toolcraft 0.0.231 → 0.0.233

package/dist/union-validation.js

@@ -0,0 +1,36 @@
+import { isPlainRecord } from "toolcraft-schema";
+export function validateUnionSchema(schema, value, label, errors, validateBranch) {
+    if (!isPlainRecord(value)) {
+        errors.push({
+            path: label,
+            message: `Invalid value for "${label}". Expected an object${typeof value === "object" && value !== null && !Array.isArray(value) ? ", got non-plain object" : ""}.`
+        });
+        return value;
+    }
+    const matches = [];
+    const branchFailures = [];
+    for (const [index, branch] of schema.branches.entries()) {
+        const branchErrors = [];
+        const normalized = validateBranch(branch, branchErrors);
+        if (branchErrors.length === 0) {
+            matches.push(normalized);
+        }
+        else {
+            const firstError = branchErrors[0];
+            branchFailures.push({ ...firstError, message: `Branch ${index + 1}: ${firstError.message}` });
+        }
+    }
+    if (matches.length === 1) {
+        return matches[0];
+    }
+    if (matches.length === 0) {
+        errors.push({ path: label, message: `No union branch matched for "${label}".` }, ...branchFailures);
+    }
+    else {
+        errors.push({
+            path: label,
+            message: `Invalid value for "${label}". Expected exactly one union branch, but matched ${matches.length}.`
+        });
+    }
+    return value;
+}

package/node_modules/@poe-code/process-runner/dist/types.d.ts

@@ -61,6 +61,8 @@ export interface OpenSpec {
         tty?: boolean;
         input?: string | Buffer;
         captureOutput?: boolean;
+        /** Keep stdout callbacks and draining, without retaining its full text when false. */
+        captureStdout?: boolean;
         activityTimeoutMs?: number;
         onStdout?(chunk: string): void;
         onStderr?(chunk: string): void;

