@kamilio/wire 0.1.8 → 0.1.10

package/node_modules/toolcraft/node_modules/{mcp-oauth → tiny-http-mcp-server/node_modules/mcp-oauth}/dist/client/token-endpoint.js

@@ -1,6 +1,15 @@
+import { createOAuthFormRequest } from "./oauth-form.js";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+import { readBoundedResponseText } from "../http-response.js";
+import { fetchMcpResponse } from "../http-fetch.js";
+import { normalizeOAuthScope } from "./scope.js";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
+const oauthErrorBrand = Symbol.for("poe-platform.mcp-oauth.OAuthError");
 export class OAuthError extends Error {
+    /** Recognize errors from separately bundled copies of this package. */
+    static is(value) {
+        return value instanceof Error && Object.getOwnPropertyDescriptor(value, oauthErrorBrand)?.value === true;
+    }
     error;
     errorDescription;
     errorUri;
@@ -9,17 +18,23 @@ export class OAuthError extends Error {
     status;
     retryable;
     terminal;
-    constructor(shape, status) {
-        super(shape.error_description ?? shape.error);
+    /** True only when a complete OAuth error response establishes rejection. */
+    outcomeKnown;
+    constructor(shape, status, outcomeKnown = true) {
+        const description = Object.hasOwn(shape, "error_description") ? shape.error_description : undefined;
+        const uri = Object.hasOwn(shape, "error_uri") ? shape.error_uri : undefined;
+        super(description ?? (outcomeKnown ? shape.error : `OAuth HTTP response did not contain a valid error (HTTP ${status})`));
         this.name = "OAuthError";
+        Object.defineProperty(this, oauthErrorBrand, { value: true });
         this.error = shape.error;
-        this.errorDescription = shape.error_description;
-        this.errorUri = shape.error_uri;
-        this.error_description = shape.error_description;
-        this.error_uri = shape.error_uri;
+        this.errorDescription = description;
+        this.errorUri = uri;
+        this.error_description = description;
+        this.error_uri = uri;
         this.status = status;
         this.retryable = isRetryableOAuthError(this);
         this.terminal = !this.retryable;
+        this.outcomeKnown = outcomeKnown;
     }
 }
 export function isRetryableOAuthError(error) {
@@ -34,6 +49,7 @@ export async function exchangeAuthorizationCode(input) {
         tokenEndpoint: input.tokenEndpoint,
         clientId: input.clientId,
         clientSecret: input.clientSecret,
+        tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
         params: {
             grant_type: "authorization_code",
             code: input.code,
@@ -42,45 +58,52 @@ export async function exchangeAuthorizationCode(input) {
             resource
         },
         fetch: input.fetch,
+        signal: input.signal,
         now: input.now
     });
 }
 export async function refreshAccessToken(input) {
     const resource = canonicalizeResourceIndicator(input.resource);
-    return requestTokens({
+    const refreshToken = input.refreshToken;
+    const tokens = await requestTokens({
         tokenEndpoint: input.tokenEndpoint,
         clientId: input.clientId,
         clientSecret: input.clientSecret,
+        tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
         params: {
             grant_type: "refresh_token",
-            refresh_token: input.refreshToken,
+            refresh_token: refreshToken,
             resource
         },
         fetch: input.fetch,
+        signal: input.signal,
         now: input.now
     });
+    return { ...tokens, refreshToken: tokens.refreshToken ?? refreshToken };
 }
 async function requestTokens(input) {
-    const body = new URLSearchParams({
-        client_id: input.clientId,
-        ...input.params
-    });
-    if (input.clientSecret !== undefined) {
-        body.set("client_secret", input.clientSecret);
-    }
-    const response = await input.fetch(input.tokenEndpoint, {
+    const { body, headers } = createOAuthFormRequest(input);
+    input.signal?.throwIfAborted();
+    const deadline = AbortSignal.timeout(30_000);
+    const signal = input.signal === undefined ? deadline : AbortSignal.any([input.signal, deadline]);
+    const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
         method: "POST",
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: body.toString()
