tiny-stdio-mcp-server 0.1.2 → 0.1.4

package/dist/content/audio.js

@@ -1,4 +1,4 @@
-import { fileTypeFromBuffer } from "./mime.js";
+import { assertBase64, fileTypeFromBuffer, parseContentType, safeRemoteLabel } from "./mime.js";
 const SUPPORTED_AUDIO_MIMES = new Set([
     "audio/mpeg",
     "audio/wav",
@@ -22,7 +22,7 @@ export class Audio {
     static async fromUrl(url) {
         const response = await fetch(url);
         if (!response.ok) {
-            throw new Error(`Failed to fetch audio from ${url}: ${response.status} ${response.statusText}`);
+            throw new Error(`Failed to fetch audio from ${safeRemoteLabel(url)}: ${response.status} ${response.statusText}`);
         }
         const arrayBuffer = await response.arrayBuffer();
         const data = new Uint8Array(arrayBuffer);
@@ -32,12 +32,12 @@ export class Audio {
             mimeType = detected.mime;
         }
         else {
-            const contentType = response.headers.get("content-type")?.split(";")[0];
+            const contentType = parseContentType(response.headers.get("content-type")).mimeType;
             if (contentType && SUPPORTED_AUDIO_MIMES.has(contentType)) {
                 mimeType = contentType;
             }
             else {
-                throw new Error(`Unable to detect audio MIME type from ${url}`);
+                throw new Error(`Unable to detect audio MIME type from ${safeRemoteLabel(url)}`);
             }
         }
         const base64 = Buffer.from(data).toString("base64");
@@ -47,11 +47,14 @@ export class Audio {
         let mimeType;
         if (format) {
             if (format.includes("/")) {
-                mimeType = format;
+                mimeType = format.toLowerCase();
             }
             else {
                 mimeType = AUDIO_FORMAT_MAP[format.toLowerCase()] || `audio/${format}`;
             }
+            if (!SUPPORTED_AUDIO_MIMES.has(mimeType)) {
+                throw new Error(`Unsupported audio MIME type: ${mimeType}`);
+            }
         }
         else {
             const detected = fileTypeFromBuffer(data);
@@ -64,7 +67,12 @@ export class Audio {
         return new Audio(base64, mimeType);
     }
     static fromBase64(base64, mimeType) {
-        return new Audio(base64, mimeType);
+        assertBase64(base64);
+        const normalizedMimeType = mimeType.toLowerCase();
+        if (!SUPPORTED_AUDIO_MIMES.has(normalizedMimeType)) {
+            throw new Error(`Unsupported audio MIME type: ${normalizedMimeType}`);
+        }
+        return new Audio(base64, normalizedMimeType);
     }
     toContentBlock() {
         return {

package/dist/content/convert.js

@@ -32,11 +32,30 @@ export function toContentBlocks(result) {
     return [convertSingleValue(result)];
 }
 function isContentBlock(value) {
-    if (!("type" in value) || typeof value.type !== "string") {
+    if (!hasOwnProperty(value, "type") || typeof value.type !== "string") {
         return false;
     }
-    return (value.type === "text" ||
-        value.type === "image" ||
-        value.type === "audio" ||
-        value.type === "resource");
+    if (value.type === "text") {
+        return hasOwnProperty(value, "text") && typeof value.text === "string";
+    }
+    if (value.type === "image" || value.type === "audio") {
+        return hasOwnProperty(value, "data")
+            && typeof value.data === "string"
+            && hasOwnProperty(value, "mimeType")
+            && typeof value.mimeType === "string";
+    }
+    if (value.type !== "resource" || !hasOwnProperty(value, "resource")) {
+        return false;
+    }
+    const resource = value.resource;
+    return typeof resource === "object"
+        && resource !== null
+        && hasOwnProperty(resource, "uri")
+        && typeof resource.uri === "string"
+        && (!hasOwnProperty(resource, "mimeType") || typeof resource.mimeType === "string")
+        && ((hasOwnProperty(resource, "text") && typeof resource.text === "string")
+            || (hasOwnProperty(resource, "blob") && typeof resource.blob === "string"));
+}
+function hasOwnProperty(value, name) {
+    return Object.prototype.hasOwnProperty.call(value, name);
 }

package/dist/content/file.d.ts

@@ -17,6 +17,7 @@ export declare class File {
     private readonly mimeType;
     private readonly isText;
     private readonly name?;
+    private readonly charset;
     private constructor();
     static fromUrl(url: string): Promise<File>;
     static fromBytes(data: Uint8Array, mimeType: string): File;

