toolcraft 0.0.147 → 0.0.149

package/README.md

@@ -583,6 +583,7 @@ Toolcraft configuration is code-first. Use `defineCommand(config)` and `defineGr
 - `positional?: string[]` — parameter names mapped from CLI argv order.
 - `params: S.Object(...)` — input schema from `toolcraft-schema`.
 - `result?: S.Object(...)` — structured result schema for MCP `outputSchema`; must be a root object.
+- `mcpResult?: (result) => Record<string, unknown>` — optional MCP-only projection applied before `result` validation; CLI and SDK still return the raw handler result. Requires `result`.
 - `secrets?: Record<string, { env: string; description?: string; optional?: boolean }>`
 - `scope?: Array<"cli" | "mcp" | "sdk">` — defaults to `["cli", "sdk"]`.
 - `confirm?: boolean` — deprecated CLI-only TTY confirmation; use `humanInLoop` instead. Cannot be combined with `humanInLoop`.

package/composition.json

@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.147",
+      "version": "0.0.149",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.147",
+      "version": "0.0.149",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.147",
+      "version": "0.0.149",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.147",
+      "version": "0.0.149",
       "license": "MIT"
     },
     {

package/dist/http-hosted-oauth.compile-check.js

@@ -1,4 +1,9 @@
 import { hostedOAuth } from "./http-hosted-oauth.js";
+const ignoredRevocationObserver = async (grant) => {
+    const ignoredSubject = grant.subject;
+    void ignoredSubject;
+};
+void ignoredRevocationObserver;
 const ignoredHostedOAuth = hostedOAuth({
     publicUrl: "https://calendar.example/mcp",
     storage: ignoredStorage,
@@ -30,6 +35,7 @@ const ignoredHostedOAuth = hostedOAuth({
     }
 });
 void ignoredHostedOAuth;
+void ignoredHostedOAuth.assertProductionReady();
 const ignoredRedirectHostedOAuth = hostedOAuth({
     publicUrl: "https://calendar.example/mcp",
     storage: ignoredStorage,

package/dist/http-hosted-oauth.d.ts

@@ -1,5 +1,5 @@
 import { type JWK } from "jose";
-import { type AuthorizationServerStore, type AuthorizationTransactionRecord, type OAuthAuthorizationServerSigningKey } from "mcp-oauth-server";
+import { type AuthorizationServerStore, type AuthorizationGrantRecord, type AuthorizationTransactionRecord, type OAuthAuthorizationServerSigningKey } from "mcp-oauth-server";
 import type { HttpAdditionalRequestHandler, TinyHttpMcpServerOAuthOptions } from "tiny-http-mcp-server/server";
 export type HostedOAuthLoginFieldName = "email" | "password" | "apiKey" | (string & {});
 export interface HostedOAuthLoginField {
@@ -33,6 +33,7 @@ export interface HostedOAuthStorage<TCredential = unknown> {
     resolveSubject(providerName: string, accountId: string): Promise<string>;
     healthCheck?(): Promise<void>;
     cleanup?(now?: number): Promise<void>;
+    onGrantRevoked?(grant: AuthorizationGrantRecord): Promise<void> | void;
 }
 export interface HostedOAuthCredentialAccess<TCredential = unknown> {
     read(): Promise<TCredential>;
@@ -105,6 +106,7 @@ export interface HostedOAuthConfiguration<TCredential = unknown, TServices exten
     prepare(options?: {
         production?: boolean;
     }): Promise<PreparedHostedOAuth>;
+    assertProductionReady(): Promise<PreparedHostedOAuth>;
 }
 export declare function isHostedOAuthConfiguration(value: unknown): value is HostedOAuthConfiguration<unknown, object>;
 export declare function hostedOAuth<TCredential = unknown, TServices extends object = object>(options: HostedOAuthOptions<TCredential, TServices>): HostedOAuthConfiguration<TCredential, TServices>;

