toolcraft 0.0.308 → 0.0.310

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.23",
+      "version": "0.1.25",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.308",
+      "version": "0.0.310",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.308",
+      "version": "0.0.310",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.23",
+      "version": "0.1.25",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.308",
+      "version": "0.0.310",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.308",
+      "version": "0.0.310",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.23",
+      "version": "0.1.25",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -41,6 +41,7 @@ const verifier = createJwksTokenVerifier({
   - `mode: "dynamic"` with optional `metadata`
   - `mode: "static"` with `clientId`, optional `clientSecret`, optional `metadata`
 - `allowInteractive: false` prevents interactive login while retaining cached tokens and silent refresh
+- `initialGrant: { resource, tokens }` optionally imports an existing Bearer grant for one HTTP resource; requires the original client ID
 - `browser.openBrowser(url)` optional
 - `browser.readLine()` optional
 - `browser.createServer()` optional
@@ -69,7 +70,10 @@ const verifier = createJwksTokenVerifier({
 Fixed redirects support `localhost`, `127.0.0.1`, and `::1` over HTTP. Their
 exact spelling, port, path and query are preserved through registration,
 authorization and code exchange. Credentials, fragments, port zero and reserved
-OAuth callback query parameters are rejected before binding a listener. Omit
+OAuth callback query parameters are rejected before binding a listener.
+`createDefaultOAuthClientProvider` also checks the configured redirect before
+creating the provider. Imported tokens that cannot be sent as HTTP header
+values fail with diagnostics that omit their contents. Omit
 `redirectUri` to allocate a random loopback port. Standalone callback sessions
 accept the same `redirectUri`, `signal` and `timeoutMs` options. Cancellation,
 timeout and explicit close settle pending code waits and release listeners.
@@ -80,9 +84,26 @@ registration, token requests and bounded token-body reads. Cancellation retains
 its original reason and does not retry authorization. Custom providers should
 observe the supplied signal and pass it to any work they start.
 
+`authorizeRequest` may return an owned token snapshot for the request it
+authorized. The HTTP client supplies that snapshot as `presentedTokens`, along
+with the actual request's `requestHeaders`, to `handleUnauthorized`. Providers
+that return `void` remain supported. The native provider compares the rejected
+snapshot with persisted credentials: delayed 401s retry with a newer grant
+without redeeming its refresh token again. A proven current token is refreshed
+on 401 even when the server omits `error="invalid_token"`. Invalid provenance
+fails without quoting token values.
+
 Configure `client.metadata.scope` to request a precise scope set; broader
 discovery metadata does not override it.
 
+Imported `initialGrant.tokens` use `accessToken`, optional `refreshToken`,
+`tokenType: "Bearer"`, `expiresAt` (Unix epoch milliseconds or `null` if unknown),
+and optional `scope`. A fresh imported token is used only for its resource.
+Discovery binds an expired or explicitly rejected grant before silent refresh,
+using the original configured client. Persisted sessions take precedence,
+including sessions whose tokens have been cleared; an import cannot revive them.
+Input tokens are copied and invalid expiry values fail before authorization.
+
 `createAuthStoreSessionStore(options)` accepts the standard `auth-store` config.
