@jini-ai/mcp 0.4.2 → 0.4.4

package/dist/client/client.js

@@ -162,38 +162,23 @@ function isHtmlLike(mime, fromPath) {
         return true;
     return /\.html?$/i.test(fromPath);
 }
-/**
- * Extract all relative (non-absolute, non-CDN, non-data-URI) file references from
- * the text content of a file, normalized to root-relative paths.
- * Runs HTML, CSS, and/or JS pattern sets based on the file's MIME type and extension.
- * Skips `https?:`, `//`, `data:`, `mailto:`, `tel:`, and `#` prefixes; drops any
- * reference that would escape the root via `..` traversal.
- * @param text The textual content of the file.
- * @param fromPath The root-relative path of the file (used for relative-path resolution).
- * @param fromMime The MIME type of the file (used to select reference-extraction patterns).
- * @returns Deduplicated root-relative paths of all referenced files found.
- */
-export function extractRelativeRefs({ text, fromPath, fromMime }) {
-    if (!text)
-        return [];
-    const refs = new Set();
+// Order matters: candidates are collected HTML → CSS → JS, so the returned
+// list keeps that first-seen order after dedupe.
+function selectRefPatterns(fromMime, fromPath, htmlLike) {
     const runPatterns = [];
-    if (isHtmlLike(fromMime, fromPath)) {
+    if (htmlLike)
         runPatterns.push(...HTML_REF_PATTERNS, ...CSS_REF_PATTERNS);
-    }
-    if (isCssLike(fromMime, fromPath)) {
+    if (isCssLike(fromMime, fromPath))
         runPatterns.push(...CSS_REF_PATTERNS);
-    }
-    if (isJsLike(fromMime, fromPath)) {
+    if (isJsLike(fromMime, fromPath))
         runPatterns.push(...JS_REF_PATTERNS);
-    }
     // Fallback for unknown textual files: only the safest pattern,
     // url() in case it's a CSS-in-something we don't recognize.
-    if (runPatterns.length === 0) {
-        runPatterns.push(...CSS_REF_PATTERNS);
-    }
+    return runPatterns.length === 0 ? [...CSS_REF_PATTERNS] : runPatterns;
+}
+function collectPatternCandidates(text, patterns) {
     const candidates = [];
-    for (const re of runPatterns) {
+    for (const re of patterns) {
         for (const m of text.matchAll(re)) {
             // The capture group is required in every pattern, so `m[1]` is always a
             // matched string here (the `!` only satisfies noUncheckedIndexedAccess).
@@ -202,44 +187,72 @@ export function extractRelativeRefs({ text, fromPath, fromMime }) {
                 candidates.push(ref);
         }
     }
-    // Pull every candidate URL out of any srcset attributes in HTML.
-    if (isHtmlLike(fromMime, fromPath)) {
-        for (const m of text.matchAll(SRCSET_PATTERN)) {
-            const list = m[1];
-            for (const part of list.split(',')) {
-                const url = part.trim().split(/\s+/)[0];
-                if (url)
-                    candidates.push(url);
-            }
+    return candidates;
+}
+// Pull every candidate URL out of any srcset attributes in HTML.
+function collectSrcsetCandidates(text) {
+    const candidates = [];
+    for (const m of text.matchAll(SRCSET_PATTERN)) {
+        for (const part of m[1].split(',')) {
+            const url = part.trim().split(/\s+/)[0];
+            if (url)
+                candidates.push(url);
         }
     }
-    for (const raw of candidates) {
-        if (/^(?:https?:|\/\/|data:|mailto:|tel:|#)/i.test(raw))
+    return candidates;
+}
+// Collapse `.`/`..`/empty segments. Returns null when a `..` would climb
+// above the root (traversal escape) — such refs are dropped, never clamped.
