toolcraft 0.0.119 → 0.0.121

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/server/jwks-token-verifier.js

@@ -0,0 +1,388 @@
+import { decodeProtectedHeader, errors, importJWK, jwtVerify } from "jose";
+import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+const DEFAULT_ALLOWED_ALGORITHMS = [
+    "ES256",
+    "ES384",
+    "ES512",
+    "RS256",
+    "RS384",
+    "RS512",
+    "PS256",
+    "PS384",
+    "PS512",
+    "EdDSA"
+];
+function isTokenVerificationErrorShape(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    const challengeError = error;
+    return (challengeError.error === "invalid_token" ||
+        challengeError.error === "insufficient_scope" ||
+        challengeError.error === "temporarily_unavailable");
+}
+function isObjectRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key)
+        ? record[key]
+        : undefined;
+}
+function getOwnString(record, key) {
+    const value = getOwnEntry(record, key);
+    return typeof value === "string" ? value : undefined;
+}
+function toUrl(value, label) {
+    try {
+        return new URL(String(value));
+    }
+    catch {
+        throw new Error(`${label} must be an absolute URL`);
+    }
+}
+function normalizeAudience(value) {
+    if (typeof value === "string") {
+        return [value];
+    }
+    return isStringArray(value) ? [...value] : [];
+}
+function normalizeVerifiedAudience(value, expectedResource) {
+    const audiences = normalizeAudience(value);
+    for (const audience of audiences) {
+        try {
+            const normalizedAudience = canonicalizeResourceIndicator(audience);
+            if (normalizedAudience === expectedResource) {
+                return [normalizedAudience];
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    throw createInvalidTokenError("audience mismatch");
+}
+function parseScopes(payload) {
+    const scope = getOwnString(payload, "scope");
+    const scopes = getOwnEntry(payload, "scopes");
+    const raw = scope !== undefined ? scope : typeof scopes === "string" ? scopes : null;
+    if (raw !== null) {
+        return raw
+            .split(" ")
+            .map((scope) => scope.trim())
+            .filter((scope) => scope.length > 0);
+    }
+    return isStringArray(scopes) ? [...scopes] : [];
+}
+function toVerifiedAccessToken(token, payload, audience = normalizeAudience(getOwnEntry(payload, "aud"))) {
+    const issuer = getOwnString(payload, "iss");
+    const expiresAt = getOwnEntry(payload, "exp");
+    const subject = getOwnString(payload, "sub");
+    const clientId = getOwnString(payload, "client_id");
+    return {
+        token,
+        issuer: issuer ?? "",
+        audience,
+        scopes: parseScopes(payload),
+        expiresAt: expiresAt,
+        claims: { ...payload },
+        ...(subject !== undefined
+            ? {
+                subject
+            }
+            : {}),
+        ...(clientId !== undefined
+            ? {
+                clientId
+            }
+            : {})
+    };
+}
+function createTokenVerificationError(input) {
+    return Object.assign(new Error(input.errorDescription ?? input.error), input);
+}
+function createTemporarilyUnavailableError() {
+    return createTokenVerificationError({
+        error: "temporarily_unavailable",
+        errorDescription: "token verification temporarily unavailable"
+    });
+}
+function createInvalidTokenError(errorDescription) {
+    return createTokenVerificationError({
+        error: "invalid_token",
+        errorDescription
+    });
+}
+function normalizeVerificationError(error) {
+    if (isTokenVerificationErrorShape(error)) {
+        return error;
+    }
+    if (error instanceof errors.JWTExpired) {
+        return createInvalidTokenError("token expired");
+    }
+    if (error instanceof errors.JWTClaimValidationFailed) {
+        if (error.claim === "aud") {
+            return createInvalidTokenError("audience mismatch");
+        }
+        if (error.claim === "iss") {
