toolcraft 0.0.50 → 0.0.52

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,10 +1,11 @@
 import { URL } from "node:url";
-import { createAuthStoreClientStore, createAuthStoreSessionStore, } from "./auth-store-session-store.js";
+import { createAuthStoreClientStore, createAuthStoreSessionStore } from "./auth-store-session-store.js";
 import { createLoopbackAuthorizationSession } from "./loopback-authorization.js";
 import { createAuthorizationState } from "./authorization-state.js";
 import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
-import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError, readOAuthJsonObjectResponse, } from "./token-endpoint.js";
+import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError, readOAuthJsonObjectResponse } from "./token-endpoint.js";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export function createOAuthClientProvider(options) {
     if (isProviderOptions(options)) {
         return options.provider;
@@ -24,10 +25,10 @@ export function createDefaultOAuthClientProvider(options) {
             const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
             const session = await ensureAuthorizedSession(requestUrl, undefined, input.fetch, false);
             const accessToken = session?.tokens?.accessToken;
-            if (session === null
-                || accessToken === undefined
-                || session.tokens === undefined
-                || isExpired(session.tokens, now)) {
+            if (session === null ||
+                accessToken === undefined ||
+                session.tokens === undefined ||
+                isExpired(session.tokens, now)) {
                 return;
             }
             assertRequestMatchesResource(requestUrl, session.resource);
@@ -39,11 +40,11 @@ export function createDefaultOAuthClientProvider(options) {
                 const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
                 const resource = canonicalizeResourceIndicator(input.discovery.resource);
                 assertRequestMatchesResource(requestUrl, resource);
-                const forceRefresh = hasCachedAccessToken(await loadSession(resource))
-                    && input.challenge?.params.error === "invalid_token";
+                const forceRefresh = hasCachedAccessToken(await loadSession(resource)) &&
+                    input.challenge?.params.error === "invalid_token";
                 const session = await ensureAuthorizedSession(resource, {
                     ...input.discovery,
-                    resource,
+                    resource
                 }, input.fetch, true, forceRefresh);
                 if (session?.tokens?.accessToken === undefined) {
                     return { action: "fail" };
@@ -53,10 +54,10 @@ export function createDefaultOAuthClientProvider(options) {
             catch (error) {
                 return {
                     action: "fail",
-                    error: error instanceof Error ? error : new Error(String(error)),
+                    error: error instanceof Error ? error : new Error(String(error))
                 };
             }
-        },
+        }
     };
     async function ensureAuthorizedSession(resource, discovery, fetch, allowInteractive, forceRefresh = false) {
         const canonicalResource = canonicalizeResourceIndicator(resource);
@@ -65,9 +66,9 @@ export function createDefaultOAuthClientProvider(options) {
         if (session?.tokens !== undefined && !forceRefresh && !isExpired(session.tokens, now)) {
             return session;
         }
-        if (session?.tokens?.refreshToken !== undefined
-            && sessionDiscovery !== undefined
-            && (forceRefresh || isExpired(session.tokens, now))) {
+        if (session?.tokens?.refreshToken !== undefined &&
+            sessionDiscovery !== undefined &&
+            (forceRefresh || isExpired(session.tokens, now))) {
             session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch);
             if (session?.tokens !== undefined && !isExpired(session.tokens, now)) {
                 return session;
@@ -104,7 +105,7 @@ export function createDefaultOAuthClientProvider(options) {
                             refreshToken: session.tokens.refreshToken,
                             resource,
                             fetch,
-                            now,
+                            now
                         });
                         break;
                     }
@@ -130,9 +131,9 @@ export function createDefaultOAuthClientProvider(options) {
                     ...session,
                     tokens: {
                         ...refreshedTokens,
-                        refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken,
+                        refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
                     },
-                    discovery: toStoredDiscovery(discovery),
