toolcraft 0.0.315 → 0.0.317

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.34",
+      "version": "0.1.37",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.315",
+      "version": "0.0.317",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.315",
+      "version": "0.0.317",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.34",
+      "version": "0.1.37",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.315",
+      "version": "0.0.317",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.315",
+      "version": "0.0.317",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.34",
+      "version": "0.1.37",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -102,12 +102,26 @@ normalized. An imported grant must declare its scope when a scope is configured.
 Authorization records the requested set when the endpoint omits scope, and
 refresh retains the previous granted set. Mismatched responses never activate
 credentials; an unusable refresh response retains the pending refresh record.
+`resourceIdentity` selects a native-owned logical server within its optional
+persistence namespace. One encrypted, locked document owns that identity's
+current resource URL, sessions and registrations. Changing the URL retires its
+credentials permanently; returning to the old URL does not restore them.
+Retired identities also withhold stale initial grants; authorize again or select
+a fresh explicit profile to import a new grant. This option requires native persistence; custom
+session stores own their durable resource trust policy. Without it, the native
+client retains its existing resource-URL cache behavior.
+
 Select a separate persistence namespace for another scope profile. No scope is
 invented when the client does not configure one.
 
 Imported `initialGrant.tokens` use `accessToken`, optional `refreshToken`,
-`tokenType: "Bearer"`, `expiresAt` (Unix epoch milliseconds or `null` if unknown),
-and optional `scope`. A fresh imported token is used only for its resource.
+`tokenType: "Bearer"`, optional `expiresAt` (Unix epoch milliseconds or `null`
+if unknown), and optional `scope`. `expiresIn` is a lifetime in seconds and is
+anchored once at import. For a delayed import, provide the original `issuedAt`
+in epoch milliseconds or its real absolute `expiresAt`; a numeric absolute
+expiry takes precedence. Without either, the relative value means remaining
+lifetime at import. Omitted expiry stays unknown. A fresh imported token is
+used only for its resource.
 Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
@@ -119,6 +133,22 @@ Explicit ID/secret values must agree with the imported response. Sessions and
 native registration stores retain arrays, issuance/expiry timestamps and JSON
 provider metadata. Registration input is copied, bounded to 64 KiB and 64
 levels, and rejects invalid standard field types and non-JSON extensions.
+An optional registration `issuer` must match discovery and the persisted
+authorization server exactly. Contradictory metadata fails without activating
+or redeeming the grant. `client_secret_expires_at` uses Unix epoch seconds;
+zero means no expiry. Live access tokens remain usable after secret expiry,
+but an expired secret is never submitted for refresh. Native DCR can replace
+an expired registration during explicit authorization; caller-owned imports
+must be updated. Headless requests retain the old record and report recovery
+is required without creating a pending refresh marker.
+Native registrations retain `requestedRedirectUri`, the actual listener URI
+submitted to DCR, separately from the full response metadata. Fresh responses
+may normalize a loopback port or represent IPv4 loopback as portless localhost;
+host, path, scheme, query and fragment differences outside that boundary fail.
+Authorization and code exchange always use the actual listener URI. Silent
+refresh keeps its original client regardless of callback changes. At interactive
+authorization, a native registration with an obsolete captured callback is
+replaced; caller-owned full registration imports retain their original identity.
 Set `client.tokenEndpointAuthMethod` to `none`, `client_secret_post` or
 `client_secret_basic`; a full registration can supply the same field as
 `token_endpoint_auth_method`. Public clients never transmit a stored secret.