+        headers,
+        body: body.toString(),
+        signal
     });
-    const payload = await readOAuthJsonObjectResponse(response);
+    const payload = await readOAuthJsonObjectResponse(response, signal);
     const accessToken = getOwnEntry(payload, "access_token");
     if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
         throw new Error("OAuth token response missing access_token");
     }
     const normalizedAccessToken = accessToken.trim();
+    try {
+        new Headers({ Authorization: `Bearer ${normalizedAccessToken}` });
+    }
+    catch {
+        throw new Error("OAuth token response access_token is not a valid HTTP header value");
+    }
     const tokenType = normalizeBearerTokenType(getOwnEntry(payload, "token_type"));
     if (tokenType === null) {
         throw new Error("OAuth token response missing token_type=Bearer");
@@ -94,7 +117,10 @@ async function requestTokens(input) {
             expiresIn < 0) {
             throw new Error("OAuth token response has invalid expires_in");
         }
-        expiresAt = input.now() + expiresIn * 1000;
+        const issuedAt = input.now();
+        if (!Number.isSafeInteger(issuedAt) || Math.abs(issuedAt) > MAX_JS_DATE_MS)
+            throw new Error("OAuth token response has invalid expires_in");
+        expiresAt = issuedAt + expiresIn * 1000;
         if (!Number.isSafeInteger(expiresAt) ||
             expiresAt > MAX_JS_DATE_MS ||
             !Number.isFinite(new Date(expiresAt).getTime())) {
@@ -102,11 +128,15 @@ async function requestTokens(input) {
         }
     }
     const refreshToken = getOwnEntry(payload, "refresh_token");
+    if (refreshToken !== undefined && (typeof refreshToken !== "string" || refreshToken.trim().length === 0))
+        throw new Error("OAuth token response has invalid refresh_token");
     const scope = getOwnEntry(payload, "scope");
     const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0
         ? refreshToken.trim()
         : undefined;
-    const normalizedScope = typeof scope === "string" && scope.trim().length > 0 ? scope.trim() : undefined;
+    const normalizedScope = scope === "" ? "" : normalizeOAuthScope(scope);
+    if (scope !== undefined && normalizedScope === undefined)
+        throw new Error("Invalid OAuth scope syntax in token response");
     return {
         accessToken: normalizedAccessToken,
         refreshToken: normalizedRefreshToken === undefined ? undefined : normalizedRefreshToken,
@@ -115,13 +145,17 @@ async function requestTokens(input) {
         scope: normalizedScope === undefined ? undefined : normalizedScope
     };
 }
-export async function readOAuthJsonObjectResponse(response) {
+export async function readOAuthJsonObjectResponse(response, signal) {
     const fallbackError = createFallbackOAuthError(response.status);
     let payload;
     try {
-        payload = await response.json();
+        payload = JSON.parse(await readBoundedResponseText(response, 1024 * 1024, undefined, signal));
     }
-    catch {
+    catch (error) {
+        if (signal?.aborted)
+            throw signal.reason;
+        if (error instanceof Error && error.message.startsWith("HTTP response exceeds "))
+            throw error;
         if (!response.ok) {
             throw fallbackError;
         }
@@ -135,7 +169,10 @@ export async function readOAuthJsonObjectResponse(response) {
     }
     const record = payload;
     if (!response.ok) {
-        throw new OAuthError(readOAuthError(record, fallbackError.error), response.status);
+        const error = getOwnEntry(record, "error");
+        if (typeof error !== "string" || error.trim() === "")
+            throw fallbackError;
+        throw new OAuthError(readOAuthError(record), response.status);
     }
     return record;
 }
@@ -153,8 +190,8 @@ function getOwnEntry(record, key) {
     return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
 }
 function createFallbackOAuthError(status) {
-    const error = status === 503 ? "temporarily_unavailable" : "server_error";
-    return new OAuthError({ error }, status);
+    const error = status === 503 ? "temporarily_unavailable" : status >= 500 ? "server_error" : "invalid_response";
+    return new OAuthError({ error }, status, false);
 }
 function normalizeBearerTokenType(value) {
     if (typeof value !== "string") {