+            return createInvalidTokenError("issuer mismatch");
+        }
+        if (error.claim === "nbf") {
+            return createInvalidTokenError("token not active yet");
+        }
+        if (error.claim === "exp") {
+            if (error.reason === "missing") {
+                return createInvalidTokenError("token missing expiry");
+            }
+            return createInvalidTokenError("token expired");
+        }
+        if (error.claim === "typ") {
+            return createInvalidTokenError("invalid access token type");
+        }
+    }
+    if (error instanceof errors.JOSEAlgNotAllowed || error instanceof errors.JOSENotSupported) {
+        return createInvalidTokenError("unsupported token algorithm");
+    }
+    if (error instanceof errors.JWKSNoMatchingKey ||
+        error instanceof errors.JWKSMultipleMatchingKeys ||
+        error instanceof errors.JWSSignatureVerificationFailed) {
+        return createInvalidTokenError("token signature invalid");
+    }
+    if (error instanceof errors.JWKSInvalid || error instanceof errors.JWKSTimeout) {
+        return createTemporarilyUnavailableError();
+    }
+    return createInvalidTokenError("token verification failed");
+}
+async function loadJwks(jwksUrl, fetchImplementation, timeoutMs) {
+    try {
+        const response = await fetchImplementation(jwksUrl, {
+            headers: {
+                Accept: "application/json"
+            },
+            signal: AbortSignal.timeout(timeoutMs)
+        });
+        if (!response.ok) {
+            throw createTemporarilyUnavailableError();
+        }
+        const payload = (await response.json());
+        const keys = isObjectRecord(payload) ? getOwnEntry(payload, "keys") : undefined;
+        if (!isObjectRecord(payload) || !Array.isArray(keys) || !keys.every(isObjectRecord)) {
+            throw createTemporarilyUnavailableError();
+        }
+        return { keys };
+    }
+    catch (error) {
+        if (isTokenVerificationErrorShape(error)) {
+            throw error;
+        }
+        throw createTemporarilyUnavailableError();
+    }
+}
+function resolveAlgorithm(token, allowedAlgorithms) {
+    const header = decodeProtectedHeader(token);
+    const alg = getOwnString(header, "alg");
+    if (hasCriticalHeaderClaims(header)) {
+        throw createInvalidTokenError("unsupported critical token claims");
+    }
+    if (typeof alg !== "string" ||
+        alg === "none" ||
+        alg.startsWith("HS") ||
+        !allowedAlgorithms.includes(alg)) {
+        throw createInvalidTokenError("unsupported token algorithm");
+    }
+    return alg;
+}
+function hasCriticalHeaderClaims(header) {
+    const criticalClaims = getOwnEntry(header, "crit");
+    return Array.isArray(criticalClaims) && criticalClaims.length > 0;
+}
+function isVerificationCandidate(key, alg, kid) {
+    const keyId = getOwnString(key, "kid");
+    const keyAlgorithm = getOwnString(key, "alg");
+    const keyUse = getOwnString(key, "use");
+    const keyOps = getOwnEntry(key, "key_ops");
+    if (kid !== undefined && keyId !== kid) {
+        return false;
+    }
+    if (keyAlgorithm !== undefined && keyAlgorithm !== alg) {
+        return false;
+    }
+    if (keyUse !== undefined && keyUse !== "sig") {
+        return false;
+    }
+    if (Array.isArray(keyOps) && !keyOps.includes("verify")) {
+        return false;
+    }
+    return true;
+}
+function shouldContinueWithNextKey(error) {
+    return error instanceof errors.JWSSignatureVerificationFailed;
+}
+async function verifyJwtAgainstJwks(input) {
+    const protectedHeader = decodeProtectedHeader(input.token);
+    const kid = getOwnString(protectedHeader, "kid");
+    const candidateKeys = input.jwks.keys.filter((key) => isVerificationCandidate(key, input.alg, kid));
+    if (candidateKeys.length === 0) {
+        throw new NoMatchingKeyError();
+    }
+    let lastSignatureError;
+    let hasMalformedKey = false;
+    for (const candidate of candidateKeys) {
