim(),
-            clientSecret: clientSecret !== undefined && clientSecret.trim().length > 0
-                ? clientSecret.trim()
-                : undefined
+            clientId: registration.client_id.trim(),
+            ...(registeredSecret === undefined ? {} : { clientSecret: registeredSecret.trim() }),
+            ...(responseMethod === undefined ? {} : { tokenEndpointAuthMethod: responseMethod }),
+            registration
         };
-        await saveRegisteredClient(discovery.authorizationServer, registeredClient);
+        assertRegistrationIssuer(registeredClient, discovery.authorizationServer);
+        if (hasExpiredClientSecret(registeredClient, now))
+            throw new Error("OAuth client secret has expired in the registration response");
+        if (!registrationMatchesRedirect(registeredClient, redirectUri, true))
+            throw new Error("OAuth registration response does not match the requested redirect URI");
+        const clientWithRedirect = { ...registeredClient, requestedRedirectUri: redirectUri };
+        await saveRegisteredClient(discovery.authorizationServer, clientWithRedirect);
         return {
             kind: "dynamic",
             fromStoredRegistration: false,
-            client: registeredClient
+            client: clientWithRedirect
         };
     }
     async function loadSession(resource) {
         return normalizeLoadedSession(await sessionStore.load(resource));
     }
     async function saveSession(resource, session) {
-        await sessionStore.save(resource, session);
+        await sessionStore.save(resource, structuredClone(session));
     }
     async function clearSession(resource) {
         await sessionStore.clear(resource);
@@ -424,7 +464,7 @@ export function createDefaultOAuthClientProvider(options) {
             return null;
         }
         const client = await clientStore.load(issuer);
-        const normalizedClient = client === null ? null : normalizeStoredClient(client);
+        const normalizedClient = client === null ? null : normalizeStoredOAuthClient(client);
         if (client !== null && normalizedClient === null) {
             await clientStore.clear(issuer);
             return null;
@@ -503,7 +543,7 @@ function normalizeLoadedSession(session) {
     const refreshState = getOwnEntry(session, "refreshState");
     if (refreshState !== undefined && (refreshState !== "pending" || getOwnEntry(session, "tokens") !== undefined))
         throw new Error("Stored OAuth refresh state is invalid");
-    const client = normalizeStoredClient(getOwnEntry(session, "client"));
+    const client = normalizeStoredOAuthClient(getOwnEntry(session, "client"));
     if (client === null) {
         return { ...session, client: { clientId: "" }, tokens: undefined };
     }
@@ -513,24 +553,20 @@ function normalizeLoadedSession(session) {
         tokens: normalizeStoredTokens(getOwnEntry(session, "tokens"))
     };
 }
-function normalizeStoredClient(value) {
-    if (!isObjectRecord(value)) {
-        return null;
-    }
-    const clientId = getOwnString(value, "clientId");
-    if (clientId === undefined || clientId.trim().length === 0) {
-        return null;
-    }
-    const normalizedClientId = clientId.trim();
-    const clientSecret = getOwnEntry(value, "clientSecret");
-    if (clientSecret === undefined) {
-        return { clientId: normalizedClientId };
-    }
-    if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
-        return null;
-    }
-    const normalizedClientSecret = clientSecret.trim();
-    return { clientId: normalizedClientId, clientSecret: normalizedClientSecret };
+function normalizeImportedTokens(value, now) {
+    if (!isObjectRecord(value))
+        return undefined;
+    const absolute = getOwnEntry(value, "expiresAt");
+    const lifetime = getOwnEntry(value, "expiresIn");
+    const issuedAt = getOwnEntry(value, "issuedAt");
+    if (lifetime !== undefined && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
+        throw new Error("OAuth initial grant has invalid relative expiry");
+    if (issuedAt !== undefined && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) ||
+        Math.abs(issuedAt) > MAX_JS_DATE_MS))
+        throw new Error("OAuth initial grant has invalid issuance time");
+    const expiresAt = absolute !== undefined && absolute !== null ? absolute :
+        lifetime === undefined ? null : (issuedAt === undefined ? now() : issuedAt) + lifetime * 1000;
+    return normalizeStoredTokens({ ...value, expiresAt });
 }
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {
@@ -581,12 +617,12 @@ function getClientMetadata(client) {