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.d.ts

@@ -1,5 +1,5 @@
-import { type CreateSecretStoreInput } from "auth-store";
-import type { OAuthSessionStore, StoredOAuthClient } from "./types.js";
+import { type CreateSecretStoreInput, type SecretStore } from "auth-store";
+import type { OAuthSessionStore, StoredOAuthSession, StoredOAuthClient } from "./types.js";
 export interface OAuthClientStore {
     load(issuer: string): Promise<StoredOAuthClient | null>;
     save(issuer: string, client: StoredOAuthClient): Promise<void>;
@@ -7,4 +7,11 @@ export interface OAuthClientStore {
 }
 export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput, namespace?: string): OAuthSessionStore;
 export declare function createAuthStoreClientStore(options: CreateSecretStoreInput, namespace?: string): OAuthClientStore;
+export declare function createNamedSecretStore(key: string, options: CreateSecretStoreInput, defaults: {
+    salt: string;
+    directory: string;
+    service: string;
+    accountPrefix: string;
+}, namespace?: string): SecretStore;
 export declare function assertPersistenceNamespace(namespace: string | undefined): void;
+export declare function isStoredOAuthSession(value: unknown): value is StoredOAuthSession;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -79,7 +79,7 @@ export function createAuthStoreClientStore(options, namespace) {
         }
     };
 }
-function createNamedSecretStore(key, options, defaults, namespace) {
+export function createNamedSecretStore(key, options, defaults, namespace) {
     const hash = crypto.createHash("sha256").update(namespace === undefined ? key : JSON.stringify([namespace, key])).digest("hex");
     const configuredFilePath = options.fileStore?.filePath;
     const parsedFilePath = configuredFilePath === undefined ? null : path.parse(configuredFilePath);
@@ -132,7 +132,7 @@ function getOwnString(record, key) {
     const value = getOwnEntry(record, key);
     return typeof value === "string" ? value : undefined;
 }
-function isStoredOAuthSession(value) {
+export function isStoredOAuthSession(value) {
     if (!isObjectRecord(value)) {
         return false;
     }