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-grant.d.ts

@@ -0,0 +1,10 @@
+import type { StoredOAuthTokens } from "./types.js";
+export interface OAuthTokenGrantImportOptions {
+    /** Absolute Unix epoch milliseconds; a numeric value takes precedence. */
+    readonly expiresAt?: number | null;
+    /** Original Unix epoch milliseconds for a delayed relative-lifetime import. */
+    readonly issuedAt?: number;
+    readonly now?: () => number;
+}
+/** Validate a raw RFC token response and anchor its lifetime once for persistence. */
+export declare function parseOAuthTokenGrant(value: unknown, options?: OAuthTokenGrantImportOptions): StoredOAuthTokens;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-grant.js

@@ -0,0 +1,56 @@
+import { copyBoundedOAuthJson } from "./bounded-json.js";
+import { normalizeOAuthScope } from "./scope.js";
+/** Validate a raw RFC token response and anchor its lifetime once for persistence. */
+export function parseOAuthTokenGrant(value, options = {}) {
+    options = { ...options, expiresAt: options.expiresAt, issuedAt: options.issuedAt, now: options.now?.bind(options) };
+    const invalid = () => new Error("Invalid OAuth token grant");
+    const result = copyBoundedOAuthJson(value, "Invalid OAuth token grant");
+    if (typeof result !== "object" || result === null || Array.isArray(result))
+        throw invalid();
+    const record = result;
+    const own = (key) => Object.hasOwn(record, key) ? record[key] : undefined;
+    const access = own("access_token"), refresh = own("refresh_token"), type = own("token_type");
+    if (typeof access !== "string" || access.trim() === "" || typeof type !== "string" || type.toLowerCase() !== "bearer" ||
+        (refresh !== undefined && (typeof refresh !== "string" || refresh.trim() === "")))
+        throw invalid();
+    const accessToken = access.trim();
+    try {
+        new Headers({ Authorization: `Bearer ${accessToken}` });
+    }
+    catch {
+        throw invalid();
+    }
+    const lifetime = own("expires_in"), seconds = own("expires_at"), milliseconds = own("expiresAt");
+    if ((lifetime !== undefined && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0)) ||
+        (seconds !== undefined && seconds !== null && (typeof seconds !== "number" || !Number.isSafeInteger(seconds))))
+        throw invalid();
+    const validTimestamp = (input) => typeof input === "number" && Number.isSafeInteger(input) && Math.abs(input) <= 8_640_000_000_000_000;
+    if ((milliseconds !== undefined && milliseconds !== null && !validTimestamp(milliseconds)) ||
+        (options.expiresAt !== undefined && options.expiresAt !== null && !validTimestamp(options.expiresAt)) ||
+        (options.issuedAt !== undefined && !validTimestamp(options.issuedAt)))
+        throw invalid();
+    // Validate every supplied timing field, even if a higher-precedence absolute
+    // value is selected. Reload uses only the resulting normalized timestamp.
+    const absoluteSeconds = typeof seconds === "number" ? seconds * 1000 : undefined;
+    if (absoluteSeconds !== undefined && !validTimestamp(absoluteSeconds))
+        throw invalid();
+    const anchor = typeof lifetime === "number" ? options.issuedAt ?? (options.now ?? Date.now)() : undefined;
+    if (typeof lifetime === "number" && !validTimestamp(anchor))
+        throw invalid();
+    const relative = typeof lifetime === "number" ? anchor + lifetime * 1000 : undefined;
+    if (relative !== undefined && !validTimestamp(relative))
+        throw invalid();
+    const expiresAt = options.expiresAt ?? (typeof milliseconds === "number" ? milliseconds : undefined) ?? absoluteSeconds ?? relative ?? null;
+    let scope;
+    try {
+        scope = normalizeOAuthScope(own("scope"));
+    }
+    catch {
+        throw invalid();
+    }
+    if (own("scope") !== undefined && scope === undefined)
+        throw invalid();
+    return { accessToken, tokenType: "Bearer", expiresAt,
+        ...(refresh === undefined ? {} : { refreshToken: refresh.trim() }),
+        ...(scope === undefined ? {} : { scope }) };
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -0,0 +1,196 @@
+import type http from "node:http";
+import type { CreateSecretStoreInput } from "auth-store";
+export type OAuthMetadataFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
+export interface OAuthProtectedResourceMetadata extends Record<string, unknown> {
+    resource: string;
+    authorization_servers: string[];
+}
+export interface OAuthAuthorizationServerMetadata extends Record<string, unknown> {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint?: string;
+    response_types_supported: string[];
+    code_challenge_methods_supported: string[];
+    authorization_response_iss_parameter_supported?: boolean;
+}
+export interface OAuthDiscoveryResult {
+    resource: string;
+    resourceMetadataUrl: string;
+    resourceMetadata: OAuthProtectedResourceMetadata;
+    authorizationServer: string;
+    authorizationServerMetadataUrl: string;
+    authorizationServerMetadata: OAuthAuthorizationServerMetadata;
+}
+export interface OAuthUnauthorizedChallenge {
+    scheme: "Bearer";
+    params: Record<string, string>;
+    raw: string;
+}
+export interface OAuthClientProvider {
+    /** Establish a grant explicitly, including when resource initialization is public. */
+    authenticate?(input: {
+        requestUrl: URL;
+        fetch: OAuthMetadataFetch;
+        /** Lazy validated discovery. Without it, recover/reuse known grants only. */
+        discover?: () => Promise<OAuthDiscoveryResult>;
+        signal?: AbortSignal;
+    }): Promise<StoredOAuthTokens | void>;
+    authorizeRequest?(input: {
+        requestUrl: URL;
+        headers: Headers;
+        fetch: OAuthMetadataFetch;
+        signal?: AbortSignal;
+    }): Promise<StoredOAuthTokens | void> | StoredOAuthTokens | void;
+    handleUnauthorized(input: {
+        requestUrl: URL;