     };
 }
 function normalizeConfiguredClient(client) {
-    const clientId = normalizeOptionalOAuthString(client.clientId);
-    if (clientId === undefined) {
+    const registration = client.registration === undefined ? undefined : parseOAuthClientRegistration(client.registration);
+    const clientId = normalizeOptionalOAuthString(client.clientId) ?? registration?.client_id.trim();
+    if (clientId === undefined)
         return null;
-    }
-    const clientSecret = normalizeOptionalOAuthString(client.clientSecret);
-    return clientSecret === undefined ? { clientId } : { clientId, clientSecret };
+    const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === undefined ? undefined : getOwnString(registration, "client_secret")?.trim());
+    return normalizeStoredOAuthClient({ clientId, clientSecret, registration, tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
 }
 function normalizeOptionalOAuthString(value) {
     if (value === undefined) {
@@ -693,12 +729,39 @@ function assertRequestMatchesResource(requestUrl, resource) {
         throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
     }
 }
-function buildClientRegistrationBody(metadata, redirectUri) {
+function assertRegistrationIssuer(client, issuer) {
+    const registrationIssuer = client.registration === undefined ? undefined : getOwnString(client.registration, "issuer");
+    if (registrationIssuer !== undefined && registrationIssuer !== issuer)
+        throw new Error("OAuth client registration issuer does not match the authorization server");
+}
+function hasExpiredClientSecret(client, now) {
+    if (client.clientSecret === undefined || client.tokenEndpointAuthMethod === "none" || client.registration === undefined)
+        return false;
+    const expiry = getOwnEntry(client.registration, "client_secret_expires_at");
+    return typeof expiry === "number" && expiry !== 0 && expiry <= now() / 1000;
+}
+function getSupportedTokenAuthMethods(metadata) {
+    const value = getOwnEntry(metadata, "token_endpoint_auth_methods_supported");
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length > 128 || value.some(method => typeof method !== "string"))
+        throw new Error("Invalid OAuth token endpoint authentication metadata");
+    return value;
+}
+function assertTokenEndpointAuthentication(client, metadata) {
+    const method = client.tokenEndpointAuthMethod ?? (client.clientSecret === undefined ? "none" : "client_secret_post");
+    if (method !== "none" && client.clientSecret === undefined)
+        throw new Error("OAuth token endpoint authentication requires a client secret");
+    const supported = getSupportedTokenAuthMethods(metadata);
+    if (supported !== undefined && !supported.includes(method))
+        throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+}
+function buildClientRegistrationBody(metadata, redirectUri, tokenEndpointAuthMethod) {
     const body = {
         redirect_uris: [redirectUri],
         grant_types: ["authorization_code", "refresh_token"],
         response_types: ["code"],
-        token_endpoint_auth_method: "none"
+        token_endpoint_auth_method: tokenEndpointAuthMethod
     };
     const clientName = metadata === undefined ? undefined : getOwnString(metadata, "clientName");
     const scope = metadata === undefined ? undefined : getOwnString(metadata, "scope");

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-auth-method.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthTokenEndpointAuthMethod } from "./types.js";
+export declare function normalizeOAuthTokenEndpointAuthMethod(value: unknown): OAuthTokenEndpointAuthMethod | undefined;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-auth-method.js

@@ -0,0 +1,7 @@
+export function normalizeOAuthTokenEndpointAuthMethod(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
+        throw new Error("Unsupported OAuth token endpoint authentication method");
+    return value;
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-endpoint.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthMetadataFetch, StoredOAuthTokens } from "./types.js";
+import type { OAuthMetadataFetch, StoredOAuthTokens, OAuthTokenEndpointAuthMethod } from "./types.js";
 interface OAuthErrorShape {
     error: string;
     error_description?: string;
@@ -22,6 +22,7 @@ export declare function exchangeAuthorizationCode(input: {
     tokenEndpoint: string;
     clientId: string;
     clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     code: string;
     codeVerifier: string;
     redirectUri: string;
@@ -34,6 +35,7 @@ export declare function refreshAccessToken(input: {