package/dist/content/file.js

@@ -1,26 +1,31 @@
-import { fileTypeFromBuffer } from "./mime.js";
+import { assertBase64, fileTypeFromBuffer, parseContentType, safeRemoteLabel } from "./mime.js";
 function isTextMimeType(mimeType) {
-    return (mimeType.startsWith("text/") ||
-        mimeType === "application/json" ||
-        mimeType === "application/xml" ||
-        mimeType === "application/javascript" ||
-        mimeType === "application/typescript");
+    const normalizedMimeType = mimeType.toLowerCase();
+    return (normalizedMimeType.startsWith("text/") ||
+        normalizedMimeType === "application/json" ||
+        normalizedMimeType.endsWith("+json") ||
+        normalizedMimeType === "application/xml" ||
+        normalizedMimeType.endsWith("+xml") ||
+        normalizedMimeType === "application/javascript" ||
+        normalizedMimeType === "application/typescript");
 }
 export class File {
     data;
     mimeType;
     isText;
     name;
-    constructor(data, mimeType, isText, name) {
+    charset;
+    constructor(data, mimeType, isText, name, charset = "utf-8") {
         this.data = data;
         this.mimeType = mimeType;
         this.isText = isText;
         this.name = name;
+        this.charset = charset;
     }
     static async fromUrl(url) {
         const response = await fetch(url);
         if (!response.ok) {
-            throw new Error(`Failed to fetch file from ${url}: ${response.status} ${response.statusText}`);
+            throw new Error(`Failed to fetch file from ${safeRemoteLabel(url)}: ${response.status} ${response.statusText}`);
         }
         const arrayBuffer = await response.arrayBuffer();
         const data = new Uint8Array(arrayBuffer);
@@ -30,26 +35,37 @@ export class File {
             mimeType = detected.mime;
         }
         else {
-            const contentType = response.headers.get("content-type")?.split(";")[0];
-            if (contentType) {
-                mimeType = contentType;
+            const contentType = parseContentType(response.headers.get("content-type"));
+            if (contentType.mimeType) {
+                mimeType = contentType.mimeType;
             }
             else {
-                throw new Error(`Unable to detect MIME type from ${url}`);
+                throw new Error(`Unable to detect MIME type from ${safeRemoteLabel(url)}`);
             }
         }
-        const isText = isTextMimeType(mimeType);
-        const name = url.split("/").pop() || "file";
-        return new File(data, mimeType, isText, name);
+        const contentType = parseContentType(response.headers.get("content-type"));
+        const charset = contentType.charset ?? "utf-8";
+        let isText = isTextMimeType(mimeType);
+        if (isText) {
+            try {
+                new TextDecoder(charset);
+            }
+            catch {
+                isText = false;
+            }
+        }
+        const name = new URL(url).pathname.split("/").pop() || "file";
+        return new File(data, mimeType, isText, name, charset);
     }
     static fromBytes(data, mimeType) {
         const isText = isTextMimeType(mimeType);
         return new File(data, mimeType, isText);
     }
     static fromText(text, mimeType = "text/plain") {
-        return new File(text, mimeType, true);
+        return new File(text, mimeType, isTextMimeType(mimeType));
     }
     static fromBase64(base64, mimeType) {
+        assertBase64(base64);
         const data = Buffer.from(base64, "base64");
         const isText = isTextMimeType(mimeType);
         return new File(new Uint8Array(data), mimeType, isText);
@@ -62,7 +78,7 @@ export class File {
                 text = this.data;
             }
             else {
-                text = new TextDecoder("utf-8").decode(this.data);
+                text = new TextDecoder(this.charset).decode(this.data);
             }
             return {
                 type: "resource",

package/dist/content/image.js

@@ -1,4 +1,4 @@
-import { fileTypeFromBuffer } from "./mime.js";
+import { assertBase64, fileTypeFromBuffer, parseContentType, safeRemoteLabel } from "./mime.js";
 const SUPPORTED_IMAGE_MIMES = new Set([
     "image/png",
     "image/jpeg",
@@ -15,7 +15,7 @@ export class Image {
     static async fromUrl(url) {
         const response = await fetch(url);
         if (!response.ok) {
-            throw new Error(`Failed to fetch image from ${url}: ${response.status} ${response.statusText}`);
+            throw new Error(`Failed to fetch image from ${safeRemoteLabel(url)}: ${response.status} ${response.statusText}`);
         }
         const arrayBuffer = await response.arrayBuffer();
         const data = new Uint8Array(arrayBuffer);
@@ -25,12 +25,12 @@ export class Image {
             mimeType = detected.mime;
         }
         else {
-            const contentType = response.headers.get("content-type")?.split(";")[0];
+            const contentType = parseContentType(response.headers.get("content-type")).mimeType;
             if (contentType && SUPPORTED_IMAGE_MIMES.has(contentType)) {
                 mimeType = contentType;
             }
             else {
-                throw new Error(`Unable to detect image MIME type from ${url}`);
+                throw new Error(`Unable to detect image MIME type from ${safeRemoteLabel(url)}`);
             }
         }
         const base64 = Buffer.from(data).toString("base64");
@@ -39,7 +39,10 @@ export class Image {
     static fromBytes(data, format) {
         let mimeType;
         if (format) {
-            mimeType = format.includes("/") ? format : `image/${format}`;
+            mimeType = (format.includes("/") ? format : `image/${format}`).toLowerCase();
+            if (!SUPPORTED_IMAGE_MIMES.has(mimeType)) {
+                throw new Error(`Unsupported image MIME type: ${mimeType}`);
+            }
         }
         else {
             const detected = fileTypeFromBuffer(data);
@@ -52,7 +55,12 @@ export class Image {
         return new Image(base64, mimeType);
     }
     static fromBase64(base64, mimeType) {
-        return new Image(base64, mimeType);
+        assertBase64(base64);
+        const normalizedMimeType = mimeType.toLowerCase();
+        if (!SUPPORTED_IMAGE_MIMES.has(normalizedMimeType)) {
+            throw new Error(`Unsupported image MIME type: ${normalizedMimeType}`);
+        }
+        return new Image(base64, normalizedMimeType);
     }
     toContentBlock() {
         return {

package/dist/content/mime.d.ts

@@ -1 +1,7 @@
 export { fileTypeFromBuffer, type FileTypeResult } from "./file-type.js";
+export declare function parseContentType(value: string | null): {
+    mimeType?: string;
+    charset?: string;
+};
+export declare function assertBase64(value: string): void;
+export declare function safeRemoteLabel(url: string): string;

package/dist/content/mime.js

@@ -1 +1,52 @@
 export { fileTypeFromBuffer } from "./file-type.js";
+export function parseContentType(value) {
+    if (!value) {
+        return {};
+    }
+    const [rawMimeType, ...parameters] = value.split(";");
+    const mimeType = rawMimeType?.trim().toLowerCase();
+    const charsetParameter = parameters.find((parameter) => parameter.trim().toLowerCase().startsWith("charset="));
+    const rawCharset = charsetParameter?.split("=", 2)[1]?.trim();
+    const charset = rawCharset?.startsWith('"') && rawCharset.endsWith('"')
+        ? rawCharset.slice(1, -1)
+        : rawCharset;
+    return {
+        ...(mimeType ? { mimeType } : {}),
+        ...(charset ? { charset } : {})
+    };
+}
+export function assertBase64(value) {
+    if (value.length % 4 !== 0) {
+        throw new Error("Invalid base64 content");
+    }
+    let paddingStarted = false;
+    let paddingCount = 0;
+    for (const character of value) {
+        if (character === "=") {
+            paddingStarted = true;
+            paddingCount += 1;
+            continue;
+        }
+        const code = character.charCodeAt(0);
+        const isValid = (code >= 65 && code <= 90) ||
+            (code >= 97 && code <= 122) ||
+            (code >= 48 && code <= 57) ||
+            character === "+" ||
+            character === "/";
+        if (!isValid || paddingStarted) {
+            throw new Error("Invalid base64 content");
+        }
+    }
+    if (paddingCount > 2) {
+        throw new Error("Invalid base64 content");
+    }
+}
+export function safeRemoteLabel(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.origin}${parsed.pathname}`;
+    }
+    catch {
+        return "remote resource";
+    }
+}