+                    discovery: toStoredDiscovery(discovery)
                 };
                 await saveSession(resource, updatedSession);
                 return updatedSession;
@@ -160,7 +161,7 @@ export function createDefaultOAuthClientProvider(options) {
                     openBrowser: options.browser.openBrowser,
                     readLine: options.browser.readLine,
                     createServer: options.browser.createServer,
-                    landingPage: options.browser.landingPage,
+                    landingPage: options.browser.landingPage
                 });
                 let resolvedClient = null;
                 try {
@@ -169,7 +170,7 @@ export function createDefaultOAuthClientProvider(options) {
                         resource,
                         authorizationServer: discovery.authorizationServer,
                         client: resolvedClient.client,
-                        discovery: toStoredDiscovery(discovery),
+                        discovery: toStoredDiscovery(discovery)
                     };
                     await saveSession(resource, sessionWithoutTokens);
                     const verifier = generateCodeVerifier();
@@ -180,7 +181,7 @@ export function createDefaultOAuthClientProvider(options) {
                         clientId: resolvedClient.client.clientId,
                         redirectUri: loopback.redirectUri,
                         codeChallenge: challenge,
-                        clientMetadata: getClientMetadata(options.client),
+                        clientMetadata: getClientMetadata(options.client)
                     });
                     const code = await loopback.waitForCode(authorizationUrl);
                     const tokens = await exchangeAuthorizationCode({
@@ -192,11 +193,11 @@ export function createDefaultOAuthClientProvider(options) {
                         redirectUri: loopback.redirectUri,
                         resource,
                         fetch,
-                        now,
+                        now
                     });
                     const session = {
                         ...sessionWithoutTokens,
-                        tokens,
+                        tokens
                     };
                     await saveSession(resource, session);
                     return session;
@@ -229,25 +230,23 @@ export function createDefaultOAuthClientProvider(options) {
         return finalPromise;
     }
     async function resolveClient(existingSession, discovery, redirectUri, fetch) {
+        const configuredClient = normalizeConfiguredClient(options.client);
         if (options.client.mode === "static") {
+            if (configuredClient === null) {
+                throw new Error("OAuth client_id must not be blank");
+            }
             return {
                 kind: "static",
                 fromStoredRegistration: false,
-                client: {
-                    clientId: options.client.clientId,
-                    clientSecret: options.client.clientSecret,
-                },
+                client: configuredClient
             };
         }
         const registrationEndpoint = getOwnString(discovery.authorizationServerMetadata, "registration_endpoint");
-        if (registrationEndpoint === undefined && options.client.clientId !== undefined) {
+        if (registrationEndpoint === undefined && configuredClient !== null) {
             return {
                 kind: "static",
                 fromStoredRegistration: false,
-                client: {
-                    clientId: options.client.clientId,
-                    clientSecret: options.client.clientSecret,
-                },
+                client: configuredClient
             };
         }
         const storedClient = await loadRegisteredClient(discovery.authorizationServer);
@@ -255,7 +254,7 @@ export function createDefaultOAuthClientProvider(options) {
             return {
                 kind: "dynamic",
                 fromStoredRegistration: true,
-                client: storedClient,
+                client: storedClient
             };
         }
         if (registrationEndpoint === undefined) {
@@ -263,21 +262,21 @@ export function createDefaultOAuthClientProvider(options) {
                 return {
                     kind: "dynamic",
                     fromStoredRegistration: true,
-                    client: existingSession.client,
+                    client: existingSession.client
                 };
             }
             throw new Error("Authorization server metadata is missing registration_endpoint");
         }
         if (existingSession !== null && existingSession.client.clientId.length > 0) {
-            const isConfiguredStaticFallback = options.client.clientId !== undefined
-                && existingSession.client.clientId === options.client.clientId
-                && existingSession.client.clientSecret === options.client.clientSecret;