package/dist/http-hosted-oauth.js

@@ -85,6 +85,9 @@ export function hostedOAuth(options) {
                 issuer: new URL(publicUrl.origin),
                 scopes: this.advanced?.scopes ?? ["mcp", "offline_access"]
             };
+        },
+        async assertProductionReady() {
+            return this.prepare({ production: true });
         }
     };
 }
@@ -225,7 +228,8 @@ export async function prepareHostedOAuthRuntime(config) {
         accessTokenTtlSeconds: config.advanced?.accessTokenTtlSeconds,
         authorizationCodeTtlSeconds: config.advanced?.authorizationCodeTtlSeconds,
         authorizationTransactionTtlSeconds: config.advanced?.authorizationTransactionTtlSeconds,
-        refreshTokenTtlSeconds: config.advanced?.refreshTokenTtlSeconds
+        refreshTokenTtlSeconds: config.advanced?.refreshTokenTtlSeconds,
+        onGrantRevoked: config.storage.onGrantRevoked
     });
     const requestHandler = async (request, response) => {
         const url = new URL(request.url ?? "/", prepared.issuer);

package/dist/index.d.ts

@@ -123,6 +123,7 @@ export interface CommandConfig<TServices extends object, TParamsSchema extends O
     positional?: string[];
     params: TParamsSchema;
     result?: ObjectSchema<any>;
+    mcpResult?: (result: TResult) => Record<string, unknown>;
     secrets?: TSecrets;
     scope?: Scope[];
     confirm?: boolean;
@@ -140,7 +141,7 @@ export type StreamHandlerContext<TParamsSchema extends ObjectSchema<any>, TSecre
     status(event: StreamStatusEvent): void;
     refreshSecrets(): Promise<InferSecrets<TSecrets>>;
 };
-export interface StreamCommandConfig<TServices extends object, TParamsSchema extends ObjectSchema<any>, TSecrets extends SecretDeclarations | undefined, TEventSchema extends AnySchema> extends Omit<CommandConfig<TServices, TParamsSchema, TSecrets, AsyncIterable<Static<TEventSchema>>>, "handler" | "render" | "result" | "humanInLoop" | "confirm"> {
+export interface StreamCommandConfig<TServices extends object, TParamsSchema extends ObjectSchema<any>, TSecrets extends SecretDeclarations | undefined, TEventSchema extends AnySchema> extends Omit<CommandConfig<TServices, TParamsSchema, TSecrets, AsyncIterable<Static<TEventSchema>>>, "handler" | "render" | "result" | "mcpResult" | "humanInLoop" | "confirm"> {
     event: TEventSchema;
     handler: (ctx: StreamHandlerContext<TParamsSchema, TSecrets, TServices>) => AsyncIterable<Static<TEventSchema>> | Promise<AsyncIterable<Static<TEventSchema>>>;
     render?: Renderers<Static<TEventSchema>>;
@@ -157,6 +158,7 @@ export interface Command<TServices extends object = EmptyServices, TParamsSchema
     positional: string[];
     params: TParamsSchema;
     result?: ObjectSchema<any>;
+    mcpResult?: (result: TResult) => Record<string, unknown>;
     stream?: StreamDefinition<any>;
     secrets: SecretDeclarations;
     scope: Scope[];

package/dist/index.js

@@ -291,6 +291,9 @@ function resolveGroupScope(ownScope, inheritedScope) {
     return cloneScope(ownScope ?? inheritedScope);
 }
 function createBaseCommand(config) {
+    if (config.mcpResult !== undefined && config.result === undefined) {
+        throw new ToolcraftBugError(`Command "${config.name}" defines mcpResult without a result schema.`);
+    }
     const command = {
         kind: "command",
         name: config.name,
@@ -303,6 +306,7 @@ function createBaseCommand(config) {
         positional: [...(config.positional ?? [])],
         params: config.params,
         result: config.result,
+        mcpResult: config.mcpResult,
         stream: undefined,
         secrets: cloneSecrets(config.secrets),
         scope: resolveCommandScope(config.scope, undefined),
@@ -320,6 +324,7 @@ function createBaseCommand(config) {
             hidden: config.hidden ?? false,
             examples: cloneCommandExamples(config.examples),
             result: config.result,
+            mcpResult: config.mcpResult,
             humanInLoop: config.humanInLoop,
             secrets: cloneSecrets(config.secrets),
             requires: cloneRequires(config.requires),
@@ -376,6 +381,7 @@ function materializeCommand(command, inherited) {
         positional: [...command.positional],
         params: command.params,
         result: internal.result,
+        mcpResult: internal.mcpResult,
         stream: command.stream,
         secrets: mergeSecrets(inherited.secrets, internal.secrets),
         scope: resolveCommandScope(internal.scope, inherited.scope),
@@ -393,6 +399,7 @@ function materializeCommand(command, inherited) {
             hidden: internal.hidden,
             examples: cloneCommandExamples(internal.examples),
             result: internal.result,
+            mcpResult: internal.mcpResult,
             humanInLoop: internal.humanInLoop,
             secrets: cloneSecrets(internal.secrets),
             requires: cloneRequires(internal.requires),