+function collapseSegments(segs) {
+    const out = [];
+    for (const s of segs) {
+        if (s === '' || s === '.')
             continue;
-        const dir = fromPath.includes('/')
-            ? fromPath.slice(0, fromPath.lastIndexOf('/') + 1)
-            : '';
-        const resolved = raw.startsWith('/') ? raw.slice(1) : dir + raw;
-        const stripped = resolved.replace(/[?#].*$/, '');
-        const segs = stripped.split('/').filter(Boolean);
-        const out = [];
-        let escaped = false;
-        for (const s of segs) {
-            if (s === '.')
-                continue;
-            if (s === '..') {
-                if (out.length === 0) {
-                    escaped = true;
-                    break;
-                }
-                out.pop();
-                continue;
-            }
+        if (s !== '..') {
             out.push(s);
-        }
-        if (escaped || out.length === 0)
             continue;
-        refs.add(out.join('/'));
+        }
+        if (out.length === 0)
+            return null;
+        out.pop();
+    }
+    return out;
+}
+// Resolve one raw ref against the referencing file's directory. Returns null
+// for external refs (`https?:`, `//`, `data:`, `mailto:`, `tel:`, `#`), for
+// refs that escape the root; a ref that collapses to nothing yields ''.
+function normalizeRef(raw, dir) {
+    if (/^(?:https?:|\/\/|data:|mailto:|tel:|#)/i.test(raw))
+        return null;
+    const resolved = raw.startsWith('/') ? raw.slice(1) : dir + raw;
+    const stripped = resolved.replace(/[?#].*$/, '');
+    return collapseSegments(stripped.split('/'))?.join('/') ?? null;
+}
+/**
+ * Extract all relative (non-absolute, non-CDN, non-data-URI) file references from
+ * the text content of a file, normalized to root-relative paths.
+ * Runs HTML, CSS, and/or JS pattern sets based on the file's MIME type and extension.
+ * Skips `https?:`, `//`, `data:`, `mailto:`, `tel:`, and `#` prefixes; drops any
+ * reference that would escape the root via `..` traversal.
+ * @param text The textual content of the file.
+ * @param fromPath The root-relative path of the file (used for relative-path resolution).
+ * @param fromMime The MIME type of the file (used to select reference-extraction patterns).
+ * @returns Deduplicated root-relative paths of all referenced files found.
+ */
+export function extractRelativeRefs({ text, fromPath, fromMime }) {
+    if (!text)
+        return [];
+    const htmlLike = isHtmlLike(fromMime, fromPath);
+    const candidates = collectPatternCandidates(text, selectRefPatterns(fromMime, fromPath, htmlLike));
+    if (htmlLike)
+        candidates.push(...collectSrcsetCandidates(text));
+    // `lastIndexOf('/') + 1` is 0 for a root-level file, giving an empty dir.
+    const dir = fromPath.slice(0, fromPath.lastIndexOf('/') + 1);
+    const refs = new Set();
+    for (const raw of candidates) {
+        const ref = normalizeRef(raw, dir);
+        if (ref)
+            refs.add(ref);
     }
     return [...refs];
 }

package/dist/core/config.js

@@ -70,29 +70,29 @@ function configFile(dataDir) {
 function isPlainObject(v) {
     return Boolean(v) && typeof v === 'object' && !Array.isArray(v);
 }
+function isKeepableMapEntry(entry) {
+    const [k, v] = entry;
+    if (k === '__proto__' || k === 'constructor' || !k.trim())
+        return false;
+    // Drop empty / whitespace-only values. Persisting them is worse than
+    // omitting them: the spawn-time merge treats a present header as
+    // "user pinned this", which would block our daemon-issued OAuth
+    // Bearer from being injected. The UI also has placeholder fields
+    // (e.g. an "Authorization=" template row) the user can leave blank
+    // — those should never make it into the saved config.