+        let key;
+        try {
+            key = await importJWK(candidate, input.alg);
+        }
+        catch {
+            hasMalformedKey = true;
+            continue;
+        }
+        try {
+            return await jwtVerify(input.token, key, {
+                algorithms: [input.alg],
+                issuer: [...input.authorizationServers],
+                clockTolerance: input.clockSkewSeconds,
+                requiredClaims: ["exp"],
+                ...(input.requireAccessTokenType ? { typ: "at+jwt" } : {})
+            });
+        }
+        catch (error) {
+            if (shouldContinueWithNextKey(error)) {
+                lastSignatureError = error;
+                continue;
+            }
+            throw error;
+        }
+    }
+    if (hasMalformedKey) {
+        throw createTemporarilyUnavailableError();
+    }
+    throw lastSignatureError ?? createInvalidTokenError("token signature invalid");
+}
+class NoMatchingKeyError extends Error {
+}
+function isLoopbackHostname(hostname) {
+    if (hostname === "localhost" || hostname.endsWith(".localhost")) {
+        return true;
+    }
+    if (hostname === "[::1]" || hostname === "::1") {
+        return true;
+    }
+    const parts = hostname.split(".");
+    return (parts.length === 4 &&
+        parts[0] === "127" &&
+        parts.slice(1).every((part) => {
+            const value = Number(part);
+            return Number.isInteger(value) && value >= 0 && value <= 255;
+        }));
+}
+export function createJwksTokenVerifier(options) {
+    const jwksUrl = toUrl(options.jwksUrl, "jwksUrl");
+    const clockSkewSeconds = options.clockSkewSeconds ?? 30;
+    const allowedAlgorithms = options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS;
+    const jwksCacheTtlMs = options.jwksCacheTtlMs ?? 300_000;
+    const jwksFetchTimeoutMs = options.jwksFetchTimeoutMs ?? 5_000;
+    const jwksRefreshCooldownMs = options.jwksRefreshCooldownMs ?? 30_000;
+    const requireAccessTokenType = options.requireAccessTokenType ?? false;
+    const fetchImplementation = options.fetch ?? globalThis.fetch;
+    let cachedJwks;
+    let pendingJwks;
+    let pendingForcedRefresh;
+    let lastForcedRefreshAt = Number.NEGATIVE_INFINITY;
+    if (jwksUrl.protocol !== "https:" &&
+        !isLoopbackHostname(jwksUrl.hostname) &&
+        options.allowInsecureJwks !== true) {
+        throw new Error("jwksUrl must use HTTPS for non-loopback hosts");
+    }
+    if (typeof fetchImplementation !== "function") {
+        throw new Error("fetch is not available; pass options.fetch explicitly");
+    }
+    async function getJwks(forceRefresh = false) {
+        const now = Date.now();
+        if (!forceRefresh && cachedJwks !== undefined && cachedJwks.expiresAt > now) {
+            return cachedJwks.value;
+        }
+        if (pendingJwks !== undefined) {
+            return pendingJwks;
+        }
+        pendingJwks = loadJwks(jwksUrl, fetchImplementation, jwksFetchTimeoutMs)
+            .then((jwks) => {
+            cachedJwks = {
+                value: jwks,
+                expiresAt: Date.now() + jwksCacheTtlMs
+            };
+            return jwks;
+        })
+            .finally(() => {
+            pendingJwks = undefined;
+        });
+        return pendingJwks;
+    }
+    function refreshJwksAfterUnknownKey() {
+        if (pendingForcedRefresh !== undefined) {
+            return pendingForcedRefresh;
+        }
+        const now = Date.now();
+        if (now - lastForcedRefreshAt < jwksRefreshCooldownMs) {
+            throw new NoMatchingKeyError();
+        }
+        lastForcedRefreshAt = now;
+        pendingForcedRefresh = getJwks(true).finally(() => {
+            pendingForcedRefresh = undefined;
+        });
+        return pendingForcedRefresh;
+    }
+    return {
+        async verify(input) {
+            try {
+                const expectedResource = canonicalizeResourceIndicator(input.resource);