package/dist/mcp.js

@@ -892,7 +892,8 @@ function createResolvedMCPServer(root, options, runtime = {}) {
                     return renderPendingApproval(result);
                 }
                 if (tool.resultSchema !== undefined) {
-                    const structuredContent = validateCommandResult(tool.resultSchema, result, casing);
+                    const mcpResult = tool.command.mcpResult === undefined ? result : tool.command.mcpResult(result);
+                    const structuredContent = validateCommandResult(tool.resultSchema, mcpResult, casing);
                     return {
                         content: [{ type: "text", text: JSON.stringify(structuredContent) }],
                         structuredContent

package/dist/testing/hosted-oauth-storage.d.ts

@@ -0,0 +1,6 @@
+import type { HostedOAuthStorage } from "../http-hosted-oauth.js";
+export interface HostedOAuthStorageConformanceOptions<TCredential> {
+    createStorage(): HostedOAuthStorage<TCredential> | Promise<HostedOAuthStorage<TCredential>>;
+    credentials: readonly [TCredential, TCredential];
+}
+export declare function verifyHostedOAuthStorage<TCredential>(options: HostedOAuthStorageConformanceOptions<TCredential>): Promise<void>;

package/dist/testing/hosted-oauth-storage.js

@@ -0,0 +1,140 @@
+import { isDeepStrictEqual } from "node:util";
+function assert(condition, message) {
+    if (!condition)
+        throw new Error(`Hosted OAuth storage conformance failed: ${message}`);
+}
+export async function verifyHostedOAuthStorage(options) {
+    const storage = await options.createStorage();
+    const [firstCredential, secondCredential] = options.credentials;
+    const firstSubject = await storage.resolveSubject("provider", "account-a");
+    const repeatedSubject = await storage.resolveSubject("provider", "account-a");
+    const secondSubject = await storage.resolveSubject("provider", "account-b");
+    const otherProviderSubject = await storage.resolveSubject("other-provider", "account-a");
+    assert(firstSubject === repeatedSubject, "subject resolution must be stable");
+    assert(firstSubject !== secondSubject, "different provider accounts must resolve independently");
+    assert(firstSubject !== otherProviderSubject, "provider namespaces must resolve independently");
+    await storage.credentials.set(firstSubject, firstCredential);
+    assert(isDeepStrictEqual(await storage.credentials.get(firstSubject), firstCredential), "credentials must round-trip");
+    await storage.credentials.update(firstSubject, () => secondCredential);
+    assert(isDeepStrictEqual(await storage.credentials.get(firstSubject), secondCredential), "credential updates must persist");
+    let releaseFirstUpdate;
+    let markFirstUpdateStarted;
+    const firstUpdateStarted = new Promise((resolve) => {
+        markFirstUpdateStarted = resolve;
+    });
+    const releaseFirst = new Promise((resolve) => {
+        releaseFirstUpdate = resolve;
+    });
+    const firstUpdate = storage.credentials.update(firstSubject, async (current) => {
+        assert(isDeepStrictEqual(current, secondCredential), "credential updates must read current data");
+        markFirstUpdateStarted?.();
+        await releaseFirst;
+        return firstCredential;
+    });
+    await firstUpdateStarted;
+    let secondUpdateStarted = false;
+    const secondUpdate = storage.credentials.update(firstSubject, (current) => {
+        secondUpdateStarted = true;
+        assert(isDeepStrictEqual(current, firstCredential), "credential updates must execute atomically");
+        return secondCredential;
+    });
+    const updates = Promise.all([firstUpdate, secondUpdate]);
+    await Promise.resolve();
+    assert(!secondUpdateStarted, "credential updates must be serialized");
+    releaseFirstUpdate?.();
+    await updates;
+    assert(isDeepStrictEqual(await storage.credentials.get(firstSubject), secondCredential), "serialized credential updates must persist");
+    await storage.credentials.delete(firstSubject);
+    assert((await storage.credentials.get(firstSubject)) === undefined, "credential deletion must persist");
+    const transaction = {
+        id: "interaction-1",
+        clientId: "client-1",
+        redirectUri: "https://client.example/callback",
+        codeChallenge: "challenge",
+        resource: "https://resource.example/mcp",