+    return typeof v === 'string' && v.trim() !== '';
+}
 function sanitizeStringMap(raw) {
     if (!isPlainObject(raw))
         return undefined;
     const out = {};
-    for (const [k, v] of Object.entries(raw)) {
-        if (k === '__proto__' || k === 'constructor')
-            continue;
-        if (!k.trim())
-            continue;
-        if (typeof v !== 'string')
-            continue;
-        // Drop empty / whitespace-only values. Persisting them is worse than
-        // omitting them: the spawn-time merge treats a present header as
-        // "user pinned this", which would block our daemon-issued OAuth
-        // Bearer from being injected. The UI also has placeholder fields
-        // (e.g. an "Authorization=" template row) the user can leave blank
-        // — those should never make it into the saved config.
-        if (v.trim() === '')
-            continue;
+    for (const [k, v] of Object.entries(raw).filter(isKeepableMapEntry))
         out[k] = v;
-    }
     return Object.keys(out).length > 0 ? out : undefined;
 }
+function nonBlankTrimmed(raw) {
+    return typeof raw === 'string' && raw.trim() ? raw.trim() : undefined;
+}
 function sanitizeStringArray(raw) {
     if (!Array.isArray(raw))
         return undefined;
@@ -140,12 +140,8 @@ export function sanitizeMcpServer({ raw }) {
     const id = typeof raw.id === 'string' ? raw.id.trim() : '';
     if (!SERVER_ID_PATTERN.test(id))
         return null;
-    // Absence preserves the legacy stdio default; a supplied invalid discriminator must not
-    // silently select a different transport or authentication policy.
-    if (raw.transport !== undefined && typeof raw.transport !== 'string')
-        return null;
-    const transport = raw.transport === undefined ? 'stdio' : raw.transport;
-    if (!VALID_TRANSPORTS.has(transport))
+    const transport = sanitizeTransport(raw.transport);
+    if (!transport)
         return null;
     if (raw.authMode !== undefined && sanitizeMcpAuthMode(raw.authMode) === undefined)
         return null;
@@ -154,41 +150,47 @@ export function sanitizeMcpServer({ raw }) {
         transport,
         enabled: raw.enabled !== false,
     };
-    if (typeof raw.label === 'string' && raw.label.trim()) {
-        next.label = raw.label.trim();
-    }
-    if (transport === 'stdio') {
-        if (typeof raw.command !== 'string' || !raw.command.trim())
-            return null;
-        next.command = raw.command.trim();
-        const args = sanitizeStringArray(raw.args);
-        if (args)
-            next.args = args;
-        const env = sanitizeStringMap(raw.env);
-        if (env)
-            next.env = env;
-    }
-    else {
-        if (typeof raw.url !== 'string' || !raw.url.trim())
-            return null;
-        // Reject anything that isn't an http(s) URL — protects against accidental
-        // `file://` / `javascript:` slipping into a config file.
-        let parsed;
-        try {
-            parsed = new URL(raw.url.trim());
-        }
-        catch {
-            return null;
-        }
-        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
-            return null;
-        next.url = parsed.toString();
-        next.authMode = sanitizeMcpAuthMode(raw.authMode) ?? inferMcpAuthModeForUrl({ rawUrl: next.url });
-        const headers = sanitizeStringMap(raw.headers);
-        if (headers)
-            next.headers = headers;
-    }
-    return next;
+    const label = nonBlankTrimmed(raw.label);
+    if (label)
+        next.label = label;
+    const fields = transport === 'stdio' ? sanitizeStdioFields(raw) : sanitizeRemoteFields(raw);
+    return fields ? { ...next, ...fields } : null;
+}
+// Absence preserves the legacy stdio default; a supplied invalid discriminator must not
+// silently select a different transport or authentication policy.