+            const isConfiguredStaticFallback = configuredClient !== null &&
+                existingSession.client.clientId === configuredClient.clientId &&
+                existingSession.client.clientSecret === configuredClient.clientSecret;
             if (!isConfiguredStaticFallback) {
                 await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
                 return {
                     kind: "dynamic",
                     fromStoredRegistration: true,
-                    client: existingSession.client,
+                    client: existingSession.client
                 };
             }
         }
@@ -285,28 +284,27 @@ export function createDefaultOAuthClientProvider(options) {
         const response = await fetch(registrationEndpoint, {
             method: "POST",
             headers: {
-                "Content-Type": "application/json",
+                "Content-Type": "application/json"
             },
-            body: JSON.stringify(registrationBody),
+            body: JSON.stringify(registrationBody)
         });
         const payload = await readOAuthJsonObjectResponse(response);
         const clientId = getOwnString(payload, "client_id");
-        if (clientId === undefined ||
-            clientId.trim().length === 0) {
+        if (clientId === undefined || clientId.trim().length === 0) {
             throw new Error("OAuth client registration response missing client_id");
         }
         const clientSecret = getOwnString(payload, "client_secret");
         const registeredClient = {
-            clientId,
-            clientSecret: clientSecret !== undefined && clientSecret.length > 0
-                ? clientSecret
-                : undefined,
+            clientId: clientId.trim(),
+            clientSecret: clientSecret !== undefined && clientSecret.trim().length > 0
+                ? clientSecret.trim()
+                : undefined
         };
         await saveRegisteredClient(discovery.authorizationServer, registeredClient);
         return {
             kind: "dynamic",
             fromStoredRegistration: false,
-            client: registeredClient,
+            client: registeredClient
         };
     }
     async function loadSession(resource) {
@@ -357,7 +355,7 @@ function resolveDiscovery(discovery, session) {
     if (discovery !== undefined) {
         return {
             ...discovery,
-            resource: canonicalizeResourceIndicator(discovery.resource),
+            resource: canonicalizeResourceIndicator(discovery.resource)
         };
     }
     if (session === null) {
@@ -378,10 +376,11 @@ function resolveDiscovery(discovery, session) {
     return {
         resource: canonicalizeResourceIndicator(session.resource),
         resourceMetadataUrl: session.discovery.resourceMetadataUrl,
-        resourceMetadata: session.discovery.resourceMetadata,
+        resourceMetadata: session.discovery
+            .resourceMetadata,
         authorizationServer: session.authorizationServer,
         authorizationServerMetadataUrl: "",
-        authorizationServerMetadata: metadata,
+        authorizationServerMetadata: metadata
     };
 }
 function clearSessionTokens(session) {
@@ -403,7 +402,7 @@ function normalizeLoadedSession(session) {
     return {
         ...session,
         client,
-        tokens: normalizeStoredTokens(getOwnEntry(session, "tokens")),
+        tokens: normalizeStoredTokens(getOwnEntry(session, "tokens"))
     };
 }
 function normalizeStoredClient(value) {
@@ -414,14 +413,16 @@ function normalizeStoredClient(value) {
     if (clientId === undefined || clientId.trim().length === 0) {
         return null;
     }
+    const normalizedClientId = clientId.trim();
     const clientSecret = getOwnEntry(value, "clientSecret");
     if (clientSecret === undefined) {
-        return { clientId };
+        return { clientId: normalizedClientId };
     }
     if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
         return null;
     }
-    return { clientId, clientSecret };
+    const normalizedClientSecret = clientSecret.trim();
+    return { clientId: normalizedClientId, clientSecret: normalizedClientSecret };
 }
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {
@@ -432,26 +433,59 @@ function normalizeStoredTokens(value) {
     const expiresAt = getOwnEntry(value, "expiresAt");
     const refreshToken = getOwnEntry(value, "refreshToken");
     const scope = getOwnString(value, "scope");
-    const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken : undefined;
+    const normalizedAccessToken = accessToken?.trim();
+    const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : undefined;
+    const normalizedScope = scope?.trim();
     if (accessToken === undefined ||
-        accessToken.trim().length === 0 ||
+        normalizedAccessToken === undefined ||
+        normalizedAccessToken.length === 0 ||
         tokenType !== "Bearer" ||