+        scopes: ["mcp"],
+        createdAt: 1,
+        expiresAt: 2
+    };
+    await storage.interactions.set(transaction);
+    assert(isDeepStrictEqual(await storage.interactions.get(transaction.id), transaction), "interactions must round-trip");
+    await storage.interactions.delete(transaction.id);
+    assert((await storage.interactions.get(transaction.id)) === undefined, "interaction deletion must persist");
+    const firstKey = await storage.signingKey();
+    const secondKey = await storage.signingKey();
+    assert(firstKey.keyId === secondKey.keyId && isDeepStrictEqual(firstKey.publicJwk, secondKey.publicJwk), "signing keys must remain stable");
+    const restartedStorage = await options.createStorage();
+    if (storage.capabilities.stableKeys) {
+        const restartedKey = await restartedStorage.signingKey();
+        assert(firstKey.keyId === restartedKey.keyId &&
+            isDeepStrictEqual(firstKey.publicJwk, restartedKey.publicJwk), "stable signing keys must survive adapter restart");
+    }
+    if (storage.capabilities.durable) {
+        assert((await restartedStorage.resolveSubject("provider", "account-a")) === firstSubject, "durable subject resolution must survive adapter restart");
+    }
+    const store = storage.authorizationServer;
+    const client = { id: "client-1", redirectUris: ["https://client.example/callback"], createdAt: 1 };
+    await store.putClient(client);
+    assert(isDeepStrictEqual(await store.getClient(client.id), client), "clients must round-trip");
+    await store.putAuthorizationTransaction(transaction);
+    assert(isDeepStrictEqual(await store.takeAuthorizationTransaction(transaction.id), transaction) &&
+        (await store.takeAuthorizationTransaction(transaction.id)) === undefined, "authorization transactions must be consumed atomically");
+    const grant = {
+        id: "grant-1",
+        clientId: client.id,
+        subject: firstSubject,
+        resource: transaction.resource,
+        scopes: ["mcp", "offline_access"],
+        createdAt: 1
+    };
+    const code = {
+        tokenHash: "code-1",
+        grantId: grant.id,
+        clientId: client.id,
+        subject: firstSubject,
+        redirectUri: transaction.redirectUri,
+        codeChallenge: transaction.codeChallenge,
+        resource: transaction.resource,
+        scopes: grant.scopes,
+        expiresAt: 10
+    };
+    await store.putAuthorizationCode(code);
+    assert(isDeepStrictEqual(await store.takeAuthorizationCode(code.tokenHash), code) &&
+        (await store.takeAuthorizationCode(code.tokenHash)) === undefined, "authorization codes must be consumed atomically");
+    await store.putGrant(grant);
+    assert(isDeepStrictEqual(await store.getGrant(grant.id), grant), "grants must round-trip");
+    const accessToken = {
+        tokenHash: "access-1",
+        tokenId: "token-1",
+        grantId: grant.id,
+        subject: firstSubject,
+        clientId: client.id,
+        resource: transaction.resource,
+        expiresAt: 10
+    };
+    await store.putAccessToken(accessToken);
+    assert(isDeepStrictEqual(await store.getAccessToken(accessToken.tokenHash), accessToken), "access tokens must round-trip");
+    await store.revokeToken(accessToken.tokenHash, 5);
+    assert((await store.getAccessToken(accessToken.tokenHash))?.revokedAt === 5, "access-token revocation must persist");
+    const refreshToken = {
+        tokenHash: "refresh-1",
+        familyId: "family-1",
+        grantId: grant.id,
+        clientId: client.id,
+        subject: firstSubject,
+        resource: transaction.resource,
+        scopes: grant.scopes,
+        createdAt: 1,
+        expiresAt: 10,
+        status: "active"
+    };
+    await store.putRefreshToken(refreshToken);
+    const rotation = await store.rotateRefreshToken(refreshToken.tokenHash, "refresh-2", 2, 20);
+    assert(rotation.status === "rotated" && isDeepStrictEqual(rotation.previous, refreshToken), "refresh tokens must rotate atomically");
+    assert((await store.rotateRefreshToken(refreshToken.tokenHash, "refresh-3", 3, 20)).status ===
+        "replay", "refresh-token replay must be detected");
+    await store.revokeGrant(grant.id, 6);
+    assert((await store.getGrant(grant.id))?.revokedAt === 6, "grant revocation must persist");
+    await storage.healthCheck?.();
+    await storage.cleanup?.(Date.now());
+}