+                const algorithm = resolveAlgorithm(input.token, allowedAlgorithms);
+                let jwks = await getJwks();
+                let verified;
+                try {
+                    verified = await verifyJwtAgainstJwks({
+                        token: input.token,
+                        jwks,
+                        alg: algorithm,
+                        authorizationServers: input.authorizationServers,
+                        clockSkewSeconds,
+                        requireAccessTokenType
+                    });
+                }
+                catch (error) {
+                    if (!(error instanceof NoMatchingKeyError)) {
+                        throw error;
+                    }
+                    jwks = await refreshJwksAfterUnknownKey();
+                    verified = await verifyJwtAgainstJwks({
+                        token: input.token,
+                        jwks,
+                        alg: algorithm,
+                        authorizationServers: input.authorizationServers,
+                        clockSkewSeconds,
+                        requireAccessTokenType
+                    });
+                }
+                const audience = normalizeVerifiedAudience(getOwnEntry(verified.payload, "aud"), expectedResource);
+                const accessToken = toVerifiedAccessToken(input.token, verified.payload, audience);
+                if (input.requiredScopes.length > 0 &&
+                    !input.requiredScopes.every((scope) => accessToken.scopes.includes(scope))) {
+                    throw createTokenVerificationError({
+                        error: "insufficient_scope",
+                        errorDescription: "insufficient scope",
+                        scope: [...input.requiredScopes]
+                    });
+                }
+                return accessToken;
+            }
+            catch (error) {
+                if (error instanceof NoMatchingKeyError) {
+                    throw createInvalidTokenError("token signature invalid");
+                }
+                throw normalizeVerificationError(error);
+            }
+        }
+    };
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/types.compile-check.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/types.compile-check.js

@@ -0,0 +1,22 @@
+const ignoredImplicitGrantOptions = {
+    client: {
+        mode: "static",
+        clientId: "client-id",
+        // @ts-expect-error implicit response types are not configurable via the public API
+        responseType: "token",
+    },
+    browser: {
+        openBrowser: async () => { },
+    },
+};
+const ignoredPasswordGrantOptions = {
+    client: {
+        mode: "dynamic",
+        // @ts-expect-error password grants are not configurable via the public API
+        grantType: "password",
+    },
+    browser: {
+        openBrowser: async () => { },
+    },
+};
+export {};

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/package.json

@@ -0,0 +1,28 @@
+{
+  "license": "MIT",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc"
+  },
+  "devDependencies": {
+    "tiny-oauth-test-server": "*"
+  },
+  "files": [
+    "dist",
+    "LICENSE"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/poe-platform/poe-code.git",
+    "directory": "packages/mcp-oauth"
+  }
+}

package/node_modules/tiny-http-mcp-server/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "tiny-http-mcp-server",
+  "version": "0.1.0",
+  "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "tiny-http-mcp-server": "dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "import": "./dist/testing.js"
+    },
+    "./test-support": {
+      "types": "./dist/test-support.d.ts",
+      "import": "./dist/test-support.js"
+    }
+  },
+  "scripts": {
+    "build": "node ../../scripts/guard-package-dist.mjs && tsc",
+    "prepack": "node ../../scripts/set-bin-executable.mjs && node ../../scripts/manage-bundled-workspace-deps.mjs prepare . mcp-oauth auth-store tiny-mcp-client jose",