package/dist/index.d.ts

@@ -1,9 +1,9 @@
 export { createServer } from "./server.js";
-export type { Server } from "./server.js";
+export type { MessageHandler, MessageSession, Server } from "./server.js";
 export { defineSchema } from "./schema.js";
 export type { TypedSchema } from "./schema.js";
 export { Image, Audio, File, toContentBlocks, fileTypeFromBuffer, } from "./content/index.js";
 export type { ImageContent, AudioContent, EmbeddedResource, TextResourceContents, BlobResourceContents, ContentBlock, TextContent, FileTypeResult, } from "./content/index.js";
 export type { ToolReturn } from "./content/index.js";
-export type { ServerOptions, ToolHandler, ToolDefinition, Tool, CallToolResult, HandleResult, ContentItem, JSONSchema, JSONSchemaProperty, Transport, SDKTransport, JSONRPCRequest, JSONRPCResponse, JSONRPCError, JSONRPCMessage, JSONRPCNotification, InitializeResult, } from "./types.js";
+export type { ServerOptions, ToolHandler, ToolDefinition, Tool, ToolAnnotations, ToolExecution, Icon, ContentAnnotations, ResourceLink, CallToolResult, PromptContentItem, PromptArgument, Prompt, PromptMessage, GetPromptResult, PromptHandler, PromptDefinition, Resource, ResourceTemplate, ResourceContents, ReadResourceResult, ResourceHandler, ResourceDefinition, ResourceTemplateDefinition, HandleResult, ContentItem, JSONSchema, JSONSchemaProperty, Transport, SDKTransport, JSONRPCRequest, JSONRPCResponse, JSONRPCError, JSONRPCMessage, JSONRPCNotification, InitializeResult, } from "./types.js";
 export { JSON_RPC_ERROR_CODES, ToolError } from "./types.js";

package/dist/jsonrpc.js

@@ -28,7 +28,25 @@ export function parseMessage(line) {
     }
     const obj = parsed;
     const hasId = "id" in obj;
-    const id = typeof obj.id === "string" || typeof obj.id === "number" ? obj.id : null;
+    const id = typeof obj.id === "string"
+        ? obj.id
+        : typeof obj.id === "number" && Number.isFinite(obj.id)
+            ? obj.id
+            : obj.id === null
+                ? null
+                : null;
+    if ("params" in obj
+        && (typeof obj.params !== "object"
+            || obj.params === null)) {
+        return {
+            success: false,
+            error: {
+                code: JSON_RPC_ERROR_CODES.INVALID_REQUEST,
+                message: "Invalid Request",
+            },
+            id,
+        };
+    }
     if (obj.jsonrpc !== "2.0") {
         return {
             success: false,
@@ -60,7 +78,7 @@ export function parseMessage(line) {
             },
         };
     }
-    if (id === null) {
+    if (obj.id !== null && id === null) {
         return {
             success: false,
             error: {

package/dist/schema.js

@@ -2,10 +2,15 @@ export function defineSchema(definition) {
     const properties = {};
     const required = [];
     for (const [key, prop] of Object.entries(definition)) {
-        properties[key] = {
-            type: prop.type,
-            ...(prop.description !== undefined && { description: prop.description }),
-        };
+        Object.defineProperty(properties, key, {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: {
+                type: prop.type,
+                ...(prop.description !== undefined && { description: prop.description }),
+            },
+        });
         if (!prop.optional) {
             required.push(key);
         }

package/dist/server.d.ts

@@ -1,13 +1,29 @@
-import type { ServerOptions, ToolHandler, HandleResult, Transport, SDKTransport, JSONRPCNotification } from "./types.js";
+import type { ServerOptions, ToolDefinition, ToolHandler, HandleResult, Prompt, PromptHandler, Resource, ResourceHandler, ResourceTemplate, Transport, SDKTransport, JSONRPCNotification } from "./types.js";
 import type { TypedSchema } from "./schema.js";
 export interface Server {
     tool<T>(name: string, description: string, inputSchema: TypedSchema<T>, handler: ToolHandler<T>): Server;
+    registerTool<T>(definition: Omit<ToolDefinition<T>, "handler">, handler: ToolHandler<T>): Server;
+    prompt(definition: Prompt, handler: PromptHandler): Server;
+    resource(definition: Resource, handler: ResourceHandler): Server;
+    resourceTemplate(definition: ResourceTemplate, handler: ResourceHandler): Server;
     onNotification(listener: (notification: JSONRPCNotification) => void): () => void;
     removeTool(name: string): boolean;
+    removePrompt(name: string): boolean;
+    removeResource(uri: string): boolean;
+    removeResourceTemplate(uriTemplate: string): boolean;
     notifyToolsChanged(): Promise<void>;
+    notifyPromptsChanged(): Promise<void>;
+    notifyResourcesChanged(): Promise<void>;
+    notifyResourceUpdated(uri: string): Promise<void>;
+    createMessageSession(listener?: (notification: JSONRPCNotification) => void | Promise<void>): MessageSession;
     handleMessage(method: string, params?: Record<string, unknown>): Promise<HandleResult>;
     listen(): Promise<void>;
     connect(transport: Transport): Promise<void>;
     connectSDK(transport: SDKTransport): Promise<void>;
 }
+export type MessageHandler = (method: string, params?: Record<string, unknown>) => Promise<HandleResult>;
+export interface MessageSession {
+    handleMessage: MessageHandler;
+    close(): void;
+}
 export declare function createServer(options: ServerOptions): Server;