     tokenEndpoint: string;
     clientId: string;
     clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     refreshToken: string;
     resource: string;
     fetch: OAuthMetadataFetch;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -1,3 +1,4 @@
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 import { readBoundedResponseText } from "../http-response.js";
 import { fetchMcpResponse } from "../http-fetch.js";
@@ -40,6 +41,7 @@ export async function exchangeAuthorizationCode(input) {
         tokenEndpoint: input.tokenEndpoint,
         clientId: input.clientId,
         clientSecret: input.clientSecret,
+        tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
         params: {
             grant_type: "authorization_code",
             code: input.code,
@@ -58,6 +60,7 @@ export async function refreshAccessToken(input) {
         tokenEndpoint: input.tokenEndpoint,
         clientId: input.clientId,
         clientSecret: input.clientSecret,
+        tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
         params: {
             grant_type: "refresh_token",
             refresh_token: input.refreshToken,
@@ -69,21 +72,28 @@ export async function refreshAccessToken(input) {
     });
 }
 async function requestTokens(input) {
-    const body = new URLSearchParams({
-        client_id: input.clientId,
-        ...input.params
-    });
-    if (input.clientSecret !== undefined) {
-        body.set("client_secret", input.clientSecret);
+    const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ??
+        (input.clientSecret === undefined ? "none" : "client_secret_post");
+    if (method !== "none" && (input.clientSecret === undefined || input.clientSecret.trim() === ""))
+        throw new Error("OAuth token endpoint authentication requires a client secret");
+    const body = new URLSearchParams(input.params);
+    const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
+    if (method === "client_secret_basic") {
+        const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
+        const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
+        headers.set("Authorization", `Basic ${Buffer.from(`${encoded}:${encodedSecret}`).toString("base64")}`);
+    }
+    else {
+        body.set("client_id", input.clientId);
+        if (method === "client_secret_post")
+            body.set("client_secret", input.clientSecret);
     }
     input.signal?.throwIfAborted();
     const deadline = AbortSignal.timeout(30_000);
     const signal = input.signal === undefined ? deadline : AbortSignal.any([input.signal, deadline]);
     const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
         method: "POST",
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded"
-        },
+        headers,
         body: body.toString(),
         signal
     });

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -70,13 +70,39 @@ export interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Import-time lifetimes are normalized once into persisted epoch milliseconds. */
+export interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
+    expiresAt?: number | null;
+    /** Remaining lifetime at import, or total lifetime when issuedAt is provided. */
+    expiresIn?: number;
+    /** Original issuance time in Unix epoch milliseconds. */
+    issuedAt?: number;
+}
+/** Full RFC 7591 response, including JSON provider extensions. */
+export interface OAuthClientRegistration extends Record<string, unknown> {
+    client_id: string;
+    client_secret?: string | null;
+    redirect_uris?: string[] | null;
+    grant_types?: string[] | null;
+    response_types?: string[] | null;
+    contacts?: string[] | null;
+    client_id_issued_at?: number | null;
+    client_secret_expires_at?: number | null;
+    token_endpoint_auth_method?: string | null;
+}
+export interface StoredOAuthClient {
+    clientId: string;
+    /** Actual listener URI submitted when this native client was registered. */
+    requestedRedirectUri?: string;
+    clientSecret?: string;
+    registration?: OAuthClientRegistration;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+}
+export type OAuthTokenEndpointAuthMethod = "none" | "client_secret_post" | "client_secret_basic";
 export interface StoredOAuthSession {
     resource: string;
     authorizationServer: string;
-    client: {
-        clientId: string;
-        clientSecret?: string;
-    };
+    client: StoredOAuthClient;
     tokens?: StoredOAuthTokens;
     /** A refresh was begun; its winning response may not have been persisted. */
     refreshState?: "pending";