 
 ## Environment Variables

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -2,7 +2,7 @@ import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
 import { createAuthStoreClientStore, createAuthStoreSessionStore } from "./auth-store-session-store.js";
-import { createLoopbackAuthorizationSession } from "./loopback-authorization.js";
+import { createLoopbackAuthorizationSession, loopbackTarget } from "./loopback-authorization.js";
 import { createAuthorizationState } from "./authorization-state.js";
 import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
 import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError, readOAuthJsonObjectResponse } from "./token-endpoint.js";
@@ -15,18 +15,51 @@ export function createOAuthClientProvider(options) {
     return createDefaultOAuthClientProvider(options);
 }
 export function createDefaultOAuthClientProvider(options) {
+    loopbackTarget(options.browser);
     const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore);
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore);
     const now = options.now ?? Date.now;
     const registeredClients = new Map();
     const refreshPromises = new Map();
     const authorizationPromises = new Map();
+    if (options.initialGrant !== undefined) {
+        let resource;
+        try {
+            resource = new URL(options.initialGrant.resource);
+        }
+        catch {
+            throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
+        }
+        if ((resource.protocol !== "http:" && resource.protocol !== "https:") || resource.username || resource.password || resource.hash)
+            throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
+    }
+    const initialGrant = options.initialGrant === undefined ? undefined : {
+        resource: canonicalizeResourceIndicator(options.initialGrant.resource),
+        tokens: normalizeStoredTokens(options.initialGrant.tokens),
+        client: normalizeConfiguredClient(options.client)
+    };
+    if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
+        throw new Error("OAuth initial grant requires valid tokens and the original client ID");
+    if (initialGrant?.tokens !== undefined) {
+        try {
+            new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
+        }
+        catch {
+            throw new Error("OAuth initial grant access token is not a valid HTTP header value");
+        }
+    }
+    let initialGrantConsumed = false;
     return {
         async authorizeRequest(input) {
             assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
             const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
             const session = await ensureAuthorizedSession(requestUrl, undefined, input.fetch, false, false, input.signal);
             const accessToken = session?.tokens?.accessToken;
+            if (session === null && !initialGrantConsumed && initialGrant?.resource === requestUrl &&
+                initialGrant.tokens !== undefined && !isExpired(initialGrant.tokens, now)) {
+                input.headers.set("Authorization", `Bearer ${initialGrant.tokens.accessToken}`);
+                return { ...initialGrant.tokens };
+            }
             if (session === null ||
                 accessToken === undefined ||
                 session.tokens === undefined ||
@@ -35,6 +68,7 @@ export function createDefaultOAuthClientProvider(options) {
             }
             assertRequestMatchesResource(requestUrl, session.resource);
             input.headers.set("Authorization", `Bearer ${accessToken}`);
+            return { ...session.tokens };
         },
         async handleUnauthorized(input) {
             try {
@@ -42,12 +76,28 @@ export function createDefaultOAuthClientProvider(options) {
                 const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
                 const resource = canonicalizeResourceIndicator(input.discovery.resource);
                 assertRequestMatchesResource(requestUrl, resource);
-                const forceRefresh = hasCachedAccessToken(await loadSession(resource)) &&
-                    input.challenge?.params.error === "invalid_token";
+                const cached = await loadSession(resource);
+                const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : undefined);
+                let rejectedCurrentGrant = hasCachedAccessToken(cached) || (!initialGrantConsumed && initialGrant?.resource === resource);
+                let presentedTokens = input.presentedTokens;
+                if (input.presentedTokens !== undefined) {
+                    rejectedCurrentGrant = false;
+                    if (input.presentedTokens !== null) {