package/dist/server.js

@@ -1,27 +1,65 @@
 import * as readline from "readline";
+import AjvModule from "ajv";
+import uriTemplateParser from "uri-template";
+import UriTemplate from "uri-template-lite";
 import { JSON_RPC_ERROR_CODES, ToolError } from "./types.js";
 import { parseMessage, formatSuccessResponse, formatErrorResponse, } from "./jsonrpc.js";
 import { toContentBlocks } from "./content/convert.js";
 const PROTOCOL_VERSION = "2025-11-25";
+const SUPPORTED_PROTOCOL_VERSIONS = new Set([
+    "2025-03-26",
+    "2025-06-18",
+    PROTOCOL_VERSION,
+]);
 export function createServer(options) {
+    const Ajv = "default" in AjvModule ? AjvModule.default : AjvModule;
+    const jsonSchemaValidator = new Ajv({ strict: false });
+    const supportNotifications = options.supportNotifications !== false;
+    const supportResourceSubscriptions = options.supportResourceSubscriptions !== false;
     const tools = new Map();
+    const prompts = new Map();
+    const resources = new Map();
+    const resourceTemplates = new Map();
     const notificationListeners = new Set();
-    let initialized = false;
-    const handleMessage = async (method, params) => {
+    const connectionNotificationListeners = new Map();
+    const defaultLifecycle = {
+        initialized: false,
+        initializeAccepted: false,
+        notificationReady: false,
+        resourceSubscriptions: new Set(),
+    };
+    const messageLifecycles = new Set([defaultLifecycle]);
+    const handleMessageWithLifecycle = async (method, lifecycle, params) => {
         // Allow ping and initialize before initialization
         if (method === "ping") {
             return { result: {} };
         }
         if (method === "initialize") {
-            initialized = true;
+            // Re-initialize on the same connection is idempotent: real MCP clients
+            // (e.g. kimi-cli via fastmcp) re-send `initialize` on a persistent
+            // connection per tool call, and the official MCP SDK server re-responds
+            // with InitializeResult instead of erroring. Per-connection isolation is
+            // still enforced by the separate lifecycle object given to each connection.
+            lifecycle.initializeAccepted = true;
+            lifecycle.initialized = true;
+            lifecycle.notificationReady = false;
             const requestedProtocol = typeof params?.protocolVersion === "string"
                 ? params.protocolVersion
-                : null;
+                : undefined;
             const result = {
-                protocolVersion: requestedProtocol ?? PROTOCOL_VERSION,
+                protocolVersion: requestedProtocol !== undefined && SUPPORTED_PROTOCOL_VERSIONS.has(requestedProtocol)
+                    ? requestedProtocol
+                    : PROTOCOL_VERSION,
                 capabilities: {
                     tools: {
-                        listChanged: true,
+                        ...(supportNotifications ? { listChanged: true } : {}),
+                    },
+                    prompts: {
+                        ...(supportNotifications ? { listChanged: true } : {}),
+                    },
+                    resources: {
+                        ...(supportNotifications ? { listChanged: true } : {}),
+                        ...(supportResourceSubscriptions ? { subscribe: true } : {}),
                     },
                 },
                 serverInfo: {
@@ -32,10 +70,19 @@ export function createServer(options) {
             return { result };
         }
         if (method === "notifications/initialized") {
+            if (!lifecycle.initializeAccepted) {
+                return {
+                    error: {
+                        code: JSON_RPC_ERROR_CODES.INVALID_REQUEST,
+                        message: "Server not initialized",
+                    },
+                };
+            }
+            lifecycle.notificationReady = true;
             return { result: undefined };
         }
         // All other methods require initialization
-        if (!initialized) {
+        if (!lifecycle.initialized) {
             return {
                 error: {
                     code: JSON_RPC_ERROR_CODES.INVALID_REQUEST,
@@ -46,17 +93,16 @@ export function createServer(options) {
         if (method === "tools/list") {
             const toolList = [];
             for (const tool of tools.values()) {
+                const descriptor = { ...tool };
+                delete descriptor.handler;
                 toolList.push({
-                    name: tool.name,
-                    description: tool.description,
-                    inputSchema: tool.inputSchema,
+                    ...descriptor,
                 });
             }
             return { result: { tools: toolList } };
         }
         if (method === "tools/call") {
             const toolName = params?.name;
-            const toolArgs = params?.arguments || {};
             if (!toolName) {
                 return {
                     error: {
@@ -74,11 +120,28 @@ export function createServer(options) {
                     },
                 };
             }
+            const toolArgs = (params?.arguments ?? {});
+            if (options.validateToolArguments !== false && !jsonSchemaValidator.validate(tool.inputSchema, toolArgs)) {
+                return {
+                    error: {
+                        code: JSON_RPC_ERROR_CODES.INVALID_PARAMS,
+                        message: "Invalid tool arguments",
+                    },
+                };
+            }
             try {
                 const handlerResult = await tool.handler(toolArgs);
+                if (hasContentArray(handlerResult) && !isCallToolResult(handlerResult)) {
+                    throw new Error("Invalid tool result");
+                }
                 const result = isCallToolResult(handlerResult)
                     ? handlerResult
                     : { content: toContentBlocks(handlerResult) };
+                if (tool.outputSchema !== undefined
+                    && (result.structuredContent === undefined
+                        || !jsonSchemaValidator.validate(tool.outputSchema, result.structuredContent))) {
+                    throw new Error("Invalid structured tool result");
+                }
                 return { result };
             }
             catch (err) {
@@ -98,6 +161,96 @@ export function createServer(options) {
                 return { result };
             }
         }
+        if (method === "prompts/list") {
+            return {
+                result: {
+                    prompts: [...prompts.values()].map(({ handler: _handler, ...prompt }) => prompt),
+                },
+            };