+        response: Response;
+        challenge: OAuthUnauthorizedChallenge | null;
+        /** Validated metadata supplied by direct callers, if already available. */
+        discovery?: OAuthDiscoveryResult;
+        /** Lazy validated metadata; invoke only when OAuth recovery needs it. */
+        discover?: () => Promise<OAuthDiscoveryResult>;
+        fetch: OAuthMetadataFetch;
+        signal?: AbortSignal;
+        /** Headers actually attached to this rejected request. */
+        requestHeaders?: Headers;
+        /** Owned snapshot returned when this request was authorized, or null if absent. */
+        presentedTokens?: StoredOAuthTokens | null;
+    }): Promise<{
+        action: "retry";
+    } | {
+        action: "fail";
+        error?: Error;
+    }> | {
+        action: "retry";
+    } | {
+        action: "fail";
+        error?: Error;
+    };
+}
+export interface OAuthClientMetadata {
+    clientName?: string;
+    scope?: string;
+    softwareId?: string;
+    softwareVersion?: string;
+}
+export interface StoredOAuthTokens {
+    accessToken: string;
+    refreshToken?: string;
+    tokenType: "Bearer";
+    expiresAt: number | null;
+    scope?: string;
+}
+/** Import-time lifetimes are normalized once into persisted epoch milliseconds. */
+export interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
+    expiresAt?: number | null;
+    /** Remaining lifetime at import, or total lifetime when issuedAt is provided. */
+    expiresIn?: number;
+    /** Original issuance time in Unix epoch milliseconds. */
+    issuedAt?: number;
+}
+/** Full RFC 7591 response, including JSON provider extensions. */
+export interface OAuthClientRegistration extends Record<string, unknown> {
+    client_id: string;
+    client_secret?: string | null;
+    redirect_uris?: string[] | null;
+    grant_types?: string[] | null;
+    response_types?: string[] | null;
+    contacts?: string[] | null;
+    client_id_issued_at?: number | null;
+    client_secret_expires_at?: number | null;
+    token_endpoint_auth_method?: string | null;
+}
+export interface StoredOAuthClient {
+    clientId: string;
+    /** Externally registered apps must never be replaced by native DCR on reload. */
+    registrationOwnership?: "caller";
+    /** Actual listener URI submitted when this native client was registered. */
+    requestedRedirectUri?: string;
+    clientSecret?: string;
+    registration?: OAuthClientRegistration;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+}
+export type OAuthTokenEndpointAuthMethod = "none" | "client_secret_post" | "client_secret_basic";
+export interface StoredOAuthSession {
+    resource: string;
+    authorizationServer: string;
+    client: StoredOAuthClient;
+    tokens?: StoredOAuthTokens;
+    /** A refresh was begun; its winning response may not have been persisted. */
+    refreshState?: "pending";
+    /** Canonical explicitly requested scope set when the server omits token scope. */
+    requestedScope?: string;
+    discovery: {
+        resourceMetadataUrl: string;
+        resourceMetadata: Record<string, unknown>;
+        authorizationServerMetadata: Record<string, unknown>;
+    };
+}
+export interface OAuthSessionStore {
+    load(resource: string): Promise<StoredOAuthSession | null>;
+    save(resource: string, session: StoredOAuthSession): Promise<void>;
+    clear(resource: string): Promise<void>;
+    /** Backend-wide lock covering a complete read/redeem/write transaction. */
+    withLock?<T>(resource: string, operation: () => Promise<T>, options: {
+        signal?: AbortSignal;
+        timeoutMs: number;
+    }): Promise<T>;
+}
+/** Configuration values are captured at creation; selected host dependencies remain live. */
+export interface DefaultOAuthClientProviderOptions {
+    client: {
+        mode: "dynamic";
+        clientId?: string;
+        clientSecret?: string;
+        metadata?: OAuthClientMetadata;
+        /** Import a complete registration owned by the caller. */
+        registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+    } | {
+        mode: "static";
+        clientId: string;
+        clientSecret?: string;
+        metadata?: OAuthClientMetadata;
+        registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+    };
+    /** Disable interactive authorization while allowing cached tokens and silent refresh. */
+    allowInteractive?: boolean;
+    /** Maximum wait to acquire a session transaction lock (default 30,000 ms). */
+    sessionLockTimeoutMs?: number;
+    /** Isolate native persisted sessions and registrations for a named profile. */
+    persistenceNamespace?: string;
+    /** Native-owned durable logical server identity; changing URL retires its credentials. */
+    resourceIdentity?: string;
+    /** Import an existing grant for one resource. Persisted sessions take precedence. */
+    initialGrant?: {
+        resource: string;
+        tokens: ImportedOAuthTokens;
+    };
+    browser: {
+        openBrowser?(url: string): Promise<void>;
+        /** Return the full hosted HTTPS callback URL; the client validates redirect, state and issuer. */
+        waitForCallback?(request: {
+            authorizationUrl: string;
+            redirectUri: string;
+            signal: AbortSignal;
+        }): Promise<string>;
+        /** Exact registered HTTP loopback redirect URI. */
+        redirectUri?: string;
+        signal?: AbortSignal;
+        timeoutMs?: number;
+        readLine?: () => Promise<string>;
+        createServer?: () => http.Server;
+        landingPage?: {
+            title: string;
+            body: string;
+        };
+    };
+    sessionStore?: OAuthSessionStore;
+    authStore?: CreateSecretStoreInput;
+    now?: () => number;
+}
+export type OAuthClientProviderOptions = {
+    provider: OAuthClientProvider;
+} | DefaultOAuthClientProviderOptions;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/types.js