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/client-registration.d.ts

@@ -2,3 +2,5 @@ import type { OAuthClientRegistration, StoredOAuthClient } from "./types.js";
 /** Validate and copy a bounded JSON DCR response without quoting credential input. */
 export declare function parseOAuthClientRegistration(value: unknown): OAuthClientRegistration;
 export declare function normalizeStoredOAuthClient(value: unknown): StoredOAuthClient | null;
+/** Fresh DCR may describe a normalized loopback port; saved identity stays exact. */
+export declare function registrationMatchesRedirect(client: StoredOAuthClient, requestedUri: string, fresh?: boolean): boolean;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -1,3 +1,4 @@
+import { loopbackTarget } from "./loopback-authorization.js";
 import { normalizeOAuthScope } from "./scope.js";
 import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 /** Validate and copy a bounded JSON DCR response without quoting credential input. */
@@ -84,6 +85,18 @@ export function normalizeStoredOAuthClient(value) {
         (clientSecret !== undefined && (typeof clientSecret !== "string" || clientSecret.trim() === "")))
         return null;
     const client = { clientId: clientId.trim(), ...(clientSecret === undefined ? {} : { clientSecret: clientSecret.trim() }) };
+    const requestedRedirectUri = Object.hasOwn(record, "requestedRedirectUri") ? record.requestedRedirectUri : undefined;
+    if (requestedRedirectUri !== undefined) {
+        try {
+            if (typeof requestedRedirectUri !== "string")
+                throw new Error("Invalid redirect identity");
+            loopbackTarget({ redirectUri: requestedRedirectUri });
+        }
+        catch {
+            throw new Error("Invalid stored OAuth registration redirect identity");
+        }
+        client.requestedRedirectUri = requestedRedirectUri;
+    }
     const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record, "tokenEndpointAuthMethod") ? record.tokenEndpointAuthMethod : undefined);
     if (Object.hasOwn(record, "registration") && record.registration !== undefined) {
         const registration = parseOAuthClientRegistration(record.registration);
@@ -101,3 +114,35 @@ export function normalizeStoredOAuthClient(value) {
         client.tokenEndpointAuthMethod = method;
     return client;
 }
+/** Fresh DCR may describe a normalized loopback port; saved identity stays exact. */
+export function registrationMatchesRedirect(client, requestedUri, fresh = false) {
+    if (client.requestedRedirectUri !== undefined)
+        return client.requestedRedirectUri === requestedUri;
+    const redirects = client.registration?.redirect_uris;
+    if (redirects === undefined || redirects === null || redirects.length === 0)
+        return true;
+    return redirects.some(returnedUri => {
+        if (returnedUri === requestedUri)
+            return true;
+        if (!fresh)
+            return false;
+        let returned, requested;
+        try {
+            returned = new URL(returnedUri);
+            requested = new URL(requestedUri);
+        }
+        catch {
+            return false;
+        }
+        if (requested.protocol !== "http:" || returned.protocol !== "http:" ||
+            !["127.0.0.1", "[::1]", "localhost"].includes(requested.hostname))
+            return false;
+        const sameHost = returned.hostname === requested.hostname;
+        const normalizedIpv4 = requested.hostname === "127.0.0.1" && returned.hostname === "localhost" && returned.port === "";
+        if (!sameHost && !normalizedIpv4)
+            return false;
+        returned.hostname = requested.hostname;
+        returned.port = requested.port;
+        return returned.href === requested.href;
+    });
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,4 +1,5 @@
-import { normalizeStoredOAuthClient, parseOAuthClientRegistration } from "./client-registration.js";
+import { createResourceBoundOAuthStores } from "./resource-bound-store.js";
+import { normalizeStoredOAuthClient, parseOAuthClientRegistration, registrationMatchesRedirect } from "./client-registration.js";
 import { normalizeOAuthScope } from "./scope.js";
 import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 import { isIP } from "node:net";
@@ -26,8 +27,13 @@ export function createDefaultOAuthClientProvider(options) {
     const configuredClient = normalizeConfiguredClient(options.client);
     const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
     const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
-    const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
-    const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
+    if (options.resourceIdentity !== undefined && options.sessionStore !== undefined)
+        throw new Error("OAuth resourceIdentity requires native-owned persistence; custom stores own their resource trust policy");
+    const resourceStores = options.resourceIdentity === undefined ? undefined :
+        createResourceBoundOAuthStores(options.authStore ?? {}, options.persistenceNamespace, options.resourceIdentity);
+    const sessionStore = resourceStores?.sessionStore ?? options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
+    const clientStore = resourceStores?.clientStore ??
+        (options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace));
     const now = options.now ?? Date.now;
     const registeredClients = new Map();
     if (options.initialGrant !== undefined) {
@@ -43,7 +49,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
     const initialGrant = options.initialGrant === undefined ? undefined : {
         resource: canonicalizeResourceIndicator(options.initialGrant.resource),
-        tokens: normalizeStoredTokens(options.initialGrant.tokens),
+        tokens: normalizeImportedTokens(options.initialGrant.tokens, now),
         client: configuredClient
     };
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
@@ -127,6 +133,15 @@ export function createDefaultOAuthClientProvider(options) {
         const canonicalResource = canonicalizeResourceIndicator(resource);
         return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
             let session = await loadSession(canonicalResource);
+            if (resourceStores !== undefined) {
+                registeredClients.clear();
+                if (!resourceStores.initialGrantAllowed)
+                    initialGrantConsumed = true;
+            }
+            if (session !== null)
+                assertRegistrationIssuer(session.client, session.authorizationServer);
+            if (configuredClient !== null && discovery !== undefined)