package/node_modules/mcp-oauth-server/dist/index.js

@@ -1,4 +1,5 @@
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { isIP } from "node:net";
 import { importJWK, jwtVerify, SignJWT } from "jose";
 class OAuthProtocolError extends Error {
     error;
@@ -69,11 +70,15 @@ function parseAbsoluteUrl(value, label) {
 }
 function validateIssuer(value) {
     const issuer = new URL(parseAbsoluteUrl(value, "issuer"));
+    const loopback = issuer.hostname === "localhost" || issuer.hostname === "[::1]" ||
+        (isIP(issuer.hostname) === 4 && issuer.hostname.startsWith("127."));
     if (issuer.protocol !== "https:" &&
-        issuer.hostname !== "localhost" &&
-        issuer.hostname !== "127.0.0.1") {
+        !(issuer.protocol === "http:" && loopback)) {
         throw new Error("issuer must use HTTPS unless it is loopback.");
     }
+    if (issuer.username.length > 0 || issuer.password.length > 0) {
+        throw new Error("issuer must not contain credentials.");
+    }
     if (issuer.pathname !== "/" || issuer.search.length > 0) {
         throw new Error("issuer must be an origin URL without a path or query.");
     }
@@ -272,6 +277,12 @@ export function createOAuthAuthorizationServer(options) {
         if (grant !== undefined)
             await options.onGrantRevoked?.(grant);
     }
+    for (const key of ["accessTokenTtlSeconds", "authorizationCodeTtlSeconds", "authorizationTransactionTtlSeconds", "refreshTokenTtlSeconds"]) {
+        const seconds = options[key];
+        if (seconds !== undefined && (!Number.isSafeInteger(seconds) || seconds <= 0 || !Number.isSafeInteger(seconds * 1000))) {
+            throw new Error(`${key} must be a positive safe integer with a safe millisecond duration.`);
+        }
+    }
     const accessTokenTtlMs = (options.accessTokenTtlSeconds ?? 300) * 1000;
     const authorizationCodeTtlMs = (options.authorizationCodeTtlSeconds ?? 60) * 1000;
     const authorizationTransactionTtlMs = (options.authorizationTransactionTtlSeconds ?? 600) * 1000;
@@ -306,14 +317,44 @@ export function createOAuthAuthorizationServer(options) {
         if (declaredLength !== null) {
             const parsedLength = Number(declaredLength);
             if (Number.isFinite(parsedLength) && parsedLength > maxRequestBodyBytes) {
+                await request.body?.cancel().catch(() => undefined);
                 throw new OAuthProtocolError("invalid_request", "Request body is too large.", 413);
             }
         }
-        const body = new Uint8Array(await request.arrayBuffer());
-        if (body.byteLength > maxRequestBodyBytes) {
-            throw new OAuthProtocolError("invalid_request", "Request body is too large.", 413);
+        if (request.body === null)
+            return "";
+        const reader = request.body.getReader();
+        const abort = () => { void reader.cancel().catch(() => undefined); };
+        request.signal.addEventListener("abort", abort, { once: true });
+        if (request.signal.aborted)
+            abort();
+        const decoder = new TextDecoder("utf-8", { fatal: true });
+        let bytes = 0;
+        let text = "";
+        try {
+            while (true) {
+                const chunk = await reader.read();
+                request.signal.throwIfAborted();
+                if (chunk.done)
+                    return text + decoder.decode();
+                bytes += chunk.value.byteLength;
+                if (bytes > maxRequestBodyBytes) {
+                    throw new OAuthProtocolError("invalid_request", "Request body is too large.", 413);
+                }
+                text += decoder.decode(chunk.value, { stream: true });
+            }
+        }
+        catch (error) {
+            await reader.cancel().catch(() => undefined);
+            if (error instanceof TypeError) {
+                throw new OAuthProtocolError("invalid_request", "Request body must use valid UTF-8.");
+            }
+            throw error;
+        }
+        finally {
+            request.signal.removeEventListener("abort", abort);
+            reader.releaseLock();
         }
-        return new TextDecoder().decode(body);
     }
     async function handleRegister(request) {
         requireJsonContentType(request);