@@ -104,11 +130,16 @@ export interface DefaultOAuthClientProviderOptions {
         clientId?: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        /** Import a complete registration owned by the caller. */
+        registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
@@ -119,7 +150,7 @@ export interface DefaultOAuthClientProviderOptions {
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;
-        tokens: StoredOAuthTokens;
+        tokens: ImportedOAuthTokens;
     };
     browser: {
         openBrowser?(url: string): Promise<void>;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.d.ts

@@ -1,11 +1,12 @@
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
+export { parseOAuthClientRegistration } from "./client/client-registration.js";
 export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
 export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, } from "./client/loopback-authorization.js";
 export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";
 export { OAuthError, } from "./client/token-endpoint.js";
 export { canonicalizeResourceIndicator, } from "./resource-indicator.js";
 export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
-export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, StoredOAuthSession, StoredOAuthTokens, } from "./client/types.js";
+export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, OAuthTokenEndpointAuthMethod, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, ImportedOAuthTokens, } from "./client/types.js";
 export type { JwksTokenVerifier, JwksTokenVerifierOptions, JwksVerifiedAccessToken, } from "./server/jwks-token-verifier.js";
 export type { LoopbackAuthorizationOptions, LoopbackAuthorizationSession, OAuthLandingPage, } from "./client/loopback-authorization.js";
 export { readBoundedResponseText } from "./http-response.js";

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.js

@@ -1,4 +1,5 @@
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
+export { parseOAuthClientRegistration } from "./client/client-registration.js";
 export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
 export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, } from "./client/loopback-authorization.js";
 export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.33",
+  "version": "0.1.36",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -173,13 +173,39 @@ interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Import-time lifetimes are normalized once into persisted epoch milliseconds. */
+interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
+    expiresAt?: number | null;
+    /** Remaining lifetime at import, or total lifetime when issuedAt is provided. */
+    expiresIn?: number;
+    /** Original issuance time in Unix epoch milliseconds. */
+    issuedAt?: number;
+}
+/** Full RFC 7591 response, including JSON provider extensions. */
+interface OAuthClientRegistration extends Record<string, unknown> {
+    client_id: string;
+    client_secret?: string | null;
+    redirect_uris?: string[] | null;
+    grant_types?: string[] | null;
+    response_types?: string[] | null;
+    contacts?: string[] | null;
+    client_id_issued_at?: number | null;
+    client_secret_expires_at?: number | null;
+    token_endpoint_auth_method?: string | null;
+}
+interface StoredOAuthClient {
+    clientId: string;
+    /** Actual listener URI submitted when this native client was registered. */
+    requestedRedirectUri?: string;
+    clientSecret?: string;
+    registration?: OAuthClientRegistration;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+}
+type OAuthTokenEndpointAuthMethod = "none" | "client_secret_post" | "client_secret_basic";
 interface StoredOAuthSession {
     resource: string;
     authorizationServer: string;
-    client: {
-        clientId: string;
-        clientSecret?: string;
-    };
+    client: StoredOAuthClient;
     tokens?: StoredOAuthTokens;
     /** A refresh was begun; its winning response may not have been persisted. */
     refreshState?: "pending";
@@ -207,11 +233,16 @@ interface DefaultOAuthClientProviderOptions {
         clientId?: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        /** Import a complete registration owned by the caller. */
+        registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
+        registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
@@ -222,7 +253,7 @@ interface DefaultOAuthClientProviderOptions {
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;
-        tokens: StoredOAuthTokens;
+        tokens: ImportedOAuthTokens;
     };
     browser: {
         openBrowser?(url: string): Promise<void>;