+                assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
             if (session !== null && initialGrant?.resource === canonicalResource)
                 initialGrantConsumed = true;
             signal?.throwIfAborted();
@@ -173,6 +188,11 @@ export function createDefaultOAuthClientProvider(options) {
             if (session?.tokens?.refreshToken !== undefined &&
                 sessionDiscovery !== undefined &&
                 (forceRefresh || isExpired(session.tokens, now))) {
+                if (hasExpiredClientSecret(session.client, now)) {
+                    if (!allowInteractive || options.allowInteractive === false || options.client.mode === "static" || configuredClient?.registration !== undefined)
+                        throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
+                    return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch, signal);
+                }
                 session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch, signal);
                 if (session?.tokens !== undefined && !isExpired(session.tokens, now)) {
                     return session;
@@ -343,6 +363,9 @@ export function createDefaultOAuthClientProvider(options) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }
+            assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(configuredClient, now))
+                throw new Error("OAuth client secret has expired; update the imported registration");
             return {
                 kind: "static",
                 fromStoredRegistration: false,
@@ -357,7 +380,14 @@ export function createDefaultOAuthClientProvider(options) {
                 client: configuredClient
             };
         }
-        const storedClient = await loadRegisteredClient(discovery.authorizationServer);
+        let storedClient = await loadRegisteredClient(discovery.authorizationServer);
+        if (storedClient !== null) {
+            assertRegistrationIssuer(storedClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(storedClient, now) || !registrationMatchesRedirect(storedClient, redirectUri)) {
+                await clearRegisteredClient(discovery.authorizationServer);
+                storedClient = null;
+            }
+        }
         if (storedClient !== null) {
             return {
                 kind: "dynamic",
@@ -366,7 +396,7 @@ export function createDefaultOAuthClientProvider(options) {
             };
         }
         if (registrationEndpoint === undefined) {
-            if (existingSession !== null && existingSession.client.clientId.length > 0) {
+            if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
                 return {
                     kind: "dynamic",
                     fromStoredRegistration: true,
@@ -375,7 +405,7 @@ export function createDefaultOAuthClientProvider(options) {
             }
             throw new Error("Authorization server metadata is missing registration_endpoint");
         }
-        if (existingSession !== null && existingSession.client.clientId.length > 0) {
+        if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
             const isConfiguredStaticFallback = configuredClient !== null &&
                 existingSession.client.clientId === configuredClient.clientId &&
                 existingSession.client.clientSecret === configuredClient.clientSecret;
@@ -415,11 +445,17 @@ export function createDefaultOAuthClientProvider(options) {
             ...(responseMethod === undefined ? {} : { tokenEndpointAuthMethod: responseMethod }),
             registration
         };
-        await saveRegisteredClient(discovery.authorizationServer, registeredClient);
+        assertRegistrationIssuer(registeredClient, discovery.authorizationServer);
+        if (hasExpiredClientSecret(registeredClient, now))
+            throw new Error("OAuth client secret has expired in the registration response");
+        if (!registrationMatchesRedirect(registeredClient, redirectUri, true))
+            throw new Error("OAuth registration response does not match the requested redirect URI");
+        const clientWithRedirect = { ...registeredClient, requestedRedirectUri: redirectUri };
+        await saveRegisteredClient(discovery.authorizationServer, clientWithRedirect);
         return {
             kind: "dynamic",
             fromStoredRegistration: false,
-            client: registeredClient
+            client: clientWithRedirect
         };
     }
     async function loadSession(resource) {
@@ -528,6 +564,21 @@ function normalizeLoadedSession(session) {
         tokens: normalizeStoredTokens(getOwnEntry(session, "tokens"))
     };
 }
+function normalizeImportedTokens(value, now) {
+    if (!isObjectRecord(value))
+        return undefined;
+    const absolute = getOwnEntry(value, "expiresAt");
+    const lifetime = getOwnEntry(value, "expiresIn");
+    const issuedAt = getOwnEntry(value, "issuedAt");
+    if (lifetime !== undefined && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
+        throw new Error("OAuth initial grant has invalid relative expiry");
+    if (issuedAt !== undefined && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) ||
+        Math.abs(issuedAt) > MAX_JS_DATE_MS))
+        throw new Error("OAuth initial grant has invalid issuance time");
+    const expiresAt = absolute !== undefined && absolute !== null ? absolute :
+        lifetime === undefined ? null : (issuedAt === undefined ? now() : issuedAt) + lifetime * 1000;
+    return normalizeStoredTokens({ ...value, expiresAt });
+}
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {
         return undefined;
@@ -689,6 +740,17 @@ function assertRequestMatchesResource(requestUrl, resource) {
         throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
     }
 }
+function assertRegistrationIssuer(client, issuer) {
+    const registrationIssuer = client.registration === undefined ? undefined : getOwnString(client.registration, "issuer");
+    if (registrationIssuer !== undefined && registrationIssuer !== issuer)
+        throw new Error("OAuth client registration issuer does not match the authorization server");
+}
+function hasExpiredClientSecret(client, now) {
+    if (client.clientSecret === undefined || client.tokenEndpointAuthMethod === "none" || client.registration === undefined)
+        return false;
+    const expiry = getOwnEntry(client.registration, "client_secret_expires_at");
+    return typeof expiry === "number" && expiry !== 0 && expiry <= now() / 1000;
+}
 function getSupportedTokenAuthMethods(metadata) {
     const value = getOwnEntry(metadata, "token_endpoint_auth_methods_supported");
     if (value === undefined)