package/node_modules/tiny-http-mcp-server/dist/cli.js

@@ -29,6 +29,8 @@ const HELP_TEXT = [
     "  --allowed-origin <url> Allowed CORS Origin value (repeatable)",
     "  --max-request-bytes <bytes>",
     "                        Maximum JSON request body size",
+    "  --max-response-bytes <bytes>",
+    "                        Maximum JSON body or SSE frame size (default: 16777216)",
     "  --max-batch-size <count>",
     "                        Maximum JSON-RPC batch member count",
     "  --max-sessions <count> Maximum active sessions (default: 128)",
@@ -38,13 +40,15 @@ const HELP_TEXT = [
     "  --max-streams-per-session <count>",
     "                        Maximum concurrent GET SSE streams per session",
     "  --max-stream-buffer-bytes <bytes>",
-    "                        Maximum buffered bytes per GET SSE stream (default: 1048576)",
+    "                        Maximum buffered bytes per SSE stream (default: 1048576)",
     "  --max-sse-event-history <count>",
     "                        Number of SSE events retained for Last-Event-ID replay",
     "  --sse-keep-alive-ms <ms>",
-    "                        GET SSE keepalive interval (default: 30000; 0 disables)",
+    "                        SSE keepalive interval (default: 30000; 0 disables)",
     "  --max-concurrent-tool-calls <count>",
     "                        Maximum concurrent tool calls across sessions (default: 4)",
+    "  --max-active-requests <count>",
+    "                        Maximum active requests across connections (default: 128)",
     "  --max-queued-tool-calls <count>",
     "                        Maximum waiting tool calls (default: 64; 0 disables waiting)",
     "  --trusted-proxy        Trust X-Forwarded-Proto and X-Forwarded-Host",
@@ -194,6 +198,7 @@ function parseCliOptions(args) {
             "allowed-host": { type: "string", multiple: true },
             "allowed-origin": { type: "string", multiple: true },
             "max-request-bytes": { type: "string" },
+            "max-response-bytes": { type: "string" },
             "max-batch-size": { type: "string" },
             "max-sessions": { type: "string" },
             "max-sessions-per-subject": { type: "string" },
@@ -203,6 +208,7 @@ function parseCliOptions(args) {
             "max-sse-event-history": { type: "string" },
             "sse-keep-alive-ms": { type: "string" },
             "max-concurrent-tool-calls": { type: "string" },
+            "max-active-requests": { type: "string" },
             "max-queued-tool-calls": { type: "string" },
             "trusted-proxy": { type: "boolean" },
             "request-timeout-ms": { type: "string" },
@@ -222,6 +228,7 @@ function parseCliOptions(args) {
     });
     const maxRequestBytes = parseOptionalInteger(values["max-request-bytes"], "--max-request-bytes", 1);
     const maxBatchSize = parseOptionalInteger(values["max-batch-size"], "--max-batch-size", 1);
+    const maxResponseBytes = parseOptionalInteger(values["max-response-bytes"], "--max-response-bytes", 1);
     const maxSessions = parseOptionalInteger(values["max-sessions"], "--max-sessions", 1);
     const maxSessionsPerSubject = parseOptionalInteger(values["max-sessions-per-subject"], "--max-sessions-per-subject", 1);
     const sessionTtlMs = parseOptionalInteger(values["session-ttl-ms"], "--session-ttl-ms", 1);
@@ -231,6 +238,7 @@ function parseCliOptions(args) {
     const sseKeepAliveMs = parseOptionalInteger(values["sse-keep-alive-ms"], "--sse-keep-alive-ms", 0);
     const maxConcurrentToolCalls = parseOptionalInteger(values["max-concurrent-tool-calls"], "--max-concurrent-tool-calls", 1);
     const maxQueuedToolCalls = parseOptionalInteger(values["max-queued-tool-calls"], "--max-queued-tool-calls", 0);
+    const maxActiveRequests = parseOptionalInteger(values["max-active-requests"], "--max-active-requests", 1);
     const requestTimeoutMs = parseOptionalInteger(values["request-timeout-ms"], "--request-timeout-ms", 0);
     const headersTimeoutMs = parseOptionalInteger(values["headers-timeout-ms"], "--headers-timeout-ms", 0);
     const keepAliveTimeoutMs = parseOptionalInteger(values["keep-alive-timeout-ms"], "--keep-alive-timeout-ms", 0);
@@ -252,6 +260,7 @@ function parseCliOptions(args) {
             }
             : {}),
         ...(maxRequestBytes === undefined ? {} : { maxRequestBytes }),
+        ...(maxResponseBytes === undefined ? {} : { maxResponseBytes }),
         ...(maxBatchSize === undefined ? {} : { maxBatchSize }),
         ...(maxSessions === undefined ? {} : { maxSessions }),
         ...(maxSessionsPerSubject === undefined ? {} : { maxSessionsPerSubject }),
@@ -261,6 +270,7 @@ function parseCliOptions(args) {
         ...(maxSseEventHistory === undefined ? {} : { maxSseEventHistory }),
         ...(sseKeepAliveMs === undefined ? {} : { sseKeepAliveMs }),
         ...(maxConcurrentToolCalls === undefined ? {} : { maxConcurrentToolCalls }),
+        ...(maxActiveRequests === undefined ? {} : { maxActiveRequests }),
         ...(maxQueuedToolCalls === undefined ? {} : { maxQueuedToolCalls }),
         trustedProxy: values["trusted-proxy"] ?? false,
         ...(requestTimeoutMs === undefined ? {} : { requestTimeoutMs }),
@@ -400,6 +410,7 @@ export async function runCli(args = process.argv.slice(2), dependencies = {}) {
             ...(options.maxRequestBytes === undefined
                 ? {}
                 : { maxRequestBytes: options.maxRequestBytes }),
+            ...(options.maxResponseBytes === undefined ? {} : { maxResponseBytes: options.maxResponseBytes }),
             ...(options.maxBatchSize === undefined ? {} : { maxBatchSize: options.maxBatchSize }),
             ...(options.maxSessions === undefined ? {} : { maxSessions: options.maxSessions }),
             ...(options.maxSessionsPerSubject === undefined ? {} : { maxSessionsPerSubject: options.maxSessionsPerSubject }),
@@ -418,6 +429,7 @@ export async function runCli(args = process.argv.slice(2), dependencies = {}) {
                 ? {}
                 : { maxConcurrentToolCalls: options.maxConcurrentToolCalls }),
             ...(options.maxQueuedToolCalls === undefined ? {} : { maxQueuedToolCalls: options.maxQueuedToolCalls }),
+            ...(options.maxActiveRequests === undefined ? {} : { maxActiveRequests: options.maxActiveRequests }),
             ...(options.trustedProxy ? { trustedProxy: true } : {}),
             ...(oauth === undefined ? {} : { oauth })
         });