@@ -0,0 +1 @@
+export {};

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/http-fetch.d.ts

@@ -0,0 +1 @@
+export declare function fetchMcpResponse(fetchImplementation: (input: string | URL, init?: RequestInit) => Promise<Response>, input: string | URL, init?: RequestInit): Promise<Response>;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/http-fetch.js

@@ -0,0 +1,45 @@
+export async function fetchMcpResponse(fetchImplementation, input, init = {}) {
+    const signal = init.signal;
+    signal?.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (error, response) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener("abort", abort);
+            if (response === undefined)
+                reject(error);
+            else
+                resolve(response);
+        };
+        const abort = () => finish(signal?.reason);
+        signal?.addEventListener("abort", abort, { once: true });
+        if (signal?.aborted) {
+            abort();
+            return;
+        }
+        let pending;
+        try {
+            pending = fetchImplementation(input, { ...init, redirect: "error" });
+        }
+        catch (error) {
+            finish(error);
+            return;
+        }
+        void pending.then(response => {
+            if (settled || signal?.aborted) {
+                void response.body?.cancel().catch(() => undefined);
+                if (!settled)
+                    abort();
+                return;
+            }
+            if (response.redirected || response.type === "opaqueredirect" || (response.status >= 300 && response.status < 400)) {
+                void response.body?.cancel().catch(() => undefined);
+                finish(new Error("MCP HTTP redirects are not allowed"));
+            }
+            else
+                finish(undefined, response);
+        }, error => finish(error));
+    });
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/http-response.d.ts