+        }
+        if (method === "prompts/get") {
+            const promptName = typeof params?.name === "string" ? params.name : undefined;
+            if (promptName === undefined) {
+                return invalidParams("Prompt name required");
+            }
+            const prompt = prompts.get(promptName);
+            if (prompt === undefined) {
+                return invalidParams(`Prompt not found: ${promptName}`);
+            }
+            const args = toStringArguments(params?.arguments);
+            if (args === undefined || !hasRequiredPromptArguments(prompt, args)) {
+                return invalidParams("Invalid prompt arguments");
+            }
+            try {
+                const result = await prompt.handler(args);
+                if (!isGetPromptResult(result)) {
+                    return internalError("Invalid prompt result");
+                }
+                return { result };
+            }
+            catch (error) {
+                return internalError(toErrorMessage(error));
+            }
+        }
+        if (method === "resources/list") {
+            return {
+                result: {
+                    resources: [...resources.values()].map(({ handler: _handler, ...resource }) => resource),
+                },
+            };
+        }
+        if (method === "resources/templates/list") {
+            return {
+                result: {
+                    resourceTemplates: [...resourceTemplates.values()].map(({ handler: _handler, ...resourceTemplate }) => resourceTemplate),
+                },
+            };
+        }
+        if (method === "resources/read") {
+            const uri = typeof params?.uri === "string" ? params.uri : undefined;
+            if (uri === undefined || !isValidUri(uri)) {
+                return invalidParams("Resource URI required");
+            }
+            const resource = findReadableResource(uri, resources, resourceTemplates);
+            if (resource === undefined) {
+                return resourceNotFound(uri);
+            }
+            try {
+                const result = await resource.handler(uri);
+                if (!isReadResourceResult(result)) {
+                    return internalError("Invalid resource result");
+                }
+                return { result };
+            }
+            catch (error) {
+                return internalError(toErrorMessage(error));
+            }
+        }
+        if (method === "resources/subscribe" || method === "resources/unsubscribe") {
+            if (!supportResourceSubscriptions) {
+                return {
+                    error: {
+                        code: JSON_RPC_ERROR_CODES.METHOD_NOT_FOUND,
+                        message: "Method not found",
+                    },
+                };
+            }
+            const uri = typeof params?.uri === "string" ? params.uri : undefined;
+            if (uri === undefined || !isValidUri(uri)) {
+                return invalidParams("Resource URI required");
+            }
+            if (method === "resources/subscribe"
+                && findReadableResource(uri, resources, resourceTemplates) === undefined) {
+                return resourceNotFound(uri);
+            }
+            if (method === "resources/subscribe") {
+                lifecycle.resourceSubscriptions.add(uri);
+            }
+            else {
+                lifecycle.resourceSubscriptions.delete(uri);
+            }
+            return { result: {} };
+        }
         return {
             error: {
                 code: JSON_RPC_ERROR_CODES.METHOD_NOT_FOUND,
@@ -105,14 +258,47 @@ export function createServer(options) {
             },
         };
     };
-    const processLine = async (line, write) => {
+    const createMessageSession = (listener) => {
+        const lifecycle = {
+            initialized: false,
+            initializeAccepted: false,
+            notificationReady: false,
+            resourceSubscriptions: new Set(),
+        };
+        messageLifecycles.add(lifecycle);
+        if (listener !== undefined) {
+            connectionNotificationListeners.set(listener, lifecycle);
+        }
+        return {
+            handleMessage: (method, params) => handleMessageWithLifecycle(method, lifecycle, params),
+            close: () => {
+                if (listener !== undefined) {
+                    connectionNotificationListeners.delete(listener);
+                }
+                messageLifecycles.delete(lifecycle);
+            },
+        };
+    };
+    const handleMessage = (method, params) => handleMessageWithLifecycle(method, defaultLifecycle, params);
+    const processLine = async (line, write, messageHandler) => {
         const parsed = parseMessage(line);
         if (!parsed.success) {
             write(formatErrorResponse(parsed.id, parsed.error) + "\n");
             return;
         }
         const { request, isNotification } = parsed;
-        const { result, error } = await server.handleMessage(request.method, request.params);
+        if (isNotification && request.method === "initialize") {
+            return;
+        }
+        if (!isNotification && request.method === "notifications/initialized") {
+            const requestWithId = request;
+            write(formatErrorResponse(requestWithId.id, {
+                code: JSON_RPC_ERROR_CODES.INVALID_REQUEST,
+                message: "Invalid Request",
+            }) + "\n");
+            return;
+        }
+        const { result, error } = await messageHandler(request.method, request.params);
         if (isNotification) {
             return;
         }
@@ -124,14 +310,20 @@ export function createServer(options) {
             write(formatSuccessResponse(requestWithId.id, result) + "\n");
         }
     };
-    const broadcastNotification = (method) => {
+    const broadcastNotification = async (method, params, canSend = () => true) => {
         const notification = {
             jsonrpc: "2.0",
             method,
+            ...(params === undefined ? {} : { params }),
         };
         for (const listener of notificationListeners) {
             listener(notification);
         }
+        await Promise.all([...connectionNotificationListeners].map(async ([listener, lifecycle]) => {
+            if (lifecycle.notificationReady && canSend(lifecycle)) {
+                await listener(notification);
+            }
+        }));
     };
     const server = {
         tool(name, description, inputSchema, handler) {
@@ -143,6 +335,30 @@ export function createServer(options) {
             });
             return server;
         },
+        registerTool(definition, handler) {
+            tools.set(definition.name, {