+                        const presented = normalizeStoredTokens(input.presentedTokens);
+                        const header = input.requestHeaders?.get("Authorization") ?? "";
+                        const separator = header.indexOf(" ");
+                        if (presented === undefined || header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented.accessToken)
+                            throw new Error("OAuth rejected-request provenance does not match its authorization header");
+                        presentedTokens = presented;
+                        rejectedCurrentGrant = currentTokens !== undefined && sameTokenGrant(currentTokens, presented);
+                    }
+                }
+                const challengeError = input.challenge?.params.error;
+                const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || (input.presentedTokens !== undefined && challengeError === undefined));
                 const session = await ensureAuthorizedSession(resource, {
                     ...input.discovery,
                     resource
-                }, input.fetch, true, forceRefresh, input.signal);
+                }, input.fetch, true, forceRefresh, input.signal, presentedTokens);
                 if (session?.tokens?.accessToken === undefined) {
                     return { action: "fail" };
                 }
@@ -62,10 +112,12 @@ export function createDefaultOAuthClientProvider(options) {
             }
         }
     };
-    async function ensureAuthorizedSession(resource, discovery, fetch, allowInteractive, forceRefresh = false, signal) {
+    async function ensureAuthorizedSession(resource, discovery, fetch, allowInteractive, forceRefresh = false, signal, rejectedTokens) {
         signal?.throwIfAborted();
         const canonicalResource = canonicalizeResourceIndicator(resource);
         let session = await loadSession(canonicalResource);
+        if (session !== null && initialGrant?.resource === canonicalResource)
+            initialGrantConsumed = true;
         signal?.throwIfAborted();
         if (discovery !== undefined && getOwnString(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
             throw new Error("OAuth discovery authorization-server issuer mismatch");
@@ -76,6 +128,17 @@ export function createDefaultOAuthClientProvider(options) {
             await clearSession(canonicalResource);
             session = null;
         }
+        if (session === null && discovery !== undefined && !initialGrantConsumed && initialGrant?.resource === canonicalResource &&
+            initialGrant.tokens !== undefined && initialGrant.client !== null) {
+            assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+            session = { resource: canonicalResource, authorizationServer: discovery.authorizationServer,
+                client: initialGrant.client, tokens: initialGrant.tokens, discovery: toStoredDiscovery(discovery) };
+            await saveSession(canonicalResource, session);
+            initialGrantConsumed = true;
+            signal?.throwIfAborted();
+        }
+        if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
+            forceRefresh = false;
         const sessionDiscovery = resolveDiscovery(discovery, session);
         if (session?.tokens !== undefined && !forceRefresh && !isExpired(session.tokens, now)) {
             return session;
@@ -410,6 +473,10 @@ function resolveDiscovery(discovery, session) {
         authorizationServerMetadata: metadata
     };
 }
+function sameTokenGrant(left, right) {
+    return left.accessToken === right.accessToken && left.refreshToken === right.refreshToken &&
+        left.tokenType === right.tokenType && left.expiresAt === right.expiresAt && left.scope === right.scope;
+}
 function clearSessionTokens(session) {
     const nextSession = { ...session };
     delete nextSession.tokens;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.d.ts

@@ -21,5 +21,10 @@ export interface LoopbackAuthorizationSession {
     close(): void;
 }
 export declare function createLoopbackAuthorizationSession(options?: LoopbackAuthorizationOptions): Promise<LoopbackAuthorizationSession>;
+export declare function loopbackTarget(options: LoopbackAuthorizationOptions): {
+    port: number;
+    host: string;
+    callbackPath: string;
+};
 export declare function extractCodeFromInput(input: string): string | null;
 export declare function buildSuccessPage(landingPage?: OAuthLandingPage): string;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -54,7 +54,7 @@ export async function createLoopbackAuthorizationSession(options = {}) {
         }
     };