         !(expiresAt === null ||
-            (typeof expiresAt === "number" && Number.isFinite(expiresAt))) ||
+            (typeof expiresAt === "number" &&
+                Number.isSafeInteger(expiresAt) &&
+                expiresAt <= MAX_JS_DATE_MS &&
+                Number.isFinite(new Date(expiresAt).getTime()))) ||
         (refreshToken !== undefined &&
-            (typeof refreshToken !== "string" || refreshToken.trim().length === 0))) {
+            (typeof refreshToken !== "string" ||
+                normalizedRefreshToken === undefined ||
+                normalizedRefreshToken.length === 0))) {
         return undefined;
     }
     return {
-        accessToken,
+        accessToken: normalizedAccessToken,
         tokenType,
         expiresAt,
         ...(normalizedRefreshToken === undefined ? {} : { refreshToken: normalizedRefreshToken }),
-        ...(scope === undefined || scope.length === 0 ? {} : { scope }),
+        ...(normalizedScope === undefined || normalizedScope.length === 0
+            ? {}
+            : { scope: normalizedScope })
     };
 }
 function getClientMetadata(client) {
-    return client.metadata;
+    if (client.metadata === undefined) {
+        return undefined;
+    }
+    return {
+        clientName: normalizeOptionalOAuthString(client.metadata.clientName),
+        scope: normalizeOptionalOAuthString(client.metadata.scope),
+        softwareId: normalizeOptionalOAuthString(client.metadata.softwareId),
+        softwareVersion: normalizeOptionalOAuthString(client.metadata.softwareVersion)
+    };
+}
+function normalizeConfiguredClient(client) {
+    const clientId = normalizeOptionalOAuthString(client.clientId);
+    if (clientId === undefined) {
+        return null;
+    }
+    const clientSecret = normalizeOptionalOAuthString(client.clientSecret);
+    return clientSecret === undefined ? { clientId } : { clientId, clientSecret };
+}
+function normalizeOptionalOAuthString(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
 }
 function getOwnEntry(record, key) {
     return Object.prototype.hasOwnProperty.call(record, key)
@@ -485,7 +519,7 @@ function buildAuthorizationUrl(input) {
     const resource = canonicalizeResourceIndicator(input.resource);
     const state = createAuthorizationState({
         issuer,
-        requireIssuer: getOwnEntry(input.metadata, "authorization_response_iss_parameter_supported") === true,
+        requireIssuer: getOwnEntry(input.metadata, "authorization_response_iss_parameter_supported") === true
     });
     url.searchParams.set("response_type", "code");
     url.searchParams.set("client_id", input.clientId);
@@ -509,9 +543,9 @@ function normalizeHostname(hostname) {
 }
 function isLoopbackHostname(hostname) {
     const normalizedHostname = normalizeHostname(hostname);
-    return normalizedHostname === "localhost"
-        || normalizedHostname === "::1"
-        || normalizedHostname.startsWith("127.");
+    return (normalizedHostname === "localhost" ||
+        normalizedHostname === "::1" ||
+        normalizedHostname.startsWith("127."));
 }
 function assertSecureUrl(value, label) {
     const url = new URL(value);
@@ -552,14 +586,12 @@ function buildClientRegistrationBody(metadata, redirectUri) {
         redirect_uris: [redirectUri],
         grant_types: ["authorization_code", "refresh_token"],
         response_types: ["code"],
-        token_endpoint_auth_method: "none",
+        token_endpoint_auth_method: "none"
     };
     const clientName = metadata === undefined ? undefined : getOwnString(metadata, "clientName");
     const scope = metadata === undefined ? undefined : getOwnString(metadata, "scope");
     const softwareId = metadata === undefined ? undefined : getOwnString(metadata, "softwareId");
-    const softwareVersion = metadata === undefined
-        ? undefined
-        : getOwnString(metadata, "softwareVersion");
+    const softwareVersion = metadata === undefined ? undefined : getOwnString(metadata, "softwareVersion");
     if (clientName !== undefined && clientName.length > 0) {
         body.client_name = clientName;
     }
@@ -578,7 +610,7 @@ function toStoredDiscovery(discovery) {
     return {
         resourceMetadataUrl: discovery.resourceMetadataUrl,
         resourceMetadata: discovery.resourceMetadata,
-        authorizationServerMetadata: discovery.authorizationServerMetadata,
+        authorizationServerMetadata: discovery.authorizationServerMetadata
     };
 }
 function shouldReRegisterStoredDynamicClient(error, client, alreadyAttempted) {

package/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -13,7 +13,7 @@ export async function createLoopbackAuthorizationSession(options = {}) {
         close() {
             server.closeAllConnections?.();
             server.close();
-        },
+        }
     };
 }
 async function startServer(server) {
@@ -52,7 +52,7 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
                 error: url.searchParams.get("error"),