@@ -0,0 +1 @@
+export declare function readBoundedResponseText(response: Response, maxBytes: number, readers?: Set<ReadableStreamDefaultReader<Uint8Array>>, signal?: AbortSignal): Promise<string>;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/http-response.js

@@ -0,0 +1,50 @@
+export async function readBoundedResponseText(response, maxBytes, readers, signal) {
+    if (maxBytes !== Infinity && (!Number.isSafeInteger(maxBytes) || maxBytes < 1))
+        throw new Error("HTTP response byte limit must be a positive safe integer");
+    if (signal?.aborted) {
+        void response.body?.cancel().catch(() => undefined);
+        throw signal.reason;
+    }
+    const length = response.headers.get("Content-Length");
+    if (length !== null &&
+        length.length > 0 &&
+        [...length].every((character) => character >= "0" && character <= "9") &&
+        Number(length) > maxBytes) {
+        void response.body?.cancel().catch(() => undefined);
+        throw new Error(`HTTP response exceeds ${maxBytes} bytes`);
+    }
+    if (response.body === null)
+        return "";
+    const reader = response.body.getReader();
+    readers?.add(reader);
+    const abort = () => {
+        void reader.cancel().catch(() => undefined);
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted)
+        abort();
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    let bytes = 0;
+    let text = "";
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            signal?.throwIfAborted();
+            if (chunk.done)
+                return text + decoder.decode();
+            bytes += chunk.value.byteLength;
+            if (bytes > maxBytes)
+                throw new Error(`HTTP response exceeds ${maxBytes} bytes`);
+            text += decoder.decode(chunk.value, { stream: true });
+        }
+    }
+    catch (error) {
+        void reader.cancel().catch(() => undefined);
+        throw error;
+    }
+    finally {
+        signal?.removeEventListener("abort", abort);
+        readers?.delete(reader);
+        reader.releaseLock();
+    }
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.browser.d.ts

@@ -0,0 +1,24 @@
+export { snapshotOAuthPersistenceOptions } from "./client/persistence-options.js";
+export { OAuthAuthorizationError } from "./client/authorization-error.js";
+export { OAuthError } from "./client/token-endpoint.js";
+export { canonicalizeResourceIndicator } from "./resource-indicator.js";
+export { readBoundedResponseText } from "./http-response.js";
+export { fetchMcpResponse } from "./http-fetch.js";
+export type * from "./client/types.js";
+import type { OAuthClientProvider, OAuthClientProviderOptions } from "./client/types.js";
+/** Remote hosts own credentials and authorization; desktop defaults are unavailable. */
+export declare function createOAuthClientProvider(options: OAuthClientProviderOptions): OAuthClientProvider;
+export declare function createDefaultOAuthClientProvider(): never;
+export declare function createAuthStoreSessionStore(): never;
+export { prepareRemoteMcpAuthorization, beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
+export type { RemoteMcpAuthorizationTransaction, RemoteMcpAuthorizationStore, PrepareRemoteMcpAuthorizationOptions, BeginRemoteMcpAuthorizationOptions, CompleteRemoteMcpAuthorizationOptions } from "./client/resumable.js";
+export { normalizeOAuthScope } from "./client/scope.js";
+export { waitForOAuthOperation } from "./client/cancellable-operation.js";
+export { parseOAuthTokenGrant } from "./client/token-grant.js";
+export { parseOAuthClientRegistration, normalizeStoredOAuthClient } from "./client/client-registration.js";
+/** Native persistence needs a desktop host; portable callers provide atomic hooks. */
+export declare function createResourceBoundOAuthStores(): never;
+export { generateCodeChallenge, generateCodeVerifier } from "./client/pkce.js";
+export { exchangeAuthorizationCode, refreshAccessToken } from "./client/token-endpoint.js";
+export { revokeOAuthToken } from "./client/revoke-token.js";
+export { registerOAuthClient, type RegisterOAuthClientOptions } from "./client/register-client.js";