+function sanitizeTransport(raw) {
+    if (raw === undefined)
+        return 'stdio';
+    return typeof raw === 'string' && VALID_TRANSPORTS.has(raw) ? raw : null;
+}
+function sanitizeStdioFields(raw) {
+    const command = nonBlankTrimmed(raw.command);
+    if (!command)
+        return null;
+    const out = { command };
+    const args = sanitizeStringArray(raw.args);
+    if (args)
+        out.args = args;
+    const env = sanitizeStringMap(raw.env);
+    if (env)
+        out.env = env;
+    return out;
+}
+function sanitizeRemoteFields(raw) {
+    const rawUrl = nonBlankTrimmed(raw.url);
+    if (!rawUrl)
+        return null;
+    // Reject anything that isn't an http(s) URL — protects against accidental
+    // `file://` / `javascript:` slipping into a config file.
+    const parsed = URL.canParse(rawUrl) ? new URL(rawUrl) : null;
+    if (parsed?.protocol !== 'http:' && parsed?.protocol !== 'https:')
+        return null;
+    const url = parsed.toString();
+    const out = { url, authMode: sanitizeMcpAuthMode(raw.authMode) ?? inferMcpAuthModeForUrl({ rawUrl: url }) };
+    const headers = sanitizeStringMap(raw.headers);
+    if (headers)
+        out.headers = headers;
+    return out;
 }
 /**
  * Coerce and de-duplicate a freeform JSON blob into a valid `McpConfig`.
@@ -307,7 +309,7 @@ export function isManagedProjectCwd({ cwd, projectsDir }, { resolvePath = resolv
     const resolvedCwd = resolvePath({ filePath: cwd });
     if (resolvedCwd === resolvedProjectsDir)
         return false; // projects root, not a project
-    return pathContains({ root: resolvedProjectsDir, target: resolvedCwd }, { caseSensitive: path.sep !== '\\', separator: path.sep === '\\' ? '\\' : '/' });
+    return pathContains({ root: resolvedProjectsDir, target: resolvedCwd }, { caseSensitive: path.sep !== '\\', separator: path.sep });
 }
 /**
  * Project-cwd `.mcp.json` shape that Claude Code auto-loads on spawn (the
@@ -329,27 +331,22 @@ export function buildClaudeMcpJson({ servers }, { tokens = {} } = {}) {
         return null;
     const out = {};
     for (const s of enabled) {
-        if (s.transport === 'stdio') {
-            const entry = { command: s.command };
-            if (s.args && s.args.length > 0)
-                entry.args = s.args;
-            if (s.env && Object.keys(s.env).length > 0)
-                entry.env = s.env;
-            out[s.id] = entry;
-        }
-        else {
-            const entry = {
-                type: s.transport, // 'sse' | 'http'
-                url: s.url,
-            };
-            const headers = mergeAuthHeader(s.headers, effectiveMcpAuthMode(s) === 'oauth' ? tokens[s.id] : undefined);
-            if (headers && Object.keys(headers).length > 0)
-                entry.headers = headers;
-            out[s.id] = entry;
-        }
+        out[s.id] = s.transport === 'stdio'
+            ? { command: s.command, ...nonEmptyField({ key: 'args', value: s.args }), ...nonEmptyField({ key: 'env', value: s.env }) }
+            // type: 'sse' | 'http'
+            : { type: s.transport, url: s.url, ...remoteHeadersField({ server: s, tokens }) };
     }
     return { mcpServers: out };
 }
+/** `{ [key]: value }` when `value` has at least one element/key, else `{}` — for spreading optional fields. */
+function nonEmptyField({ key, value }) {
+    return value && Object.keys(value).length > 0 ? { [key]: value } : {};
+}
+/** `{ headers }` for a remote server (user headers + daemon OAuth bearer when in oauth mode), or `{}` when empty. */
+function remoteHeadersField({ server, tokens }) {
+    const bearer = effectiveMcpAuthMode(server) === 'oauth' ? tokens[server.id] : undefined;
+    return nonEmptyField({ key: 'headers', value: mergeAuthHeader(server.headers, bearer) });
+}