 }
-function loopbackTarget(options) {
+export function loopbackTarget(options) {
     if (options.redirectUri !== undefined) {
         let url;
         try {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -33,7 +33,7 @@ export interface OAuthClientProvider {
         headers: Headers;
         fetch: OAuthMetadataFetch;
         signal?: AbortSignal;
-    }): Promise<void> | void;
+    }): Promise<StoredOAuthTokens | void> | StoredOAuthTokens | void;
     handleUnauthorized(input: {
         requestUrl: URL;
         response: Response;
@@ -41,6 +41,10 @@ export interface OAuthClientProvider {
         discovery: OAuthDiscoveryResult;
         fetch: OAuthMetadataFetch;
         signal?: AbortSignal;
+        /** Headers actually attached to this rejected request. */
+        requestHeaders?: Headers;
+        /** Owned snapshot returned when this request was authorized, or null if absent. */
+        presentedTokens?: StoredOAuthTokens | null;
     }): Promise<{
         action: "retry";
     } | {
@@ -99,6 +103,11 @@ export interface DefaultOAuthClientProviderOptions {
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
+    /** Import an existing grant for one resource. Persisted sessions take precedence. */
+    initialGrant?: {
+        resource: string;
+        tokens: StoredOAuthTokens;
+    };
     browser: {
         openBrowser?(url: string): Promise<void>;
         /** Exact registered HTTP loopback redirect URI. */

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -110,7 +110,7 @@ interface OAuthClientProvider {
         headers: Headers;
         fetch: OAuthMetadataFetch;
         signal?: AbortSignal;
-    }): Promise<void> | void;
+    }): Promise<StoredOAuthTokens | void> | StoredOAuthTokens | void;
     handleUnauthorized(input: {
         requestUrl: URL;
         response: Response;
@@ -118,6 +118,10 @@ interface OAuthClientProvider {
         discovery: OAuthDiscoveryResult;
         fetch: OAuthMetadataFetch;
         signal?: AbortSignal;
+        /** Headers actually attached to this rejected request. */
+        requestHeaders?: Headers;
+        /** Owned snapshot returned when this request was authorized, or null if absent. */
+        presentedTokens?: StoredOAuthTokens | null;
     }): Promise<{
         action: "retry";
     } | {
@@ -176,6 +180,11 @@ interface DefaultOAuthClientProviderOptions {
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
+    /** Import an existing grant for one resource. Persisted sessions take precedence. */
+    initialGrant?: {
+        resource: string;
+        tokens: StoredOAuthTokens;
+    };
     browser: {
         openBrowser?(url: string): Promise<void>;
         /** Exact registered HTTP loopback redirect URI. */
@@ -644,6 +653,7 @@ declare class HttpTransport implements McpTransport {
     private readonly oauthMetadataDiscovery;
     private readonly inFlightFetchAbortControllers;
     private readonly inFlightOAuthAbortControllers;
+    private readonly oauthRequestTokens;
     private readonly openResponseReaders;
     private readonly modernRequests;
     private modernMode;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4594,23 +4594,54 @@ function createOAuthClientProvider(options) {
   return createDefaultOAuthClientProvider(options);
 }
 function createDefaultOAuthClientProvider(options) {
+  loopbackTarget(options.browser);
   const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore);
   const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore);
   const now = options.now ?? Date.now;
   const registeredClients = /* @__PURE__ */ new Map();
   const refreshPromises = /* @__PURE__ */ new Map();
   const authorizationPromises = /* @__PURE__ */ new Map();
+  if (options.initialGrant !== void 0) {
+    let resource;
+    try {
+      resource = new URL2(options.initialGrant.resource);
+    } catch {
+      throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
+    }
+    if (resource.protocol !== "http:" && resource.protocol !== "https:" || resource.username || resource.password || resource.hash)
+      throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
+  }
+  const initialGrant = options.initialGrant === void 0 ? void 0 : {
+    resource: canonicalizeResourceIndicator(options.initialGrant.resource),
+    tokens: normalizeStoredTokens(options.initialGrant.tokens),
+    client: normalizeConfiguredClient(options.client)
+  };
+  if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
+    throw new Error("OAuth initial grant requires valid tokens and the original client ID");
+  if (initialGrant?.tokens !== void 0) {
+    try {
+      new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