+    "postpack": "node ../../scripts/manage-bundled-workspace-deps.mjs cleanup . mcp-oauth auth-store tiny-mcp-client jose",
+    "prepublishOnly": "tsc"
+  },
+  "files": [
+    "LICENSE",
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/poe-platform/poe-code.git",
+    "directory": "packages/tiny-http-mcp-server"
+  },
+  "license": "MIT",
+  "bundleDependencies": [
+    "mcp-oauth"
+  ],
+  "optionalDependencies": {
+    "mcp-oauth": "*"
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@types/express": "^5.0.6",
+    "express": "^5.1.0"
+  }
+}

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.119",
+      "version": "0.0.121",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.119",
+  "version": "0.0.121",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.119",
+  "version": "0.0.121",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -70,6 +70,10 @@
       "types": "./dist/human-in-loop/index.d.ts",
       "import": "./dist/human-in-loop/index.js"
     },
+    "./http": {
+      "types": "./dist/http.d.ts",
+      "import": "./dist/http.js"
+    },
     "./frontmatter": {
       "types": "./dist/frontmatter.d.ts",
       "import": "./dist/frontmatter.js"
@@ -104,8 +108,8 @@
     "test": "cd ../.. && vitest run packages/toolcraft/src",
     "test:unit": "cd ../.. && vitest run packages/toolcraft/src",
     "lint": "cd ../.. && eslint packages/toolcraft/src --ext ts && tsc -p packages/toolcraft/tsconfig.json --noEmit",
-    "prepack": "node ../../scripts/manage-bundled-workspace-deps.mjs prepare . toolcraft-schema toolcraft-design @poe-code/frontmatter @poe-code/agent-mcp-config @poe-code/agent-human-in-loop @poe-code/task-list @poe-code/agent-defs @poe-code/config-mutations @poe-code/process-runner tiny-mcp-client tiny-stdio-mcp-server auth-store fast-string-width fast-wrap-ansi ignore jsonc-parser sisteransi smol-toml yaml",
-    "postpack": "node ../../scripts/manage-bundled-workspace-deps.mjs cleanup . toolcraft-schema toolcraft-design @poe-code/frontmatter @poe-code/agent-mcp-config @poe-code/agent-human-in-loop @poe-code/task-list @poe-code/agent-defs @poe-code/config-mutations @poe-code/process-runner tiny-mcp-client tiny-stdio-mcp-server auth-store fast-string-width fast-wrap-ansi ignore jsonc-parser sisteransi smol-toml yaml"
+    "prepack": "node ../../scripts/manage-bundled-workspace-deps.mjs prepare . toolcraft-schema toolcraft-design @poe-code/frontmatter @poe-code/agent-mcp-config @poe-code/agent-human-in-loop @poe-code/task-list @poe-code/agent-defs @poe-code/config-mutations @poe-code/process-runner tiny-http-mcp-server tiny-mcp-client tiny-stdio-mcp-server auth-store jose fast-string-width fast-wrap-ansi ignore jsonc-parser sisteransi smol-toml yaml",
+    "postpack": "node ../../scripts/manage-bundled-workspace-deps.mjs cleanup . toolcraft-schema toolcraft-design @poe-code/frontmatter @poe-code/agent-mcp-config @poe-code/agent-human-in-loop @poe-code/task-list @poe-code/agent-defs @poe-code/config-mutations @poe-code/process-runner tiny-http-mcp-server tiny-mcp-client tiny-stdio-mcp-server auth-store jose fast-string-width fast-wrap-ansi ignore jsonc-parser sisteransi smol-toml yaml"
   },
   "dependencies": {
     "commander": "^13.1.0",
@@ -142,9 +146,11 @@
     "@poe-code/agent-defs",
     "@poe-code/config-mutations",
     "@poe-code/process-runner",
+    "tiny-http-mcp-server",
     "tiny-mcp-client",
     "tiny-stdio-mcp-server",
     "auth-store",
+    "jose",
     "fast-string-width",
     "fast-wrap-ansi",
     "ignore",
@@ -154,7 +160,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.119",
+    "toolcraft-schema": "0.0.121",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",
@@ -163,6 +169,7 @@
     "@poe-code/agent-defs": "*",
     "@poe-code/config-mutations": "*",
     "@poe-code/process-runner": "*",
+    "tiny-http-mcp-server": "*",
     "tiny-mcp-client": "*",
     "tiny-stdio-mcp-server": "*",
     "auth-store": "*"