 /** Build a headers object that includes the daemon-issued bearer token when
  * the user hasn't already supplied a NON-EMPTY Authorization header. A
  * blank Authorization (empty string / whitespace only) is treated as
@@ -360,22 +357,19 @@ export function buildClaudeMcpJson({ servers }, { tokens = {} } = {}) {
  * win so manually-set PATs aren't silently overwritten. */
 function mergeAuthHeader(existing, bearer) {
     const merged = {};
-    let userAuth = null;
+    let userAuth = false;
     for (const [k, v] of Object.entries(existing ?? {})) {
-        if (k.toLowerCase() === 'authorization') {
-            if (typeof v === 'string' && v.trim() !== '') {
-                userAuth = v;
-                merged[k] = v;
-            }
-            // empty / whitespace authorization is ignored, NOT carried through
+        const isAuth = k.toLowerCase() === 'authorization';
+        // empty / whitespace authorization is ignored, NOT carried through
+        if (isAuth && (typeof v !== 'string' || v.trim() === ''))
             continue;
-        }
+        userAuth ||= isAuth;
         merged[k] = v;
     }
     if (bearer && !userAuth) {
         merged['Authorization'] = `Bearer ${bearer}`;
     }
-    return Object.keys(merged).length > 0 ? merged : undefined;
+    return merged;
 }
 /**
  * Convert user-configured external MCP servers into the ACP `mcpServers` array.
@@ -385,84 +379,54 @@ function mergeAuthHeader(existing, bearer) {
  * @returns ACP-shaped server entries for all enabled stdio servers.
  */
 export function buildAcpMcpServers({ servers }) {
-    const enabled = servers.filter((s) => s.enabled && s.transport === 'stdio');
-    const out = [];
-    for (const s of enabled) {
-        const envEntries = [];
-        if (s.env) {
-            for (const [name, value] of Object.entries(s.env)) {
-                if (typeof value !== 'string')
-                    continue;
-                envEntries.push({ name, value });
-            }
-        }
-        out.push({
-            type: 'stdio',
-            name: s.id,
-            command: s.command ?? '',
-            args: Array.isArray(s.args) ? [...s.args] : [],
-            env: envEntries,
-        });
-    }
-    return out;
+    return servers
+        .filter((s) => s.enabled && s.transport === 'stdio')
+        .map((s) => ({
+        type: 'stdio',
+        name: s.id,
+        command: s.command ?? '',
+        args: Array.isArray(s.args) ? [...s.args] : [],
+        env: Object.entries(s.env ?? {})
+            .filter(([, value]) => typeof value === 'string')
+            .map(([name, value]) => ({ name, value })),
+    }));
 }
 export function buildOpenCodeMcpConfigContent({ servers }, options = {}) {
     const tokens = options.tokens ?? {};
     const resolvePath = options.resolvePath ?? (({ filePath }) => realpathSync.native(filePath));
-    return buildOpenCodeContent(servers, tokens, options, resolvePath);
-}
-function buildOpenCodeContent(servers, tokens, options, resolvePath) {
-    const enabled = servers.filter((s) => s.enabled);
     const mcp = {};
-    for (const s of enabled) {
-        if (s.transport === 'stdio') {
-            const cmd = typeof s.command === 'string' ? s.command.trim() : '';
-            if (!cmd)
-                continue;
-            const entry = {
-                type: 'local',
-                command: [cmd, ...(Array.isArray(s.args) ? s.args : [])],
-            };
-            if (s.env && Object.keys(s.env).length > 0) {
-                entry.environment = { ...s.env };
-            }
-            entry.enabled = true;
+    for (const s of servers.filter((server) => server.enabled)) {
+        const entry = buildOpenCodeServerEntry({ server: s, tokens });
+        if (entry)