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/resource-bound-store.d.ts

@@ -0,0 +1,9 @@
+import type { CreateSecretStoreInput } from "auth-store";
+import { type OAuthClientStore } from "./auth-store-session-store.js";
+import type { OAuthSessionStore } from "./types.js";
+/** One locked document owns a logical server's URL history, grant and clients. */
+export declare function createResourceBoundOAuthStores(options: CreateSecretStoreInput, namespace: string | undefined, identity: string): {
+    sessionStore: OAuthSessionStore;
+    clientStore: OAuthClientStore;
+    initialGrantAllowed: boolean;
+};

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/resource-bound-store.js

@@ -0,0 +1,108 @@
+import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+import { assertPersistenceNamespace, createNamedSecretStore, isStoredOAuthSession } from "./auth-store-session-store.js";
+import { normalizeStoredOAuthClient } from "./client-registration.js";
+/** One locked document owns a logical server's URL history, grant and clients. */
+export function createResourceBoundOAuthStores(options, namespace, identity) {
+    assertPersistenceNamespace(identity);
+    const store = createNamedSecretStore(identity, options, { salt: "poe-code:mcp-oauth:resources:v1",
+        directory: ".poe-code/mcp-oauth/resources", service: "poe-code-mcp-oauth-resources", accountPrefix: "resource" }, namespace);
+    const result = { initialGrantAllowed: true, sessionStore: {}, clientStore: {} };
+    async function read() {
+        const raw = await store.get();
+        if (raw === null)
+            return null;
+        let value;
+        try {
+            value = JSON.parse(raw);
+        }
+        catch {
+            throw new Error("Stored OAuth resource identity must be valid JSON; reset explicitly to recover");
+        }
+        if (typeof value !== "object" || value === null || Array.isArray(value))
+            throw new Error("Invalid stored OAuth resource identity");
+        const record = value;
+        if (!["version", "resource", "generation", "session", "clients"].every(key => Object.hasOwn(record, key)) || record.version !== 1 || typeof record.resource !== "string" || record.resource !== canonicalizeResourceIndicator(record.resource) ||
+            !Number.isSafeInteger(record.generation) || record.generation < 0 ||
+            (record.session !== null && (!isStoredOAuthSession(record.session) || record.session.resource !== record.resource)) ||
+            typeof record.clients !== "object" || record.clients === null || Array.isArray(record.clients))
+            throw new Error("Invalid stored OAuth resource identity; reset explicitly to recover");
+        let resourceUrl;
+        try {
+            resourceUrl = new URL(record.resource);
+        }
+        catch {
+            throw new Error("Invalid stored OAuth resource identity URL");
+        }
+        if (!["http:", "https:"].includes(resourceUrl.protocol) || resourceUrl.username || resourceUrl.password || resourceUrl.hash)
+            throw new Error("Invalid stored OAuth resource identity URL");
+        for (const [issuer, client] of Object.entries(record.clients)) {
+            const normalized = normalizeStoredOAuthClient(client);
+            let url;
+            try {
+                url = new URL(issuer);
+            }
+            catch {
+                throw new Error("Invalid stored OAuth resource client issuer");
+            }
+            if (normalized === null || !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash)
+                throw new Error("Invalid stored OAuth resource client");
+            Object.defineProperty(record.clients, issuer, { value: normalized, enumerable: true, configurable: true, writable: true });
+        }
+        return record;
+    }
+    async function reconcile(resource) {
+        resource = canonicalizeResourceIndicator(resource);
+        const existing = await read();
+        if (existing?.resource === resource) {
+            result.initialGrantAllowed = existing.generation === 0;
+            return existing;
+        }
+        const record = { version: 1, resource, generation: existing === null ? 0 : existing.generation + 1, session: null, clients: {} };
+        if (!Number.isSafeInteger(record.generation))
+            throw new Error("OAuth resource identity generation limit exceeded");
+        await store.set(JSON.stringify(record));
+        result.initialGrantAllowed = record.generation === 0;
+        return record;
+    }
+    result.sessionStore = {
+        async withLock(_resource, operation, options) {
+            if (store.withLock === undefined)
+                throw new Error("OAuth resource identity backend must support transaction locks");
+            return store.withLock(operation, options);
+        },
+        async load(resource) { return (await reconcile(resource)).session; },
+        async save(resource, session) {
+            const record = await reconcile(resource);
+            if (canonicalizeResourceIndicator(session.resource) !== record.resource)
+                throw new Error("OAuth session does not match its resource identity");
+            record.session = session;
+            await store.set(JSON.stringify(record));
+        },
+        async clear(resource) {
+            const record = await reconcile(resource);
+            record.session = null;
+            // Preserve a tombstone so environment grants cannot revive a cleared family.
+            record.generation = Math.max(1, record.generation);
+            result.initialGrantAllowed = false;
+            await store.set(JSON.stringify(record));
+        }
+    };
+    result.clientStore = {
+        async load(issuer) { const record = await read(); return record !== null && Object.hasOwn(record.clients, issuer) ? record.clients[issuer] : null; },
+        async save(issuer, client) {
+            const record = await read();
+            if (record === null)
+                throw new Error("OAuth resource identity must be bound before registering a client");
+            Object.defineProperty(record.clients, issuer, { value: client, enumerable: true, configurable: true, writable: true });
+            await store.set(JSON.stringify(record));
+        },
+        async clear(issuer) {
+            const record = await read();
+            if (record === null || !Object.hasOwn(record.clients, issuer))
+                return;
+            delete record.clients[issuer];
+            await store.set(JSON.stringify(record));
+        }
+    };
+    return result;
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -70,6 +70,14 @@ export interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Import-time lifetimes are normalized once into persisted epoch milliseconds. */
+export interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
+    expiresAt?: number | null;
+    /** Remaining lifetime at import, or total lifetime when issuedAt is provided. */
+    expiresIn?: number;
+    /** Original issuance time in Unix epoch milliseconds. */
+    issuedAt?: number;
+}
 /** Full RFC 7591 response, including JSON provider extensions. */
 export interface OAuthClientRegistration extends Record<string, unknown> {
     client_id: string;
@@ -84,6 +92,8 @@ export interface OAuthClientRegistration extends Record<string, unknown> {
 }
 export interface StoredOAuthClient {
     clientId: string;
+    /** Actual listener URI submitted when this native client was registered. */
+    requestedRedirectUri?: string;
     clientSecret?: string;
     registration?: OAuthClientRegistration;
     tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
@@ -137,10 +147,12 @@ export interface DefaultOAuthClientProviderOptions {
     sessionLockTimeoutMs?: number;
     /** Isolate native persisted sessions and registrations for a named profile. */
     persistenceNamespace?: string;
+    /** Native-owned durable logical server identity; changing URL retires its credentials. */
+    resourceIdentity?: string;
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;
-        tokens: StoredOAuthTokens;
+        tokens: ImportedOAuthTokens;
     };
     browser: {
         openBrowser?(url: string): Promise<void>;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.d.ts