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.browser.js

@@ -0,0 +1,31 @@
+export { snapshotOAuthPersistenceOptions } from "./client/persistence-options.js";
+export { OAuthAuthorizationError } from "./client/authorization-error.js";
+export { OAuthError } from "./client/token-endpoint.js";
+export { canonicalizeResourceIndicator } from "./resource-indicator.js";
+export { readBoundedResponseText } from "./http-response.js";
+export { fetchMcpResponse } from "./http-fetch.js";
+/** Remote hosts own credentials and authorization; desktop defaults are unavailable. */
+export function createOAuthClientProvider(options) {
+    if ("provider" in options && options.provider !== undefined)
+        return options.provider;
+    throw new Error("Worker MCP requires a host-owned OAuth provider or authenticated fetch; desktop OAuth is unavailable");
+}
+export function createDefaultOAuthClientProvider() {
+    throw new Error("Desktop OAuth is unavailable in Worker MCP");
+}
+export function createAuthStoreSessionStore() {
+    throw new Error("Desktop OAuth persistence is unavailable in Worker MCP");
+}
+export { prepareRemoteMcpAuthorization, beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
+export { normalizeOAuthScope } from "./client/scope.js";
+export { waitForOAuthOperation } from "./client/cancellable-operation.js";
+export { parseOAuthTokenGrant } from "./client/token-grant.js";
+export { parseOAuthClientRegistration, normalizeStoredOAuthClient } from "./client/client-registration.js";
+/** Native persistence needs a desktop host; portable callers provide atomic hooks. */
+export function createResourceBoundOAuthStores() {
+    throw new Error("Desktop OAuth persistence is unavailable in Worker MCP; provide host-owned import/reset hooks");
+}
+export { generateCodeChallenge, generateCodeVerifier } from "./client/pkce.js";
+export { exchangeAuthorizationCode, refreshAccessToken } from "./client/token-endpoint.js";
+export { revokeOAuthToken } from "./client/revoke-token.js";
+export { registerOAuthClient } from "./client/register-client.js";

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.d.ts

@@ -0,0 +1,25 @@
+export { snapshotOAuthPersistenceOptions } from "./client/persistence-options.js";
+export { normalizeOAuthScope } from "./client/scope.js";
+export { waitForOAuthOperation } from "./client/cancellable-operation.js";
+export { parseOAuthTokenGrant } from "./client/token-grant.js";
+export type { OAuthTokenGrantImportOptions } from "./client/token-grant.js";
+export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
+export { createResourceBoundOAuthStores } from "./client/resource-bound-store.js";
+export type { ResourceBoundOAuthStores } from "./client/resource-bound-store.js";
+export { parseOAuthClientRegistration, normalizeStoredOAuthClient } from "./client/client-registration.js";
+export { createDefaultOAuthClientProvider, createOAuthClientProvider, } from "./client/default-oauth-client-provider.js";
+export { buildSuccessPage, createLoopbackAuthorizationSession, extractCodeFromInput, OAuthAuthorizationError, } from "./client/loopback-authorization.js";
+export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";
+export { OAuthError, } from "./client/token-endpoint.js";
+export { canonicalizeResourceIndicator, } from "./resource-indicator.js";
+export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
+export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, OAuthTokenEndpointAuthMethod, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, ImportedOAuthTokens, } from "./client/types.js";
+export type { JwksTokenVerifier, JwksTokenVerifierOptions, JwksVerifiedAccessToken, } from "./server/jwks-token-verifier.js";
+export type { LoopbackAuthorizationOptions, LoopbackAuthorizationSession, OAuthLandingPage, } from "./client/loopback-authorization.js";
+export { readBoundedResponseText } from "./http-response.js";
+export { fetchMcpResponse } from "./http-fetch.js";
+export { prepareRemoteMcpAuthorization, beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
+export type { RemoteMcpAuthorizationTransaction, RemoteMcpAuthorizationStore, PrepareRemoteMcpAuthorizationOptions, BeginRemoteMcpAuthorizationOptions, CompleteRemoteMcpAuthorizationOptions } from "./client/resumable.js";
+export { exchangeAuthorizationCode, refreshAccessToken } from "./client/token-endpoint.js";
+export { revokeOAuthToken } from "./client/revoke-token.js";
+export { registerOAuthClient, type RegisterOAuthClientOptions } from "./client/register-client.js";