                 errorDescription: url.searchParams.get("error_description"),
                 state: url.searchParams.get("state"),
-                iss: url.searchParams.get("iss"),
+                iss: url.searchParams.get("iss")
             };
             try {
                 validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
@@ -60,9 +60,7 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
             catch (error) {
                 res.writeHead(400);
                 res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
-                if (callbackParameters.error === null) {
-                    settle(() => reject(error instanceof Error ? error : new Error(String(error))));
-                }
+                settle(() => reject(error instanceof Error ? error : new Error(String(error))));
                 return;
             }
             const authorizationError = callbackParameters.error;
@@ -86,7 +84,9 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
             }
         });
         if (options.readLine !== undefined) {
-            options.readLine().then((input) => {
+            options
+                .readLine()
+                .then((input) => {
                 const callbackParameters = extractCallbackParametersFromInput(input);
                 if (callbackParameters === null) {
                     settle(() => reject(new Error("OAuth callback missing authorization code")));
@@ -104,7 +104,8 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
                 catch (error) {
                     settle(() => reject(error instanceof Error ? error : new Error(String(error))));
                 }
-            }).catch((error) => {
+            })
+                .catch((error) => {
                 settle(() => reject(error instanceof Error ? error : new Error(String(error))));
             });
         }
@@ -130,7 +131,7 @@ function extractCallbackParametersFromInput(input) {
             error: url.searchParams.get("error"),
             errorDescription: url.searchParams.get("error_description"),
             state: url.searchParams.get("state"),
-            iss: url.searchParams.get("iss"),
+            iss: url.searchParams.get("iss")
         };
     }
     catch {
@@ -139,7 +140,7 @@ function extractCallbackParametersFromInput(input) {
             error: null,
             errorDescription: null,
             state: null,
-            iss: null,
+            iss: null
         };
     }
 }
@@ -150,7 +151,7 @@ function readExpectedAuthorizationCallback(authorizationUrl) {
     return {
         state,
         issuer: parsedState?.issuer ?? null,
-        requireIssuer: parsedState?.requireIssuer ?? false,
+        requireIssuer: parsedState?.requireIssuer ?? false
     };
 }
 function validateAuthorizationCallbackParameters(callback, expected) {
@@ -174,10 +175,10 @@ function validateAuthorizationCallbackBinding(callback, expected) {
             throw new Error("OAuth callback missing issuer");
         }
     }
-    if (callback.iss !== null
-        && callback.iss.length > 0
-        && expected.issuer !== null
-        && callback.iss !== expected.issuer) {
+    if (callback.iss !== null &&
+        callback.iss.length > 0 &&
+        expected.issuer !== null &&
+        callback.iss !== expected.issuer) {
         throw new Error("OAuth callback issuer mismatch");
     }
 }
@@ -189,7 +190,7 @@ function escapeHtml(text) {
         .replaceAll("&", "&")
         .replaceAll("<", "&lt;")
         .replaceAll(">", "&gt;")
-        .replaceAll("\"", "&quot;");
+        .replaceAll('"', "&quot;");
 }
 export function buildSuccessPage(landingPage) {
     const title = landingPage?.title ?? "Connected";
@@ -197,10 +198,10 @@ export function buildSuccessPage(landingPage) {
     return [
         "<!DOCTYPE html>",
         `<html><head><meta charset=utf-8><title>${escapeHtml(title)}</title></head>`,
-        "<body style=\"font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0\">",
-        "<div style=\"text-align:center\">",
+        '<body style="font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0">',
+        '<div style="text-align:center">',
         `<h1>${escapeHtml(title)}</h1>`,
         `<p style="color:#666">${escapeHtml(body)}</p>`,
-        "</div></body></html>",
+        "</div></body></html>"
     ].join("");
 }

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -1,4 +1,5 @@
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export class OAuthError extends Error {
     error;
     errorDescription;
@@ -22,10 +23,10 @@ export class OAuthError extends Error {
     }
 }
 export function isRetryableOAuthError(error) {
-    return (error instanceof OAuthError
-        && (error.status >= 500
-            || error.error === "server_error"
-            || error.error === "temporarily_unavailable"));
+    return (error instanceof OAuthError &&
+        (error.status >= 500 ||