@@ -6,7 +6,7 @@ export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";
 export { OAuthError, } from "./client/token-endpoint.js";
 export { canonicalizeResourceIndicator, } from "./resource-indicator.js";
 export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
-export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, OAuthTokenEndpointAuthMethod, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, } from "./client/types.js";
+export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, OAuthTokenEndpointAuthMethod, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, ImportedOAuthTokens, } from "./client/types.js";
 export type { JwksTokenVerifier, JwksTokenVerifierOptions, JwksVerifiedAccessToken, } from "./server/jwks-token-verifier.js";
 export type { LoopbackAuthorizationOptions, LoopbackAuthorizationSession, OAuthLandingPage, } from "./client/loopback-authorization.js";
 export { readBoundedResponseText } from "./http-response.js";

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.34",
+  "version": "0.1.37",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -173,6 +173,14 @@ interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Import-time lifetimes are normalized once into persisted epoch milliseconds. */
+interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
+    expiresAt?: number | null;
+    /** Remaining lifetime at import, or total lifetime when issuedAt is provided. */
+    expiresIn?: number;
+    /** Original issuance time in Unix epoch milliseconds. */
+    issuedAt?: number;
+}
 /** Full RFC 7591 response, including JSON provider extensions. */
 interface OAuthClientRegistration extends Record<string, unknown> {
     client_id: string;
@@ -187,6 +195,8 @@ interface OAuthClientRegistration extends Record<string, unknown> {
 }
 interface StoredOAuthClient {
     clientId: string;
+    /** Actual listener URI submitted when this native client was registered. */
+    requestedRedirectUri?: string;
     clientSecret?: string;
     registration?: OAuthClientRegistration;
     tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
@@ -240,10 +250,12 @@ interface DefaultOAuthClientProviderOptions {
     sessionLockTimeoutMs?: number;
     /** Isolate native persisted sessions and registrations for a named profile. */
     persistenceNamespace?: string;
+    /** Native-owned durable logical server identity; changing URL retires its credentials. */
+    resourceIdentity?: string;
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;
-        tokens: StoredOAuthTokens;
+        tokens: ImportedOAuthTokens;
     };
     browser: {
         openBrowser?(url: string): Promise<void>;