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.17",
+      "version": "0.1.18",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/http-server.d.ts

@@ -1,5 +1,5 @@
 import { type IncomingMessage, type ServerResponse } from "node:http";
-import { type Server, type ServerOptions, type ToolDefinition, type CallToolResult, type ToolReturn, type TypedSchema } from "tiny-stdio-mcp-server";
+import { type Server, type ServerOptions, type ToolDefinition, type CallToolResult, type InputRequiredResult, type HandlerRequestContext, type ToolReturn, type TypedSchema, type TypedOutputSchema } from "tiny-stdio-mcp-server";
 import { type AuthenticatedIncomingMessage, type TokenVerifier, type VerifiedAccessToken, type RequestAuthInfo } from "./auth.js";
 import { type HttpObservabilityEvent, type StreamableHttpTransportOptions } from "./http-transport.js";
 export interface ProtectedResourceMetadataOptions {
@@ -33,18 +33,20 @@ export interface HttpServerHandle {
     closeAllConnections(): void;
 }
 export interface HttpServer extends Omit<Server, "tool" | "registerTool"> {
-    tool<TIn, TOut = never>(name: string, description: string, inputSchema: TypedSchema<TIn>, handler: HttpToolHandler<TIn, TOut>, outputSchema?: TypedSchema<TOut>): HttpServer;
+    tool<TIn, TOut = never>(name: string, description: string, inputSchema: TypedSchema<TIn>, handler: HttpToolHandler<TIn, TOut>, outputSchema?: TypedOutputSchema<TOut>): HttpServer;
     registerTool<TIn, TOut = never>(definition: Omit<ToolDefinition<TIn, TOut>, "handler">, handler: HttpToolHandler<TIn, TOut>): HttpServer;
     listenHttp(options?: HttpListenOptions): Promise<HttpServerHandle>;
     handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void>;
-    getRequestContext(): HttpToolContext | undefined;
+    getRequestContext(): HttpRequestContext | undefined;
 }
-export interface HttpToolContext {
+export interface HttpRequestContext {
     request: AuthenticatedIncomingMessage;
     sessionId?: string;
     auth?: RequestAuthInfo;
 }
-export type HttpToolHandler<T = Record<string, unknown>, TOut = ToolReturn> = (args: T, context: HttpToolContext) => Promise<TOut | CallToolResult> | TOut | CallToolResult;
+export interface HttpToolContext extends HttpRequestContext, HandlerRequestContext {
+}
+export type HttpToolHandler<T = Record<string, unknown>, TOut = ToolReturn> = (args: T, context: HttpToolContext) => Promise<TOut | CallToolResult | InputRequiredResult> | TOut | CallToolResult | InputRequiredResult;
 export declare function createProtectedResourceMetadataDocument(options: ProtectedResourceMetadataOptions): Record<string, unknown>;
 export declare function createHttpServer(options: HttpTransportOptions): HttpServer;
 export type { RequestAuthInfo, TokenVerifier, VerifiedAccessToken };