             mcp[s.id] = entry;
-        }
-        else {
-            const url = typeof s.url === 'string' ? s.url.trim() : '';
-            if (!url)
-                continue;
-            const entry = {
-                type: 'remote',
-                url: s.url,
-            };
-            const headers = mergeAuthHeader(s.headers, effectiveMcpAuthMode(s) === 'oauth' ? tokens[s.id] : undefined);
-            if (headers && Object.keys(headers).length > 0)
-                entry.headers = headers;
-            entry.enabled = true;
-            mcp[s.id] = entry;
-        }
     }
     const externalDirectory = buildOpenCodeExternalDirectoryAllowlist(options.allowedDirectories, resolvePath);
-    const extraConfig = options.extraConfig ?? {};
-    if (Object.keys(mcp).length === 0 &&
-        !externalDirectory &&
-        Object.keys(extraConfig).length === 0)
-        return null;
-    const config = { ...extraConfig };
-    if (Object.keys(mcp).length > 0)
-        config.mcp = mcp;
+    const config = { ...options.extraConfig, ...nonEmptyField({ key: 'mcp', value: mcp }) };
     if (externalDirectory) {
-        const priorPermission = config.permission && typeof config.permission === 'object' && !Array.isArray(config.permission)
-            ? config.permission
-            : {};
+        const priorPermission = isPlainObject(config.permission) ? config.permission : {};
         config.permission = {
             ...priorPermission,
             external_directory: externalDirectory,
         };
     }
-    return JSON.stringify(config);
+    return Object.keys(config).length === 0 ? null : JSON.stringify(config);
+}
+/** One OpenCode `mcp` entry, or null when the server lacks its transport-required command/url. */
+function buildOpenCodeServerEntry({ server: s, tokens }) {
+    if (s.transport === 'stdio') {
+        const cmd = typeof s.command === 'string' ? s.command.trim() : '';
+        if (!cmd)
+            return null;
+        return {
+            type: 'local',
+            command: [cmd, ...(Array.isArray(s.args) ? s.args : [])],
+            ...nonEmptyField({ key: 'environment', value: { ...s.env } }),
+            enabled: true,
+        };
+    }
+    if (typeof s.url !== 'string' || !s.url.trim())
+        return null;
+    return { type: 'remote', url: s.url, ...remoteHeadersField({ server: s, tokens }), enabled: true };
 }
 function buildOpenCodeExternalDirectoryAllowlist(directories, resolvePath) {
     const normalized = Array.from(new Set((directories ?? [])

package/dist/core/tokens.js

@@ -82,64 +82,40 @@ export function sanitizeTokensFile({ raw }, { clock = createSystemClock() } = {}
     }
     return { servers: out };
 }
+function trimmedString(raw) {
+    return typeof raw === 'string' && raw.trim() ? raw.trim() : undefined;
+}
+function finiteNumber(raw) {
+    return typeof raw === 'number' && Number.isFinite(raw) ? raw : undefined;
+}
+/** Optional fields copied when they deserialize cleanly, in persisted key order. */
+const OPTIONAL_TOKEN_FIELDS = [
+    ['refreshToken', trimmedString],
+    ['scope', trimmedString],
+    ['expiresAt', finiteNumber],
+    ['tokenEndpoint', trimmedString],
+    ['clientId', trimmedString],
+    ['clientSecret', trimmedString],
+    ['authServerIssuer', trimmedString],
+    ['redirectUri', trimmedString],
+    ['resourceUrl', trimmedString],
+];
 function sanitizeToken(raw, clock) {
     if (!isPlainObject(raw))
         return null;
-    const accessToken = typeof raw.accessToken === 'string' ? raw.accessToken.trim() : '';
+    const accessToken = trimmedString(raw.accessToken);
     if (!accessToken)
         return null;
-    const tokenType = typeof raw.tokenType === 'string' && raw.tokenType.trim()
-        ? raw.tokenType.trim()
-        : 'Bearer';