package/dist/testing/index.d.ts

@@ -2,3 +2,4 @@ export { createCommandTestHarness, type CommandTestHarness, type ConfirmationReq
 export { fakeFetch, fakeService, type FetchRoute, type ServiceCall } from "./fakes.js";
 export { createMemoryFs, type FsChange, type MemoryFs } from "./memory-fs.js";
 export type { ParityResult, SurfaceOutcome } from "./parity.js";
+export { verifyHostedOAuthStorage, type HostedOAuthStorageConformanceOptions } from "./hosted-oauth-storage.js";

package/dist/testing/index.js

@@ -1,3 +1,4 @@
 export { createCommandTestHarness } from "./harness.js";
 export { fakeFetch, fakeService } from "./fakes.js";
 export { createMemoryFs } from "./memory-fs.js";
+export { verifyHostedOAuthStorage } from "./hosted-oauth-storage.js";

package/node_modules/mcp-oauth-server/dist/index.d.ts

@@ -63,6 +63,7 @@ export type RefreshTokenRotationResult = {
     previous: RefreshTokenRecord;
 } | {
     status: "replay";
+    grant?: AuthorizationGrantRecord;
 } | {
     status: "invalid";
 };
@@ -79,7 +80,7 @@ export interface AuthorizationServerStore {
     getAccessToken(tokenHash: string): Promise<AccessTokenRecord | undefined>;
     putRefreshToken(token: RefreshTokenRecord): Promise<void>;
     rotateRefreshToken(tokenHash: string, replacementTokenHash: string, now: number, expiresAt: number): Promise<RefreshTokenRotationResult>;
-    revokeToken(tokenHash: string, now: number): Promise<void>;
+    revokeToken(tokenHash: string, now: number): Promise<void | AuthorizationGrantRecord>;
     revokeGrant(grantId: string, now: number): Promise<void>;
 }
 export interface AuthorizationInteractionStartContext {
@@ -111,6 +112,7 @@ export interface OAuthAuthorizationServerOptions {
     maxRequestBodyBytes?: number;
     now?: () => number;
     randomToken?: () => string;
+    onGrantRevoked?(grant: AuthorizationGrantRecord): Promise<void> | void;
 }
 export interface CompleteAuthorizationInput {
     transactionId: string;