+                ...definition,
+                handler: handler,
+            });
+            return server;
+        },
+        prompt(definition, handler) {
+            prompts.set(definition.name, { ...definition, handler });
+            return server;
+        },
+        resource(definition, handler) {
+            if (!isValidUri(definition.uri)) {
+                throw new Error(`Invalid resource URI: ${definition.uri}`);
+            }
+            resources.set(definition.uri, { ...definition, handler });
+            return server;
+        },
+        resourceTemplate(definition, handler) {
+            uriTemplateParser.parse(definition.uriTemplate);
+            new UriTemplate(definition.uriTemplate);
+            resourceTemplates.set(definition.uriTemplate, { ...definition, handler });
+            return server;
+        },
         onNotification(listener) {
             notificationListeners.add(listener);
             return () => {
@@ -152,11 +368,37 @@ export function createServer(options) {
         removeTool(name) {
             return tools.delete(name);
         },
+        removePrompt(name) {
+            return prompts.delete(name);
+        },
+        removeResource(uri) {
+            return resources.delete(uri);
+        },
+        removeResourceTemplate(uriTemplate) {
+            return resourceTemplates.delete(uriTemplate);
+        },
         async notifyToolsChanged() {
-            if (initialized) {
-                broadcastNotification("notifications/tools/list_changed");
+            if (supportNotifications && [...messageLifecycles].some((lifecycle) => lifecycle.notificationReady)) {
+                await broadcastNotification("notifications/tools/list_changed");
+            }
+        },
+        async notifyPromptsChanged() {
+            if (supportNotifications && [...messageLifecycles].some((lifecycle) => lifecycle.notificationReady)) {
+                await broadcastNotification("notifications/prompts/list_changed");
             }
         },
+        async notifyResourcesChanged() {
+            if (supportNotifications && [...messageLifecycles].some((lifecycle) => lifecycle.notificationReady)) {
+                await broadcastNotification("notifications/resources/list_changed");
+            }
+        },
+        async notifyResourceUpdated(uri) {
+            if (!supportResourceSubscriptions) {
+                return;
+            }
+            await broadcastNotification("notifications/resources/updated", { uri }, (lifecycle) => lifecycle.resourceSubscriptions.has(uri));
+        },
+        createMessageSession,
         handleMessage,
         async listen() {
             return server.connect({
@@ -166,27 +408,40 @@ export function createServer(options) {
         },
         async connect(transport) {
             return new Promise((resolve) => {
-                const unsubscribe = server.onNotification((notification) => {
+                const lifecycle = { initialized: false, initializeAccepted: false, notificationReady: false, resourceSubscriptions: new Set() };
+                const messageHandler = (method, params) => handleMessageWithLifecycle(method, lifecycle, params);
+                messageLifecycles.add(lifecycle);
+                const listener = (notification) => {
                     transport.writable.write(`${JSON.stringify(notification)}\n`);
-                });
+                };
+                connectionNotificationListeners.set(listener, lifecycle);
                 const rl = readline.createInterface({
                     input: transport.readable,
                     crlfDelay: Infinity,
                 });
+                const pendingMessages = new Set();
                 rl.on("line", (line) => {
-                    processLine(line, (data) => transport.writable.write(data));
+                    const message = processLine(line, (data) => transport.writable.write(data), messageHandler);
+                    pendingMessages.add(message);
+                    void message.finally(() => {
+                        pendingMessages.delete(message);
+                    });
                 });
-                rl.on("close", () => {
-                    unsubscribe();
+                rl.on("close", async () => {
+                    await Promise.all([...pendingMessages]);
+                    connectionNotificationListeners.delete(listener);
+                    messageLifecycles.delete(lifecycle);
                     resolve();
                 });
             });
         },
         async connectSDK(transport) {
-            return new Promise((resolve) => {
-                const unsubscribe = server.onNotification((notification) => {
-                    void transport.send(notification);
-                });
+            return new Promise((resolve, reject) => {
+                const lifecycle = { initialized: false, initializeAccepted: false, notificationReady: false, resourceSubscriptions: new Set() };
+                const messageHandler = (method, params) => handleMessageWithLifecycle(method, lifecycle, params);
+                messageLifecycles.add(lifecycle);
+                const listener = (notification) => transport.send(notification);
+                connectionNotificationListeners.set(listener, lifecycle);
                 transport.onmessage = async (message) => {
                     // Ignore responses (we only handle requests/notifications)
                     if (!("method" in message)) {
@@ -194,11 +449,25 @@ export function createServer(options) {
                     }
                     // Handle notifications (no id) - don't respond
                     if (!("id" in message) || message.id === undefined) {
-                        await server.handleMessage(message.method, message.params);
+                        if (message.method === "initialize") {
+                            return;
+                        }
+                        await messageHandler(message.method, message.params);
+                        return;
+                    }
+                    if (message.method === "notifications/initialized") {
+                        await transport.send({
+                            jsonrpc: "2.0",
+                            id: message.id,
+                            error: {
+                                code: JSON_RPC_ERROR_CODES.INVALID_REQUEST,
+                                message: "Invalid Request",
+                            },
+                        });
                         return;
                     }
                     const request = message;
-                    const { result, error } = await server.handleMessage(request.method, request.params);