-    const refreshToken = typeof raw.refreshToken === 'string' && raw.refreshToken.trim()
-        ? raw.refreshToken.trim()
-        : undefined;
-    const scope = typeof raw.scope === 'string' && raw.scope.trim()
-        ? raw.scope.trim()
-        : undefined;
-    const expiresAt = typeof raw.expiresAt === 'number' && Number.isFinite(raw.expiresAt)
-        ? raw.expiresAt
-        : undefined;
-    const savedAt = typeof raw.savedAt === 'number' && Number.isFinite(raw.savedAt)
-        ? raw.savedAt
-        : clock.nowMs();
-    const tokenEndpoint = typeof raw.tokenEndpoint === 'string' && raw.tokenEndpoint.trim()
-        ? raw.tokenEndpoint.trim()
-        : undefined;
-    const clientId = typeof raw.clientId === 'string' && raw.clientId.trim()
-        ? raw.clientId.trim()
-        : undefined;
-    const clientSecret = typeof raw.clientSecret === 'string' && raw.clientSecret.trim()
-        ? raw.clientSecret.trim()
-        : undefined;
-    const authServerIssuer = typeof raw.authServerIssuer === 'string' && raw.authServerIssuer.trim()
-        ? raw.authServerIssuer.trim()
-        : undefined;
-    const redirectUri = typeof raw.redirectUri === 'string' && raw.redirectUri.trim()
-        ? raw.redirectUri.trim()
-        : undefined;
-    const resourceUrl = typeof raw.resourceUrl === 'string' && raw.resourceUrl.trim()
-        ? raw.resourceUrl.trim()
-        : undefined;
-    const out = { accessToken, tokenType, savedAt };
-    if (refreshToken)
-        out.refreshToken = refreshToken;
-    if (scope)
-        out.scope = scope;
-    if (expiresAt !== undefined)
-        out.expiresAt = expiresAt;
-    if (tokenEndpoint)
-        out.tokenEndpoint = tokenEndpoint;
-    if (clientId)
-        out.clientId = clientId;
-    if (clientSecret)
-        out.clientSecret = clientSecret;
-    if (authServerIssuer)
-        out.authServerIssuer = authServerIssuer;
-    if (redirectUri)
-        out.redirectUri = redirectUri;
-    if (resourceUrl)
-        out.resourceUrl = resourceUrl;
+    const out = {
+        accessToken,
+        tokenType: trimmedString(raw.tokenType) ?? 'Bearer',
+        savedAt: finiteNumber(raw.savedAt) ?? clock.nowMs(),
+    };
+    for (const [key, read] of OPTIONAL_TOKEN_FIELDS) {
+        const value = read(raw[key]);
+        if (value !== undefined)
+            Object.assign(out, { [key]: value });
+    }
     return out;
 }
 /**

package/dist/federation/adapter.http.js

@@ -200,11 +200,11 @@ class McpHttpSession {
         const controller = new AbortController();
         const onCallerAbort = forwardAbort(controller, callerSignal);
         const timer = setTimeout(() => controller.abort(), this.requestTimeoutMs);
+        let response;
         try {
-            const response = await this.exchange.send({ url: this.spec.url, method: "POST", headers: await this.authenticatedHeaders(headers, controller.signal) }, { body, signal: controller.signal });
+            response = await this.exchange.send({ url: this.spec.url, method: "POST", headers: await this.authenticatedHeaders(headers, controller.signal) }, { body, signal: controller.signal });
             if (response.status === 401)
                 await this.notifyAuthenticationChallenge({ response, signal: controller.signal });
-            return response;
         }
         catch (error) {
             throw buildPostFailureError({
@@ -218,6 +218,7 @@ class McpHttpSession {
             clearTimeout(timer);
             callerSignal?.removeEventListener("abort", onCallerAbort);
         }
+        return response;
     }
     /** Observes a 401 within the POST's remaining budget, without superseding its typed auth error.
      * @complexity O(1) beyond the injected hook's work, bounded by the request signal.