package/node_modules/mcp-oauth-server/dist/index.js

@@ -206,7 +206,11 @@ export function createInMemoryAuthorizationServerStore() {
             }
             if (token.status === "rotated") {
                 revokeFamily(token.familyId, now);
-                return { status: "replay" };
+                const grant = grants.get(token.grantId);
+                return {
+                    status: "replay",
+                    ...(grant === undefined ? {} : { grant: structuredClone(grant) })
+                };
             }
             refreshTokens.set(tokenHash, { ...token, status: "rotated" });
             refreshTokens.set(replacementTokenHash, {
@@ -220,13 +224,19 @@ export function createInMemoryAuthorizationServerStore() {
         },
         async revokeToken(tokenHash, now) {
             const refreshToken = refreshTokens.get(tokenHash);
+            const accessToken = accessTokens.get(tokenHash);
+            const grantId = refreshToken?.grantId ?? accessToken?.grantId;
+            const grant = grantId === undefined ? undefined : grants.get(grantId);
+            const alreadyRevoked = grant?.revokedAt !== undefined ||
+                refreshToken?.status === "revoked" ||
+                accessToken?.revokedAt !== undefined;
             if (refreshToken !== undefined) {
                 revokeFamily(refreshToken.familyId, now);
             }
-            const accessToken = accessTokens.get(tokenHash);
             if (accessToken !== undefined) {
                 accessTokens.set(tokenHash, { ...accessToken, revokedAt: now });
             }
+            return grant === undefined || alreadyRevoked ? undefined : structuredClone(grant);
         },
         async revokeGrant(grantId, now) {
             const grant = grants.get(grantId);
@@ -258,6 +268,10 @@ export function createOAuthAuthorizationServer(options) {
     }
     const now = options.now ?? Date.now;
     const randomToken = options.randomToken ?? opaqueToken;
+    async function notifyGrantRevoked(grant) {
+        if (grant !== undefined)
+            await options.onGrantRevoked?.(grant);
+    }
     const accessTokenTtlMs = (options.accessTokenTtlSeconds ?? 300) * 1000;
     const authorizationCodeTtlMs = (options.authorizationCodeTtlSeconds ?? 60) * 1000;
     const authorizationTransactionTtlMs = (options.authorizationTransactionTtlSeconds ?? 600) * 1000;
@@ -534,11 +548,15 @@ export function createOAuthAuthorizationServer(options) {
         const tokenHash = hashToken(refreshToken);
         const existing = await options.store.rotateRefreshToken(tokenHash, replacementTokenHash, currentTime, currentTime + refreshTokenTtlMs);
         if (existing.status !== "rotated") {
+            if (existing.status === "replay")
+                await notifyGrantRevoked(existing.grant);
             throw new OAuthProtocolError("invalid_grant", "Refresh token is invalid or replayed.");
         }
         if (existing.previous.clientId !== body.get("client_id") ||
             existing.previous.resource !== requestedResource) {
+            const revokedGrant = await options.store.getGrant(existing.previous.grantId);
             await options.store.revokeGrant(existing.previous.grantId, currentTime);
+            await notifyGrantRevoked(revokedGrant);
             throw new OAuthProtocolError("invalid_grant", "Refresh token binding is invalid.");
         }
         const grant = await options.store.getGrant(existing.previous.grantId);
@@ -563,8 +581,9 @@ export function createOAuthAuthorizationServer(options) {
         requireFormContentType(request);
         const body = new URLSearchParams(await readRequestBody(request));
         const token = body.get("token");
-        if (token !== null)
-            await options.store.revokeToken(hashToken(token), now());
+        if (token !== null) {
+            await notifyGrantRevoked(await options.store.revokeToken(hashToken(token), now()));
+        }
         return new Response(null, { status: 200, headers: { "cache-control": "no-store" } });
     }
     async function handle(request) {
@@ -655,7 +674,9 @@ export function createOAuthAuthorizationServer(options) {
         denyAuthorization,
         verifyAccessToken,
         async revokeGrant(grantId) {
+            const grant = await options.store.getGrant(grantId);
             await options.store.revokeGrant(grantId, now());
+            await notifyGrantRevoked(grant?.revokedAt === undefined ? grant : undefined);
         }
     };
 }

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.147",
+      "version": "0.0.149",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.147",
+  "version": "0.0.149",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.147",
+  "version": "0.0.149",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.147",
+    "toolcraft-schema": "0.0.149",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",