+                    const { result, error } = await messageHandler(request.method, request.params);
                     if (error) {
                         const response = {
                             jsonrpc: "2.0",
@@ -217,18 +486,181 @@ export function createServer(options) {
                     }
                 };
                 transport.onclose = () => {
-                    unsubscribe();
+                    connectionNotificationListeners.delete(listener);
+                    messageLifecycles.delete(lifecycle);
                     resolve();
                 };
-                transport.start();
+                void transport.start().catch((error) => {
+                    connectionNotificationListeners.delete(listener);
+                    messageLifecycles.delete(lifecycle);
+                    reject(error);
+                });
             });
         },
     };
     return server;
 }
+function invalidParams(message) {
+    return {
+        error: {
+            code: JSON_RPC_ERROR_CODES.INVALID_PARAMS,
+            message,
+        },
+    };
+}
+function internalError(message) {
+    return {
+        error: {
+            code: JSON_RPC_ERROR_CODES.INTERNAL_ERROR,
+            message,
+        },
+    };
+}
+function resourceNotFound(uri) {
+    return {
+        error: {
+            code: JSON_RPC_ERROR_CODES.RESOURCE_NOT_FOUND,
+            message: `Resource not found: ${uri}`,
+        },
+    };
+}
+function toErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function isValidUri(uri) {
+    try {
+        new URL(uri);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function toStringArguments(value) {
+    if (value === undefined) {
+        return {};
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const args = {};
+    for (const [name, argument] of Object.entries(value)) {
+        if (typeof argument !== "string") {
+            return undefined;
+        }
+        args[name] = argument;
+    }
+    return args;
+}
+function hasRequiredPromptArguments(prompt, args) {
+    return (prompt.arguments ?? []).every((argument) => argument.required !== true || args[argument.name] !== undefined);
+}
+function findReadableResource(uri, resources, resourceTemplates) {
+    const resource = resources.get(uri);
+    if (resource !== undefined) {
+        return resource;
+    }
+    return [...resourceTemplates.values()].find((template) => matchesUriTemplate(template.uriTemplate, uri));
+}
+function matchesUriTemplate(template, uri) {
+    try {
+        return new UriTemplate(template).match(uri) !== null;
+    }
+    catch {
+        return false;
+    }
+}
 function isCallToolResult(value) {
-    if (typeof value !== "object" || value === null || !("content" in value)) {
+    return hasContentArray(value) && value.content.every(isContentItem);
+}
+function isGetPromptResult(value) {
+    if (typeof value !== "object" || value === null || !hasOwnProperty(value, "messages")) {
+        return false;
+    }
+    return Array.isArray(value.messages)
+        && value.messages.every((message) => typeof message === "object"
+            && message !== null
+            && hasOwnProperty(message, "role")
+            && (message.role === "user" || message.role === "assistant")
+            && hasOwnProperty(message, "content")
+            && isPromptContentItem(message.content));
+}
+function isReadResourceResult(value) {
+    if (typeof value !== "object" || value === null || !hasOwnProperty(value, "contents")) {
+        return false;
+    }
+    return Array.isArray(value.contents)
+        && value.contents.every((content) => typeof content === "object"
+            && content !== null
+            && hasOwnProperty(content, "uri")
+            && typeof content.uri === "string"
+            && isValidUri(content.uri)
+            && ((hasOwnProperty(content, "text") && typeof content.text === "string")
+                || (hasOwnProperty(content, "blob") && typeof content.blob === "string" && isBase64(content.blob))));
+}
+function hasContentArray(value) {
+    return typeof value === "object" && value !== null && hasOwnProperty(value, "content")
+        && Array.isArray(value.content);
+}
+function isContentItem(value) {
+    if (typeof value !== "object" || value === null || !hasOwnProperty(value, "type")) {
+        return false;
+    }
+    const block = value;
+    if (block.type === "text") {
+        return hasOwnProperty(block, "text") && typeof block.text === "string";
+    }
+    if (block.type === "image" || block.type === "audio") {
+        return hasOwnProperty(block, "data")
+            && typeof block.data === "string"
+            && isBase64(block.data)
+            && hasOwnProperty(block, "mimeType")
+            && typeof block.mimeType === "string";
+    }
+    if (block.type === "resource_link") {
+        return hasOwnProperty(block, "uri")
+            && typeof block.uri === "string"
+            && hasOwnProperty(block, "name")
+            && typeof block.name === "string";
+    }
+    if (block.type !== "resource"
+        || !hasOwnProperty(block, "resource")
+        || typeof block.resource !== "object"
+        || block.resource === null) {
+        return false;
+    }
+    const resource = block.resource;
+    return hasOwnProperty(resource, "uri")
+        && typeof resource.uri === "string"
+        && (!hasOwnProperty(resource, "mimeType") || typeof resource.mimeType === "string")
+        && ((hasOwnProperty(resource, "text") && typeof resource.text === "string")
+            || (hasOwnProperty(resource, "blob") && typeof resource.blob === "string" && isBase64(resource.blob)));
+}
+function isBase64(value) {
+    if (value.length === 0) {
+        return true;
+    }
+    if (value.length % 4 !== 0) {
+        return false;
+    }
+    const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    const paddingStart = value.indexOf("=");
+    const encoded = paddingStart === -1 ? value : value.slice(0, paddingStart);
+    const padding = paddingStart === -1 ? "" : value.slice(paddingStart);
+    if (padding.length > 2 || [...padding].some((character) => character !== "=")) {
+        return false;
+    }
+    if ([...encoded].some((character) => !alphabet.includes(character))) {
         return false;
     }
-    return Array.isArray(value.content);
+    return Buffer.from(value, "base64").toString("base64") === value;
+}
+function isPromptContentItem(value) {
+    if (!isContentItem(value)) {
+        return false;
+    }
+    return !(typeof value === "object" && value !== null && hasOwnProperty(value, "type") && value.type === "resource_link");
+}
+function hasOwnProperty(value, name) {
+    return Object.prototype.hasOwnProperty.call(value, name);
 }