+            error.error === "server_error" ||
+            error.error === "temporarily_unavailable"));
 }
 export async function exchangeAuthorizationCode(input) {
     const resource = canonicalizeResourceIndicator(input.resource);
@@ -38,10 +39,10 @@ export async function exchangeAuthorizationCode(input) {
             code: input.code,
             code_verifier: input.codeVerifier,
             redirect_uri: input.redirectUri,
-            resource,
+            resource
         },
         fetch: input.fetch,
-        now: input.now,
+        now: input.now
     });
 }
 export async function refreshAccessToken(input) {
@@ -53,16 +54,16 @@ export async function refreshAccessToken(input) {
         params: {
             grant_type: "refresh_token",
             refresh_token: input.refreshToken,
-            resource,
+            resource
         },
         fetch: input.fetch,
-        now: input.now,
+        now: input.now
     });
 }
 async function requestTokens(input) {
     const body = new URLSearchParams({
         client_id: input.clientId,
-        ...input.params,
+        ...input.params
     });
     if (input.clientSecret !== undefined) {
         body.set("client_secret", input.clientSecret);
@@ -70,39 +71,48 @@ async function requestTokens(input) {
     const response = await input.fetch(input.tokenEndpoint, {
         method: "POST",
         headers: {
-            "Content-Type": "application/x-www-form-urlencoded",
+            "Content-Type": "application/x-www-form-urlencoded"
         },
-        body: body.toString(),
+        body: body.toString()
     });
     const payload = await readOAuthJsonObjectResponse(response);
     const accessToken = getOwnEntry(payload, "access_token");
     if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
         throw new Error("OAuth token response missing access_token");
     }
+    const normalizedAccessToken = accessToken.trim();
     const tokenType = normalizeBearerTokenType(getOwnEntry(payload, "token_type"));
     if (tokenType === null) {
         throw new Error("OAuth token response missing token_type=Bearer");
     }
     const expiresIn = getOwnEntry(payload, "expires_in");
-    if (typeof expiresIn === "number"
-        && Number.isFinite(expiresIn)
-        && expiresIn < 0) {
-        throw new Error("OAuth token response has invalid expires_in");
+    let expiresAt = null;
+    if (expiresIn !== undefined) {
+        if (typeof expiresIn !== "number" ||
+            !Number.isFinite(expiresIn) ||
+            !Number.isInteger(expiresIn) ||
+            expiresIn < 0) {
+            throw new Error("OAuth token response has invalid expires_in");
+        }
+        expiresAt = input.now() + expiresIn * 1000;
+        if (!Number.isSafeInteger(expiresAt) ||
+            expiresAt > MAX_JS_DATE_MS ||
+            !Number.isFinite(new Date(expiresAt).getTime())) {
+            throw new Error("OAuth token response has invalid expires_in");
+        }
     }
     const refreshToken = getOwnEntry(payload, "refresh_token");
     const scope = getOwnEntry(payload, "scope");
+    const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0
+        ? refreshToken.trim()
+        : undefined;
+    const normalizedScope = typeof scope === "string" && scope.trim().length > 0 ? scope.trim() : undefined;
     return {
-        accessToken,
-        refreshToken: typeof refreshToken === "string" && refreshToken.length > 0
-            ? refreshToken
-            : undefined,
+        accessToken: normalizedAccessToken,
+        refreshToken: normalizedRefreshToken === undefined ? undefined : normalizedRefreshToken,
         tokenType,
-        expiresAt: typeof expiresIn === "number" && Number.isFinite(expiresIn)
-            ? input.now() + (expiresIn * 1000)
-            : null,
-        scope: typeof scope === "string" && scope.length > 0
-            ? scope
-            : undefined,
+        expiresAt,
+        scope: normalizedScope === undefined ? undefined : normalizedScope
     };
 }
 export async function readOAuthJsonObjectResponse(response) {
@@ -135,12 +145,8 @@ function readOAuthError(payload, fallbackError = "server_error") {
     const errorUri = getOwnEntry(payload, "error_uri");
     return {
         error: typeof error === "string" ? error : fallbackError,
-        error_description: typeof errorDescription === "string"
-            ? errorDescription
-            : undefined,
-        error_uri: typeof errorUri === "string"
-            ? errorUri
-            : undefined,
+        error_description: typeof errorDescription === "string" ? errorDescription : undefined,
+        error_uri: typeof errorUri === "string" ? errorUri : undefined
     };
 }
 function getOwnEntry(record, key) {

package/node_modules/mcp-oauth/package.json

@@ -15,7 +15,6 @@
     "build": "tsc"
   },
   "dependencies": {
-    "auth-store": "*",
     "jose": "^6.1.2"
   },
   "devDependencies": {