package/node_modules/tiny-http-mcp-server/dist/http-server.js

@@ -87,12 +87,7 @@ export function createProtectedResourceMetadataDocument(options) {
 }
 export function createHttpServer(options) {
     const requestContextStorage = new AsyncLocalStorage();
-    const supportsSessions = !hasOwnProperty(options, "sessionIdGenerator") || options.sessionIdGenerator !== undefined;
-    const server = createServer({
-        ...options,
-        supportNotifications: supportsSessions,
-        supportResourceSubscriptions: supportsSessions
-    });
+    const server = createServer(options);
     const transport = new StreamableHttpTransport(server, options, async (req, callback) => requestContextStorage.run({
         request: req,
         sessionId: Array.isArray(req.headers["mcp-session-id"])
@@ -144,11 +139,11 @@ export function createHttpServer(options) {
         return true;
     };
     httpServer.tool = (name, description, inputSchema, handler, outputSchema) => {
-        registerTool(name, description, inputSchema, (args) => handler(args, requestContextStorage.getStore() ?? defaultContext), outputSchema);
+        registerTool(name, description, inputSchema, (args, context) => handler(args, { ...(requestContextStorage.getStore() ?? defaultContext), ...context }), outputSchema);
         return httpServer;
     };
     httpServer.registerTool = (definition, handler) => {
-        registerRichTool(definition, (args) => handler(args, requestContextStorage.getStore() ?? defaultContext));
+        registerRichTool(definition, (args, context) => handler(args, { ...(requestContextStorage.getStore() ?? defaultContext), ...context }));
         return httpServer;
     };
     httpServer.listenHttp = async (listenOptions = {}) => {
@@ -265,6 +260,3 @@ export function createHttpServer(options) {
     httpServer.getRequestContext = () => requestContextStorage.getStore();
     return httpServer;
 }
-function hasOwnProperty(value, key) {
-    return Object.prototype.hasOwnProperty.call(value, key);
-}

package/node_modules/tiny-http-mcp-server/dist/http-transport.d.ts

@@ -64,6 +64,7 @@ export interface StreamableHttpTransportOptions {
     allowedOrigins?: readonly string[];
     allowedHosts?: readonly string[];
     maxRequestBytes?: number;
+    maxResponseBytes?: number;
     maxBatchSize?: number;
     maxSessions?: number;
     /** Maximum sessions per authenticated subject or client ID; defaults to 16. */
@@ -88,6 +89,7 @@ export declare class StreamableHttpTransport {
     private readonly allowedOrigins;
     private readonly allowedHosts;
     private readonly maxRequestBytes;
+    private readonly maxResponseBytes;
     private readonly maxBatchSize;
     private readonly maxSessions;
     private readonly maxSessionsPerSubject;
@@ -108,6 +110,8 @@ export declare class StreamableHttpTransport {
     private readonly responseRequestIds;
     private readonly responseOrigins;
     private readonly responseRejectionReasons;
+    private readonly modernRequests;
+    private readonly modernStreams;
     private nextNotificationEventId;
     private nextRequestId;
     private activeToolCalls;
@@ -118,6 +122,7 @@ export declare class StreamableHttpTransport {
     handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void>;
     close(): Promise<void>;
     private handlePost;
+    private handleModernPost;
     private handleGet;
     private handleDelete;
     private handleOptions;
@@ -143,7 +148,7 @@ export declare class StreamableHttpTransport {
     private stopSseKeepAliveIfIdle;
     private stopSseKeepAlive;
     private sendNotificationToSession;
-    private writeToLiveGetStream;
+    private writeToLiveStream;
     private recordSseEvent;
     private replaySseEvents;
     private isJsonRequest;