package/dist/types.d.ts

@@ -1,6 +1,6 @@
 export interface JSONRPCRequest {
     jsonrpc: "2.0";
-    id: string | number;
+    id: string | number | null;
     method: string;
     params?: Record<string, unknown>;
 }
@@ -15,13 +15,14 @@ export interface JSONRPCError {
     message: string;
     data?: unknown;
 }
-export declare const JSON_RPC_ERROR_CODES: {
+export declare const JSON_RPC_ERROR_CODES: Readonly<{
     readonly PARSE_ERROR: -32700;
     readonly INVALID_REQUEST: -32600;
     readonly METHOD_NOT_FOUND: -32601;
     readonly INVALID_PARAMS: -32602;
     readonly INTERNAL_ERROR: -32603;
-};
+    readonly RESOURCE_NOT_FOUND: -32002;
+}>;
 export declare class ToolError extends Error {
     readonly code: number;
     constructor(code: number, message: string);
@@ -29,10 +30,19 @@ export declare class ToolError extends Error {
 export interface ToolsCapability {
     listChanged?: boolean;
 }
+export interface PromptsCapability {
+    listChanged?: boolean;
+}
+export interface ResourcesCapability {
+    subscribe?: boolean;
+    listChanged?: boolean;
+}
 export interface InitializeResult {
     protocolVersion: string;
     capabilities: {
         tools?: ToolsCapability;
+        prompts?: PromptsCapability;
+        resources?: ResourcesCapability;
     };
     serverInfo: {
         name: string;
@@ -41,13 +51,116 @@ export interface InitializeResult {
 }
 export interface Tool {
     name: string;
-    description: string;
+    title?: string;
+    description?: string;
     inputSchema: JSONSchema;
+    outputSchema?: JSONSchema;
+    annotations?: ToolAnnotations;
+    execution?: ToolExecution;
+    icons?: Icon[];
+    _meta?: Record<string, unknown>;
 }
 export interface CallToolResult {
     content: ContentItem[];
+    structuredContent?: Record<string, unknown>;
     isError?: boolean;
 }
+export interface ToolAnnotations {
+    title?: string;
+    readOnlyHint?: boolean;
+    destructiveHint?: boolean;
+    idempotentHint?: boolean;
+    openWorldHint?: boolean;
+}
+export interface ToolExecution {
+    taskSupport?: "optional" | "required" | "forbidden";
+}
+export interface Icon {
+    src: string;
+    mimeType?: string;
+    sizes?: string[];
+    theme?: "light" | "dark";
+}
+export interface ContentAnnotations {
+    audience?: Array<"user" | "assistant">;
+    priority?: number;
+    lastModified?: string;
+}
+export interface ResourceLink {
+    type: "resource_link";
+    uri: string;
+    name: string;
+    title?: string;
+    description?: string;
+    mimeType?: string;
+    size?: number;
+    annotations?: ContentAnnotations;
+}
+export interface PromptArgument {
+    name: string;
+    description?: string;
+    required?: boolean;
+}
+export interface Prompt {
+    name: string;
+    title?: string;
+    description?: string;
+    arguments?: PromptArgument[];
+    icons?: Icon[];
+    _meta?: Record<string, unknown>;
+}
+export interface PromptMessage {
+    role: "user" | "assistant";
+    content: PromptContentItem;
+}
+export interface GetPromptResult {
+    description?: string;
+    messages: PromptMessage[];
+}
+export type PromptHandler = (args: Record<string, string>) => Promise<GetPromptResult> | GetPromptResult;
+export interface PromptDefinition extends Prompt {
+    handler: PromptHandler;
+}
+export interface Resource {
+    uri: string;
+    name: string;
+    title?: string;
+    description?: string;
+    mimeType?: string;
+    size?: number;
+    annotations?: ContentAnnotations;
+    icons?: Icon[];
+    _meta?: Record<string, unknown>;
+}
+export interface ResourceTemplate {
+    uriTemplate: string;
+    name: string;
+    title?: string;
+    description?: string;
+    mimeType?: string;
+    annotations?: ContentAnnotations;
+    icons?: Icon[];
+    _meta?: Record<string, unknown>;
+}
+export type ResourceContents = {
+    uri: string;
+    mimeType?: string;
+    text: string;
+} | {
+    uri: string;
+    mimeType?: string;
+    blob: string;
+};
+export interface ReadResourceResult {
+    contents: ResourceContents[];
+}
+export type ResourceHandler = (uri: string) => Promise<ReadResourceResult> | ReadResourceResult;
+export interface ResourceDefinition extends Resource {
+    handler: ResourceHandler;
+}
+export interface ResourceTemplateDefinition extends ResourceTemplate {
+    handler: ResourceHandler;
+}
 export interface HandleResult {
     result?: unknown;
     error?: {
@@ -55,48 +168,64 @@ export interface HandleResult {
         message: string;
     };
 }
-export type ContentItem = {
+export type PromptContentItem = {
     type: "text";
     text: string;
+    annotations?: ContentAnnotations;
 } | {
     type: "image";
     data: string;
     mimeType: string;
+    annotations?: ContentAnnotations;
 } | {
     type: "audio";
     data: string;
     mimeType: string;
+    annotations?: ContentAnnotations;
 } | {
     type: "resource";
+    annotations?: ContentAnnotations;
     resource: {
         uri: string;
-        mimeType: string;
+        mimeType?: string;
         text: string;
     } | {
         uri: string;
-        mimeType: string;
+        mimeType?: string;
         blob: string;
     };
 };
+export type ContentItem = PromptContentItem | ResourceLink;
 export interface JSONSchema {
     type: "object";
-    properties: Record<string, JSONSchemaProperty>;
+    properties?: Record<string, JSONSchemaProperty>;
     required?: string[];
+    [keyword: string]: unknown;
 }
-export interface JSONSchemaProperty {
-    type: "string" | "number" | "boolean" | "object" | "array";
+export interface JSONSchemaProperty extends Record<string, unknown> {
+    type?: string | string[];
     description?: string;
+    [keyword: string]: unknown;
 }
 export interface ServerOptions {
     name: string;
     version: string;
+    validateToolArguments?: boolean;
+    supportNotifications?: boolean;
+    supportResourceSubscriptions?: boolean;
 }
 import type { ToolReturn } from "./content/index.js";
 export type ToolHandler<T = Record<string, unknown>> = (args: T) => Promise<ToolReturn | CallToolResult> | ToolReturn | CallToolResult;
 export interface ToolDefinition<T = Record<string, unknown>> {
     name: string;
-    description: string;
+    title?: string;
+    description?: string;
     inputSchema: JSONSchema;
+    outputSchema?: JSONSchema;
+    annotations?: ToolAnnotations;
+    execution?: ToolExecution;
+    icons?: Icon[];
+    _meta?: Record<string, unknown>;
     handler: ToolHandler<T>;
 }
 export interface Transport {

package/dist/types.js

@@ -1,14 +1,18 @@
 // JSON-RPC error codes
-export const JSON_RPC_ERROR_CODES = {
+export const JSON_RPC_ERROR_CODES = Object.freeze({
     PARSE_ERROR: -32700,
     INVALID_REQUEST: -32600,
     METHOD_NOT_FOUND: -32601,
     INVALID_PARAMS: -32602,
-    INTERNAL_ERROR: -32603
-};
+    INTERNAL_ERROR: -32603,
+    RESOURCE_NOT_FOUND: -32002
+});
 export class ToolError extends Error {
     code;
     constructor(code, message) {
+        if (!Number.isFinite(code)) {
+            throw new Error("ToolError code must be a finite number");
+        }
         super(message);
         this.code = code;
         this.name = "ToolError";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-stdio-mcp-server",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Minimal MCP server over stdio with typed tools and rich content helpers",
   "type": "module",
   "main": "dist/index.js",
@@ -20,7 +20,7 @@
     }
   },
   "scripts": {
-    "build": "tsc",
+    "build": "node ../../scripts/guard-package-dist.mjs && tsc",
     "prepublishOnly": "tsc"
   },
   "files": [
@@ -44,5 +44,10 @@
   ],
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.25.3"
+  },
+  "dependencies": {
+    "ajv": "^8.20.0",
+    "uri-template": "^2.0.0",
+    "uri-template-lite": "^23.4.0"
   }
 }