+    } catch {
+      throw new Error("OAuth initial grant access token is not a valid HTTP header value");
+    }
+  }
+  let initialGrantConsumed = false;
   return {
     async authorizeRequest(input) {
       assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
       const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
       const session = await ensureAuthorizedSession(requestUrl, void 0, input.fetch, false, false, input.signal);
       const accessToken = session?.tokens?.accessToken;
+      if (session === null && !initialGrantConsumed && initialGrant?.resource === requestUrl && initialGrant.tokens !== void 0 && !isExpired(initialGrant.tokens, now)) {
+        input.headers.set("Authorization", `Bearer ${initialGrant.tokens.accessToken}`);
+        return { ...initialGrant.tokens };
+      }
       if (session === null || accessToken === void 0 || session.tokens === void 0 || isExpired(session.tokens, now)) {
         return;
       }
       assertRequestMatchesResource(requestUrl, session.resource);
       input.headers.set("Authorization", `Bearer ${accessToken}`);
+      return { ...session.tokens };
     },
     async handleUnauthorized(input) {
       try {
@@ -4618,11 +4649,28 @@ function createDefaultOAuthClientProvider(options) {
         const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
         const resource = canonicalizeResourceIndicator(input.discovery.resource);
         assertRequestMatchesResource(requestUrl, resource);
-        const forceRefresh = hasCachedAccessToken(await loadSession(resource)) && input.challenge?.params.error === "invalid_token";
+        const cached = await loadSession(resource);
+        const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : void 0);
+        let rejectedCurrentGrant = hasCachedAccessToken(cached) || !initialGrantConsumed && initialGrant?.resource === resource;
+        let presentedTokens = input.presentedTokens;
+        if (input.presentedTokens !== void 0) {
+          rejectedCurrentGrant = false;
+          if (input.presentedTokens !== null) {
+            const presented = normalizeStoredTokens(input.presentedTokens);
+            const header = input.requestHeaders?.get("Authorization") ?? "";
+            const separator = header.indexOf(" ");
+            if (presented === void 0 || header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented.accessToken)
+              throw new Error("OAuth rejected-request provenance does not match its authorization header");
+            presentedTokens = presented;
+            rejectedCurrentGrant = currentTokens !== void 0 && sameTokenGrant(currentTokens, presented);
+          }
+        }
+        const challengeError = input.challenge?.params.error;
+        const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || input.presentedTokens !== void 0 && challengeError === void 0);
         const session = await ensureAuthorizedSession(resource, {
           ...input.discovery,
           resource
-        }, input.fetch, true, forceRefresh, input.signal);
+        }, input.fetch, true, forceRefresh, input.signal, presentedTokens);
         if (session?.tokens?.accessToken === void 0) {
           return { action: "fail" };
         }
@@ -4636,10 +4684,12 @@ function createDefaultOAuthClientProvider(options) {
       }
     }
   };
-  async function ensureAuthorizedSession(resource, discovery, fetch2, allowInteractive, forceRefresh = false, signal) {
+  async function ensureAuthorizedSession(resource, discovery, fetch2, allowInteractive, forceRefresh = false, signal, rejectedTokens) {
     signal?.throwIfAborted();
     const canonicalResource = canonicalizeResourceIndicator(resource);
     let session = await loadSession(canonicalResource);
+    if (session !== null && initialGrant?.resource === canonicalResource)
+      initialGrantConsumed = true;
     signal?.throwIfAborted();
     if (discovery !== void 0 && getOwnString2(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
       throw new Error("OAuth discovery authorization-server issuer mismatch");
@@ -4648,6 +4698,21 @@ function createDefaultOAuthClientProvider(options) {
       await clearSession(canonicalResource);
       session = null;
     }
+    if (session === null && discovery !== void 0 && !initialGrantConsumed && initialGrant?.resource === canonicalResource && initialGrant.tokens !== void 0 && initialGrant.client !== null) {
+      assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+      session = {
+        resource: canonicalResource,
+        authorizationServer: discovery.authorizationServer,
+        client: initialGrant.client,
+        tokens: initialGrant.tokens,
+        discovery: toStoredDiscovery(discovery)
+      };
+      await saveSession(canonicalResource, session);
+      initialGrantConsumed = true;
+      signal?.throwIfAborted();
+    }
+    if (forceRefresh && rejectedTokens !== void 0 && (rejectedTokens === null || session?.tokens === void 0 || !sameTokenGrant(session.tokens, rejectedTokens)))
+      forceRefresh = false;
     const sessionDiscovery = resolveDiscovery(discovery, session);
     if (session?.tokens !== void 0 && !forceRefresh && !isExpired(session.tokens, now)) {
       return session;
@@ -4969,6 +5034,9 @@ function resolveDiscovery(discovery, session) {
     authorizationServerMetadata: metadata
   };
 }
+function sameTokenGrant(left, right) {
+  return left.accessToken === right.accessToken && left.refreshToken === right.refreshToken && left.tokenType === right.tokenType && left.expiresAt === right.expiresAt && left.scope === right.scope;
+}
 function clearSessionTokens(session) {
   const nextSession = { ...session };
   delete nextSession.tokens;
@@ -6744,6 +6812,7 @@ var HttpTransport = class {
   oauthMetadataDiscovery;
   inFlightFetchAbortControllers = /* @__PURE__ */ new Set();
   inFlightOAuthAbortControllers = /* @__PURE__ */ new Set();
+  oauthRequestTokens = /* @__PURE__ */ new WeakMap();
   openResponseReaders = /* @__PURE__ */ new Set();
   modernRequests = /* @__PURE__ */ new Map();
   modernMode = false;
@@ -7014,7 +7083,7 @@ var HttpTransport = class {
   }
   async authorizeRequestHeaders(headers, signal) {
     signal?.throwIfAborted();
-    await this.oauthProvider?.authorizeRequest?.({
+    const tokens = await this.oauthProvider?.authorizeRequest?.({
       requestUrl: new URL(this.url),
       headers,
       signal,
@@ -7023,6 +7092,7 @@ var HttpTransport = class {
         signal: signal === void 0 ? init?.signal : init?.signal == null ? signal : AbortSignal.any([signal, init.signal])
       })
     });
+    if (tokens !== void 0) this.oauthRequestTokens.set(headers, { ...tokens });
     signal?.throwIfAborted();
     return headers;
   }
@@ -7166,7 +7236,7 @@ var HttpTransport = class {
     const message = responseBody.length === 0 ? `HTTP transport POST failed (${statusDescriptor})` : `HTTP transport POST failed (${statusDescriptor}): ${responseBody}`;
     throw new HttpTransportError(message, response.status, "POST");
   }
-  async maybeHandleUnauthorizedResponse(response, signal) {
+  async maybeHandleUnauthorizedResponse(response, signal, requestHeaders, presentedTokens) {
     if (response.status !== 401 || this.oauthProvider === void 0) {
       return false;
     }
@@ -7187,6 +7257,8 @@ var HttpTransport = class {
           challenge,
           discovery,
           signal,
+          requestHeaders: new Headers(requestHeaders),
+          presentedTokens,
           fetch: (url, init) => fetchMcpResponse(this.fetchImpl, url, {
             ...init,
             signal: init?.signal == null ? signal : AbortSignal.any([signal, init.signal])
@@ -7327,16 +7399,20 @@ var HttpTransport = class {
     const request = async () => {
       controller.signal.throwIfAborted();
       const headers = await input.createHeaders(controller.signal);
+      const headerSnapshot = new Headers(headers);
+      const tokens = this.oauthRequestTokens.get(headers) ?? null;
       controller.signal.throwIfAborted();
-      return this.fetchWithAbort(input.url ?? this.url, {
+      const response = await this.fetchWithAbort(input.url ?? this.url, {
         method: input.method,
         headers,
         body: input.body
       }, controller);
+      return { response, headers: headerSnapshot, tokens };
     };
     try {
-      let response = await request();
-      if (await this.maybeHandleUnauthorizedResponse(response, controller.signal)) response = await request();
+      let attempt = await request();
+      if (await this.maybeHandleUnauthorizedResponse(attempt.response, controller.signal, attempt.headers, attempt.tokens)) attempt = await request();
+      const response = attempt.response;
       const oauthError = this.oauthProvider === void 0 ? null : this.readOAuthChallengeError(response);
       if (oauthError !== null) {
         void response.body?.cancel().catch(() => void 0);

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.308",
+      "version": "0.0.310",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.308",
+  "version": "0.0.310",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.308",
+  "version": "0.0.310",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.308",
+    "toolcraft-schema": "0.0.310",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",